During an interface call, the requester may receive a response that contains a signature string from the recipient. In this case, the requester can verify the signature string in order to check if the response has been tampered with. This helps secure the interface call. Generally, only the payment public key is used for signature verification. The response to a query request can be verified on the app client. Only the callback message indicating successful payment, which sent to the developer server from the Huawei payment server, needs to be verified on the app server.

1. Obtain the signature string in the returned result, that is, the rtnSign field returned by the interface.

2. Sort the returned parameters rtnCode and ts that need to be signed in ascending order according to the ASCII codes of their names.

3. Splice the sorted parameters into a string using the URL key value pair format, for example rtnCode=xxxxxx&ts=xxxxxxx.

4. Verify the string that is generated and the string that is returned by using the game public key.

See the following for the sample code in Java:

public static boolean doCheck(String content, String sign, String publicKey, String signtype) {
   try {
      KeyFactory keyFactory = KeyFactory.getInstance("RSA");
      byte[] encodedKey = decoder.decode(publicKey);
      PublicKey pubKey = keyFactory.generatePublic(new X509EncodedKeySpec(encodedKey));
      java.security.Signature signature = null;
      if ("RSA256".equals(signtype)) {
        signature = java.security.Signature.getInstance(SIGN_ALGORITHMS256);
      } else {
        signature = java.security.Signature.getInstance(SIGN_ALGORITHMS);
      }       
      signature.initVerify(pubKey);
      signature.update(content.getBytes("utf-8"));
      boolean bverify = signature.verify(decoder.decode(sign));
      return bverify;
   } catch (Exception e) {
      e.printStackTrace();
   }
   return false;
}