Software verification method, device and system and storage medium

Abstract

The invention provides a software verification method, device and system and a storage medium, relates to the field of software security, and is used for solving the problem that the security of software downloaded by a user is difficult to guarantee. The method is applied to user equipment. In the method, user equipment acquires target software from a software repository. And the user equipment obtains software identification information of the target software based on the identification storage information of the target software. The software identification information is used for verifying the integrity of the software, and the identification storage information is used for indicating the mode of storing the software identification information. The software identification information is stored in at least one of the following modes: storage in identification management equipment and storage in a software warehouse. The user equipment verifies the target software based on the software identification information of the target software to generate a verification result, and the verification result is used for indicating whether the target software is complete or not.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a software verification method, device, system and storage medium. Background Art

[0002] With the rapid development of information technology, software is increasingly used in various fields. However, software security is related to the security of user data and the stable operation of the system. If the software downloaded by the user is tampered with, it may be used to execute malicious code, causing damage to the information system and affecting the user experience. Therefore, how to ensure the security of the software downloaded by users has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] The present application provides a software verification method, device, system and storage medium, which are used to solve the problem that the security of software downloaded by users is difficult to ensure.

[0004] In order to achieve the above purpose, this application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a software verification method, which is applied to a user device. In the method, the user device obtains the target software from the software warehouse. The user device obtains the software identification information of the target software based on the identification storage information of the target software. The software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate the way of storing the software identification information. The way of storing the software identification information includes at least one of the following: storing in an identification management device and storing in a software warehouse. The user device verifies the target software based on the software identification information of the target software and generates a verification result, which is used to indicate whether the target software is complete.

[0006] Based on the above technical solution, the user device obtains the target software from the software warehouse. The user device obtains the software identification information of the target software based on the identification storage information of the target software. The software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate the way of storing the software identification information. The way of storing the software identification information includes at least one of the following: storing in an identification management device and storing in a software warehouse. The user device verifies the target software based on the software identification information of the target software and generates a verification result, and the verification result is used to indicate whether the target software is complete. In this way, by verifying the integrity of the target software through the software identification information, the security of the software downloaded by the user can be guaranteed.

[0007] In one possible design, the user device determines a method for obtaining the software identification information based on the identification storage information of the target software. The acquisition method is to obtain from the identification management device or from the developer device. The user device obtains the software identification information of the target software based on the acquisition method.

[0008] In one possible design, when the identification storage information is used to indicate that the software identification information is stored in the developer's device, the software identification information is signed software identification information. If the signed software identification information is successfully verified, the user device obtains the verified software identification information.

[0009] In a possible design, the software identification information includes: a first type of identification and / or a second type of identification. The first type of identification is used to verify the software installation package of the software, and the second type of identification is used to verify the executable program corresponding to the installed software.

[0010] In a possible design, the software identification information further includes: a third type of identification. The third type of identification is used to indicate the operation and maintenance status of the software.

[0011] In a second aspect, the present application provides a software verification method, which is applied to an identification management device. In the method, the identification management device obtains the software identification information of the target software, and the software identification information is used to verify the integrity of the software. The identification management device receives the identification storage information sent by the developer device, and the identification storage information is used to indicate the way of storing the software identification information. The way of storing the software identification information includes at least one of the following: storing in the identification management device and storing in the software warehouse. The identification management device stores the software identification information based on the identification storage information.

[0012] In one possible design, the identification management device receives software identification information sent by the developer device. Alternatively, the identification management device receives a software data packet of the target software sent by the developer device. The identification management device processes the software data packet to generate software identification information.

[0013] In one possible design, if the identification storage information is used to indicate storage in an identification management device, the identification management device stores the software identification information in the identification management device. If the identification storage information is used to indicate storage in a software warehouse, the identification management device signs the software identification information and sends a first storage message to the developer device, the first storage message is used to indicate storage of the signed software identification information, and the first storage message includes: the signed software identification information, or the target software storing the signed software identification information.

[0014] In a possible design, the software identification information includes: a first type of identification and / or a second type of identification. The first type of identification is used to verify the software installation package of the software, and the second type of identification is used to verify the executable program corresponding to the installed software.

[0015] In a possible design, if the identification management device does not store the first type identification of the target software or the second type identification of the target software, the identification management device stores the software identification information based on the identification storage information.

[0016] In a possible design, if the identification management device stores the first type identification of the target software and the second type identification of the target software, the identification management device does not store the software identification information.

[0017] In a third aspect, the present application provides a software verification method, which is applied to a software verification system. The software verification system includes: an identification management device, a user device, and a software warehouse. In this method, the identification management device obtains the software identification information of the target software, and the software identification information is used to verify the integrity of the software. The identification management device receives the identification storage information sent by the developer device, and stores the software identification information based on the identification storage information. The user device obtains the target software from the software warehouse, and obtains the software identification information of the target software from the software warehouse or the identification management device. The user device verifies the target software based on the software identification information of the target software and generates a verification result, which is used to indicate whether the target software is complete.

[0018] In a fourth aspect, the present application provides a software verification system, which includes: an identification management device, a user device, and a software warehouse. The identification management device is used to obtain software identification information of the target software, and the software identification information is used to verify the integrity of the software. The identification management device is also used to receive identification storage information sent by the developer device, and store the software identification information based on the identification storage information. The user device is used to obtain the target software from the software warehouse, and obtain the software identification information of the target software from the software warehouse or the identification management device. The user device is also used to verify the target software based on the software identification information of the target software and generate a verification result, and the verification result is used to indicate whether the target software is complete.

[0019] In a fifth aspect, the present application provides a software verification device, which is applied to a user device, and the device includes an acquisition module and a processing module.

[0020] The acquisition module is used to obtain the target software from the software warehouse. Based on the identification storage information of the target software, the software identification information of the target software is obtained. The software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate the way of storing the software identification information. The way of storing the software identification information includes at least one of the following: storing in an identification management device, storing in a software warehouse. The processing module is used to verify the target software based on the software identification information of the target software, and generate a verification result, and the verification result is used to indicate whether the target software is complete.

[0021] In one possible design, the acquisition module is also used for the user device to determine a method for acquiring the software identification information based on the identification storage information of the target software, where the acquisition method is to acquire the software identification information from the identification management device or from the developer device. The user device acquires the software identification information of the target software based on the acquisition method.

[0022] In one possible design, when the identification storage information is used to indicate that the software identification information is stored in the developer's device, the software identification information is signed software identification information. The processing module is also used to, if the signed software identification information is successfully verified, the user device obtains the verified software identification information.

[0023] In one possible design, the software identification information includes: a first type of identification and / or a second type of identification, the first type of identification is used to verify the software installation package of the software, and the second type of identification is used to verify the executable program corresponding to the installed software.

[0024] In a possible design, the software identification information also includes: a third type of identification, which is used to indicate the operation and maintenance status of the software.

[0025] In a sixth aspect, the present application provides a software verification device, which is applied to a software identification device. The device includes an acquisition module and a processing module.

[0026] The acquisition module is used for the identification management device to obtain the software identification information of the target software, and the software identification information is used to verify the integrity of the software. The processing module is used for the identification management device to receive the identification storage information sent by the developer device. The identification storage information is used to indicate the way of storing the software identification information, and the way of storing the software identification information includes at least one of the following: storing in the identification management device and storing in the software warehouse. The identification management device stores the software identification information based on the identification storage information.

[0027] In one possible design, the acquisition module is also used to identify that the management device receives software identification information sent by the developer device. Alternatively, the management device receives a software data packet of the target software sent by the developer device. The processing module is also used to identify that the management device processes the software data packet to generate software identification information.

[0028] In one possible design, the processing module is further configured to, if the identification storage information is used to indicate storage in the identification management device, the identification management device stores the software identification information in the identification management device. If the identification storage information is used to indicate storage in the software warehouse, the identification management device signs the software identification information and sends a first storage message to the developer device, the first storage message is used to indicate storage of the signed software identification information, and the first storage message includes: the signed software identification information, or the target software storing the signed software identification information.

[0029] In one possible design, the software identification information includes: a first type of identification and / or a second type of identification, the first type of identification is used to verify the software installation package of the software, and the second type of identification is used to verify the executable program corresponding to the installed software.

[0030] In one possible design, the processing module is also used to store the software identification information based on the identification storage information if the identification management device does not store the first type of identification of the target software or the second type of identification of the target software.

[0031] In a possible design, the processing module is also used for not storing the software identification information in the identification management device if the identification management device stores the first type of identification of the target software and the second type of identification of the target software.

[0032] In the seventh aspect, the present application provides a software verification device, which includes: a processor and a memory; the processor and the memory are coupled; the memory is used to store one or more programs, and the one or more programs include computer execution instructions. When the user device is running, the processor executes the computer execution instructions stored in the memory to implement the method described in the first aspect and the third aspect, and any possible implementation of the first aspect and the third aspect.

[0033] In an eighth aspect, the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the method described in any possible implementation of the first and third aspects above.

[0034] In a ninth aspect, the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement a method as described in any possible implementation of the first and third aspects.

[0035] In a tenth aspect, the present application provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to execute the method described in any possible implementation of the first and third aspects above.

[0036] In the above scheme, the technical problems that can be solved by the software verification device, software verification system, computer equipment, computer storage medium, chip or computer program product and the technical effects achieved can be referred to the technical problems and technical effects solved by the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1A system architecture diagram of a software verification system provided in an embodiment of the present application;

[0038] Figure 2 A flowchart of a software verification method provided in an embodiment of the present application;

[0039] Figure 3 A flowchart of another software verification method provided in an embodiment of the present application;

[0040] Figure 4 A flowchart of a software verification method provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of the structure of a software verification device provided in an embodiment of the present application;

[0042] Figure 6 A schematic diagram of the structure of another software verification device provided in an embodiment of the present application;

[0043] Figure 7 A schematic diagram of the structure of another software verification device provided in an embodiment of the present application;

[0044] Figure 8 A conceptual partial view of a computer program product provided for an embodiment of the present application. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] The terms “first” and “second” in the description and claims of the present application are used to distinguish different objects rather than to describe a specific order of the objects.

[0047] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not limited to the listed steps or modules, but may optionally include other steps or modules that are not listed, or may optionally include other steps or modules that are inherent to these processes, methods, products or devices.

[0048] In addition, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present concepts in a specific way.

[0049] With the rapid development of information technology, software is increasingly used in various fields. However, software security is related to the security of user data and the stable operation of the system. Once the software downloaded by the user is tampered with, it may be used to execute malicious code, causing damage to the information system and affecting the user experience.

[0050] At present, common software integrity protection technologies include integrity verification based on hash algorithms, code signing based on the public key infrastructure (PKI) system, and software protection based on trusted platform module (TPM) hardware. Among them, integrity verification based on hash algorithms can only check whether the software has been tampered with during the distribution and transmission process, and requires the user to actively initiate a check. Code signing based on the PKI system requires manual review by a third party, and the verification cost is relatively high. Software protection based on TPM hardware requires the device to support TPM hardware, and its versatility is poor. Therefore, how to ensure the security of software downloaded by users has become a technical problem that needs to be solved urgently.

[0051] In view of the technical problems pointed out in the background technology section of this application, an embodiment of this application provides a software verification method. In this method, a user device obtains the target software from a software warehouse. The user device obtains the software identification information of the target software based on the identification storage information of the target software. The software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate the way of storing the software identification information. The way of storing the software identification information includes at least one of the following: storing in an identification management device and storing in a software warehouse. The user device verifies the target software based on the software identification information of the target software and generates a verification result, and the verification result is used to indicate whether the target software is complete. The software identification information is obtained through the identification storage information of the target software, and the integrity of the target software is verified to generate a verification result. In this way, the software identification information can be uniformly managed to achieve the effect of automated auditing, and there is no special hardware requirement. It is suitable for various integrity verification scenarios and can ensure the security of software downloaded by users.

[0052] The implementation environment of the embodiments of the present application is introduced below.

[0053] like Figure 1As shown, a software verification system provided by an embodiment of the present application includes: a developer device 101, an identification management device 102, a user device 103, and a software warehouse 104. The developer device 101 can be wirelessly connected to the identification management device 102; the identification management device 102 can be wirelessly connected to the user device 103; the user device 103 can be wirelessly connected to the software warehouse 104; and the software warehouse 104 can be wirelessly connected to the developer device 101.

[0054] The developer device 101 is used to develop software. In addition, the developer device 101 can also be used to upload software data to the identification management device, so that the identification management device 102 can generate software identification information based on the software data, and the software identification information is used to perform integrity verification on the software. The developer device 101 can also be used to transmit the developed software to the software warehouse 104.

[0055] The identification management device 102 can receive the software data sent by the developer device 101 to obtain the software identification information of the target software. For example, the software data can be the software identification information or the software data packet. The identification management device 102 can verify the software identification information to determine whether to store the software identification information. In addition, the identification management device 102 can also receive the identification storage information sent by the developer device 101 to store the software identification information.

[0056] The user device 103 is used to obtain the target software from the software warehouse. In addition, the user device 103 can also install and run the target software.

[0057] The software warehouse 104 is used to store software. For example, the software warehouse 104 can store software, and can also store software and software identification information. For example, the software warehouse 104 can store the completed software transmitted by the developer device 101. In addition, the software warehouse 104 can distribute software, and can also distribute software and software identification information.

[0058] Exemplarily, the developer device 101 and user device 103 in the embodiments of the present application may be tablet computers, mobile phones, desktop computers, laptop computers, handheld computers, notebook computers, ultra-mobile personal computers (UMPCs), netbooks, and the like. The embodiments of the present application do not impose any special restrictions on the specific forms of the developer device 101 and user device 103.

[0059] The identification management device 102 and the software warehouse 104 in the embodiment of the present application may be a server. The server may be a physical server or a cloud server. The server may be a single server, or a server cluster consisting of multiple servers. In some implementations, the server cluster may also be a distributed cluster. The present disclosure does not limit the specific implementation of the server.

[0060] In some embodiments, the system further includes: a verification device 105. The verification device 105 can obtain identification storage information from the target software to obtain software identification information of the target software. In addition, the verification device 105 can verify the target software through the software identification information to obtain a verification result.

[0061] It should be noted that the verification device 105 and the user device 103 may be the same device. Alternatively, the verification device 105 and the user device 103 may be different devices. This embodiment of the present application is not limited to this. The following takes the verification device 105 and the user device 103 as the same device as an example to introduce the embodiment of the present application.

[0062] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0063] like Figure 2 As shown, a software verification method provided by an embodiment of the present application includes:

[0064] S201. A user device obtains target software from a software warehouse.

[0065] The software warehouse may store software or software identification information of the software.

[0066] It should be noted that after the developer has developed the software, he or she can upload the software to the software warehouse so that users can download the software from the software warehouse.

[0067] In a possible implementation, the user device may send a software download request to the software warehouse, where the software download request is used to request downloading of the target software. Afterwards, the software warehouse may send the target software to the user device in response to the software download request.

[0068] S202: The user device obtains software identification information of the target software based on the identification storage information of the target software.

[0069] The identification storage information is used to indicate the method of storing the software identification information, and the method of storing the software identification information includes at least one of the following: storing in an identification management device, storing in a software warehouse. The software identification information is used to verify the integrity of the software.

[0070] In some embodiments, the user device determines a method for acquiring the software identification information based on the identification storage information of the target software. The acquisition method is to acquire the software identification information from the identification management device or from the developer device. The user device acquires the software identification information of the target software based on the acquisition method.

[0071] In a possible implementation, when the identification storage information is used to indicate that the software identification information is stored in the identification management device, the user device may send a first query request to the identification management device via a wireless network, and the first query request is used to request to query the software identification information of the target software. In response to the first query request, the identification management device may obtain the software identification information of the target software and send the software identification information of the target software to the user device.

[0072] Optionally, the first query request includes a software name of the target software. The identification management device stores a correspondence between the software name and the software identification information.

[0073] In another possible implementation, when the identification storage information is used to indicate that the software identification information is stored in the software warehouse, the software identification information is signed software identification information. Furthermore, when the identification storage information is used to indicate that the software identification information is stored in the software warehouse, the software identification information may be stored in the software, or the software identification information may be associated with the software.

[0074] In the embodiment of the present application, when the identification storage information is used to indicate that the software identification information is stored in the software, the user device can obtain the target software storing the software identification information. When the identification storage information is used to indicate that the software identification information can establish an association relationship with the software, the user device can obtain the target software and the software identification information of the target software.

[0075] Afterwards, the user device can verify the signed software identification information. If the signed software identification information is successfully verified, the user device obtains the verified software identification information.

[0076] The signed software identification information is used to verify whether the software identification information is complete.

[0077] It should be noted that the software identification device signs the software identification information with a private key and stores the public key on the software identification device. The user device obtains the public key from the identification management device and verifies the signed software identification information. If the verification is successful, it means that the software identification information has not been tampered with and is safe. If the verification is unsuccessful, it means that the software identification information is incomplete and there is a security risk.

[0078] S203: The user device verifies the target software based on the software identification information of the target software and generates a verification result.

[0079] The verification result is used to indicate whether the target software is complete.

[0080] In some embodiments, the software identification information includes: a first type of identification and / or a second type of identification, the first type of identification is used to verify the software installation package of the target software, and the second type of identification is used to verify the executable program corresponding to the installed target software.

[0081] Optionally, the first type of identifier may include at least one of the following: a hash value of the software, a unique value corresponding to the file format of a file in a data package of the software. For example, the first type of identifier may be a file hash value, or an AuthenticodePE Image Hash value in a PE format. The second type of identifier may be a unique value after the software is installed, such as a hash value corresponding to the software after installation.

[0082] It should be noted that the user device can perform integrity verification of the target software at any time after downloading the target software.

[0083] Optionally, the user equipment may verify the software installation package before the target software is installed, or may verify the executable program generated after the target software is installed.

[0084] In one possible implementation, the user device processes the software data packet through a hash algorithm to obtain a hash value of the software. If the obtained hash value is the same as the hash value in the software identification information, the software integrity verification passes, indicating that the target software has not been tampered with.

[0085] In another possible implementation, the user device processes the software data packet through a hash algorithm to obtain a hash value of the software. If the obtained hash value is different from the hash value in the software identification information, the software integrity verification passes, indicating that the target software has not been tampered with.

[0086] After the user device downloads the target software from the software warehouse, the first type of identification and the calculation method of the first type of identification can be obtained through the software identification information. The target software is recalculated using the calculation method of the first type of identification. If the result is the same as the first type of identification, the software integrity verification passes and the target software has not been tampered with. If the result is different from any item of the first type of identification, the software integrity verification fails and the target software has been tampered with.

[0087] In another possible implementation, after the user device downloads the target software from the software warehouse, the first type of identification, the second type of identification, the calculation method of the first type of identification, and the calculation method of the second type of identification can be obtained through the software identification information. After the software integrity check of the first type of identification passes, the user device installs the target software to obtain the installed target software and the executable program generated during the installation process. The executable program generated during the installation process is recalculated using the calculation method of the second type of identification. If the result is the same as the second type of identification, the software integrity verification passes and the target software has not been tampered with. If the result is different from any of the second type of identification, the software integrity verification fails and the target software has been tampered with.

[0088] In some embodiments, the software identification information also includes: a third type of identification. The third type of identification is used to indicate the operation and maintenance status of the target software. The third type of identification includes at least one of the following: anti-virus detection information of the software, software maintenance information, developer information, and signature information. The software maintenance information includes the environmental requirements and version information of the software. The anti-virus detection information is used to indicate the virus detection process of the software when the software is infected by a virus. The signature information is used to indicate whether the software is signed and the signing method of the software.

[0089] In a possible design, the first category identification and the second category identification can be stored in the first storage area, and the third category identification can be stored in the second storage area. The identification management device can establish an association relationship between the first category identification and the second category identification and the third category identification. Furthermore, when the first category identification and the second category identification remain unchanged, the identification management device can update the third category identification.

[0090] In this way, the user device can use the third type of identification to check whether the version information of the target software meets the requirements, check whether the target software is compatible with the local environment, and realize the operation and maintenance management of the target software.

[0091] Based on the above technical solution, the user device obtains the target software from the software warehouse. The user device obtains the software identification information of the target software based on the identification storage information of the target software. The software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate the way of storing the software identification information. The way of storing the software identification information includes at least one of the following: storing in an identification management device, storing in a software warehouse; the user device verifies the target software based on the software identification information of the target software, generates a verification result, and the verification result is used to indicate whether the target software is complete. In this way, the security of the software downloaded by the user can be guaranteed.

[0092] like Figure 3 As shown, a software verification method provided by an embodiment of the present application includes:

[0093] S301: The identification management device obtains software identification information of the target software.

[0094] Among them, the software identification information is used to verify the integrity of the software.

[0095] In an embodiment of the present application, the identification management device can directly receive the software identification information sent by the developer device, or it can process the software data packet of the target software sent by the developer device to generate the software identification information of the target software.

[0096] In a possible implementation, the developer device may send software identification information of the target software, and the identification management device receives the software identification information sent by the developer device.

[0097] That is to say, the identification management device does not need to generate software identification information, and the developer device can directly send the software identification information, thereby reducing the data processing amount of the identification management device and reducing the load of the identification management device.

[0098] In another possible implementation, the developer device may send a software data packet of the target software, and the identification management device receives the software data packet of the target software sent by the developer device. The identification management device processes the software data packet and generates software identification information. The software identification information includes: a first type of identification and / or a second type of identification, the first type of identification is used to verify the software installation package of the target software, and the second type of identification is used to verify the executable program corresponding to the installed target software.

[0099] It should be noted that the embodiment of the present application does not limit the method of generating the first type identification and / or the second type identification. For example, the first type identification and / or the second type identification can be obtained by performing data processing on the software data packet through a hash algorithm.

[0100] Optionally, the identification management device may process the software data packet to generate a third type of identification.

[0101] It should be noted that the embodiment of the present application does not limit the processing method of the software data package. For example, the software data package can be queried to obtain the third type of identification.

[0102] Optionally, the developer device can choose to upload in developer mode or in public mode.

[0103] In one possible implementation, the developer device selects developer mode to upload software. The user device can send first identity information to the identification management device, and the first identity information is used to verify that the user account logged in to the developer device is a developer. Afterwards, if the user account logged in to the developer device is a developer, the developer device can maintain the software identification information of the uploaded software. If the identification management device stores the first category identification of the target software or the second category identification of the target software, the developer device can delete the software identification information of the first software in the software identification device, or the developer device can add prompt information to the software identification information of the first software, and the prompt information is used to indicate that the first software has a security risk. The first software is software whose first category identification is the same as the first category identification of the target software, or the first software is software whose second category identification is the same as the second category identification of the target software. In addition, the first software is software uploaded through the public mode.

[0104] It should be noted that public mode uploading means that any user can upload the software identification information of the software to the identification management device through the developer device.

[0105] That is to say, in the implementation of this application, the software identification information in the identification management device can be managed through the developer mode, and software similar to the software uploaded through the developer mode can be processed, thereby improving the security of the software.

[0106] S302: The identification management device receives identification storage information sent by the developer device.

[0107] The identification storage information is used to indicate a method for storing the software identification information. The method for storing the software identification information includes at least one of the following: storing in an identification management device, storing in a software warehouse.

[0108] In a possible design, the identification storage information is used to indicate storage in an identification management device, and the identification management device directly stores the software identification information in the identification management device.

[0109] In another possible design, the identification storage information is used to indicate storage in a software warehouse, and the identification management device signs the software identification information and sends the signed software identification information to the developer device, or sends the target software carrying the signed software identification information to the developer device.

[0110] In a possible design, there are multiple target software, the multiple target software have an association relationship, and the identification storage information is used to indicate that they are stored in the software warehouse. The identification management device can generate software identification information of multiple target software. Afterwards, the identification management device can splice the software identification information of the multiple target software into a software identification directory, which includes the software identification information of the multiple target software. Then, the identification management device can sign the software identification directory and send the signed software identification directory to the developer device.

[0111] Optionally, the software identification directory can be downloaded together with the target software, or can be downloaded separately.

[0112] S303: The identification management device stores the software identification information based on the identification storage information.

[0113] In a possible implementation, if the identification management device does not store the first type identification of the target software or the second type identification of the target software, the identification management device stores the software identification information based on the identification storage information.

[0114] That is to say, if the first type identification of the target software or the second type identification of the target software is not stored, it means that there is no identical software identification information. Therefore, the software identification information of the target software can be stored.

[0115] In some embodiments, if the identification management device stores the first type identification of the target software and the second type identification of the target software, the identification management device does not store the software identification information.

[0116] It can be understood that if the first type of identification and the second type of identification are the same, it means that the software identification information is the same, and the software identification information is not stored.

[0117] In the embodiment of the present application, after the identification management device stores the software identification information, the software identification information cannot be modified.

[0118] Exemplarily, the identification management device may store the software identification information in a Merkle Tree manner.

[0119] Based on the above technical solution, the identification management device obtains the software identification information of the target software, and the software identification information is used to verify the integrity of the software. The identification management device receives the identification storage information sent by the developer device, and the identification storage information is used to indicate the method of storing the software identification information. The method of storing the software identification information includes at least one of the following: storing in the identification management device and storing in the software warehouse. The identification management device stores the software identification information based on the identification storage information. In this way, by storing the software identification information in a unified manner, the software integrity verification can be made more convenient.

[0120] like Figure 4 As shown, a software verification method provided by an embodiment of the present application includes:

[0121] S401. The identification management device obtains software identification information of the target software, where the software identification information is used to verify the integrity of the software.

[0122] S402: The identification management device receives the identification storage information sent by the developer device, and stores the software identification information based on the identification storage information.

[0123] S403: The user device obtains the target software from the software warehouse, and obtains the software identification information of the target software from the software warehouse or the identification management device.

[0124] S404: The user device verifies the target software based on the software identification information of the target software and generates a verification result, where the verification result is used to indicate whether the target software is complete.

[0125] It should be noted that, for the specific description of S401, S402, S403 and S404, reference may be made to the introduction of S201, S202, S203, S301, S302 and S303 in the above embodiments, which will not be repeated here.

[0126] It can be understood that the identification management device obtains the software identification information of the target software, and the software identification information is used to verify the integrity of the software. The identification management device receives the identification storage information sent by the developer device, and stores the software identification information based on the identification storage information. The user device obtains the target software from the software warehouse, and obtains the software identification information of the target software from the software warehouse or the identification management device. The user device verifies the target software based on the software identification information of the target software and generates a verification result, which is used to indicate whether the target software is complete. In this way, by verifying the integrity of the target software through the software identification information, the security of the software downloaded by the user can be guaranteed.

[0127] The embodiments of the present application are introduced below in combination with specific examples (Example 1, Example 2 and Example 3).

[0128] Example 1: Developer device A has developed a software X. The upload mode selected by developer device A this time is developer mode upload. The developer can prove his identity to the identity management device, such as using the process of applying for an SSL certificate to prove the ownership of software X. Developer device A can use the full upload method to send the data packet of software X to the identity management device, such as sending it through the https protocol. Therefore, the developer needs to package software X and pass it to the identity management device in a secure way, such as using the https protocol.

[0129] After receiving software X, the identification management device selects a hash algorithm such as SHA-1, SHA-2, SHA-3, SM3, etc., and calculates the hash value hashVal of software X; then calculates the Authenticode PE Image Hash value of the software, represented as peHashVal; finally, the anti-virus engine is used to scan the software, and the result is represented as antiVirusResult. If you want to perform integrity checks after the software is installed, you can add the hash information of the installed files, such as the hash value program1HashVal of the installed file 1 and the hash value program2HashVal of the installed file 2. The identification management device uses the Merkle Tree method to store the software identification information, and this information is stored in a formatted manner, such as a JSON file.

[0130] In this embodiment, the software identification information stored in JSON format can be expressed as: {"Upload information": {"Upload mode": "Developer mode upload", "Uploader identity": "such as uploader name, email, company name, official website", "Upload behavior type": "Full upload"}, "Identification information": {"Unique identification information": [{"File hash algorithm": "SHA-1", "File hash value": "hashVal"}, {"Authenticode PE Image Hash algorithm": "SHA-1", "Authenticode PE Image Hash value": "peHashVal"}, {"Hash algorithm for installed files": "SHA-1", "Hash value for installed files": "program1HashVal"}, {"Hash algorithm for installed files": "SHA-1", "Hash value for installed files": "program2HashVal"}],"Additional identification information": [{"Anti-virus engine result": "antiVirusResult"}, {"Developer identity": "such as developer name, email address, company name, official website"}]}}.

[0131] The identification management device embeds the generated identification information into the software, such as placing it in the AttributeCertificate structure of the file. Then the software X with the identification information added is packaged and returned to the developer device A. The developer device A makes the version of the software public and distributes it, and the user device B downloads the software X.

[0132] User device B checks software X. Here, user device B acts as both a downloader and a verifier in the method architecture. User device B detects that software X contains embedded software identification information, and then reads and obtains them. User device B first verifies the digital signature, and then further parses and obtains the software identification information after the verification is correct. User device B recalculates each unique identification information in the software identification information. User device B first calculates the hashVal and Authenticode PE Image Hash of software X, and compares them with the values ​​in the embedded identification. If all items are consistent, it means that the software integrity verification has passed. If one item is inconsistent, it means that the software integrity has failed. At the same time, user device B checks the anti-virus engine results and developer identity in the additional identification information, and manually determines whether to take further actions on the software, such as installing it in the local environment.

[0133] User device B has determined that the software has not been tampered with and the source is reliable, so it installs software X in the local environment. During the installation process, executable programs of software X are generated in the local environment, such as program1 and program2. User device B parses and reads program1HashVal and program2HashVal in the unique identification information, and uses these post-installation file hash values ​​to verify the integrity of executable programs program1 and program2 generated by software installation at any time.

[0134] Example 2: Developer device A has developed a series of software X, Y, and Z. Developer device A has previously authenticated its identity to the identification management device, such as by using the process of applying for an SSL certificate to authenticate ownership of the series of software X, Y, and Z. Developer device A selects a suitable upload mode and upload behavior type, and stores the software identification information of X, Y, and Z in the identification management device. The software identification information corresponding to X, Y, and Z in the identification management device is represented as infoX, infoY, and infoZ. Developer device A applies to the identification management device for an identification directory, and the identification management device concatenates infoX, infoY, and infoZ into a file and signs it, and then sends the integrated and signed identification directory to developer device A. Developer device A can make the identification directory public on the official software website, or include it in the distribution process of X, Y, and Z.

[0135] User device B downloads software X, Y, and Z. Similar to the steps in Example 1, user device B checks the software integrity of X, Y, and Z. The software identification information from the identification management device used in the check is the identification directory that comes with the software distribution process.

[0136] After distributing software X, Y, and Z, developer device A discovers that software X has security issues, so it uploads the software identification information of the new version X' of X and stores it in the identification management device. Afterwards, developer device A updates the additional identification information of X stored in the identification management device, adds software maintenance information, points out that X has security issues, and recommends updating to X'.

[0137] Verification device C is the security management device of user device B. Verifier C performs a security check on the software installed locally on user device B. Verifier C obtains the latest software identification information of X from the identification management device, and finds the software maintenance information left by developer device A. It points out that X has security issues and recommends updating to X'.

[0138] Example 3: The developer device A develops a software Y. There is a software Y' on the market that is a modification of software Y. The modification of software Y will cause Y and Y' to have different file hash values, but the same Authenticode PEImage Hash value.

[0139] User device C uploads software Y' to the identity management device. Since uploading information with the same AuthenticodePE Image Hash value will be judged as duplicate submission, user device C chooses summary upload, and only fills in the file hash value in the unique identification information without adding the Authenticode PE Image Hash value. After the information of software Y' is uploaded and saved in the identity management device, user device B downloads software Y' and installs it locally after integrity verification.

[0140] Developer device A obtains software Y' through some means, and after checking, finds that although Y' and software Y have different file hash values, they have the same Authenticode PE Image Hash value. Developer device A has previously proved its identity to the identity management device, such as using the process of applying for an SSL certificate to prove ownership of software Y. Developer device A makes a request to the identity management device to add the illegal modification of the software to the software maintenance information of Y'.

[0141] Verification device C is the security management device of user device B. Verification device C performs a security check on software Y' installed locally on user device B. Verification device C obtains the latest software identification information of Y' from the identification management device, and finds the software maintenance information left by developer device A, indicating that Y' has security issues.

[0142] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. It is understandable that, in order to realize the above functions, the software verification device includes a hardware structure and / or software module corresponding to each function. Those skilled in the art should easily realize that, in combination with the software verification method steps of each example described in the embodiment disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0143] The embodiment of the present application also provides a software verification device. The software verification device can be an electronic device (server or terminal), or a CPU in the above electronic device, or a verification module in the above electronic device for correcting software, or a client in the above electronic device for correcting software.

[0144] The embodiment of the present application can divide the software verification device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

[0145] The present application embodiment provides a software verification device. Figure 5 As shown, the software verification device may include: an acquisition module 501 and a processing module 502.

[0146] The acquisition module 501 is used to acquire the target software from the software warehouse. The information is stored based on the identification of the target software. The acquisition module 501 is also used to acquire the software identification information of the target software. The software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate the way of storing the software identification information. The way of storing the software identification information includes at least one of the following: storing in an identification management device, storing in a software warehouse. The processing module 502 is used to verify the target software based on the software identification information of the target software, and generate a verification result, and the verification result is used to indicate whether the target software is complete.

[0147] The present application embodiment provides a software verification device. Figure 6 As shown, the software verification device may include: an acquisition module 601 and a processing module 602.

[0148] The acquisition module 601 is used to verify the target software based on the software identification information of the target software and generate a verification result, which is used to indicate whether the target software is complete; the acquisition module 601 is also used to receive the identification storage information sent by the developer device, the identification storage information is used to indicate the way of storing the software identification information, and the way of storing the software identification information includes at least one of the following: storing in the identification management device and storing in the software warehouse. The processing module 602 is used to store the software identification information based on the identification storage information.

[0149] Figure 7 7 is a schematic diagram showing the structure of a software verification device according to an exemplary embodiment. The software verification device may include a processor 702, and the processor 702 is used to execute application code to implement the software verification method in the present application.

[0150] The processor 702 may be a central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0151] like Figure 7 As shown, the software verification device may further include a memory 703. The memory 703 is used to store application program codes for executing the solution of the present application, and the execution is controlled by the processor 702.

[0152] The memory 703 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 703 may exist independently and be connected to the processor 702 via a bus 704. The memory 703 may also be integrated with the processor 702.

[0153] like Figure 7 As shown, the software verification device may further include a communication interface 701, wherein the communication interface 701, the processor 702, and the memory 703 may be coupled to each other, for example, via a bus 704. The communication interface 701 is used to exchange information with other devices, for example, to support information exchange between the software verification device and other devices.

[0154] It should be pointed out that Figure 7 The device structure shown in the figure does not constitute a limitation on the software verification device, except Figure 7 In addition to the components shown, the software verification device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0155] In actual implementation, the functions implemented by the processing unit can be Figure 7 The processor 702 shown calls the program code in the memory 703 to implement.

[0156] The present application also provides a computer-readable storage medium, on which instructions are stored, and when the instructions in the computer-readable storage medium are executed by a processor of a computer device, the computer is able to execute the software verification method provided in the above-mentioned embodiment. For example, the computer-readable storage medium may be a memory 703 including instructions, and the above instructions may be executed by a processor 702 of a computer device to complete the above method. Optionally, the computer-readable storage medium may be a non-temporary computer-readable storage medium, for example, a non-temporary computer-readable storage medium may be a ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0157] Figure 8 A conceptual partial view of a computer program product provided by an embodiment of the present application is schematically shown, where the computer program product includes a computer program for executing a computer process on a computing device.

[0158] In one embodiment, the computer program product is provided using a signal bearing medium 800. The signal bearing medium 800 may include one or more program instructions that, when executed by one or more processors, may provide the above-described Figure 2 , Figure 3 Thus, for example, reference to Figure 2 In the embodiment shown in , one or more features of S201 to S203 may be undertaken by one or more instructions associated with the signal bearing medium 800. In addition, Figure 8 The program instructions in also describe example instructions.

[0159] In some examples, the signal bearing medium 800 may include a computer readable medium 801, such as, but not limited to, a hard drive, a compact disk (CD), a digital video disk (DVD), a digital tape, a memory, a read-only memory (ROM) or a random access memory (RAM), and the like.

[0160] In some implementations, the signal bearing medium 800 may include a computer recordable medium 802 such as, but not limited to, a memory, a read / write (R / W) CD, a R / W DVD, or the like.

[0161] In some implementations, signal bearing medium 800 may include communication medium 803 such as, but not limited to, digital and / or analog communication media (eg, fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).

[0162] The signal bearing medium 800 may be communicated by a wireless form of communication medium 803. The one or more program instructions may be, for example, computer executable instructions or logic implemented instructions.

[0163] In some examples, the software verification apparatus may be configured to provide various operations, functions, or actions in response to one or more program instructions via computer-readable medium 801 , computer-recordable medium 802 , and / or communication medium 803 .

[0164] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0165] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0166] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0167] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0168] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the full classification part or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute the full classification part or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes various media that can store program codes, such as-U disk, mobile hard disk, ROM, RAM, disk or CD.

[0169] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A software verification method, characterized in that: Applied to user equipment, the method comprises: The user device obtains the target software from the software warehouse; The user device acquires the software identification information of the target software based on the identification storage information of the target software, wherein the software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate a method for storing the software identification information, wherein the method for storing the software identification information includes at least one of the following: storing in an identification management device, or storing in the software warehouse; The user equipment verifies the target software based on the software identification information of the target software and generates a verification result, where the verification result is used to indicate whether the target software is complete.

2. The method according to claim 1, characterized in that: The user device acquires the software identification information of the target software based on the identification storage information of the target software, including: The user device determines a method for acquiring the software identification information based on the identification storage information of the target software, wherein the acquisition method is acquiring from the identification management device or acquiring from a developer device; The user equipment acquires the software identification information of the target software based on the acquisition method.

3. The method according to claim 2, characterized in that In a case where the identification storage information is used to indicate that the software identification information is stored in the developer device, the software identification information is signed software identification information; The user device acquires the software identification information of the target software based on the acquisition method, including: If the signed software identification information is successfully verified, the user device obtains the verified software identification information.

4. The method according to any one of claims 1 to 3, characterized in that The software identification information includes: a first type of identification and / or a second type of identification, the first type of identification is used to verify the software installation package of the software, and the second type of identification is used to verify the executable program corresponding to the installed software.

5. The method according to claim 4, characterized in that The software identification information also includes: a third type of identification, and the third type of identification is used to indicate the operation and maintenance status of the software.

6. A software verification method, characterized in that: Applied to an identification management device, the method comprises: The identification management device obtains software identification information of the target software, and the software identification information is used to verify the integrity of the software; The identification management device receives identification storage information sent by the developer device, where the identification storage information is used to indicate a method for storing the software identification information, where the method for storing the software identification information includes at least one of the following: storing in the identification management device, or storing in the software warehouse; The identification management device stores the software identification information based on the identification storage information.

7. The method according to claim 6, characterized in that The identification management device obtains the software identification information of the target software, including: The identification management device receives the software identification information sent by the developer device; or, The identification management device receives a software data packet of the target software sent by the developer device; The identification management device processes the software data packet to generate the software identification information.

8. The method according to claim 6 or 7, characterized in that: The identification management device stores the software identification information based on the identification storage information, including: If the identification storage information is used to indicate storage in the identification management device, the identification management device stores the software identification information in the identification management device; If the identification storage information is used to indicate storage in the software warehouse, the identification management device signs the software identification information and sends a first storage message to the developer device, and the first storage message is used to indicate storage of the signed software identification information. The first storage message includes: the signed software identification information, or the target software storing the signed software identification information.

9. The method according to claim 6 or 7, characterized in that: The software identification information includes: a first type of identification and / or a second type of identification, the first type of identification is used to verify the software installation package of the software, and the second type of identification is used to verify the executable program corresponding to the installed software.

10. The method according to claim 9, characterized in that The identification management device stores the software identification information based on the identification storage information, including: If the identification management device does not store the first type identification of the target software or the second type identification of the target software, the identification management device stores the software identification information based on the identification storage information.

11. The method according to claim 10, characterized in that The method further comprises: If the identification management device stores the first type identification of the target software and the second type identification of the target software, the identification management device does not store the software identification information.

12. A software verification method, characterized in that: Applied to a software verification system, the software verification system includes: an identification management device, a user device, and a software warehouse; the method includes: The identification management device obtains software identification information of the target software, and the software identification information is used to verify the integrity of the software; The identification management device receives the identification storage information sent by the developer device, and stores the software identification information based on the identification storage information; The user device obtains the target software from the software warehouse, and obtains the software identification information of the target software from the software warehouse or the identification management device; The user equipment verifies the target software based on the software identification information of the target software and generates a verification result, where the verification result is used to indicate whether the target software is complete.

13. A software verification system, characterized in that: The software verification system includes: an identification management device, a user device, and a software warehouse; the identification management device is used to obtain software identification information of the target software, and the software identification information is used to verify the integrity of the software; The identification management device is further used to receive identification storage information sent by the developer device, and store the software identification information based on the identification storage information; The user device is used to obtain the target software from the software warehouse, and obtain the software identification information of the target software from the software warehouse or the identification management device; The user device is further used to verify the target software based on the software identification information of the target software and generate a verification result, where the verification result is used to indicate whether the target software is complete.

14. A software verification device, characterized in that: Applied to user equipment, including: The acquisition module is used to obtain the target software from the software warehouse; The acquisition module is further used to acquire the software identification information of the target software based on the identification storage information of the target software, wherein the software identification information is used to verify the integrity of the software, and the identification storage information is used to indicate the way of storing the software identification information, and the way of storing the software identification information includes at least one of the following: storing in an identification management device, and storing in the software warehouse; The processing module is used to verify the target software based on the software identification information of the target software and generate a verification result, wherein the verification result is used to indicate whether the target software is complete.

15. A software verification device, characterized in that: Applicable to identity management devices, including: An acquisition module, used to verify the target software based on the software identification information of the target software and generate a verification result, wherein the verification result is used to indicate whether the target software is complete; The acquisition module is further used to receive the identification storage information sent by the developer device, the identification storage information is used to indicate the way of storing the software identification information, and the way of storing the software identification information includes at least one of the following: storing in the identification management device, storing in the software warehouse; The processing module is used to store the software identification information based on the identification storage information.

16. A software verification device, characterized in that: include: Processor and memory; The processor is coupled to the memory; The memory is used to store one or more programs, and one or more of the programs include computer-executable instructions. When the software verification device is running, the processor executes the computer-executable instructions stored in the memory to enable the software verification device to perform the method as described in any one of claims 1-12.

17. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, characterized in that: When a computer executes the instruction, the computer performs the method according to any one of claims 1 to 12.

18. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 12.

Images