ELF file identification method and device based on code signature

Abstract

The invention discloses an ELF file identification method based on a code signature. According to ELF file identification, an issuer provides evidence, and a caller (an operating system) verifies the evidence. The evidence of the issuer is the file signature of the issuer, and the signature is made in two steps that firstly, the issuers signs for the file identification, and secondly, the issuer signs for file features. The caller carries out verification in two steps that firstly, the caller extracts the signature of the file identification to verify the file identification and judges whether a file is loaded or not, and secondly, the caller extracts the signature of the file features to verify the file features and judges whether the file is executed or not, wherein the first step is named as admissibility verification, and the second step is named as acceptance verification. By means of the ELF file identification method, identification authentication and feature authentication of the ELF file are achieved, damage caused by illegal invasion and malicious software can be effectively prevented, the operational safety of a computer is ensured, and the optimal balance between the efficiency and safety of the operating system is achieved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method and device for identifying ELF files based on code signatures. Background technique [0002] With the continuous development of Linux, more and more individuals and enterprises begin to use Linux, especially many enterprise servers begin to adopt the Linux operating system, and its security is also subject to more and more challenges. Executable and Linkable Format (ELF for short), as the most important executable binary file format under Linux and Unix, has naturally become the attack target of viruses and various malicious codes. Facts have proved that many virus programs under Linux achieve intrusion by directly modifying the ELF file. The traditional Unix system (including Linux) does not check the integrity and legality of the executed code, thus allowing many virus programs and Trojan horse programs to take advantage of it. [0003] In order to ensure the security...

AI Technical Summary

Problems solved by technology

For the code authentication mechanism under Linux, although some people have studied it, there are still the following problems: one is the method of signature verification during installation, and the executable attribute of the control file is controlled by modifying the chmod system call. The method cannot detect any modification of the code after the program is installed, and has certain limitations; the second is to use the PKI public key system. Since PKI is based on a third party, it cannot guarantee the real-time validity of the certificate, and the CA root certificate is easy to be replaced. There are also obvious loopholes; the third is that the signature verification is to load the entire file into the memory first, calculate its digital digest and then verify the authenticity and integrity of the file.

[0004] Aiming at the problem that the security of the system is threatened due to flaws in the scheme for identifying files in related technologies, no effective solution has been proposed so far

Images