A program integrity verification system and method suitable for read-only file systems

Abstract

The application provides a program integrity verification system and method suitable for a read-only file system, relates to the technical field of read-only file system protection, and comprises the following steps: when a read-only file system image is made, the trusted program file of the read-only file system is subjected to integrity measurement to construct a hash tree, then the unique identification of the hash tree is recorded in the metadata of the trusted program file, and the hash tree is signed and saved; when the program file is loaded, when the program file is determined to be a trusted program file according to the unique identification, the corresponding hash tree is called according to the unique identification to perform signature authentication, the program page is subjected to integrity verification, and the program page is allowed to be loaded and run when the signature authentication and the integrity verification are passed. The beneficial effect is to protect the safety of the read-only file system and the program credibility, so that even if a malicious program attacks into the computer by using a system vulnerability, the malicious program cannot run in the read-only file system, and the safety and reliability of the read-only file system are ensured to a greater extent.

Description

Technical Field

[0001] The present invention relates to the technical field of protection of read-only file systems, and in particular to a program integrity verification system and method applicable to read-only file systems. Background Art

[0002] In embedded operating systems, file system security is crucial. File system protection typically focuses on read-write file systems, while read-only file systems are often overlooked. However, in some fields and projects, particularly on embedded devices with limited storage capacity, where data writing is often unnecessary, read-only file systems such as squashfs and cramfs are often used. Once attackers exploit vulnerabilities and other means to gain access to these read-only file systems, they can potentially download and execute illegal programs, implant Trojans, and steal system information, disrupting the operating environment and posing a serious threat to operating system security.

[0003] Existing file system protection technologies include block device-based integrity verification technology and file-based authentication protection technology. Although block device-based integrity verification technology can protect read-only file systems, it mainly performs integrity detection on block devices based on blocks, and cannot provide more fine-grained security protection for specific files. The protection measures are too single and rigid. Although file-based authentication protection technology can perform integrity verification and authentication on system program files based on file types to ensure that tampered processes cannot run, file-based authentication protection technology relies on the support of a read-write file system to write authentication information into the file system, and cannot provide effective security protection for read-only file system programs. Summary of the Invention

[0004] In view of the problems existing in the prior art, the present invention provides a program integrity verification system applicable to a read-only file system, comprising:

[0005] a pre-configuration module configured to, when creating a read-only file system image, perform integrity measurement on a trusted program file of the read-only file system to construct a hash tree, subsequently generate a unique identifier for the hash tree and record it in metadata of the trusted program file, and sign and save the hash tree;

[0006] An integrity verification module is connected to the pre-configuration module and is used to, when the read-only file system loads a program file, determine that the program file is the trusted program file based on the unique identifier, retrieve the corresponding hash tree for signature authentication based on the unique identifier, and perform integrity verification on the program page, and allow the program page to be loaded and run when both the signature authentication and the integrity authentication pass.

[0007] Preferably, the pre-configuration module includes:

[0008] A first storage unit, configured to store a pre-configured signature key;

[0009] a hash tree building unit, configured to perform integrity measurement on the trusted program files of the read-only file system in units of program pages, build the hash tree according to the integrity measurement result, and generate the unique identifier of the hash tree;

[0010] a signature unit, connected to the first storage unit, the hash tree establishment unit, and the second storage unit, respectively, configured to sign the root hash of the hash tree according to the signature key to obtain a corresponding signature result, and store the hash tree and the corresponding signature result in the second storage unit;

[0011] a mapping table generating unit, connected to the hash tree establishing unit and the second storage unit, respectively, for obtaining the hash tree and the storage address of the corresponding signature result in the second storage unit, and establishing an association relationship between the unique identifier and the storage address to form a hash tree mapping table;

[0012] The integrity verification module obtains the corresponding storage address by matching the unique identifier in the hash tree mapping table, and retrieves the hash tree and the corresponding signature result from the second storage unit according to the storage address.

[0013] Preferably, the signature unit obtains the signature result by sending a signature request including the type of the trusted program file and the root hash to the first storage unit; then the first storage unit includes:

[0014] A storage subunit, used to store the signature key;

[0015] The service providing subunit is connected to the storage subunit, and is used to receive the type contained in the signature request, call the signature key to sign the root hash, obtain the signature result, and send it to the signature unit.

[0016] Preferably, the integrity verification module includes:

[0017] a trust judgment unit, configured to search the metadata of the program file when the program file is loaded in the read-only file system, and generate a trust signal indicating that the program file is the trustworthy program file when the unique identifier is retrieved;

[0018] a signature authentication unit, connected to the trust judgment unit, configured to retrieve the corresponding hash tree through the unique identifier according to the trust signal and perform signature authentication on the root hash of the hash tree, and generate a first pass signal after the signature authentication passes;

[0019] a first verification unit, connected to the signature authentication unit, configured to perform an integrity measurement on a program page of the loaded program file according to the first pass signal to obtain a corresponding first verification hash, and generate a second pass signal when it is determined that the first verification hash is consistent with a hash of the corresponding program page in the hash tree;

[0020] An operation control unit is connected to the first verification unit and is used to allow the corresponding program page to be loaded and executed according to the second pass signal.

[0021] Preferably, the integrity verification module also includes a second verification unit, which is connected to the operation control unit and is used to perform integrity measurement on the program page replaced each time to obtain a corresponding second verification hash when the read-only file system runs the program page of the program file using page replacement, and generate the second pass signal when it is determined that the second verification hash is consistent with the hash of the corresponding program page in the hash tree.

[0022] The present invention also provides a program integrity verification method applicable to a read-only file system, characterized in that the program integrity verification system described above is applied, and the program integrity verification method includes:

[0023] Step S1: When creating a read-only file system image, the program integrity verification system performs integrity measurement on the trusted program files of the read-only file system to construct a hash tree, then generates a unique identifier for the hash tree and records it in the metadata of the trusted program file, and signs and saves the hash tree.

[0024] Step S2: When the program file is loaded into the read-only file system, the program integrity verification system determines whether the program file is the trusted program file according to the unique identifier.

[0025] If not, exit;

[0026] If yes, go to step S3;

[0027] In step S3, the program integrity verification system retrieves the corresponding hash tree according to the unique identifier to perform signature authentication, and performs integrity verification on the program page, and checks whether both the signature authentication and the integrity authentication pass:

[0028] If so, loading and running the program page is allowed;

[0029] If not, loading and running the program page is prohibited.

[0030] Preferably, a pre-configured signature key is stored in the program integrity verification system;

[0031] Then the step S1 includes:

[0032] Step S11, the program integrity verification system performs integrity measurement on the trusted program file of the read-only file system in units of program pages, constructs the hash tree according to the integrity measurement result, and generates the unique identifier of the hash tree;

[0033] Step S12: the program integrity verification system signs the root hash of the hash tree according to the signature key to obtain a corresponding signature result, and stores the hash tree and the corresponding signature result;

[0034] Step S13: the program integrity verification system obtains the hash tree and the storage address of the corresponding signature result, and establishes an association relationship between the unique identifier and the storage address to form a hash tree mapping table;

[0035] In step S2, the program integrity verification system matches the unique identifier in the hash tree mapping table to obtain the corresponding storage address, and retrieves the hash tree and the corresponding signature result according to the storage address.

[0036] Preferably, the program integrity verification system is provided with a first storage unit for storing a pre-configured signature key;

[0037] In step S12, the program integrity verification system sends a signature request containing the type of the trusted program file and the root hash to the first storage unit, and receives the signature result obtained by the first storage unit calling the signature key to sign the root hash according to the type contained in the signature request.

[0038] Preferably, the step S2 includes:

[0039] Step S12: When the program file is loaded into the read-only file system, the program integrity verification system searches the metadata of the program file and determines whether the unique identifier is retrieved.

[0040] If so, a trust signal is generated indicating that the program file is the trustworthy program file, and then the process goes to step S13;

[0041] If not, exit;

[0042] In step S13, the program integrity verification system retrieves the corresponding hash tree through the unique identifier according to the trusted signal, performs signature authentication on the root hash of the hash tree, and determines whether the signature authentication is passed:

[0043] If yes, go to step S14;

[0044] If not, then prohibit loading and running the program page, and then exit;

[0045] In step S14, the program integrity verification system performs integrity measurement on the program page of the loaded program file to obtain a corresponding first verification hash, and determines whether the first verification hash is consistent with the hash of the corresponding program page in the hash tree:

[0046] If so, the corresponding program page is allowed to load and run;

[0047] If not, loading and running the program page is prohibited.

[0048] Preferably, the step S14 further includes:

[0049] When the read-only file system uses page replacement to run the program page of the program file, the program integrity verification system performs integrity measurement on the program page replaced each time to obtain a corresponding second verification hash, and determines whether the second verification hash is consistent with the hash of the corresponding program page in the hash tree:

[0050] If so, the program page that was replaced is allowed to load and run;

[0051] If not, the program page that is replaced is prohibited from loading and running.

[0052] The above technical solution has the following advantages or beneficial effects:

[0053] 1) Before program files are started and during execution, integrity verification and signature authentication are performed on each program page. Only programs with legal signatures and without tampering can run normally, thus protecting the security and program trustworthiness of the read-only file system. Even if malicious programs exploit system vulnerabilities to break into the computer, they cannot run in the read-only file system, thus ensuring the security and reliability of the read-only file system to a greater extent.

[0054] 2) Perform integrity measurement on trusted program files in a read-only file system and configure a unique identifier of the corresponding hash tree in the metadata of the trusted program files. This allows the program files to be classified into trusted and untrusted program files on the read-only file system, thereby enabling verification and interception of the operation of trusted program files without controlling the operation of untrusted program files.

[0055] 3) When a trusted program file is loaded, integrity measurement is performed on a per-program page basis, without verifying the entire trusted program file. This significantly speeds up detection and enables timely detection of issues when program page content has been tampered with.

[0056] 4) By signing the root hash of the hash tree, users are prevented from forging the hash tree, ensuring the credibility of the program file identity. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a schematic diagram of the structure of a program integrity verification system applicable to a read-only file system in a preferred embodiment of the present invention;

[0058] Figure 2 1 is a flow chart of a method for verifying program integrity in a read-only file system in a preferred embodiment of the present invention;

[0059] Figure 3 Schematic diagram of a sub-flow chart of step S1 in a preferred embodiment of the present invention;

[0060] Figure 4 This is a schematic diagram of a sub-flow chart of step S2 in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. The present invention is not limited to this embodiment, and other embodiments may also fall within the scope of the present invention as long as they conform to the gist of the present invention.

[0062] In a preferred embodiment of the present invention, based on the above problems existing in the prior art, a program integrity verification system applicable to a read-only file system is provided. Figure 1 Shown, including:

[0063] Pre-configuration module 1 is used to measure the integrity of the trusted program files of the read-only file system to construct a hash tree when creating a read-only file system image, then generate a unique identifier of the hash tree and record it in the metadata of the trusted program file, and sign the hash tree and save it;

[0064] The integrity verification module 2 is connected to the pre-configuration module 1 and is used to load a program file in a read-only file system. When the program file is judged to be a trusted program file based on the unique identifier, the corresponding hash tree is retrieved according to the unique identifier for signature authentication, and the integrity verification of the program page is performed, and the loading and running of the program page is allowed when both the signature authentication and the integrity authentication are passed.

[0065] Specifically, in this embodiment, before the program file is started, integrity measurement is performed on the trusted program files that need to be verified and intercepted, and then a hash tree is constructed based on the integrity measurement results, which serves as a verification standard for subsequent program file execution. Since not all program files in the read-only file system need to be verified and intercepted for protection, in order to facilitate the distinction between which program files are trusted program files that need to be verified and intercepted for protection, in this embodiment, after the hash tree is constructed, a unique identifier corresponding to the hash tree needs to be generated and recorded in the metadata of the trusted program file. This allows, when the program file is loaded, to determine whether it is a trusted program file or an untrusted program file based on whether the unique identifier is recorded in its metadata, and then to determine whether it needs to be verified and intercepted for protection.

[0066] Furthermore, if only a hash tree is constructed as a verification standard for subsequent program file execution, the hash tree may be forged, making it impossible to perform effective verification and interception protection. Based on this, in this embodiment, after the hash tree is constructed, it needs to be signed to prevent users from forging the hash tree, thereby ensuring the credibility of the program file identity.

[0067] Furthermore, during the execution of a program file, it is first determined based on the unique identifier whether it is a trusted program file. If it is a trusted program file, the associated hash tree must be retrieved based on the unique identifier. After the signature authentication of the hash tree is passed, the integrity of the loaded program page is verified. Only when both the signature authentication and the integrity verification are passed, the program page is allowed to be loaded and run.

[0068] In summary, it can be seen that this technical solution performs integrity verification and signature authentication on program files according to program pages before the program files are started and during execution. Only programs that have been legally signed and have not been tampered with can run normally, thereby protecting the security of the read-only file system and the credibility of the programs. Even if malicious programs exploit system vulnerabilities to break into the computer, they cannot run in the read-only file system, thereby ensuring the security and reliability of the read-only file system to a greater extent.

[0069] In a preferred embodiment of the present invention, the pre-configuration module 1 includes:

[0070] The first storage unit 11 is used to store a pre-configured signature key;

[0071] The hash tree building unit 12 is used to measure the integrity of the trusted program files in the read-only file system in units of program pages, build a hash tree based on the integrity measurement results, and generate a unique identifier for the hash tree;

[0072] The signature unit 13 is connected to the first storage unit 11, the hash tree establishment unit 12, and the second storage unit 14, respectively, and is used to sign the root hash of the hash tree according to the signature key to obtain a corresponding signature result, and store the hash tree and the corresponding signature result in the second storage unit 14;

[0073] The mapping table generation unit 15 is connected to the hash tree establishment unit 12 and the second storage unit 14, respectively, and is used to obtain the storage address of the hash tree and the corresponding signature result in the second storage unit 14, and establish an association relationship between the unique identifier and the storage address to form a hash tree mapping table;

[0074] The integrity verification module 2 obtains the corresponding storage address by matching the unique identifier in the hash tree mapping table, and retrieves the hash tree and the corresponding signature result from the second storage unit 14 according to the storage address.

[0075] Specifically, in this embodiment, the size of the program page can be configured as needed, preferably 4K. Among them, the first layer of the hash tree includes the integrity measurement results obtained by performing integrity measurement on each program page of the trusted program file, that is, the hash calculated for each program page, and the second layer of the hash tree includes the hash calculated by each hash of the first layer in units of program pages, and so on, until the root hash is reached. It can be seen from the construction process of the above hash tree that if any program page of the trusted program file is tampered with, its corresponding hash will also change, and then the root hash will also change. Based on this, only signing the root hash can prevent the forgery of the hash tree.

[0076] Furthermore, by storing the signature key in the first storage unit 11 and the hash tree to be signed in the second storage unit 14, physical isolation between the signature key and the hash tree to be signed is achieved, thereby achieving storage protection for the signature key. Furthermore, the signature unit 13 obtains the signature result by sending a signature request containing the type and root hash of the trusted program file to the first storage unit 11; the first storage unit 11 then includes:

[0077] Storage subunit 111, used to store the signature key;

[0078] The service providing subunit 112 is connected to the storage subunit 111 and is used to receive the type contained in the signature request, call the signature key to sign the root hash, obtain the signature result, and send it to the signature unit 13.

[0079] Specifically, in this embodiment, when signing is required, the first storage unit 11 only allows the signature unit 13, which is the requestor of the data to be signed, to access the signature key through the service providing sub-unit 112 and the service providing sub-unit 112 signs the root hash to be signed. The service providing sub-unit 112 signs the root hash according to the specified type and sends the signature result to the signature unit 13, so that the signing process is invisible to the outside world, and the storage protection of the signature key is realized.

[0080] In a preferred embodiment of the present invention, the integrity verification module 2 includes:

[0081] The trust judgment unit 21 is used to search the metadata of the program file when loading the program file in the read-only file system, and generate a trust signal indicating that the program file is a trustworthy program file when a unique identifier is retrieved;

[0082] The signature authentication unit 22 is connected to the trust judgment unit 21 and is used to retrieve the corresponding hash tree through the unique identifier according to the trust signal and perform signature authentication on the root hash of the hash tree, and generate a first pass signal after the signature authentication is passed;

[0083] a first verification unit 23, connected to the signature authentication unit 22, configured to perform an integrity measurement on a program page of the loaded program file according to the first pass signal to obtain a corresponding first verification hash, and generate a second pass signal when it is determined that the first verification hash is consistent with a hash of the corresponding program page in the hash tree;

[0084] The execution control unit 24 is connected to the first verification unit 23 and is configured to allow the corresponding program page to be loaded and executed according to the second pass signal.

[0085] Specifically, in this embodiment, trusted program support is provided for the read-only file system through the configuration of a unique identifier, that is, the program file with a unique identifier recorded in the metadata is a trusted program file, otherwise it is an untrusted program file. This technical solution does not control the operation of untrusted program files, but requires signature authentication and integrity verification to be performed in sequence for trusted program files. The program page is allowed to load and run only when both the signature authentication and integrity verification are passed, otherwise the loading and running of the program page are prohibited, and the program page is intercepted, thereby protecting the security of the system operation and the credibility of the program, so that even if a malicious program exploits a system vulnerability to break into the computer, it cannot run in the system, thereby ensuring the security and reliability of the read-only file system to a greater extent.

[0086] In a preferred embodiment of the present invention, the integrity verification module 2 also includes a second verification unit 25, which is connected to the operation control unit 24 and is used to perform integrity measurement on each replaced program page to obtain a corresponding second verification hash when the read-only file system uses page replacement to run the program page of the program file, and generate a second pass signal when it is determined that the second verification hash is consistent with the hash of the corresponding program page in the hash tree.

[0087] Specifically, in this embodiment, by performing an integrity check on the replaced program page each time a page is replaced, it is possible to ensure that the current program page has not been tampered with.

[0088] The present invention also provides a program integrity verification method applicable to a read-only file system, characterized in that the program integrity verification system described above is applied, such as Figure 2 As shown, the program integrity verification method includes:

[0089] Step S1: When creating a read-only file system image, the program integrity verification system measures the integrity of the trusted program files in the read-only file system to construct a hash tree. The unique identifier of the hash tree is then generated and recorded in the metadata of the trusted program file. The hash tree is signed and saved.

[0090] Step S2: When the program file is loaded into the read-only file system, the program integrity verification system determines whether the program file is a trusted program file based on the unique identifier:

[0091] If not, exit;

[0092] If yes, go to step S3;

[0093] In step S3, the program integrity verification system retrieves the corresponding hash tree based on the unique identifier to perform signature authentication and integrity verification on the program page, and checks whether both signature authentication and integrity authentication pass:

[0094] If so, the program page is allowed to load and run;

[0095] If not, loading and running the program page is prohibited.

[0096] In a preferred embodiment of the present invention, a pre-configured signature key is stored in the program integrity verification system;

[0097] like Figure 3 As shown, step S1 includes:

[0098] Step S11: The program integrity verification system performs integrity measurement on the trusted program files in the read-only file system in units of program pages, constructs a hash tree based on the integrity measurement results, and generates a unique identifier for the hash tree;

[0099] Step S12: The program integrity verification system signs the root hash of the hash tree according to the signature key to obtain a corresponding signature result, and stores the hash tree and the corresponding signature result;

[0100] Step S13: The program integrity verification system obtains the hash tree and the storage address of the corresponding signature result, and establishes an association relationship between the unique identifier and the storage address to form a hash tree mapping table;

[0101] In step S2, the program integrity verification system matches the unique identifier in the hash tree mapping table to obtain the corresponding storage address, and retrieves the hash tree and the corresponding signature result according to the storage address.

[0102] In a preferred embodiment of the present invention, the program integrity verification system is provided with a first storage unit for storing a pre-configured signature key;

[0103] In step S12, the program integrity verification system sends a signature request containing the type and root hash of the trusted program file to the first storage unit, and receives a signature result obtained by the first storage unit calling the signature key to sign the root hash according to the type contained in the signature request.

[0104] In a preferred embodiment of the present invention, Figure 4 As shown, step S2 includes:

[0105] Step S21: When the program integrity verification system loads the program file in the read-only file system, it searches the metadata of the program file and determines whether a unique identifier is retrieved:

[0106] If so, a trust signal is generated indicating that the program file is a trustworthy program file, and then the process goes to step S22;

[0107] If not, exit;

[0108] In step S22, the program integrity verification system retrieves the corresponding hash tree through the unique identifier based on the trusted signal and performs signature authentication on the root hash of the hash tree, and determines whether the signature authentication is passed:

[0109] If yes, go to step S23;

[0110] If not, then prohibit loading and running the program page and then exit;

[0111] In step S23, the program integrity verification system performs integrity measurement on the program page of the loaded program file to obtain a corresponding first verification hash, and determines whether the first verification hash is consistent with the hash of the corresponding program page in the hash tree:

[0112] If so, the corresponding program page is allowed to load and run;

[0113] If not, loading and running the program page is prohibited.

[0114] In a preferred embodiment of the present invention, step S23 further includes:

[0115] When the program integrity verification system runs the program page of the program file in a read-only file system using page replacement, it performs integrity measurement on each replaced program page to obtain the corresponding second verification hash, and determines whether the second verification hash is consistent with the hash of the corresponding program page in the hash tree:

[0116] If so, the replaced program page is allowed to load and run;

[0117] If not, the loaded program page is prohibited from loading and running.

[0118] The above description is only a preferred embodiment of the present invention and does not limit the implementation mode and protection scope of the present invention. For those skilled in the art, it should be aware that all solutions obtained by equivalent substitutions and obvious changes made using the content of this specification and illustrations should be included in the protection scope of the present invention.

Claims

1. A program integrity verification system for a read-only file system, characterized in that: include: a pre-configuration module configured to, when creating a read-only file system image, perform integrity measurement on a trusted program file of the read-only file system to construct a hash tree, subsequently generate a unique identifier for the hash tree and record it in metadata of the trusted program file, and sign and save the hash tree; an integrity verification module, connected to the preconfiguration module, for, when the read-only file system loads a program file, determining that the program file is the trusted program file based on the unique identifier, retrieving the corresponding hash tree based on the unique identifier for signature authentication, and performing integrity verification on the program page, and allowing the program page to be loaded and run if both the signature authentication and the integrity verification pass; The integrity verification module also includes a second verification unit, which is used to perform integrity measurement on each replaced program page to obtain a corresponding second verification hash when the read-only file system uses page replacement to run the program page of the program file, and indicates that the integrity verification is passed when it is determined that the second verification hash is consistent with the hash of the corresponding program page in the hash tree.

2. The program integrity verification system according to claim 1, characterized in that: The pre-configuration module includes: A first storage unit, configured to store a pre-configured signature key; a hash tree building unit, configured to perform integrity measurement on the trusted program files of the read-only file system in units of program pages, build the hash tree according to the integrity measurement result, and generate the unique identifier of the hash tree; a signature unit, connected to the first storage unit, the hash tree establishment unit, and the second storage unit, respectively, configured to sign the root hash of the hash tree according to the signature key to obtain a corresponding signature result, and store the hash tree and the corresponding signature result in the second storage unit; a mapping table generating unit, connected to the hash tree establishing unit and the second storage unit, respectively, for obtaining the hash tree and the storage address of the corresponding signature result in the second storage unit, and establishing an association relationship between the unique identifier and the storage address to form a hash tree mapping table; The integrity verification module obtains the corresponding storage address by matching the unique identifier in the hash tree mapping table, and retrieves the hash tree and the corresponding signature result from the second storage unit according to the storage address.

3. The program integrity verification system according to claim 2, characterized in that: The signature unit obtains the signature result by sending a signature request including the type of the trusted program file and the root hash to the first storage unit; the first storage unit includes: A storage subunit, used to store the signature key; The service providing subunit is connected to the storage subunit, and is used to receive the type contained in the signature request, call the signature key to sign the root hash, obtain the signature result, and send it to the signature unit.

4. The program integrity verification system according to claim 2, characterized in that: The integrity verification module includes: a trust judgment unit, configured to search the metadata of the program file when the program file is loaded in the read-only file system, and generate a trust signal indicating that the program file is the trustworthy program file when the unique identifier is retrieved; a signature authentication unit, connected to the trust judgment unit, configured to retrieve the corresponding hash tree through the unique identifier according to the trust signal and perform signature authentication on the root hash of the hash tree, and generate a first pass signal after the signature authentication passes; a first verification unit, connected to the signature authentication unit, configured to perform an integrity measurement on a program page of the loaded program file according to the first pass signal to obtain a corresponding first verification hash, and generate a second pass signal when it is determined that the first verification hash is consistent with a hash of the corresponding program page in the hash tree; An operation control unit is connected to the first verification unit and is used to allow the corresponding program page to be loaded and executed according to the second pass signal.

5. A program integrity verification method applicable to a read-only file system, characterized in that: Applied to the program integrity verification system according to any one of claims 1 to 4, the program integrity verification method comprises: Step S1: When creating a read-only file system image, the program integrity verification system performs integrity measurement on the trusted program files of the read-only file system to construct a hash tree, then generates a unique identifier for the hash tree and records it in the metadata of the trusted program file, and signs and saves the hash tree. Step S2: When the program file is loaded into the read-only file system, the program integrity verification system determines whether the program file is the trusted program file according to the unique identifier. If not, exit; If yes, go to step S3; In step S3, the program integrity verification system retrieves the corresponding hash tree according to the unique identifier to perform signature authentication, and performs integrity verification on the program page, and checks whether both the signature authentication and the integrity verification pass: If so, loading and running the program page is allowed; If not, loading and running the program page is prohibited.

6. The program integrity verification method according to claim 5, characterized in that: The program integrity verification system stores a pre-configured signature key; Then the step S1 includes: Step S11, the program integrity verification system performs integrity measurement on the trusted program file of the read-only file system in units of program pages, constructs the hash tree according to the integrity measurement result, and generates the unique identifier of the hash tree; Step S12: the program integrity verification system signs the root hash of the hash tree according to the signature key to obtain a corresponding signature result, and stores the hash tree and the corresponding signature result; Step S13: the program integrity verification system obtains the hash tree and the storage address of the corresponding signature result, and establishes an association relationship between the unique identifier and the storage address to form a hash tree mapping table; In step S2, the program integrity verification system matches the unique identifier in the hash tree mapping table to obtain the corresponding storage address, and retrieves the hash tree and the corresponding signature result according to the storage address.

7. The program integrity verification method according to claim 6, characterized in that: The program integrity verification system is provided with a first storage unit for storing a pre-configured signature key; In step S12, the program integrity verification system sends a signature request containing the type of the trusted program file and the root hash to the first storage unit, and receives the signature result obtained by the first storage unit calling the signature key to sign the root hash according to the type contained in the signature request.

8. The program integrity verification method according to claim 6, characterized in that: The step S2 comprises: Step S12: When the program file is loaded into the read-only file system, the program integrity verification system searches the metadata of the program file and determines whether the unique identifier is retrieved. If so, a trust signal is generated indicating that the program file is the trustworthy program file, and then the process goes to step S13; If not, exit; In step S13, the program integrity verification system retrieves the corresponding hash tree through the unique identifier according to the trusted signal, performs signature authentication on the root hash of the hash tree, and determines whether the signature authentication is passed: If yes, go to step S14; If not, then prohibit loading and running the program page, and then exit; In step S14, the program integrity verification system performs integrity measurement on the program page of the loaded program file to obtain a corresponding first verification hash, and determines whether the first verification hash is consistent with the hash of the corresponding program page in the hash tree: If so, the corresponding program page is allowed to load and run; If not, loading and running the program page is prohibited.

9. The program integrity verification method according to claim 8, characterized in that: The step S14 further includes: When the read-only file system uses page replacement to run the program page of the program file, the program integrity verification system performs integrity measurement on the program page replaced each time to obtain a corresponding second verification hash, and determines whether the second verification hash is consistent with the hash of the corresponding program page in the hash tree: If so, the program page that was replaced is allowed to load and run; If not, the program page that is replaced is prohibited from loading and running.

Images