保护您的安卓应用：防止未经授权克隆与分发的策略

import com.google.android.play.core.integrity.IntegrityManagerFactory
import com.google.android.play.core.integrity.IntegrityTokenRequest
import android.content.Context
import android.util.Log

class IntegrityChecker(private val context: Context) {

    private val TAG = "IntegrityChecker"

    fun requestIntegrityToken(nonce: String, callback: (String?) -> Unit) {
        val integrityManager = IntegrityManagerFactory.create(context)

        val request = IntegrityTokenRequest.builder()
            .setNonce(nonce) // 随机数，用于防止重放攻击，应由服务器生成
            .build()

        integrityManager.requestIntegrityToken(request)
            .addOnSuccessListener { response ->
                val integrityToken = response.token()
                Log.d(TAG, "Integrity Token: $integrityToken")
                callback(integrityToken)
            }
            .addOnFailureListener { e ->
                Log.e(TAG, "Failed to request integrity token: ${e.message}")
                callback(null)
            }
    }
}

// 在Activity或Fragment中使用
// val integrityChecker = IntegrityChecker(this)
// val serverGeneratedNonce = "YOUR_SERVER_GENERATED_NONCE" // 确保是服务器生成的唯一随机数
// integrityChecker.requestIntegrityToken(serverGeneratedNonce) { token ->
//     if (token != null) {
//         // 将token发送到您的后端服务器进行验证
//         sendTokenToServer(token)
//     } else {
//         // 处理令牌获取失败的情况
//     }
// }

# 概念性后端验证代码 (Python Flask 示例)
from flask import Flask, request, jsonify
import requests
import json

app = Flask(__name__)

# 请替换为您的Google Cloud项目凭据和API密钥
GOOGLE_PLAY_INTEGRITY_VERIFY_URL = "https://playintegrity.googleapis.com/v1/projects/YOUR_PROJECT_NUMBER/integrity:decodeIntegrityToken"
GOOGLE_API_KEY = "YOUR_GOOGLE_API_KEY" # 通常通过服务账户认证，而不是API密钥

@app.route('/verify-integrity', methods=['POST'])
def verify_integrity():
    data = request.get_json()
    integrity_token = data.get('integrityToken')
    client_nonce = data.get('nonce') # 客户端发送的随机数，用于匹配

    if not integrity_token or not client_nonce:
        return jsonify({"status": "error", "message": "Missing token or nonce"}), 400

    # 实际应用中，您应该使用服务账户进行认证
    headers = {
        "Content-Type": "application/json"
    }
    payload = {
        "integrityToken": integrity_token
    }

    try:
        response = requests.post(
            f"{GOOGLE_PLAY_INTEGRITY_VERIFY_URL}?key={GOOGLE_API_KEY}", # 实际应使用OAuth2服务账户认证
            headers=headers,
            json=payload
        )
        response.raise_for_status() # 如果请求失败，抛出HTTPError

        integrity_response = response.json()

        # 验证随机数是否匹配，防止重放攻击
        decoded_payload = integrity_response.get('tokenPayloadExternal')
        if decoded_payload and json.loads(decoded_payload).get('nonce') != client_nonce:
            return jsonify({"status": "error", "message": "Nonce mismatch"}), 403

        # 解析并检查完整性结果
        app_integrity = integrity_response.get('appIntegrity', {}).get('appRecognitionVerdict')
        device_integrity = integrity_response.get('deviceIntegrity', {}).get('deviceRecognitionVerdict')

        # 更多检查，例如 licenseVerdict, accountDetails 等

        if app_integrity == 'PLAY_RECOGNIZED' and device_integrity == 'MEETS_DEVICE_INTEGRITY':
            return jsonify({"status": "success", "message": "App and device integrity verified"}), 200
        else:
            return jsonify({"status": "error", "message": "Integrity check failed", "details": integrity_response}), 403

    except requests.exceptions.RequestException as e:
        return jsonify({"status": "error", "message": f"Google Play Integrity API error: {e}"}), 500
    except Exception as e:
        return jsonify({"status": "error", "message": f"Server error: {e}"}), 500

if __name__ == '__main__':
    app.run(debug=True)