android中的ssl_Android中的SSL固定

android中的ssl

什么是SSL？ (What is SSL?)

SSL stands for Secure Sockets Layer. SSL is the standard security technology for establishing an encrypted link between a client and a server. This link ensures that all data passed between the web server and browser remain private.

SSL代表安全套接字层 。 SSL是用于在客户端和服务器之间建立加密链接的标准安全技术。 此链接可确保在Web服务器和浏览器之间传递的所有数据保持私有状态。

These two systems can be a server (our backend server) and a client (our android app) or a server and another server (our backend server interacting with another server).

这两个系统可以是服务器(我们的后端服务器)和客户端(我们的android应用)，也可以是服务器和另一台服务器(我们的后端服务器与另一台服务器交互)。

This is the most widely deployed cryptographic protocol to provide a secure communication channel.

这是部署最广泛的加密协议，用于提供安全的通信通道。

SSL如何确保数据的安全性？ (How does SSL ensure security of data?)

A Man-in-the-Middle attack occurs when an attacker places himself between the server/host and the client, impersonating one of them. In other words, when the client is connecting to the server, it is actually dealing with the hacker and vice versa. Thus, although the client “thinks” that it has established an encrypted connection with the server, but in reality both of them are actually “talking” to the attacker who can view and modify the data. For this reason, everyone calls it a “Man-in-the-Middle” attack.

当攻击者将自己放置在服务器/主机和客户端之间，并冒充其中之一时，就会发生中间人攻击。 换句话说，当客户端连接到服务器时，它实际上是在处理黑客，反之亦然。 因此，尽管客户端“认为”它已经与服务器建立了加密连接，但实际上，它们两者实际上都是在与可以查看和修改数据的攻击者“交谈”。 因此，每个人都将其称为“中间人”攻击。

SSL encrypts the data being transmitted so that a third party or any “Man-in-the-Middle” cannot “eavesdrop” on the transmission and view the data being transmitted. Only the client and the secure server are able to recognize and understand the data. This means that anyone who tries to intercept this data will only see a garbled mix of characters that’s nearly impossible to decrypt.

SSL对正在传输的数据进行加密，以使第三方或任何“中间人”无法“窃听”传输并查看正在传输的数据。 只有客户端和安全服务器才能识别和理解数据。 这意味着任何试图截取此数据的人都只会看到几乎无法解密的乱码字符。

This technique derives from the concept of the SSL Certificate and the Certificate Authority’s infrastructure. It is based on the usage of the private key, which establishes a valid connection when it is associated with the corresponding certificate. This initiates an authentication process called a handshake between two communicating devices to ensure that both devices are really who they claim to be. SSL also digitally signs data in order to provide data integrity, verifying that the data is not tampered with before reaching its intended recipient.

该技术源自SSL证书和证书颁发机构的基础结构的概念。 它基于私钥的用法，当私钥与相应的证书关联时，私钥将建立有效的连接。 这会在两个通信设备之间启动称为握手的身份验证过程，以确保两个设备确实是他们声称的真实身份。 SSL还对数据进行数字签名，以提供数据完整性，并在到达目标收件人之前验证数据是否被篡改。

TLS和SSL之间的区别 (Difference between TLS and SSL)

TLS (Transport Layer Security) is a successor to SSL.

TLS (传输层安全性)是SSL的后继产品。

It’s more improved and secure version of SSL. Although the SSL protocol was deprecated with the release of TLS 1.0 in 1999, it is still common to refer to these related technologies as “SSL” or “SSL/TLS.” Hence, we use the term SSL Pinning. The most current version is TLS 1.3, defined in RFC 8446 (August 2018).

它是SSL的改进和安全版本。 尽管在1999年TLS 1.0发行版中不赞成使用SSL协议，但将这些相关技术称为“ SSL”或“ SSL / TLS”仍然很普遍。 因此，我们使用术语SSL固定。 最新版本是RFC 1.3446 (2018年8月)中定义的TLS 1.3 。

什么是SSL固定以及如何实现？ (What is SSL Pinning and how to achieve it?)

SSL pinning is a process of associating a host with their expected X509 certificate or public key. Once a certificate or public key is known or seen for a host, the certificate or public key is associated or ‘pinned’ to the host. If more than one certificate or public key is acceptable then advertised identity must match one of the elements in the certificate chainset. This allows the application to trust only the valid or pre-defined certificates or public Keys. We should use SSL pinning technique as an additional security layer for application traffic and to validate the remote host’s identity. If we do not implement SSL Pinning, application trusts custom certificate and allows proxy tools to intercept the traffic.

SSL固定是将主机与其预期的X509证书或公钥相关联的过程。 一旦知道或看到了主机的证书或公钥，便会将证书或公钥关联或“固定”到主机。 如果可以接受多个证书或公钥，则公告的身份必须与证书链集中的元素之一匹配。 这允许应用程序仅信任有效或预定义的证书或公共密钥。 我们应该使用SSL固定技术作为应用程序流量和验证远程主机身份的附加安全层。 如果我们未实现SSL Pinning ，则应用程序将信任自定义证书，并允许代理工具拦截流量。

This can be achieved in 3 ways — Certificate Pinning, Public Key Pinning & Hash Pinning.

这可以通过3种方式实现- 证书固定，公钥固定和哈希固定。