Method for realizing self-defined signature verification of swan gap application program

Abstract

The invention discloses a method for realizing self-defined signature verification of a swan application program. The method comprises two stages of signature self-defining and signature verification. According to the method, a customized signature verification mechanism is realized for the HAP application package of the swan operating system, the generation, insertion and verification of the customized signature value and the additional value are realized, the official swan HAP package signature verification mechanism is not damaged, and the application installation package subjected to customized signature can still be installed and used on the swan operating system through the method. After signature operation of official developers is completed in the development stage of the swan application, a self-defined signature can be created through the method, and in the application installation stage, self-defined signature verification and additional value verification can be completed based on the method. The method can be used for source check and integrity check of the HAP application, meets customized safety requirements urgently needed by related industries, and fills the industry blank.

Description

Technical Field

[0001] The present invention relates to the technical field of data signature verification, and in particular to a method for implementing customized signature verification for Hongmeng application programs. Background Art

[0002] The compression method of the unsigned Hongmeng HAP package is ZIP format, which is simply divided into file blocks, central directory blocks, and central directory end blocks. The signed HAP package has an official signature block inserted between the file block and the central directory block. The signature block consists of three parts: the whole package signature data block, the authorization file signature data block, and the signature header. The entire official verification process also includes the verification of the above three parts: whole package verification, authorization file verification, and authorization file content verification. Currently, there is no relevant technology for Hongmeng HAP packages to support the coexistence of Hongmeng application official signatures and custom signatures.

[0003] CN108768662A discloses a method for adding a custom signature to an Android APK. The solution is based on the custom signature verification technology of Android native applications and implements the custom signature verification operation of the APK application running on the Android system. However, the solution only supports the custom signature verification operation of the APK application in the Android operating system and cannot be used for the HAP application of the Hongmeng operating system. The APK application files of the Android system and the HAP application files of the Hongmeng system have great differences in the file composition structure, especially in the insertion position of the signature value. In addition, the solution does not support the signature attribute verification mechanism, has no signature added value design, and has no verification mechanism designed for the signature source identification, signature date, signature validity period, certificate validity period, etc.

[0004] CN115987529A discloses an APP signature method, electronic device and storage medium based on Hongmeng system, which is applicable to various operating systems such as Hongmeng system. However, this solution cannot support the coexistence of official signatures and custom signatures of Hongmeng applications. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention aims to provide a method for implementing customized signature verification for Hongmeng applications.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A method for implementing custom signature verification for Hongmeng applications, including two stages: custom signature and signature verification;

[0008] 1. Custom signature:

[0009] A1, obtain the HAP application package file byte stream BD1;

[0010] A2. Parse the HAP application package file byte stream BD1 and segment it according to the positioning identifier to determine whether there is an official signature block. If the data after parsing and segmentation includes a data file block, an official signature block, a central directory block, and a central directory end block, continue to step A3; however, if the data after parsing and segmentation does not contain an official signature block, it is determined that the Hongmeng official signature value is not included, and the custom signature cannot be executed, and the custom signature process ends;

[0011] A3, parse the official signature block in step A2 and split it according to the positioning identifier to obtain the three parts of the authorization file signature block, the whole package signature block and the signature header, and determine whether the custom signature block exists according to the custom signature magic ID1 and ID2. If not, continue to step A4, otherwise it is determined that the custom signature block is included, and the custom signature operation is no longer performed, and the custom signature process ends;

[0012] A4. Locate the end of the entire signature block of the official signature block and obtain the offset of the positioning identifier OFT;

[0013] A5. Create a custom value-added SDM according to the generation strategy. The custom value-added SDM includes signature magic ID1, signature source, signature date, signature validity period, signature certificate validity period, extension identifier and signature magic ID2;

[0014] A6. Insert the custom additional value SDM created in step A5 after the positioning mark OFT of BD1, and merge them to obtain the byte stream BD2;

[0015] A7, using a cryptographic algorithm to calculate the byte stream BD2 obtained in step A6 to generate a custom signature value SP7;

[0016] A8, combining the custom additional value SDM generated in step A5 and the custom signature value SP7 generated in step A7 to obtain a custom signature block SD, inserting the custom signature block SD after the positioning marker OFT of the byte stream BD1, and merging them into the generated byte stream BD3;

[0017] A9. Modify the central directory offset value of the central directory end block of BD3. After completion, obtain the byte stream BD4, including the data file block, the modified official signature block, the central directory block and the central directory end block. The modified official signature block includes the original authorization file signature block, the original whole package signature block, the custom additional value SDM, the custom signature value SP7 and the original signature header.

[0018] A10, outputting the byte stream BD4 as a HAP application file, obtaining an installation file with a custom additional value and a custom signature value added;

[0019] A11. End the custom signature process;

[0020] 2. Customized signature verification

[0021] B1, obtain the HAP application package file byte stream BT1;

[0022] B2. Parse the HAP application package file byte stream BT1 and segment it according to the positioning identifier to determine whether there is an official signature block. If the data after parsing and segmentation includes a data file block, an official signature block, a central directory block, and a central directory end block, it is determined that there is an official signature block, and continue to step B3. If the data after parsing and segmentation does not contain an official signature block, it is determined that the Hongmeng official developer signature is not included, and the application installation is prohibited, and the signature verification process ends.

[0023] B3. Parse the official signature block in step B2 to obtain the authorization file signature block, the whole package signature block and the signature header, and determine whether the official signature block contains a custom signature block based on the custom signature magic ID1 and ID2. If so, proceed to step B4. Otherwise, it is determined that the custom signature value is not included, and the application installation is prohibited, and the signature verification process ends.

[0024] B4. According to the custom signature magic ID1 and ID2, the custom signature block is split to obtain the custom additional value SDM, and the remaining part is the custom signature value SP7;

[0025] B5, after removing the custom signature value SP7 from the byte stream BT1, reassemble it to obtain the byte stream BT2 with only the custom additional value inserted;

[0026] B6. Perform a signature verification operation using a cryptographic algorithm based on the custom signature value SP7 and the byte stream BT2 obtained in step B5. If the signature verification fails, the system returns a signal indicating that the signature verification failed, prohibits the installation of the application, and ends the signature verification. If the signature verification succeeds, the system continues to execute step B7.

[0027] B7. Parse the custom added value SDM to obtain five additional verification items, namely, signature source, signature date, signature validity period, signature certificate validity period and extension mark;

[0028] B8. Perform calculation verification on the five additional items obtained in step B7 according to the verification algorithm and the preset strategy. If the verification fails, return verification failure, prohibit installation, and end signature verification. If the verification succeeds, continue to step B9;

[0029] B9. After the custom signature value SP7 is verified and the additional verification items are verified, the application is allowed to be installed;

[0030] B10. End the custom signature verification process.

[0031] Furthermore, in step A5, the length of the custom additional value SDM is fixed at 192 bytes.

[0032] Furthermore, in step A8, if the length of the custom signature block SD is less than 2048 bytes, it needs to be padded with 0x00 to complete it to 2048 bytes.

[0033] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0034] The present invention also provides a terminal device, comprising a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, the above method is implemented.

[0035] The beneficial effects of the present invention are:

[0036] The present invention is aimed at the HAP application package of the Hongmeng operating system, implements a custom signature verification mechanism, realizes the generation, insertion and verification of custom signature values ​​and additional values, and does not destroy the signature verification mechanism of the official Hongmeng HAP package. The application installation package after the custom signature is completed by the present invention can still be installed and used on the Hongmeng operating system. After the official developer signature operation is completed in the development stage of the Hongmeng application, a custom signature can be created through the present invention. In the application installation stage, the custom signature verification and additional value verification can be completed based on the present invention. The present invention can be used for the source inspection and integrity verification of the Hongmeng HAP application, meeting the customized security requirements urgently needed by related industries and filling the gaps in the industry. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flowchart for implementing the custom signature phase in the method of the embodiment of the present invention;

[0038] Figure 2 It is a schematic diagram of the structure of a HAP application package file after completing the custom signature stage in an embodiment of the present invention;

[0039] Figure 3 The following is a flowchart of the implementation of customized signature verification in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0041] This embodiment provides a method for implementing customized signature verification for Hongmeng application programs, including two stages: customized signature and signature verification.

[0042] 1. Custom signature:

[0043] In this embodiment, the process of customizing the signature is as follows Figure 1 As shown, the following steps are included:

[0044] A1, obtain the HAP application package file byte stream BD1;

[0045] A2. Parse the HAP application package file byte stream BD1 according to the ZIP compression format structure, and segment it according to the positioning identifier to determine whether there is an official signature block. If the data after parsing and segmentation includes four parts: data file block, official signature block, central directory block and central directory end block, continue to step A3; however, if the data after parsing and segmentation does not contain an official signature block, it is determined that the Hongmeng official signature value is not included, and the custom signature cannot be executed, and the custom signature process ends;

[0046] A3, parse the official signature block in step A2 and split it according to the positioning identifier to obtain the three parts of the authorization file signature block, the whole package signature block and the signature header, and determine whether the custom signature block exists according to the custom signature magic ID1 and ID2. If not, continue to step A4, otherwise it is determined that the custom signature block is included, and the custom signature operation is no longer performed, and the custom signature process ends;

[0047] A4. Locate the end of the entire signature block of the official signature block and obtain the offset of the positioning identifier OFT;

[0048] A5. According to the generation strategy, create a custom additional value SDM with a fixed length of 192 bytes, which mainly includes seven parts, namely, signature magic ID1, signature source, signature date, signature validity period, signature certificate validity period, extension identifier and signature magic ID2. The extension identifier can be used to store application identification information such as encoded data;

[0049] A6. Insert the custom additional value SDM created in step A5 after the positioning mark OFT of BD1, and merge them to obtain the byte stream BD2;

[0050] A7, using SM2, SM3 and other national secret algorithms, calculate the byte stream BD2 obtained in step A6 to generate a custom signature value SP7 in PKCS#7 format;

[0051] A8. Combine the custom additional value SDM generated in step A5 and the custom signature value SP7 generated in step A7 to obtain a custom signature block SD. Insert the custom signature block SD after the positioning mark OFT of the byte stream BD1 and combine them into the generated byte stream BD3. If the length of the custom signature block SD is less than 2048 bytes, fill it with 0x00 to make it 2048 bytes.

[0052] A9. Modify the central directory offset value of the central directory end block of BD3. After completion, the byte stream BD4 is obtained. The complete structure is as follows Figure 2 As shown, it includes a data file block, a modified official signature block, a central directory block and a central directory end block, wherein the modified official signature block includes the original authorization file signature block, the original whole package signature block, the custom additional value SDM, the custom signature value SP7 and the original signature header. The central directory offset value of the central directory end block of BD3 is modified by adding 2048 to the original value of the central directory offset value, and then overwriting the original value with the new value, so as to obtain the byte stream BD4.

[0053] A10, outputting the byte stream BD4 as a HAP application file, obtaining an installation file with a custom additional value and a custom signature value added;

[0054] A11. End the custom signature process.

[0055] 2. Customized signature verification

[0056] In this embodiment, the process of customizing the signature verification is as follows: Figure 3 As shown, the following steps are included:

[0057] B1, obtain the HAP application package file byte stream BT1;

[0058] B2. Parse the HAP application package file byte stream BT1 according to the ZIP compression format structure, and segment it according to the positioning identifier to determine whether there is an official signature block. If the data after parsing and segmentation includes four parts: data file block, official signature block, central directory block and central directory end block, it is determined that there is an official signature block, and continue to step B3. If the data after parsing and segmentation does not contain an official signature block, it is determined that it does not contain the Hongmeng official developer signature, and the application installation is prohibited, and the signature verification process ends;

[0059] B3. Parse the official signature block in step B2 to obtain the authorization file signature block, the whole package signature block and the signature header, and determine whether the official signature block contains a custom signature block based on the custom signature magic ID1 and ID2. If so, proceed to step B4. Otherwise, it is determined that the custom signature value is not included, and the application installation is prohibited, and the signature verification process ends.

[0060] B4. According to the custom signature magic ID1 and ID2, the custom signature block is split to obtain the 192-byte custom additional value SDM, and the remaining part is the custom signature value SP7;

[0061] B5, after removing the custom signature value SP7 from the byte stream BT1, reassemble it to obtain the byte stream BT2 with only the custom additional value inserted;

[0062] B6. Perform the signature verification operation using the national secret algorithm according to the custom signature value SP7 and the byte stream BT2 obtained in step B5. If the signature verification fails, the system returns that the signature verification failed, prohibits the installation of the application, and ends the signature verification. If the signature verification succeeds, continue to step B7.

[0063] B7. Parse the custom additional value SDM to obtain five additional verification items, namely, signature source, signature date, signature validity period, signature certificate validity period and extension mark (encoded data, etc.);

[0064] B8. Perform calculation verification on the five additional items obtained in step B7 according to the verification algorithm and the preset strategy. If the verification fails, return verification failure, prohibit installation, and end signature verification. If the verification succeeds, continue to step B9;

[0065] B9. After the custom signature value SP7 is verified and the additional verification items are verified, the application is allowed to be installed;

[0066] B10. End the custom signature verification process.

[0067] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A method for implementing custom signature verification for Hongmeng applications, characterized in that: It includes two stages: custom signature and signature verification; 1. Custom signature: A1. Obtain the byte stream BD1 of the HAP application package file; A2. Parse the HAP application package file byte stream BD1 and segment it according to the positioning identifier to determine whether there is an official signature block. If the data after parsing and segmentation includes a data file block, an official signature block, a central directory block, and a central directory end block, continue to step A3; however, if the data after parsing and segmentation does not contain an official signature block, it is determined that the Hongmeng official signature value is not included, and the custom signature cannot be executed, and the custom signature process ends; A3, parse the official signature block in step A2 and split it according to the positioning identifier to obtain the three parts of the authorization file signature block, the whole package signature block and the signature header, and determine whether the custom signature block exists according to the custom signature magic ID1 and ID2. If not, continue to step A4, otherwise it is determined that the custom signature block is included, and the custom signature operation is no longer performed, and the custom signature process ends; A4. Locate the end of the entire signature block of the official signature block and obtain the offset of the positioning identifier OFT; A5. Create a custom value-added SDM according to the generation strategy. The custom value-added SDM includes signature magic ID1, signature source, signature date, signature validity period, signature certificate validity period, extension identifier and signature magic ID2; A6. Insert the custom additional value SDM created in step A5 after the positioning mark OFT of BD1, and merge them to obtain the byte stream BD2; A7, using a cryptographic algorithm to calculate the byte stream BD2 obtained in step A6 to generate a custom signature value SP7; A8, combining the custom additional value SDM generated in step A5 and the custom signature value SP7 generated in step A7 to obtain a custom signature block SD, inserting the custom signature block SD after the positioning marker OFT of the byte stream BD1, and merging them into the generated byte stream BD3; A9. Modify the central directory offset value of the central directory end block of BD3. After completion, obtain the byte stream BD4, including the data file block, the modified official signature block, the central directory block and the central directory end block. The modified official signature block includes the original authorization file signature block, the original whole package signature block, the custom additional value SDM, the custom signature value SP7 and the original signature header. A10, outputting the byte stream BD4 as a HAP application file, obtaining an installation file with a custom additional value and a custom signature value added; A11. End the custom signature process; 2. Customized signature verification B1, obtain the HAP application package file byte stream BT1; B2. Parse the HAP application package file byte stream BT1 and segment it according to the positioning identifier to determine whether there is an official signature block. If the data after parsing and segmentation includes a data file block, an official signature block, a central directory block, and a central directory end block, it is determined that there is an official signature block, and continue to step B3. If the data after parsing and segmentation does not contain an official signature block, it is determined that the Hongmeng official developer signature is not included, and the application installation is prohibited, and the signature verification process ends. B3. Parse the official signature block in step B2 to obtain the authorization file signature block, the whole package signature block and the signature header, and determine whether the official signature block contains a custom signature block based on the custom signature magic ID1 and ID2. If so, proceed to step B4. Otherwise, it is determined that the custom signature value is not included, and the application installation is prohibited, and the signature verification process ends. B4. According to the custom signature magic ID1 and ID2, the custom signature block is split to obtain the custom additional value SDM, and the remaining part is the custom signature value SP7; B5, after removing the custom signature value SP7 from the byte stream BT1, reassemble it to obtain the byte stream BT2 with only the custom additional value inserted; B6. Perform a signature verification operation using a cryptographic algorithm based on the custom signature value SP7 and the byte stream BT2 obtained in step B5. If the signature verification fails, the system returns a signal indicating that the signature verification failed, prohibits the installation of the application, and ends the signature verification. If the signature verification succeeds, the system continues to execute step B7. B7. Parse the custom added value SDM to obtain five additional verification items, namely, signature source, signature date, signature validity period, signature certificate validity period and extension mark; B8. Perform calculation verification on the five additional items obtained in step B7 according to the verification algorithm and the preset strategy. If the verification fails, return verification failure, prohibit installation, and end signature verification. If the verification succeeds, continue to step B9; B9. After the custom signature value SP7 is verified and the additional verification items are verified, the application is allowed to be installed; B10. End the custom signature verification process.

2. The method according to claim 1, characterized in that In step A5, the length of the custom additional value SDM is fixed at 192 bytes.

3. The method according to claim 1, characterized in that In step A8, if the length of the custom signature block SD is less than 2048 bytes, it needs to be padded with 0x00 to make it up to 2048 bytes.

4. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

5. A terminal device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, the method described in any one of claims 1 to 3 is implemented.

Images