Code signature-based program protection method, device and storage medium

Abstract

The present disclosure provides a code signature-based program protection method, device and equipment and a storage medium. The method comprises: obtaining a description file of a current program when the current program is started; if there is signature section data in the description file, obtaining a first hash value of the first section data of the description file using a first encryption algorithm according to the first section data of the description file; calling a signature verification interface of a signature verification server, and obtaining a verification result after the signature verification server verifies whether the signature is correct using a second encryption algorithm according to the signature section data and the first hash value; and if the verification result indicates that the signature is correct, generating and sending a release instruction to release the current program. The technical solution of the present disclosure can improve the security of application program signature protection.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer networks, and particularly relates to a program protection method and device based on code signature, electronic equipment and non-transitory computer readable storage medium. BACKGROUND

[0002] The Linux operating system is a high-efficiency and safe operating system, but the open source code will reduce the security performance of the open source program, and the information such as the privacy of the user will be leaked through the application program of the platform.

[0003] In order to ensure the security of the system, it is necessary to effectively identify the application program file to determine its legality. At present, the main identification method is code identification. Code identification is a method that can effectively prevent viruses and other malicious codes from invading, and code identification can be performed through digital signature verification when the application program is installed.

[0004] In the related art, in the digital signature verification scheme of the application program, the content of the digital certificate is written in the configuration file or the code, so that there is a risk of certificate leakage. If the certificate is leaked, the cracker can use the certificate to sign the malicious application program, bypass the protection process of the signature verification, which cannot guarantee the security of the signature protection of the application program. SUMMARY

[0005] The present disclosure provides a program protection method and device based on code signature, electronic equipment and non-transitory computer readable storage medium, to solve the problem of low security of application program signature protection in the prior art, and improve the security of application program signature protection.

[0006] The present disclosure provides a program protection method based on code signature, comprising: obtaining a description file of a current program when the current program is started; if there is signature section data in the description file, using a first encryption algorithm to obtain a first hash value of the first section data of the description file according to the first section data of the description file; calling a signature verification interface of a signature verification server, and obtaining a verification result after the signature verification server verifies whether the signature is correct according to the signature section data and the first hash value using a second encryption algorithm; if the verification result represents that the signature is correct, generating and sending a release instruction to release the current program.

[0007] According to the program protection method based on code signature provided by the present disclosure, after obtaining the verification result, the method further comprises: if the verification result represents that the signature is incorrect, generating and sending an interception instruction to intercept the current program.

[0008] According to the program protection method based on code signature provided by the present disclosure, after the description file of the current program is obtained, the method further comprises: if there is no signature section data in the description file, generating and sending an interception instruction to intercept the current program.

[0009] According to the program protection method based on code signature provided by the present disclosure, before the description file of the current program is obtained, the method further comprises: obtaining the original file of the current program; using the first encryption algorithm to obtain the second hash value of the second section data according to the second section data of the original file; calling a signature interface of a signature verification server to obtain a signature value after the signature verification server uses a second encryption algorithm to sign according to the second hash value; and adding the signature value to the original file.

[0010] According to the program protection method based on code signature provided by the present disclosure, before the description file of the current program is obtained, the method further comprises: obtaining current program information sent by a system kernel, wherein the current program information is obtained by the system kernel according to a listening program list listening to a read event; and obtaining the description file of the current program according to the current program information.

[0011] According to the program protection method based on code signature provided by the present disclosure, the method further comprises: respectively performing incremental hash value calculation on each of the first section data of the description file to obtain a plurality of single-section hash values; and obtaining the first hash value according to the plurality of single-section hash values.

[0012] According to the program protection method based on code signature provided by the present disclosure, before the first hash value of the first section data of the description file is obtained using the first encryption algorithm, the method further comprises: obtaining a section header table size and an offset according to the current program information; and obtaining the first section data according to the section header table size and the offset.

[0013] The disclosure provides a program protection device based on code signature, the device comprises: an acquisition unit configured to acquire a description file of a current program when the current program is started; an encryption unit configured to acquire a first hash value of a first section data of the description file using a first encryption algorithm if there is signature section data in the description file; a signature verification unit configured to call a signature verification interface of a signature verification server and acquire a signature verification result after the signature verification server verifies whether the signature is correct using a second encryption algorithm according to the signature section data and the first hash value; and a generation unit configured to generate and send a release instruction to release the current program when the signature verification result indicates that the signature is correct.

[0014] According to the program protection device based on code signature provided by the disclosure, the generation unit is further configured to generate and send an interception instruction to intercept the current program if the signature verification result indicates that the signature is incorrect.

[0015] According to the program protection device based on code signature provided by the disclosure, the generation unit is further configured to generate and send an interception instruction to intercept the current program if there is no signature section data in the description file.

[0016] According to the program protection device based on code signature provided by the disclosure, the acquisition unit is further configured to acquire an original file of the current program; the encryption unit is further configured to acquire a second hash value of a second section data of the original file using the first encryption algorithm; the device further comprises a signature unit configured to call a signature interface of a signature verification server and acquire a signature value after the signature verification server signs using a second encryption algorithm according to the second hash value; and an adding unit configured to add the signature value to the original file.

[0017] According to the program protection device based on code signature provided by the disclosure, the device further comprises a starting unit configured to acquire current program information sent by a system kernel, wherein the current program information is obtained by the system kernel according to a listening program list listening to a read event; and acquire a description file of the current program according to the current program information.

[0018] According to the program protection device based on code signature provided by the disclosure, the encryption unit is configured to respectively perform incremental hash value calculation on each of the first section data of the description file, and correspondingly obtain a plurality of single-section hash values; and acquire the first hash value according to the plurality of single-section hash values.

[0019] According to the code signature based program protection method provided by the present disclosure, the program protection device further comprises an analyzing unit configured to acquire a section header table size and an offset according to the current program information, and acquire the first section data according to the section header table size and the offset.

[0020] The present disclosure further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the code signature based program protection method according to any one of the above when executing the program.

[0021] The present disclosure further provides a non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the code signature based program protection method according to any one of the above.

[0022] The code signature based program protection method, device, electronic device and non-transitory computer readable storage medium provided by the present disclosure use a signature verification server to implement verification of a digital signature, thereby enhancing the security of application program signature protection. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the present disclosure or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0024] Figure 1 is one of the flowcharts of the code signature based program protection method provided by the present disclosure;

[0025] Figure 2 is one of the flowcharts of the code signature process provided by the present disclosure;

[0026] Figure 3 is another flowchart of the code signature process provided by the present disclosure;

[0027] Figure 4 is the flowchart of the code verification process provided by the present disclosure;

[0028] Figure 5 is the structural schematic diagram of the code signature based program protection device provided by the present disclosure;

[0029] Figure 6 is the structural schematic diagram of the electronic device provided by the present disclosure. DETAILED DESCRIPTION

[0030] To make the objectives, technical solutions, and advantages of this disclosure clearer, the technical solutions of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0031] The terminology used in one or more embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this disclosure. The singular forms “a,” “the,” and “the” as used in one or more embodiments of this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this disclosure refers to and includes any or all possible combinations of one or more associated listed items.

[0032] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this disclosure, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this disclosure, and similarly, second may also be referred to as first. Depending on the context, the word “if” as used herein may be interpreted as “when”, “in response to a determination”, or “when…”.

[0033] The technical terms used in the embodiments of this disclosure are explained below:

[0034] ELF (Extensible Linking Format): is the format for binary applications on the Linux platform.

[0035] Section: A component of the ELF format. The ELF header file describes information about the section header table, including its size and offset.

[0036] Signature verification server: A dedicated server authorized by the State Cryptography Administration of China to provide digital certificate-based signature services for electronic data and to verify the authenticity and validity of the signature data.

[0037] SM2: An asymmetric encryption algorithm developed by the State Cryptography Administration of China. It uses an improved elliptic curve algorithm to replace the insecure RSA encryption algorithm, resulting in higher cryptographic complexity, faster processing speed, and lower machine performance consumption.

[0038] SM3: a cryptographic hash algorithm formulated by the Chinese national cryptography standard, mainly used in scenarios such as digital signature and verification, message authentication code generation and verification, and the like, and the security and efficiency of which are comparable to those of SHA-256. Among them, SHA stands for Secure Hash Algorithm, secure hash algorithm.

[0039] In the related art, the security of signature protection of an application program of a Linux operating system is low.

[0040] To solve the problem, an embodiment of the present disclosure provides a program protection method based on code signature, an apparatus, an electronic device, and a non-transitory computer-readable storage medium.

[0041] The example embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0042] As Figure 1 shown is a flowchart of a program protection method based on code signature according to an embodiment of the present disclosure. The method provided by the embodiment of the present disclosure can be executed by any electronic device with computer processing capability, such as a terminal device and / or a server. As Figure 1 shown, the program protection method based on code signature includes:

[0043] Step 102, when a current program is started, obtaining a description file of the current program.

[0044] Specifically, the current program is an application program of a Linux system, and the format thereof can be ELF format. The description file in ELF format is parsed in format to obtain the description file in ELF format, i.e., the description file of the above-mentioned current program.

[0045] Step 104, if there is signature section data in the description file, using a first encryption algorithm to obtain a first hash value of the first section data according to the first section data of the description file.

[0046] Specifically, the description file in ELF format includes ELF header information, and the ELF header information includes size and offset information of a section header table. According to the size and offset information of the section header table, section header table information can be read to further obtain section data. The first section data is section data in the description file, which does not include signature section data. The description file of the current program can have signature section data or can not have signature section data. Signature section data is generated in the signature link of the application program. If the current program does not have signature section data, signature verification of steps 104 to 108 cannot be performed. In the embodiment of the present disclosure, the first encryption algorithm can be used to calculate the SM3 hash value of the application program.

[0047] Step 106: Call the signature verification interface of the signature verification server. After the signature verification server uses the second encryption algorithm to verify whether the signature is correct based on the signature byte data and the first hash value, obtain the signature verification result.

[0048] Specifically, the signature verification server is a hardware security module (HSM) that requires a pre-imported SM2 signature certificate, which is a national cryptographic signature certificate. A second encryption algorithm, which can be the SM2 algorithm, is used for signature verification. The signature verification server receives verification requests through a verification interface, generates a verification result based on the second encryption algorithm, and sends it through the verification interface. This verification request contains signature byte data and a first hash value.

[0049] Step 108: If the signature verification result indicates that the signature is correct, then generate and send a release instruction to release the current program.

[0050] In the technical solution of this disclosure embodiment, a first encryption algorithm is used to calculate the hash value of the application, and a hardware security module and a second encryption algorithm are used for signature verification. The hardware security module is a hardware security module with national cryptographic certification, and no third party can obtain the public and private keys of the signature certificate through this hardware security module, thereby improving the security of the application's digital signature protection.

[0051] In related technologies, Linux systems generally use the SHA-2 algorithm (obtained from overseas) for hash value calculation and the RSA algorithm for signature. However, the RSA algorithm is less secure and less efficient than the elliptic curve algorithm of SM2.

[0052] In the technical solution of this disclosure embodiment, a national cryptographic algorithm with high security strength is adopted. For example, the SM3 algorithm is used as the first encryption algorithm for hash value calculation, and the SM2 algorithm is used as the second encryption algorithm for signing and verification. This makes the signing and verification process in this disclosure embodiment less likely to be cracked, thereby enhancing the security of signing and verification.

[0053] Before step 102, a signing process is required to sign the application. For example... Figure 2 As shown, the signature method in this embodiment includes the following steps:

[0054] Step 202: Obtain the original file of the current program.

[0055] Step 204: Using the first encryption algorithm, obtain the second hash value of the second section of data based on the second section of data in the original file.

[0056] Step 206, a signature interface of the signature verification server is called, and a signature value is obtained after the signature verification server uses a second encryption algorithm to sign according to the second hash value.

[0057] Step 208, the signature value is added to the original file.

[0058] Specifically, before signing the application, the signature verification server needs to be initialized. When the signature verification server is initialized, a SM2 certificate of a national secret signature can be purchased from an authoritative CA institution, and the SM2 signature certificate is imported into the signature verification server.

[0059] In an embodiment of the present disclosure, the process of signing the application using the signature verification server and the national secret algorithm is as shown in Figure 3 , which includes the following steps:

[0060] Step 301, parse the ELF file, that is, format parse the application in ELF format to generate a description file in ELF format. In the format parsing process, the ELF header information is read to obtain the file type, encoding format, target platform architecture, ELF version number, and program header table size and offset, section header table size and offset, and other information, and the file type is judged according to the ELF header information, and if it is not an application, a failure information is returned.

[0061] Step 302, find the code segment and the data segment, that is, read the section header table information according to the section header table size and offset information in the ELF header information. In the finding process, the section header table information can be read in a loop, including the name of the section, the type of the section, the attribute of the section, the address of the section, the offset of the section, the size of the section, additional information, and the like, until all the section header table information is read.

[0062] Step 303, calculate the SM3 digest, that is, obtain the section data according to the section header table information, and use the SM3 algorithm to calculate the hash value. In the hash value calculation, the SM3 algorithm is first initialized using a private initialization vector, and then each second section data is read in sequence, and the SM3 algorithm is used to calculate the incremental hash value of each section data.

[0063] The incremental hash value calculation of the section data can specifically include the following contents:

[0064] The.text section of the ELF format application program is read, and the SM3 algorithm is used to calculate the incremental hash value of the data in this section. The.text section is the machine code after the application is compiled.

[0065] Read the.rodata section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.rodata section is the read-only data of the application program.

[0066] Read the.data section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.data section is the initialized global variable of the application program.

[0067] Read the.init section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.init section is the machine code of the application initialization.

[0068] Read the.fini section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.fini section is the machine code of the application exit.

[0069] Read the.ctors section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.ctors section is the pointer array of the global constructor of the application program.

[0070] Read the.dtors section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.dtors section is the pointer array of the global destructor of the application program.

[0071] Read the.dynamic section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.dynamic section is the dynamic linker binding process address information.

[0072] Read the.dynsym section of the ELF format application program as the dynamic connection symbol table, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.dynsym section is the dynamic connection symbol table.

[0073] Read the.dynstr section of the ELF format application program, and use the SM3 algorithm to calculate the incremental hash value of the data in this section. Among them, the.dynstr section is the string table of the dynamic symbol.

[0074] After obtaining the incremental hash value of the above second section data, that is, the SM3 data, the SM3 data is integrated to obtain the final SM3 hash value.

[0075] Step 304, use the signature verification server to sign, specifically, call the signature interface of the signature verification server, and obtain the signature value of the SM3 hash value. Specifically, the signature interface of the signature verification server can be called according to the requirements of GM / T 0018-2012 "Cryptographic Device Application Interface Specification", the SM3 hash value is input, the signature verification server uses the SM2 algorithm for signature, and the signature data of SM2 is returned.

[0076] Step 305, generate an ELF format signature segment, specifically, generate a new section.sm2sig section according to the SM2 data.

[0077] Step 306, append the signature segment to the ELF file. Specifically, the section header information of the.sm2sig section is appended to the section header table, and the SM2 signature segment is written into a new ELF application program, that is, a new ELF application program containing signature information is generated according to the new ELF description information.

[0078] As Figure 4 shown is a process of using a signature verification server to verify an application program using a national secret algorithm. The process includes the following steps:

[0079] Step 401, the program starts to call Exec.

[0080] Step 402, SignHooker sends a program start notification.

[0081] Step 403, the character device driver sends a program start notification.

[0082] Step 404, SignVerify reads the program start information.

[0083] Step 405, SignVerify requests the file of the application program.

[0084] Step 406, SignVerify obtains the file of the application program from the program.

[0085] Step 407, SignVerify uses the signature verification server for verification.

[0086] Step 408, SignVerify obtains the verification result.

[0087] Step 409, SignVerify notifies the character device driver to release according to the verification result.

[0088] Step 410, the character device driver notifies SignHooker to release the program.

[0089] Step 411, the S program starts successfully.

[0090] Before step 102, the signature verification system needs to be initialized, which can control the application program by signature verification. As shown in Figure 4 The signature verification system includes SignVerify, character device driver, SignHooker and executable program. The SignHooker is a Linux kernel module. The SignVerify is a program module in the Linux system. The executable program refers to the current application program. The character device is a device that can only access the device memory in the order of byte stream, and cannot be randomly accessed. The character device driver is a special program that can communicate the computer and the device, which is equivalent to the interface of hardware.

[0091] When the initialization of the signature verification system is performed, the kernel module SignHooker is loaded into the kernel of the Linux system, and the address of the system call table of the kernel is transmitted into the SignHooker through the loading parameter. The address of the system call table can be sys_call_table and ia32_sys_call_table.

[0092] In step 401, the executable program starts to call Exec. The Exec is the sys_exec system call, and the operating system can map and read the executable file through the sys_exec.

[0093] The SignHooker intercepts the sys_exec system call through the address of the system call table, saves the sys_exec address of the operating system, and registers the new callback function. The resident program SignVerify is started, and the list of application programs to be checked is initialized through the character device, and then the read event of the character device is listened.

[0094] In steps 402 and 403, when the application program to be checked is started, the SignHooker informs the SignVerify through the character device driver. Specifically, the SignHooker intercepts the sys_exec system call, and if the name or path of the application program belongs to the list to be protected, the information is sent to the SignVerify through the file_operations.read interface. In step 404, the SignVerify receives the read event of the character device, and then reads the name and path of the application program to be checked from the character device.

[0095] In the embodiments of the present disclosure, after SignVerify obtains the current program information sent by the system kernel, in steps 405 and 406, the description file of the current program is obtained according to the current program information, which is obtained by the system kernel according to the listening program list listening to the reading event.

[0096] SignVerify performs ELF application file format analysis to obtain ELF header information, section header table information, and SM3 hash value calculated according to section data, and obtain signature section data content. Referring to step 303, the SM3 hash value of the ELF application can be calculated using the same algorithm as the signature, and the signature section data content of the application can be obtained, that is, the signature section.sm2sig section of the ELF application is read.

[0097] Specifically, the section header table size and offset can be obtained according to the current program information; and the first section data is obtained according to the section header table size and offset.

[0098] The incremental hash value calculation is performed on each first section data of the description file, and a plurality of single-section hash values can be obtained correspondingly, and the first hash value is obtained according to the plurality of single-section hash values.

[0099] If the signature section data content does not exist in the application, SignHooker is notified to intercept. Specifically, if the signature section data does not exist in the description file, SignVerify can generate and send an interception instruction to SignHooker through a character device to intercept the current program.

[0100] In step 407, the signature verification interface of the signature verification server is called, the signature information and the SM3 hash value are sent to the signature verification server for signature verification, and in step 408, SignVerify obtains the signature verification result.

[0101] The signature verification interface of the signature verification server is called according to the requirements of GM / T 0018-2012 “Cryptographic Device Application Interface Specification”, the signature data and the SM3 hash value are input, and the signature verification server uses the SM2 algorithm to verify the signature, so that the result of whether the signature is correct can be obtained.

[0102] In steps 409 and 410, SignVerify decides whether to intercept according to the signature verification result, and notifies SignHooker of the decision result through the character device driver. Wherein:

[0103] If the signature verification result indicates that the signature is correct, a pass instruction is generated and sent to SignHooker through a character device to pass the current program.

[0104] If the signature verification result indicates that the signature is incorrect, an intercept instruction is generated and sent to the SignHooker through the character device to intercept the current program.

[0105] In step 411, after receiving the instruction, the SignHooker performs the release operation in step 411 according to the instruction, or performs the intercept operation. Specifically, if the instruction is intercept, an error code is returned, and the starting process of the application program is aborted; if the instruction is release, the system default sys_exec function is called, and the starting process of the application program is continued.

[0106] In the embodiments of the present disclosure, the certificate is protected by using a hardware security module with a certification qualification of the National Cryptography Administration, that is, a signature verification server, so that any third party cannot obtain the public key and the private key of the certificate through the hardware security module, and the security of the application program signature protection is enhanced; meanwhile, a higher security strength national cryptography algorithm is used for hash value calculation and signature, so that the entire signature and verification process is less likely to be cracked.

[0107] The program protection method based on code signature provided by the present disclosure uses a signature verification server to realize signature verification of a digital signature, and the security of the application program signature protection is enhanced.

[0108] The program protection device based on code signature provided by the present disclosure is described below, and the program protection device based on code signature described below can be correspondingly referred to the program protection method based on code signature described above.

[0109] As shown in Figure 5 The program protection device based on code signature of the embodiments of the present disclosure includes:

[0110] The obtaining unit 502 can be configured to obtain a description file of a current program when the current program is started.

[0111] The encryption unit 504 can be configured to, if there is signature section data in the description file, obtain a first hash value of first section data of the description file by using a first encryption algorithm according to the first section data.

[0112] The signature verification unit 506 can be configured to call a signature verification interface of a signature verification server, and obtain a signature verification result after the signature verification server verifies whether the signature is correct by using a second encryption algorithm according to the signature section data and the first hash value.

[0113] The generation unit 508 can be configured to, if the signature verification result indicates that the signature is correct, generate and send a release instruction to release the current program.

[0114] In the embodiments of the present disclosure, the generating unit can be further configured to generate and send an interception instruction to intercept the current program if the signature is incorrect.

[0115] In the embodiments of the present disclosure, the generating unit can be further configured to generate and send an interception instruction to intercept the current program if the signature section data does not exist in the description file.

[0116] In the embodiments of the present disclosure, the obtaining unit can be further configured to obtain an original file of the current program, and the encryption unit can be further configured to obtain a second hash value of the second section data according to the second section data of the original file by using the first encryption algorithm; the device can further include a signing unit configured to call a signing interface of a signature verification server and obtain a signature value after the signature verification server signs according to the second hash value by using a second encryption algorithm; and an adding unit configured to add the signature value to the original file.

[0117] In the embodiments of the present disclosure, the device can further include a starting unit configured to obtain current program information sent by a system kernel, wherein the current program information is obtained by the system kernel according to a listening program list listening to a reading event; and obtain a description file of the current program according to the current program information.

[0118] In the embodiments of the present disclosure, the encryption unit can be further configured to respectively perform incremental hash value calculation on each of the first section data of the description file, to obtain a plurality of single-section hash values; and obtain the first hash value according to the plurality of single-section hash values.

[0119] In the embodiments of the present disclosure, the device can further include an analyzing unit configured to obtain a section header table size and an offset according to the current program information; and obtain the first section data according to the section header table size and the offset.

[0120] Since each functional module of the program protection device based on code signature according to the example embodiments of the present disclosure corresponds to the steps of the example embodiments of the program protection method based on code signature described above, for the details not disclosed in the device embodiments of the present disclosure, please refer to the above-mentioned embodiments of the program protection method based on code signature of the present disclosure.

[0121] The program protection device based on code signature provided by the present disclosure enhances the security of application program signature protection by using a signature verification server to verify the digital signature.

[0122] Figure 6 An example of an entity structure schematic diagram of an electronic device is shown in FIG. 1. Figure 6As shown, the electronic device can include a processor 610, a communications interface 620, a memory 630, and a communications bus 640, wherein the processor 610, the communications interface 620, and the memory 630 complete mutual communication through the communications bus 640. The processor 610 can invoke a logic instruction in the memory 630 to execute a code signature-based program protection method, which includes: when a current program is started, obtaining a description file of the current program; if there is signature section data in the description file, using a first encryption algorithm to obtain a first hash value of first section data of the description file according to the first section data; calling a signature verification interface of a signature verification server, and obtaining a verification result after the signature verification server verifies whether the signature is correct according to the signature section data and the first hash value using a second encryption algorithm; if the verification result represents that the signature is correct, generating and sending a release instruction to release the current program.

[0123] In addition, the logic instruction in the memory 630 described above can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present disclosure essentially or partly contribute to the prior art, or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present disclosure. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0124] In another aspect, the present disclosure also provides a computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions which, when executed by a computer, enable the computer to perform the code signature-based program protection method provided by any of the above methods, the method comprising: obtaining a description file of a current program when the current program is started; if there is signature section data in the description file, obtaining a first hash value of first section data of the description file using a first encryption algorithm according to the first section data; calling a signature verification interface of a signature verification server, and obtaining a verification result after the signature verification server verifies whether the signature is correct using a second encryption algorithm according to the signature section data and the first hash value; and if the verification result indicates that the signature is correct, generating and sending a release instruction to release the current program.

[0125] In another aspect, the present disclosure also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the code signature-based program protection method provided by any of the above methods, the method comprising: obtaining a description file of a current program when the current program is started; if there is signature section data in the description file, obtaining a first hash value of first section data of the description file using a first encryption algorithm according to the first section data; calling a signature verification interface of a signature verification server, and obtaining a verification result after the signature verification server verifies whether the signature is correct using a second encryption algorithm according to the signature section data and the first hash value; and if the verification result indicates that the signature is correct, generating and sending a release instruction to release the current program.

[0126] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0127] Those skilled in the art can clearly understand the implementation of the various embodiments by means of software and the necessary general hardware platform from the above description of the embodiments, and of course, the embodiments can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0128] Finally, it should be noted that: the above examples are only used to illustrate the technical solutions of the present disclosure, and not to limit them; although the present disclosure has been described in detail with reference to the foregoing examples, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacement for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present disclosure.

Claims

1. A program protection method based on code signing, characterized in that, The method includes: When the current program starts, the following steps are taken: First, the description file of the current program is obtained. Before obtaining the description file, the process includes: obtaining the original file of the current program; using a first encryption algorithm to obtain a second hash value of the second section of data from the original file; calling the signature interface of a signature verification server, and obtaining a signature value after the signature verification server signs the data using the second encryption algorithm based on the second hash value; adding the signature value to the original file. The first encryption algorithm is the SM3 algorithm, and the second encryption algorithm is the SM2 algorithm. Before obtaining the description file, the process also includes: obtaining current program information sent by the system kernel, which is obtained by the system kernel listening for read events based on a list of listening programs; and obtaining the description file of the current program based on the current program information. If the description file contains signature section data, a first encryption algorithm is used to obtain the first hash value of the first section data based on the first section data of the description file. The process of obtaining the first hash value of the first section data based on the first encryption algorithm includes: calculating incremental hash values ​​for each of the first sections of the description file to obtain multiple single-section hash values; obtaining the first hash value based on the multiple single-section hash values; the first encryption algorithm is used to calculate the hash value of the current program; before obtaining the first hash value of the first section data based on the first encryption algorithm, the process further includes: obtaining the section header table size and offset based on the current program information; obtaining the first section data based on the section header table size and offset. The signature verification interface of the signature verification server is called. After the signature verification server verifies whether the signature is correct based on the signature byte data and the first hash value using the second encryption algorithm, the signature verification result is obtained; wherein, the second encryption algorithm is used to perform signature verification. If the signature verification result indicates that the signature is correct, a release command is generated and sent to allow the current program to proceed.

2. The method according to claim 1, characterized in that, After obtaining the signature verification result, the method further includes: If the signature verification result indicates that the signature is incorrect, an interception command is generated and sent to intercept the current program.

3. The method according to claim 1, characterized in that, After obtaining the description file of the current program, the method further includes: If the signature section data is not present in the description file, an interception command is generated and sent to intercept the current program.

4. A program protection device based on code signing, characterized in that, The device includes: An acquisition unit is configured to acquire the description file of the current program when the current program starts; before acquiring the description file of the current program, the unit further includes: acquiring the original file of the current program; using a first encryption algorithm to acquire a second hash value of the second section of data in the original file; calling the signature interface of a signature verification server, and acquiring a signature value after the signature verification server signs the data using the second encryption algorithm based on the second hash value; and adding the signature value to the original file; wherein the first encryption algorithm is the SM3 algorithm and the second encryption algorithm is the SM2 algorithm; before acquiring the description file of the current program, the unit further includes: acquiring current program information sent by the system kernel, wherein the current program information is obtained by the system kernel listening for read events according to the listening program list; and acquiring the description file of the current program based on the current program information; An encryption unit is configured to, if signature section data exists in the description file, use a first encryption algorithm to obtain a first hash value of the first section data based on the first section data of the description file; wherein, obtaining the first hash value of the first section data based on the first section data of the description file using the first encryption algorithm includes: calculating incremental hash values ​​for each of the first section data of the description file to obtain multiple single-section hash values; obtaining the first hash value based on the multiple single-section hash values; the first encryption algorithm is used to calculate the hash value of the current program; before obtaining the first hash value of the first section data based on the first section data of the description file using the first encryption algorithm, the unit further includes: obtaining the section header table size and offset based on the current program information; obtaining the first section data based on the section header table size and offset; The signature verification unit is used to call the signature verification interface of the signature verification server. After the signature verification server verifies whether the signature is correct based on the signature byte data and the first hash value using the second encryption algorithm, it obtains the signature verification result. The second encryption algorithm is used to perform signature verification. The generation unit is used to generate and send a release instruction when the verification result indicates that the signature is correct, so as to release the current program.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 3.

Images