A kind of software multi-layer signature method and system based on digital certificate

Abstract

The invention discloses a digital certificate-based software multi-layer signature method and system, including setting a certificate partition and a signature partition in a software package, wherein the certificate partition is used for storing digital certificates, and the signature partition is used for storing digital signatures, The digital certificate and the digital signature are matched one by one; after the digital certificate to be signed is signed, a new digital certificate is added at the end of the existing digital certificate in the certificate partition, and a new digital certificate is added at the end of the existing digital signature in the signature partition. New digital signature. The implementation process is simple, the signature is stable, and the implementation cost is low; it can support multi-layer signatures of certificates of different organizations, and solve the problem of the upper-layer signature invalidation caused by this signature; it can effectively ensure the reliability of the source of the software package; it can effectively guarantees the integrity and consistency of the package prior to installation.

Description

technical field [0001] The present application relates to the technical field of computer security, and in particular, to a method and system for multi-layer signature of software based on digital certificates. Background technique [0002] During the transmission process of software packages, software packages are vulnerable to attacks and the contents of packages are replaced, tampered with or damaged. Therefore, it is necessary to ensure the information integrity of software packages from release to installation, and that there is no connection between package developers and software packages. The corresponding relationship of denial, the commonly used and mature software package security protection measure is to use digital certificate signature technology to sign and verify the signature of the software package. In the actual operation process, the software developer is often required to sign the software once, the software manufacturer signs once, and the software stor...

AI Technical Summary

Problems solved by technology

The realization method of the locked domain proposed by CN100505621 is very complicated. Only when the content of the locked domain, the relationship and algorithm between the locked domains, the relationship and the algorithm between the locked domain and the entire digital certificate signature object are handled well, can the multi-layer signed function

Such harsh implementation conditions lead to high development costs, which is not conducive to the popularization of this method, and this method can only ensure the integrity of the data in the locked domain, but cannot guarantee the integrity of the entire signature object; the method proposed by CN111523889A requires artificial definition The conditions satisfied by the boolean value are highly subjective, and there is an iterative signature process, and the signature effect is unstable; the multi-layer certificate signature proposed by CN107632932A is for source code software package, binary software package directory, software warehouse summary file, software The warehouse summary file is signed step by step, and does not support multi-level certificate signing of the same object by different organizations

Images