A dynamic library integrity checking method, device, equipment and readable storage medium

Abstract

The application discloses a dynamic library integrity verification method and device, equipment and a readable storage medium, and is applied to the technical field of computers. The method comprises the following steps: when a verification instruction is received, a first start-stop address of a code section and a second start-stop address of a data section are acquired through a dynamic library. The complete data section of the dynamic library comprises an integrity verification data section and a data section. The first start-stop address and the second start-stop address are subjected to integrity calculation. A verification value obtained according to the integrity calculation is acquired, and an integrity verification value in the integrity verification data section is acquired. According to the comparison result of the verification value and the integrity verification value, the integrity of the dynamic library is determined. Compared with the prior art, the dynamic library integrity verification method provided by the application can execute the integrity verification process by itself because the dynamic library itself comprises the integrity verification data section. The application program is completely unaware of the integrity verification process, and the application program is not invasive, and the usability is better.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and readable storage medium for verifying the integrity of dynamic libraries. Background Technology

[0002] The rapid development of computer network technology has greatly facilitated information exchange, but attack methods are also constantly evolving. Dynamic libraries currently face various security threats, such as malicious modification or destruction of software code. Protecting data security has become a hot social issue. How to effectively protect the integrity of code and data in dynamic libraries has become an increasingly important concern for practitioners.

[0003] The integrity constraints of dynamic libraries are designed to prevent malicious tampering of critical information such as code and data, which could lead to server crashes. Currently, most technical solutions for protecting the integrity of dynamic libraries rely on external executable programs to perform integrity calculations on the dynamic library files. These checksums are then stored and managed outside the dynamic library files, and the external program retrieves the corresponding checksums and performs the verification process. It is evident that the current technology, which relies on external programs to retrieve checksums for verification, is highly intrusive to the application and provides a poor user experience. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, apparatus, device and readable storage medium for verifying the integrity of dynamic libraries, which solves the problem that the process of obtaining the corresponding verification value by an external program for verification in the prior art is highly intrusive to the application and has a poor user experience.

[0005] To solve the above-mentioned technical problems, the present invention provides a method for verifying the integrity of a dynamic library, comprising:

[0006] When a verification instruction is received, the first start and end addresses of the code segment and the second start and end addresses of the data segment are obtained through the dynamic library; wherein, the code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and the data segment;

[0007] Perform integrity calculations on the first start and end addresses and the second start and end addresses;

[0008] Obtain the verification value calculated based on the integrity, and obtain the integrity verification value in the integrity verification data segment;

[0009] The integrity of the dynamic library is determined based on the comparison result between the verification value and the integrity verification value.

[0010] Optionally, the second start and end addresses of the acquired data segment include:

[0011] When the data segment is divided into two segments by the integrity verification data segment, the start and end addresses of the first data segment and the start and end addresses of the second data segment are obtained.

[0012] Optionally, the integrity calculation of the first start and end addresses and the second start and end addresses includes:

[0013] Integrity calculations are performed on the first start and end addresses and the second start and end addresses using a hash algorithm.

[0014] Optionally, the process of generating the dynamic library includes:

[0015] Obtain the start and end addresses of the initial code segment and the initial data segment, and perform integrity calculations to obtain the integrity verification value; wherein, the initial code segment and the initial data segment have integrity.

[0016] Write the integrity check value into the integrity check data segment;

[0017] The integrity verification data segment, the initial data segment, and the initial code segment are integrated to obtain the dynamic library.

[0018] Optionally, before writing the integrity check value into the integrity check data segment, the method further includes:

[0019] Obtain the key and write the key into the integrity verification data segment;

[0020] Accordingly, the start and end addresses of the initial code segment and the initial data segment are obtained, and integrity calculations are performed to obtain the integrity check value, including:

[0021] Obtain the third start and end addresses of the initial code segment and the fourth start and end addresses of the initial data segment;

[0022] Extract the key according to the preset extraction rules;

[0023] The integrity check value is obtained by performing HMAC calculation on the key, the third start and end address, and the fourth start and end address.

[0024] Optionally, writing the integrity check value into the integrity check data segment includes:

[0025] A random number is generated using a random number algorithm and written into the integrity verification data segment;

[0026] Obtain the integrity verification value and write it into the integrity verification data segment according to the preset hiding rules.

[0027] Optionally, determining the integrity of the dynamic library based on the comparison result between the verification value and the integrity verification value includes:

[0028] When the comparison result shows that the verification value and the integrity verification value are different, an integrity verification failure message is output.

[0029] The present invention also provides a dynamic library integrity verification device, comprising:

[0030] The start and end address acquisition module is used to acquire the first start and end addresses of the code segment and the second start and end addresses of the data segment through the dynamic library when a startup command is received; wherein, the code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and the data segment;

[0031] The integrity calculation module is used to perform integrity calculations on the first start and end addresses and the second start and end addresses.

[0032] The verification value acquisition module is used to acquire the verification value calculated based on the integrity, and to acquire the integrity verification value in the integrity verification data segment;

[0033] The integrity verification module is used to determine the integrity of the dynamic library based on the comparison result between the verification value and the integrity verification value.

[0034] The present invention also provides a dynamic library integrity verification device, comprising:

[0035] Memory, used to store computer programs;

[0036] A processor is used to implement the steps of the above-described dynamic library integrity verification method when executing the computer program.

[0037] The present invention also provides a readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the dynamic library integrity verification method described above.

[0038] As can be seen, this method, based on the received verification instruction, obtains the first start and end addresses of the code segment and the second start and end addresses of the data segment from the dynamic library. The code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and a data segment. Integrity calculations are performed on the first and second start and end addresses. The verification value calculated based on the integrity is obtained, as well as the integrity verification value from the integrity verification data segment. Based on the comparison between the verification value and the integrity verification value, the integrity of the dynamic library is determined. Therefore, compared with existing technologies, the dynamic library integrity verification method provided in this application allows the dynamic library itself to perform the integrity verification process, without the application being aware of it. This solution is non-intrusive to the application and has better usability.

[0039] In addition, the present invention also provides a method, apparatus, device and readable storage medium for verifying the integrity of dynamic libraries, which also have the above-mentioned beneficial effects. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0041] Figure 1 A flowchart of a dynamic library integrity verification method provided in an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of the structure of a dynamic library integrity verification device provided in an embodiment of the present invention;

[0043] Figure 3 This is a schematic diagram of a dynamic library integrity verification device provided in an embodiment of the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Please refer to Figure 1 , Figure 1A flowchart illustrating a dynamic library integrity verification method provided in an embodiment of the present invention. The method may include:

[0046] S100: When a verification instruction is received, the first start and end addresses of the code segment and the second start and end addresses of the data segment are obtained through the dynamic library; wherein, the code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and a data segment.

[0047] This embodiment does not limit the specific form of the verification instruction, as long as it can trigger the dynamic library to perform integrity verification. For example, the verification instruction could be to start the dynamic library, call the dynamic library, or load the dynamic library, etc. This embodiment does not limit the specific location of the integrity verification code within the code segment, as long as the code can be executed to perform integrity verification. For example, the integrity verification code can be located at either end or in the middle. This embodiment also does not limit the positional relationship between the integrity verification data segment and the data segment; for example, the integrity verification data segment can be in the middle of the data segment or at either end of the data segment. This embodiment does not limit the type of dynamic library; for example, the dynamic library can be a dynamic library from any operating system platform, such as a Linux dynamic library, a Windows dynamic library, or an Android dynamic library.

[0048] S101, perform integrity calculation on the first start and end addresses and the second start and end addresses.

[0049] This embodiment does not limit the specific process of performing integrity calculations on the first and second start and end addresses. For example, integrity calculations can be performed on the first and second start and end addresses first, and then on the second start and end addresses, as long as the integrity verification values ​​of the first and second start and end addresses can be obtained in the end. This embodiment also does not limit the integrity calculation method, as long as it is consistent with the integrity calculation method used when generating the database. For example, if the integrity calculation is based on SM3 (a domestic hash algorithm) when generating the dynamic library, then this embodiment will also perform integrity calculations on the first and second start and end addresses based on SM3 (a domestic hash algorithm); or if a digital signature algorithm is used when generating the dynamic library, then this embodiment will use a digital signature algorithm when performing integrity calculations on the first and second start and end addresses. Alternatively, if the dynamic library is generated based on HMAC (Hash-based Message Authentication Code) integrity calculation, then this embodiment will also perform integrity calculations on the first and second start-end addresses based on HMAC. Or, if the dynamic library is generated based on the SM4 (symmetric encryption algorithm) message authentication integrity calculation method, then this embodiment will also perform integrity calculations on the first and second start-end addresses based on SM4. This embodiment uses a location technique to obtain the first and second start-end addresses. This embodiment does not limit the type of location technique, as long as the location technique can obtain the start and end addresses of the code and data segments in the dynamic library.

[0050] S102, obtain the verification value calculated based on integrity, and obtain the integrity verification value in the integrity verification data segment.

[0051] This embodiment does not limit the specific values ​​of the check value and the integrity check value, as long as the integrity check value and the check value are calculated according to the same integrity algorithm.

[0052] S103. Determine the integrity of the dynamic library based on the comparison result between the check value and the integrity check value.

[0053] In this embodiment, when the comparison results of the check value and the integrity check value are inconsistent, it indicates that the integrity of the dynamic library has been compromised; when the comparison results of the check value and the integrity check value are consistent, it indicates that the dynamic library has integrity and has not been compromised.

[0054] Based on the above implementation scheme, this embodiment of the invention directly obtains the first start and end addresses of the code segment and the second start and end addresses of the data segment through the dynamic library. The code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and a data segment. Integrity calculations are performed on the first and second start and end addresses. The verification value obtained from the integrity calculation is obtained, as well as the integrity verification value in the integrity verification data segment. The integrity of the dynamic library is determined based on the comparison result between the verification value and the integrity verification value. Compared with existing technologies that store and manage integrity verification values ​​outside the dynamic library, and have external programs retrieve the corresponding verification values ​​from external sources to perform the integrity verification process, this embodiment of the invention can directly perform integrity verification using the integrity verification code in the code segment within the dynamic library, reducing the intrusion of external programs into the application and improving the user experience.

[0055] Furthermore, to improve the security of the integrity verification data segment and the flexibility of its location setting, obtaining the second start and end addresses of the aforementioned data segment may include:

[0056] When a data segment is divided into two segments by an integrity verification data segment, obtain the start and end addresses of the first data segment and the second data segment.

[0057] In this embodiment, since the integrity verification data segment can be located anywhere within a data segment, when the integrity verification data segment is in the middle of the data segment, the data segment will be divided into two segments. Since the integrity verification data segment is in the middle of the data segment, it is necessary to obtain the start and end addresses of the two consecutive data segments separately, i.e., the start and end addresses of the first data segment and the second data segment. When the integrity verification data segment is located in the middle of the data segment, the possibility of being attacked is reduced, thus achieving higher integrity.

[0058] Furthermore, to improve encryption efficiency, integrity calculations can be performed on the first and second start-end addresses, which may include:

[0059] Integrity calculations are performed on the first and second start and end addresses using a hash algorithm.

[0060] This embodiment does not limit the specific type of hash algorithm, as long as it can be used to calculate the integrity of the first and second start and end addresses. For example, using the SM3 hash algorithm (a domestically developed hash algorithm) to calculate the integrity of the first and second start and end addresses is more in line with national requirements and has higher encryption efficiency; or using MD5 (Message-Digest Algorithm) to calculate the integrity of the first and second start and end addresses, or using SHA (Secure Hash Algorithm).

[0061] Furthermore, to ensure the feasibility of the dynamic library integrity verification method, the process of generating the aforementioned dynamic library may include:

[0062] Obtain the start and end addresses of the initial code segment and the initial data segment, perform integrity calculations, and obtain integrity verification values; wherein, the initial code segment and the initial data segment have integrity.

[0063] Write the integrity check value into the integrity check data segment;

[0064] The integrity verification data segment, the initial data segment, and the initial code segment are integrated to obtain a dynamic library.

[0065] This embodiment does not limit the specific timing of obtaining the start and end addresses of the initial code segment and the initial data segment, as long as it can be ensured that the data segment and the code segment are complete when the dynamic library is generated. For example, the start and end addresses of the initial code segment and the initial data segment can be obtained when the complete initial code segment and the initial data segment have been edited, or the start and end addresses of the initial code segment and the initial data segment can be obtained after using the dynamic library for a period of time and ensuring that the dynamic library is complete.

[0066] Furthermore, to enhance the security of integrity verification using this dynamic library, the process of writing the integrity verification value into the integrity verification data segment may further include:

[0067] Obtain the key and write it into the integrity verification data segment;

[0068] Accordingly, the start and end addresses of the initial code segment and the initial data segment are obtained, and integrity calculations are performed to obtain integrity verification values, including:

[0069] Obtain the third start and end addresses of the initial code segment and the fourth start and end addresses of the initial data segment;

[0070] Extract the key according to the preset extraction rules;

[0071] Perform HMAC calculation on the key, the third start and end address, and the fourth start and end address to obtain the integrity check value.

[0072] This embodiment does not limit the specific value of the key, as long as it is a pre-negotiated or agreed-upon key that is unknown to third parties. Users can choose the key according to their settings; it supports keys generated from trusted cryptographic devices such as cryptographic machines and encryption machines, as well as keys generated by existing key management systems. For example, the key could be “MDDDDDDDKC-J63B3--KTJJJHHHHKPB”, “VX-48-QHC7K-6XXR2-X6HXX”, “D9Y8H-4HW6B-26T-2CVPB-CDB9P”, etc. This embodiment does not limit the specific type of the preset extraction rule, as long as the preset extraction rule corresponds to the writing method of writing the key into the integrity verification data segment. This embodiment does not limit the specific algorithm of HMAC (Hash-based Message Authentication Code), but can be integrity calculation methods such as HmacMD5 (message authentication code based on MD5 (Message Digest Algorithm 5)), HmacSHA1 (message authentication code based on SHA1 (Secure Hash Algorithm-1)), HmacSM3 (message authentication code based on SM3).

[0073] Based on the above embodiments, further, in order to improve the concealment of the integrity check value, writing the integrity check value into the integrity check data segment may include:

[0074] Random numbers are generated using a random number algorithm and written into the integrity verification data segment;

[0075] Obtain the integrity verification value and write it into the integrity verification data segment according to the preset hiding rules.

[0076] This embodiment does not limit the specific method for generating random numbers, as long as the random numbers meet security and compliance requirements. Random numbers can be generated directly using a cryptographic machine. This embodiment also does not limit the specific hiding rules, as long as the integrity check value can be written into the integrity check data segment of the protection key. For example, the integrity check value can be divided into four parts and hidden in the integrity check data segment containing random numbers, or it can be divided into five parts and hidden in the integrity check data segment containing random numbers.

[0077] Furthermore, to alert the user of a failed dynamic library integrity verification, the determination of dynamic library integrity based on the comparison between the verification value and the integrity verification value may include:

[0078] When the comparison result shows that the check value and the integrity check value are different, an integrity check failure message will be output.

[0079] This embodiment does not limit the specific method of the prompt message. For example, it can be an alarm, a text prompt, or a voice prompt. For instance, it can output a text message indicating that the dynamic library integrity check failed, or output a text message indicating that the dynamic library integrity check failed via voice.

[0080] In summary, based on the above embodiments, the dynamic library integrity verification method provided by this invention can directly verify the integrity of the database using the integrity verification value and integrity verification code segment contained in the integrity verification data segment of the dynamic library itself. It does not require obtaining the verification value from outside the dynamic library, and the application is completely unaware of the integrity verification process. Therefore, this solution is non-intrusive to the application and has better usability. Furthermore, the HMAC (Hash-based Message Authentication Code) method can be used to verify the integrity of the dynamic library, improving the security of integrity verification using the dynamic library. Further, to improve the concealment of the integrity verification value, a random number is added to the integrity verification data segment. Finally, to alert the user of dynamic library integrity verification failure, the dynamic library will output a prompt message indicating integrity verification failure.

[0081] The following describes a dynamic library integrity verification device provided by an embodiment of the present invention. The dynamic library integrity verification device described below can be referred to in correspondence with the dynamic library integrity verification method described above.

[0082] Please refer to the details. Figure 2 , Figure 2 A schematic diagram of a dynamic library integrity verification device provided in an embodiment of the present invention may include:

[0083] The start and end address acquisition module 100 is used to acquire the first start and end addresses of the code segment and the second start and end addresses of the data segment through the dynamic library when a start command is received; wherein, the code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and the data segment;

[0084] Integrity calculation module 200 is used to perform integrity calculation on the first start and end addresses and the second start and end addresses;

[0085] The verification value acquisition module 300 is used to acquire the verification value calculated based on the integrity, and to acquire the integrity verification value in the integrity verification data segment;

[0086] The integrity verification module 400 is used to determine the integrity of the dynamic library based on the comparison result between the verification value and the integrity verification value.

[0087] Based on the above embodiments, the start and end address acquisition module 100 may include:

[0088] The data segment acquisition unit is used to acquire the start and end addresses of the first data segment and the second data segment when the data segment is divided into two segments by the integrity verification data segment.

[0089] Based on any of the above embodiments, the integrity calculation module 200 may include:

[0090] The hash algorithm calculation unit is used to perform integrity calculation on the first start and end addresses and the second start and end addresses using a hash algorithm.

[0091] Based on any of the above embodiments, before the start and end address acquisition module 100, it may further include:

[0092] The integrity setting module obtains the start and end addresses of the initial code segment and the initial data segment, performs integrity calculations, and obtains the integrity verification value; wherein, the initial code segment and the initial data segment have integrity.

[0093] The integrity verification data segment setting module is used to write the integrity verification value into the integrity verification data segment;

[0094] The dynamic library generation module is used to integrate the integrity verification data segment, the initial data segment, and the initial code segment to obtain the dynamic library.

[0095] Based on any of the above embodiments, before the integrity verification data segment setting module, it may further include:

[0096] A key acquisition module is used to acquire a key and write the key into the integrity verification data segment;

[0097] Accordingly, the integrity setting module may include:

[0098] An initial address acquisition unit is used to acquire the third start and end addresses of the initial code segment and the fourth start and end addresses of the initial data segment;

[0099] A key extraction unit is used to extract the key according to a preset extraction rule;

[0100] The integrity check value calculation unit is used to perform HMAC calculation on the key, the third start and end address and the fourth start and end address to obtain the integrity check value.

[0101] Based on any of the above embodiments, the integrity verification data segment setting module may include:

[0102] A random number generation unit is used to generate random numbers using a random number algorithm and write them into the integrity verification data segment;

[0103] The hidden unit is used to obtain the integrity verification value and write it into the integrity verification data segment according to a preset hiding rule.

[0104] Based on any of the above embodiments, the integrity verification module 400 may include:

[0105] The prompt module is used to output a prompt message indicating that the integrity verification failed when the comparison result is that the verification value and the integrity verification value are different.

[0106] Based on the above implementation scheme, this embodiment provides a dynamic library integrity verification device. The device may include: a start / end address acquisition module 100, used to acquire a first start / end address of a code segment and a second start / end address of a data segment from the dynamic library when a startup command is received; wherein the code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and the data segment; an integrity calculation module 200, used to perform integrity calculations on the first start / end address and the second start / end address; a verification value acquisition module 300, used to acquire a verification value calculated based on the integrity, and to acquire an integrity verification value from the integrity verification data segment; and an integrity verification module 400, used to determine the integrity of the dynamic library based on a comparison result between the verification value and the integrity verification value. As can be seen, the dynamic library integrity verification device provided in this embodiment adds an integrity verification code segment and an integrity verification code segment containing integrity verification values ​​to the code segment and data segment of the dynamic library. Therefore, the dynamic library itself can perform the integrity verification process, and the application is completely unaware of the integrity verification process. Thus, this solution is non-intrusive to the application and has better ease of use.

[0107] The following describes the dynamic library integrity verification device provided in the embodiments of the present invention. The dynamic library integrity verification device described below and the dynamic library integrity verification method described above can be referred to in correspondence.

[0108] Please refer to Figure 3 , Figure 3 A schematic diagram of a dynamic library integrity verification device provided in an embodiment of the present invention may include:

[0109] Memory 10 is used to store computer programs;

[0110] The processor 20 is used to execute a computer program to implement the steps of the dynamic library integrity verification method described above.

[0111] like Figure 3 The diagram shows the structure of a dynamic library integrity verification device, which may include: a memory 10, a processor 20, a communication interface 31, and a communication bus 32. The memory 10, processor 20, and communication interface 31 all communicate with each other through the communication bus 32.

[0112] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 10 may store programs for implementing the following functions:

[0113] When a verification instruction is received, the first start and end addresses of the code segment and the second start and end addresses of the data segment are obtained through the dynamic library; wherein, the code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and the data segment;

[0114] Perform integrity calculations on the first start and end addresses and the second start and end addresses;

[0115] Obtain the verification value calculated based on the integrity, and obtain the integrity verification value in the integrity verification data segment;

[0116] The integrity of the dynamic library is determined based on the comparison result between the verification value and the integrity verification value.

[0117] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0118] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0119] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0120] Communication interface 31 can be an interface for the communication module, used to connect with other devices or systems.

[0121] Of course, it should be noted that, Figure 3 The structure shown does not constitute a limitation on the dynamic library integrity verification device in the embodiments of this application. In practical applications, the dynamic library integrity verification device may include more than Figure 3 More or fewer components as shown, or combinations of certain components.

[0122] The readable storage medium provided in the embodiments of the present invention is described below. The readable storage medium described below can be referred to in correspondence with the dynamic library integrity verification method described above.

[0123] The present invention also provides a readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the dynamic library integrity verification method described above.

[0124] The readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0125] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0126] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0127] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0128] The foregoing has provided a detailed description of the dynamic library integrity verification device, method, apparatus, device, and readable storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. For example, the method can also be used to detect the integrity of static libraries or executable code. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for verifying the integrity of a dynamic library, characterized in that, include: When a verification instruction is received, the first start and end addresses of the code segment and the second start and end addresses of the data segment are obtained through the dynamic library; wherein, the code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and the data segment; Perform integrity calculations on the first start and end addresses and the second start and end addresses; Obtain the verification value calculated based on the integrity, and obtain the integrity verification value in the integrity verification data segment; The integrity of the dynamic library is determined based on the comparison result between the verification value and the integrity verification value; The step of obtaining the second start and end addresses of the data segment includes: when the data segment is divided into two segments by the integrity verification data segment, obtaining the start and end addresses of the first data segment and the second data segment; the integrity verification data is located in the middle of the data segment; The process of generating the dynamic library includes: Obtain the start and end addresses of the initial code segment and the initial data segment, and perform integrity calculations to obtain the integrity verification value; wherein, the initial code segment and the initial data segment have integrity. Write the integrity check value into the integrity check data segment; The integrity verification data segment, the initial data segment, and the initial code segment are integrated to obtain the dynamic library; Before writing the integrity check value into the integrity check data segment, the method further includes: Obtain the key and write the key into the integrity verification data segment; Accordingly, the start and end addresses of the initial code segment and the initial data segment are obtained, and integrity calculations are performed to obtain the integrity check value, including: Obtain the third start and end addresses of the initial code segment and the fourth start and end addresses of the initial data segment; Extract the key according to the preset extraction rules; The integrity check value is obtained by performing HMAC calculation on the key, the third start and end address, and the fourth start and end address. The integrity calculation for the first start and end addresses and the second start and end addresses includes: The integrity calculation is performed on the first start and end addresses and the second start and end addresses using a hash algorithm; The step of writing the integrity check value into the integrity check data segment includes: A random number is generated using a random number algorithm and written into the integrity verification data segment; Obtain the integrity verification value and write it into the integrity verification data segment according to the preset hiding rules; Determining the integrity of the dynamic library based on the comparison result between the verification value and the integrity verification value includes: When the comparison result shows that the verification value and the integrity verification value are different, an integrity verification failure message is output.

2. A dynamic library integrity verification device, characterized in that, include: The start and end address acquisition module is used to acquire the first start and end addresses of the code segment and the second start and end addresses of the data segment through the dynamic library when a startup command is received. The code segment includes an integrity verification code segment, and the complete data segment of the dynamic library includes an integrity verification data segment and the data segment. Acquiring the second start and end addresses of the data segment includes: when the data segment is divided into two segments by the integrity verification data segment, acquiring the start and end addresses of the first data segment and the second data segment; the integrity verification data segment is located in the middle of the data segment. The integrity calculation module is used to perform integrity calculations on the first start and end addresses and the second start and end addresses; the integrity calculation of the first start and end addresses and the second start and end addresses includes: performing integrity calculations on the first start and end addresses and the second start and end addresses using a hash algorithm; The verification value acquisition module is used to acquire the verification value calculated based on the integrity, and to acquire the integrity verification value in the integrity verification data segment; The integrity verification module is used to determine the integrity of the dynamic library based on the comparison result between the verification value and the integrity verification value; the step of determining the integrity of the dynamic library based on the comparison result between the verification value and the integrity verification value includes: when the comparison result is that the verification value and the integrity verification value are different, outputting a prompt message indicating that the integrity verification failed; The integrity setting module is used to obtain the start and end addresses of the initial code segment and the initial data segment, and perform integrity calculation to obtain the integrity verification value; wherein, the initial code segment and the initial data segment have integrity. An integrity verification data segment setting module is used to write the integrity verification value into the integrity verification data segment; the step of writing the integrity verification value into the integrity verification data segment includes: generating a random number using a random number algorithm and writing it into the integrity verification data segment; obtaining the integrity verification value and writing it into the integrity verification data segment according to a preset hiding rule; A dynamic library generation module is used to integrate the integrity verification data segment, the initial data segment, and the initial code segment to obtain the dynamic library; A key acquisition module is used to acquire a key and write the key into the integrity verification data segment; Accordingly, the integrity setting module includes: An initial address acquisition unit is used to acquire the third start and end addresses of the initial code segment and the fourth start and end addresses of the initial data segment; A key extraction unit is used to extract the key according to a preset extraction rule; The integrity check value calculation unit is used to perform HMAC calculation on the key, the third start and end address and the fourth start and end address to obtain the integrity check value.

3. A dynamic library integrity verification device, characterized in that, include: Memory, used to store computer programs; A processor is configured to implement the dynamic library integrity verification method as described in claim 1 when executing the computer program.

4. A readable storage medium, characterized in that, The readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the dynamic library integrity verification method as described in claim 1.

Images