A signature verification method based on domestic operating system

Abstract

The present invention relates to a signature verification method based on a domestic operating system, which belongs to the technical field of signature verification based on a domestic operating system, and solves the problem in the prior art that there is a lack of using the software provided by the domestic operating system to implement URL verification and file anti-swiping. The method comprises: a client generates a corresponding URL containing a signature according to a file URL that does not contain a signature; using a domestic operating system as a server, installing and starting Nginx and Perl modules in the installation environment of the domestic operating system, and creating a Perl script for implementing URL signature verification; Nginx in the server receives a URL request from a client, and the URL request is a URL containing a signature; Nginx calls a Perl script to perform URL signature verification on the URL request, and responds to the URL request of the client according to the URL signature verification result.

Description

Technical Field

[0001] The present invention relates to the technical field of signature verification based on a domestic operating system, and in particular to a signature verification method based on a domestic operating system. Background Art

[0002] The access address of files on the Internet is expressed in the form of URL (Uniform Resource Locator), that is, network protocol: / / resource address. However, the information transmitted in the URL is usually not only the network protocol and resource address, but also the relevant parameters and identifiers of the network request. It has always been common to carry out file attacks against URLs. URL attacks are mainly manifested in the following aspects: repeated requests and illegal acquisition of resources.

[0003] (1) Repeated Request

[0004] For example, when a normal user accesses a URL such as "http: / / www.test.com / path / file.rar", a file named file.rar will be downloaded. When an attacker obtains the URL and repeatedly requests the URL using multiple machines, the Web server will consume a large amount of network bandwidth resources, thereby affecting the file download requests of normal users.

[0005] (2) Illegal acquisition of resources

[0006] For example, when a normal user accesses a URL such as "http: / / www.test.com / path / file1", a file named file1 will be downloaded. When an attacker obtains the URL and knows or infers the naming rules of the path and file, he can obtain other files published by the Web server by modifying the URL. For example, an attacker can infer "http: / / www.test.com / path / file2" based on the file name, or "http: / / www.test.com / path1 / file1" based on the path, which will cause serious data leakage problems.

[0007] There are some methods that can effectively prevent the above URL attacks, such as signing URLs and verifying signatures. The general implementation method is: 1. Select specific content in the URL, use a custom encryption algorithm to process it into a signature, and add the signature to the URL request parameters, such as "http: / / www.test.com / path / file?Sign"; 2. When the Web server receives the URL request, it verifies the Sign in the URL. If the verification is successful, it responds to the request. If it is not successful, it refuses to respond to the request.

[0008] URL signing and signature verification are currently usually implemented using Nginx+Lua or Openresty.

[0009] 2020 is the starting point for the comprehensive promotion of the ICT industry. The ICT industry refers to the information technology application innovation industry. In the past, most of China's IT underlying standards, architectures, products, and ecosystems were formulated by foreign IT commercial companies, which resulted in many risks of restrictions on underlying technologies, information security, and data storage methods. The global IT ecological landscape will evolve from the past "one pole" to the future "two poles", and China must gradually establish its own IT underlying architecture and standards. The IT industry ecosystem based on its own IT underlying architecture and standards is the main connotation of the ICT industry. The ICT industry is based on the information technology product ecosystem. The current traditional information technology industry is mainly composed of four parts: infrastructure (chips, memory, complete machines [servers, PCs], firmware, etc.), basic software (operating systems, middleware, databases), application software, and information / network security.

[0010] Domestic operating systems such as KylinV10-SP1_ARM use 64-bit ARM chips as CPUs, and their official yum software source currently does not provide software installation packages for Nginx+Lua and Openresty. On this operating system, if you install external Nginx+Lua or Openresty to implement URL signing and signature verification, its compliance and security cannot be guaranteed.

[0011] Therefore, how to implement URL verification and file anti-swiping by using the Nginx+Perl software included in the yum source under a domestic operating system (such as KylinV10-SP1_ARM) without installing additional external third-party software is a technical problem that needs to be solved urgently. Summary of the invention

[0012] In view of the above analysis, an embodiment of the present invention aims to provide a signature verification method based on a domestic operating system, so as to solve the problem in the prior art of lack of using software provided by the domestic operating system to implement URL verification and file anti-swiping.

[0013] The present invention provides a signature verification method based on a domestic operating system, the method comprising:

[0014] The client generates a corresponding URL containing a signature based on the file URL that does not contain a signature;

[0015] Use the domestic operating system as the server. In the installation environment of the domestic operating system, install and start Nginx and Perl modules, and create a Perl script for implementing URL signature verification.

[0016] Nginx in the server receives a URL request from a client, where the URL request is a URL containing a signature; Nginx calls a Perl script to perform URL signature verification on the URL request, and responds to the URL request of the client according to the URL signature verification result.

[0017] On the basis of the above scheme, the present invention also makes the following improvements:

[0018] Furthermore, the format of the file URL not containing a signature is: network protocol: / / host:port / path / file name; the client generates a corresponding URL containing a signature according to the file URL not containing a signature, and executes:

[0019] Extract " / path / filename" from the file URL that does not contain the signature as string S1, reverse string S1 and take the MD5 digest to get Key1;

[0020] Get the number of seconds since the fixed reference date as T1, which is used as the timestamp for generating the URL;

[0021] Sequentially concatenate T1, key1, and the client-defined secret key Secret to obtain string S2; take the MD5 digest of string S2 to obtain Key2;

[0022] Use "-" to connect Key1, T1 and Key2 in sequence to get the URL signature Sign;

[0023] Generate the corresponding URL containing the signature, expressed as: network protocol: / / host:port / path / filename?Sign.

[0024] Further, the Nginx calls the Perl script to perform signature verification on the URL request and executes:

[0025] Nginx forwards the received URL request to the Perl script, which verifies the URL signature.

[0026] The Perl script extracts the signature from the URL request and determines whether the format of the signature satisfies "Key1-T1-Key2". If not, the URL signature verification fails. Otherwise, T1, Key1, and Key2 are checked in sequence. If all of them pass, the URL signature verification passes.

[0027] The Perl script forwards the return value corresponding to the URL signature verification result to Nginx. If the URL signature verification fails, the return value is 0; if the URL signature verification passes, the return value is 1.

[0028] Further, the URL signature verification result is used to respond to the URL request of the client and execute:

[0029] If Nginx receives 0, it returns a resource unavailable status code to the client;

[0030] If Nginx receives 1, it responds normally to the target folder of the URL request and returns a success status code.

[0031] Further, the verification of T1, Key1, and Key2 is performed in sequence:

[0032] The Perl script extracts T1 from the signature Sign, converts the current time of the server into "seconds since the fixed reference date" and subtracts it from T1. If the result exceeds the valid time, the URL verification signature fails; otherwise, proceed to the next step of verification;

[0033] The Perl script intercepts " / path / filename" from the URL request as string PS1, reverses string PS1 and takes MD5 digest to get PKey1; if PKey1 is different from Key1 in the signature Sign, the URL signature verification fails; otherwise, proceed to the next step of verification;

[0034] The Perl script sequentially concatenates T1, PKey1, and the custom secret key PSecret in the Perl script to obtain the string PS2; the MD5 digest of the string PS2 is taken to obtain PKey2; if PKey2 is different from the Key2 in the signature Sign, the URL verification signature fails; otherwise, the URL verification signature passes;

[0035] The custom key PSecret in the Perl script is the same as the custom key Secret on the client.

[0036] Furthermore, in the installation environment of the domestic operating system, Nginx and Perl modules are installed and started, and the following are executed:

[0037] Check whether the components that Nginx depends on are installed;

[0038] If the components that Nginx depends on are not installed, install the missing components and then install Nginx; otherwise, install Nginx directly;

[0039] Start Nginx;

[0040] Among them, Nginx has a built-in Perl module.

[0041] Further, the Perl script for implementing URL signature verification is created and executed:

[0042] Write the check.pm file as a Perl script. When writing the check.pm file:

[0043] Encapsulate the check.pm file into a package named check for Nginx to call;

[0044] Configure the check.pm file to call the parameters in the Nginx request.

[0045] Furthermore, the Perl script created to implement URL signature verification also executes:

[0046] In check.pm, define internal variables of the Perl script to carry Nginx requests, and define a function named handler for Nginx to call; the handler function returns the URL signature verification result.

[0047] Further, Nginx calls the Perl script in the following way:

[0048] Nginx loads the perl module;

[0049] Deploy a Perl script for implementing URL signature verification;

[0050] Nginx configuration file that calls the Perl script for URL signature verification.

[0051] Furthermore, the domestically produced operating system is the domestically produced KylinV10-SP1_ARM version.

[0052] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0053] The signature verification method based on the domestic operating system provided by the present invention is to install and start Nginx and Perl modules in the installation environment of the domestic operating system, create a Perl script for implementing URL signature verification; and after receiving the URL request from the client, Nginx calls the Perl script to perform URL signature verification on the URL request, and responds to the URL request of the client according to the URL signature verification result. Thus, URL verification is implemented by using the software provided by the domestic operating system, which well solves the problem of lack of using the software provided by the domestic operating system to implement URL verification in the prior art.

[0054] At the same time, the present invention also optimizes the specific process of generating and verifying signatures, effectively improving the difficulty of signature cracking and effectively solving the problem of file anti-swiping.

[0055] In addition, the present invention uses Nginx to call a Perl script to perform URL signature verification on the URL request, thereby realizing signature verification in a domestic operating system, expanding the functions of the domestic operating system, avoiding dependence on some software, and having strong practicality.

[0056] In the present invention, the above-mentioned technical solutions can also be combined with each other to achieve more preferred combination solutions. Other features and advantages of the present invention will be described in the subsequent description, and some advantages can become obvious from the description, or can be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0058] Figure 1 A flowchart of a method for preventing file brushing based on Nginx and Perl script verification of URLs provided in an embodiment of the present invention;

[0059] Figure 2 A flow chart of generating a signature provided by an embodiment of the present invention;

[0060] Figure 3 A flowchart of signature verification provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0062] A specific embodiment of the present invention discloses a signature verification method based on a domestic operating system, the flow chart is as follows: Figure 1 The specific implementation process of this method is described as follows.

[0063] Step S1: The client generates a corresponding URL containing a signature based on a file URL that does not contain a signature.

[0064] In step S1, the client generates a signature, usually using a programming language, and Java is used as an example for illustration. Preferably, the format of the file URL without the signature is: network protocol: / / host:port / path / file name.

[0065] For example: https: / / www.test.com / res / EU / image / 2011 / 6 / 010081701.JPG

[0066] At this point, the client generates a corresponding URL containing a signature based on the file URL that does not contain a signature, and executes:

[0067] Step S11: intercept “ / path / filename” from the file URL that does not contain a signature as the string S1, reverse the string S1 and take the MD5 digest to obtain Key1.

[0068] For example: S1= / res / EU / image / 2020 / 6 / 018250528.JPGS1 reverse=GPJ.825052810 / 6 / 0202 / egami / UE / ser /

[0069] S1 reverses and takes MD5 summary = bf3cb733f53a4d1b891cabb31ecdd2d1

[0070] Key1=bf3cb733f53a4d1b891cabb31ecdd2d1

[0071] Step S12: Get the "number of seconds since the fixed reference date" as T1, which is used as the timestamp for generating the URL.

[0072] String clientTime=String.valueOf(new Date().getTime() / 1000);

[0073] For example, if the acquisition time is 2023-12-2609:15:06, it is converted to a timestamp, that is, T1 = 1703553306

[0074] Step S13: sequentially concatenate T1, key1 and the client-defined secret key Secret to obtain a string S2; obtain the MD5 digest of the string S2 to obtain Key2.

[0075] For example: Secret = ABCDE

[0076] S2=T1+key1+Secret

[0077] S2=1703553306bf3cb733f53a4d1b891cabb31ecdd2d1ABCDE

[0078] S2 takes MD5 summary = 5643a894bc95bd182f8857e012fce69a

[0079] Key2=5643a894bc95bd182f8857e012fce69a

[0080] Step S14: Use “-” to connect Key1, T1 and Key2 in sequence to obtain the URL signature Sign. For example:

[0081] Sign=bf3cb733f53a4d1b891cabb31ecdd2d1-1703553306-5643a894bc95bd182f8857e012fce69a

[0082] Step S15: Generate a corresponding URL containing a signature, expressed as: network protocol: / / host:port / path / filename?Sign.

[0083] like:

[0084] https: / / www.test.com / res / EU / image / 2020 / 6 / 018250528.JPG?bf3cb733f53a4d1b891cabb31ecdd2d1-1703553306-5643a894bc95bd182f8857e012fce69a

[0085] The flow chart for generating signatures is as follows Figure 2 shown.

[0086] Step S2: Using the domestic operating system as the server, in the installation environment of the domestic operating system, install and start the Nginx and Perl modules, and create a Perl script for implementing URL signature verification.

[0087] For example, in this embodiment, the installation environment of the domestic operating system is: domestic Kylin V10-SP1_ARM version, newly created user user1. In this installation environment, Nginx and Perl modules are installed by performing the following operations. The specific implementation process of step S3 is described as follows:

[0088] Step S21: Check whether the components that Nginx depends on are installed.

[0089] gcc gcc-c++autoconf automake make zlib zlib-devel openssl openssl-devel pcre pcre-devel

[0090] rpm-q component name

[0091] Step S22: If the components that Nginx depends on are not installed, install the missing components and then jump to step S23; otherwise, jump directly to step S23.

[0092] yuminstall component name

[0093] Step S23: Install Nginx.

[0094] yum-y install nginx-all-modules

[0095] Step S24: Start Nginx.

[0096] / usr / local / nginx-1.24.0 / sbin / nginx

[0097] The above is the Nginx full module version installed from the KylinV10-SP1_ARM version yum source, which includes the Perl module. Therefore, after installing Nginx, the installation of Nginx and Perl modules is completed. After starting Nginx, the loading of the Perl module is also completed at the same time.

[0098] Step S25: Create a Perl script for implementing URL signature verification.

[0099] Write the check.pm file as a Perl script, the contents of which are as follows:

[0100]

[0101]

[0102] illustrate:

[0103] (1)Package check:

[0104] Indicates that the check.pm file is encapsulated into a package named check for Nginx to call;

[0105] (2) use nginx:

[0106] Indicates that the configuration check.pm file can call various parameters in the Nginx request;

[0107] (3) my$r = shift:

[0108] Indicates defining a Perl script internal variable to carry Nginx request. my means that only the module or function at this level can see this variable, and the higher or lower levels cannot see it. $ is the prefix of the Perl script variable definition; shift indicates Nginx request; $r=shift means that Nginx request can be called through $r, and the following parameters are supported:

[0109]

[0110]

[0111] (4)use Digest::MD5 qw(md5_hex):

[0112] Represents the check.pm script, which introduces the md5_hex method of the Digest::MD5 module in Perl to calculate the MD5 digest of the string during the signature verification process.

[0113] (5) sub handler {return return value} 1:

[0114] Indicates that a function named handler is defined in check.pm for Nginx to call. The handler function returns the URL signature verification result. The default return value of the function is 1, and the return value in the function body {} is returned first. sub is a keyword for defining a function in a Perl script.

[0115] (6)__END__ indicates the logical end of the script and the following text is ignored.

[0116] Step S3: Nginx in the server receives the URL request from the client; Nginx calls the Perl script to perform URL signature verification on the URL request, and responds to the URL request of the client according to the URL signature verification result.

[0117] Preferably, in step S3, Nginx calls a Perl script to perform signature verification on the URL request, and responds to the client's URL request according to the URL signature verification result, executing:

[0118] Step S31: Nginx calls the Perl script.

[0119] There are two ways to call perl scripts in Nginx. The first is to write the content of the Perl script directly in the Nginx configuration file. If the content of the Perl script is large, this method will result in a large content in the Nginx configuration file, which is not easy to maintain. The second method is to write the perl script outside Nginx, and the Nginx configuration file only references the Perl script and calls its function. This method maximizes the separation of the Nginx configuration file and the Perl script, which is easy to maintain. The embodiment of the present invention uses the second method. The specific implementation process is described as follows:

[0120] Step S311: Nginx loads the perl module.

[0121] In nginx.conf, add worker_processes at the same level:

[0122] load_module" / usr / local / nginx-version number / modules / ngx_http_perl_module.so"; indicates that nginx will load the perl module named ngx_http_perl_module.so in the above path when it runs.

[0123] Step S312: deploy a Perl script for implementing URL signature verification.

[0124] Copy check.pm to the directory: / usr / share / perl5 / or / usr / local / nginx-version number / perl / lib. The above directory is the directory where the perl module looks for the script to be called.

[0125] Step S313: Call the Perl script to perform Nginx configuration file for URL signature verification.

[0126] In this embodiment, the relevant procedures of the Nginx configuration file that calls the Perl script to perform URL signature verification are as follows:

[0127]

[0128] As configured above, the handler process in the check.pm script is defined as the $url_check function that can be called in the Nginx configuration file. When Nginx receives a URL request, if the $url_check function fails to verify the signature, Nginx returns a 403 resource unavailable status code; if the $url_check function passes the signature verification, Nginx returns the corresponding resource.

[0129] (1)perl_modules perl / lib:

[0130] Indicates that the Perl module searches for Perl scripts in this directory

[0131] (2) perl_require check.pm:

[0132] Indicates the introduction of the check.pm script;

[0133] (3)perl_set$url_check check::handler:

[0134] Indicates that the handler function in the package named check is redefined as the $url_check function in Nginx for internal calls by Nginx;

[0135] (4) server means creating a web service in Nginx, listen defines the listening port of the server, and location / res means the virtual directory of the server providing resources to the outside world is / res

[0136] (5) alias represents the request for the virtual directory / res, which is forwarded to the corresponding 'target folder';

[0137] (6) $url_check means that the request for the virtual directory / res is handed over to the $url_check function for execution, that is, to the handler function in the check.pm script for execution;

[0138] (7) If the handler function in the check.pm script returns 0 when processing the request for the / res virtual directory in Nginx (i.e., the signature verification process), it means that the Perl script fails to verify the signature, and Nginx returns a 403 resource unavailable response; otherwise, Nginx believes that the Perl script has passed the signature verification, and Nginx continues to forward the request for the / res virtual directory to the corresponding 'target folder' and returns the corresponding file.

[0139] Step S32: Nginx forwards the received URL request to the Perl script, and the Perl script performs URL signature verification.

[0140] That is, Nginx uses the called Perl script to perform signature verification on the URL request. The specific process is described as follows:

[0141] The Perl script extracts the signature Sign from the URL request (according to the signature generation process, the format of Sign should be "Key1-T1-Key2"), and determines whether the format of the signature Sign satisfies "Key1-T1-Key2". If not, the URL signature verification fails; otherwise, T1, Key1, and Key2 are checked in turn. If all pass the verification, the URL signature verification passes. To determine whether the format of the signature Sign satisfies "Key1-T1-Key2", the corresponding Perl script is:

[0142]

[0143] In step S32, T1, Key1, and Key2 are checked in sequence, and the following is executed:

[0144] Step S321: The Perl script extracts T1 from the signature Sign, converts the current time of the server into "the number of seconds since a fixed reference date (such as January 1, 1970)" (i.e., $serverTime), and subtracts it from T1 (i.e., $clientTime). If the result exceeds the valid time (such as 10 minutes), the URL verification signature fails; otherwise, proceed to the next step of verification.

[0145] The corresponding Perl script is:

[0146]

[0147] like:

[0148] The server time is 2023-12-2609:15:26, so $serverTime = 1703553326.

[0149] $differentTime=1703553326-1703553306=20 (seconds), which means the valid time has not been exceeded, and the next step of verification is continued.

[0150] Step S322: The Perl script intercepts " / path / filename" from the URL request as the string PS1, reverses the string PS1 and takes the MD5 digest to obtain PKey1; if PKey1 is not the same as Key1 in the signature Sign, the URL verification signature fails; otherwise, proceed to the next step of verification.

[0151] The corresponding Perl script is:

[0152]

[0153] like:

[0154] $filePath= / res / EU / image / 2020 / 6 / 018250528.JPG,

[0155] $reversePath=GPJ.825052810 / 6 / 0202 / egami / UE / ser / ,

[0156] $PKey1=bf3cb733f53a4d1b891cabb31ecdd2d1,

[0157] Because Key1 = bf3cb733f53a4d1b891cabb31ecdd2d1, PKey1 is equal to Key1 at this time, so the verification here passes and proceed to the next step of verification.

[0158] Step S323: The Perl script sequentially concatenates T1, PKey1 and the custom secret key PSecret in the Perl script to obtain a string PS2; takes the MD5 digest of the string PS2 to obtain PKey2; if PKey2 is not the same as Key2 in the signature Sign, the URL verification signature fails; otherwise, the URL verification signature passes.

[0159] The custom key PSecret in the Perl script is the same as the custom key Secret on the client.

[0160] The corresponding Perl script is:

[0161]

[0162] like:

[0163] $PS2=1703553306bf3cb733f53a4d1b891cabb31ecdd2d1ABCDE,

[0164] $PKey2=5643a894bc95bd182f8857e012fce69a,

[0165] Since Key2 = 5643a894bc95bd182f8857e012fce69a, PKey2 is equal to Key2, so the verification succeeds.

[0166] Step S33: The Perl script forwards the return value corresponding to the URL signature verification result to Nginx. If the URL signature verification fails, the return value is 0; if the URL signature verification passes, the return value is 1.

[0167] Step S34: If Nginx receives 0, it returns a resource inaccessible status code (403) to the client; if Nginx receives 1, it responds normally to the target folder of the URL request and returns a success status code (200).

[0168] The Nginx configuration corresponding to step S33 and step S34 is:

[0169]

[0170] The flow chart for verifying the signature is as follows Figure 3 shown.

[0171] In summary, the signature verification method based on the domestic operating system provided in the embodiment of the present invention is to install and start Nginx and Perl modules in the installation environment of the domestic operating system, create a Perl script for implementing URL signature verification; and after receiving the URL request from the client, Nginx calls the Perl script to perform URL signature verification on the URL request, and responds to the URL request from the client according to the URL signature verification result. Thus, URL verification is implemented by using the software provided by the domestic operating system, which well solves the problem of the lack of using the software provided by the domestic operating system to implement URL verification in the prior art.

[0172] At the same time, the embodiment of the present invention also optimizes the specific process of generating and verifying signatures, effectively improving the difficulty of signature cracking and effectively solving the problem of file anti-swiping.

[0173] In addition, in the embodiment of the present invention, Nginx calls a Perl script to perform URL signature verification on the URL request, thereby realizing signature verification in the domestic operating system, expanding the functions of the domestic operating system, avoiding dependence on some software, and having strong practicality.

[0174] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0175] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A signature verification method based on a domestic operating system, characterized in that: The method comprises: The client generates a corresponding URL containing a signature based on the file URL that does not contain a signature; Using the domestic operating system as the server, install and start Nginx and Perl modules in the installation environment of the domestic operating system, and create a Perl script for implementing URL signature verification; the Perl script is written outside Nginx, and the Nginx configuration file only references the Perl script and calls the function of the Perl script; Nginx in the server receives a URL request from a client, where the URL request is a URL containing a signature; Nginx calls a Perl script to perform URL signature verification on the URL request, and responds to the URL request from the client according to the URL signature verification result; The format of the file URL without signature is: network protocol: / / host:port / path / file name; the client generates a corresponding URL with signature according to the file URL without signature, and executes: Extract " / path / filename" from the file URL that does not contain the signature as string S1, reverse string S1 and take the MD5 digest to get Key1; Get the number of seconds since the fixed reference date as T1, which is used as the timestamp for generating the URL; Sequentially concatenate T1, key1, and the client-defined secret key Secret to obtain string S2; take the MD5 digest of string S2 to obtain Key2; Use "-" to sequentially connect Key1, T1 and Key2 to get the URL signature Sign; Generate the corresponding URL containing the signature, expressed as: network protocol: / / host:port / path / filename?Sign; The Nginx calls the Perl script to perform signature verification on the URL request and executes: Nginx forwards the received URL request to the Perl script, which verifies the URL signature. The Perl script extracts the signature from the URL request and determines whether the format of the signature satisfies "Key1-T1-Key2". If not, the URL signature verification fails. Otherwise, T1, Key1, and Key2 are checked in sequence. If all of them pass, the URL signature verification passes. The Perl script forwards the return value corresponding to the URL signature verification result to Nginx. If the URL signature verification fails, the return value is 0; if the URL signature verification passes, the return value is 1; The following checks are performed in turn: T1, Key1, Key2: The Perl script extracts T1 from the signature Sign, converts the current time of the server into "seconds since the fixed reference date" and subtracts it from T1. If the result exceeds the valid time, the URL signature verification fails; otherwise, proceed to the next step of verification; The Perl script intercepts " / path / filename" from the URL request as string PS1, reverses string PS1 and takes MD5 digest to get PKey1; if PKey1 is different from Key1 in the signature Sign, the URL signature verification fails; otherwise, proceed to the next step of verification; The Perl script sequentially concatenates T1, PKey1, and the custom secret key PSecret in the Perl script to obtain the string PS2; the MD5 digest of the string PS2 is taken to obtain PKey2; if PKey2 is different from the Key2 in the signature Sign, the URL verification signature fails; otherwise, the URL verification signature passes; The custom key PSecret in the Perl script is the same as the custom key Secret on the client.

2. The signature verification method based on a domestic operating system according to claim 1 is characterized in that: The method responds to the client's URL request based on the URL signature verification result and executes: If Nginx receives 0, it returns a resource unavailable status code to the client; If Nginx receives 1, it responds normally to the target folder of the URL request and returns a success status code.

3. The signature verification method based on a domestic operating system according to claim 1 or 2, characterized in that: In the installation environment of the domestic operating system, install and start the Nginx and Perl modules, and execute: Check whether the components that Nginx depends on are installed; If the components that Nginx depends on are not installed, install the missing components and then install Nginx; otherwise, install Nginx directly; Start Nginx; Among them, Nginx has a built-in Perl module.

4. The signature verification method based on a domestic operating system according to claim 3 is characterized in that: To create a Perl script for implementing URL signature verification, execute: Write the check.pm file as a Perl script. When writing the check.pm file: Encapsulate the check.pm file into a package named check for Nginx to call; Configure the check.pm file to call the parameters in the Nginx request.

5. The signature verification method based on the domestic operating system according to claim 4 is characterized in that: The Perl script created to implement URL signature verification also executes: In check.pm, define internal variables of the Perl script to carry Nginx requests, and define a function named handler for Nginx to call; the handler function returns the URL signature verification result.

6. The signature verification method based on a domestic operating system according to claim 5 is characterized in that: Nginx calls the Perl script in the following way: Nginx loads the perl module; Deploy a Perl script for implementing URL signature verification; Nginx configuration file that calls the Perl script for URL signature verification.

7. The signature verification method based on a domestic operating system according to claim 6 is characterized in that: The domestically produced operating system is the domestically produced KylinV10-SP1_ARM version.

Images