一薄嫡、簡(jiǎn)述
業(yè)務(wù)需求，需要指紋登錄颗胡，鑒于市面上的資料不是特別齊全岂座，走了不少?gòu)澛贰，F(xiàn)在通了杭措，寫點(diǎn)東西給大伙做個(gè)參考费什。末尾會(huì)提供demo和參考資料
二、指紋登錄/支付工作流程
指紋驗(yàn)證加密流程.png
最新的流程圖請(qǐng)點(diǎn)擊鏈接
三手素、原理解析
- 指紋驗(yàn)證
通過FingerprintManager.authenticate()方法即可驗(yàn)證鸳址，同時(shí)實(shí)現(xiàn)FingerprintManager.AuthenticationCallback即可進(jìn)行監(jiān)聽。 - 數(shù)據(jù)加解密
- 待加密數(shù)據(jù)結(jié)合Android KeyStore System進(jìn)行加密泉懦，需要經(jīng)過設(shè)備校驗(yàn)后才能解密稿黍。（Android M后才有）
- 指紋驗(yàn)證成功后，回調(diào)
AuthenticationCallback.onAuthenticationSucceeded(AuthenticationResult result)崩哩，利用result中的CryptoObject的Cipher進(jìn)行加密
Cipher cipher = result.getCryptoObject().getCipher(); byte[] encrypted = cipher.doFinal(data.getBytes()); byte[] IV = cipher.getIV(); String se = Base64.encodeToString(encrypted, Base64.URL_SAFE); String siv = Base64.encodeToString(IV, Base64.URL_SAFE);- 獲得加密的數(shù)據(jù)和iv后巡球，本地保存起來。需要用的時(shí)候邓嘹，再根據(jù)SecretKey酣栈、iv初始化出cipher，進(jìn)行解密
cipher.doFinal(byte[] input) - 為什么這樣安全汹押？ --> 因?yàn)镃ipher根據(jù)SecretKey和IV初始化出來矿筝，而SecretKey由KeyStore保存在Android系統(tǒng)中，IV由指紋驗(yàn)證自動(dòng)生成棚贾。由這兩者生成出來的Cipher進(jìn)行加解密窖维，即可保證安全榆综。
四、實(shí)現(xiàn)過程（以指紋登錄為例铸史，指紋支付也大同小異）
- 判斷當(dāng)前設(shè)備是否支持指紋（具體詳細(xì)代碼鼻疮，demo有）
/**
* 獲取當(dāng)前設(shè)備的指紋狀態(tài)
*
* @param ctx
* @return 是否支持指紋
*/
public FingerPrintInitType getFingerprintAvailable(Context ctx) {
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
return FingerPrintInitType.NOT_SUPPORT;
} else if (!isKeyProtectedEnforcedBySecureHardware()) {
return FingerPrintInitType.NO_FINGER_HARDWARE;
} else if (!manager.isHardwareDetected()) {
Toast.makeText(ctx, "該設(shè)備尚未檢測(cè)到指紋硬件", Toast.LENGTH_SHORT).show();
return FingerPrintInitType.NO_FINGER_HARDWARE;
} else if (!manager.hasEnrolledFingerprints()) {
Toast.makeText(ctx, "該設(shè)備未錄入指紋，請(qǐng)去系統(tǒng)->設(shè)置中添加指紋", Toast.LENGTH_SHORT).show();
return FingerPrintInitType.NONE_FINGER;
}
return FingerPrintInitType.HAS_FINGER;
}
- 如果當(dāng)前設(shè)備支持指紋琳轿，則顯示是否開啟指紋登錄判沟。
點(diǎn)擊開啟指紋登錄后，則彈出指紋驗(yàn)證UI利赋，并將一些關(guān)鍵數(shù)據(jù)EncryptData進(jìn)行加密（如賬號(hào)、密碼/openToken）
/**
* 指紋驗(yàn)證關(guān)鍵方法
*
* @param intPurpose 加密/解密 KeyProperties.PURPOSE_ENCRYPT/ KeyProperties.PURPOSE_DECRYPT
* @param encryptData 加密數(shù)據(jù),加密的時(shí)候才需要填
*/
public boolean authenticate(int intPurpose, String encryptData) {
try {
purpose = intPurpose;
FingerprintManager.CryptoObject object;
if (purpose == KeyProperties.PURPOSE_DECRYPT) {
//解密
String IV = mLocalSharedPreference.getData(keyAlias + mLocalSharedPreference.IVKeyName);
object = mLocalAndroidKeyStore.getCryptoObject(keyAlias, Cipher.DECRYPT_MODE, Base64.decode(IV, Base64.URL_SAFE));
if (object == null) {
return false;
}
} else {
//加密
generateKey();
data = encryptData;
object = mLocalAndroidKeyStore.getCryptoObject(keyAlias, Cipher.ENCRYPT_MODE, null);
}
mCancellationSignal = new CancellationSignal();
manager.authenticate(object, mCancellationSignal, 0, this, null);
return true;
} catch (SecurityException e) {
e.printStackTrace();
return false;
}
}
- 指紋驗(yàn)證后猩系，會(huì)回調(diào)
FingerprintManager.AuthenticationCallback接口媚送，在這個(gè)接口里面進(jìn)行數(shù)據(jù)的加密和解密。指紋驗(yàn)證成功會(huì)調(diào)用public void onAuthenticationSucceeded(FingerprintManager.AuthenticationResult result)寇甸，指紋驗(yàn)證失敗會(huì)調(diào)用public void onAuthenticationFailed()塘偎，指紋驗(yàn)證失敗次數(shù)過多會(huì)調(diào)用public void onAuthenticationError(int errorCode, CharSequence errString)
@Override
public void onAuthenticationSucceeded(FingerprintManager.AuthenticationResult result) {
if (callback == null) {
return;
}
if (result.getCryptoObject() == null) {
callback.onAuthenticationFail();
return;
}
final Cipher cipher = result.getCryptoObject().getCipher();
if (purpose == KeyProperties.PURPOSE_DECRYPT) {
//取出secret key并返回
String data = mLocalSharedPreference.getData(keyAlias + mLocalSharedPreference.dataKeyName);
if (TextUtils.isEmpty(data)) {
callback.onAuthenticationFail();
return;
}
try {
byte[] decrypted = cipher.doFinal(Base64.decode(data, Base64.URL_SAFE));
callback.onAuthenticationSucceeded(new String(decrypted));
} catch (BadPaddingException | IllegalBlockSizeException e) {
e.printStackTrace();
callback.onAuthenticationFail();
}
} else {
//將前面生成的data包裝成secret key，存入沙盒
try {
byte[] encrypted = cipher.doFinal(data.getBytes());
byte[] IV = cipher.getIV();
String se = Base64.encodeToString(encrypted, Base64.URL_SAFE);
String siv = Base64.encodeToString(IV, Base64.URL_SAFE);
if (mLocalSharedPreference.storeData(keyAlias + mLocalSharedPreference.dataKeyName, se) &&
mLocalSharedPreference.storeData(keyAlias + mLocalSharedPreference.IVKeyName, siv)) {
callback.onAuthenticationSucceeded(se);
} else {
callback.onAuthenticationFail();
}
} catch (BadPaddingException | IllegalBlockSizeException e) {
e.printStackTrace();
callback.onAuthenticationFail();
}
}
}
@Override
public void onAuthenticationError(int errorCode, CharSequence errString) {
// LogUtils.d(errorCode + " " + errString);
if (callback != null) {
callback.onAuthenticationError();
}
}
@Override
public void onAuthenticationHelp(int helpCode, CharSequence helpString) {
}
@Override
public void onAuthenticationFailed() {
if (callback != null) {
callback.onAuthenticationFail();
}
}
備注
- 指紋發(fā)生變更也會(huì)導(dǎo)致指紋驗(yàn)證失敗
- 指紋驗(yàn)證5次后,30s內(nèi)再次申請(qǐng)指紋驗(yàn)證會(huì)直接失敗
- Android 6.0(Android M)之后才有統(tǒng)一的指紋驗(yàn)證接口拿霉，建議說服產(chǎn)品只適配6.0及之后的設(shè)備吟秩，之前的放棄
- github demo!!!(未有，埋了個(gè)坑)
