Software installation package signature method and system based on digital certificate state check

Abstract

The invention provides a software installation package signature method and system based on digital certificate state check. The method comprises the following steps: acquiring a user terminal equipment fingerprint and a user digital certificate which initiate a software installation package code signature request, and an organization digital certificate of an organization to which a user belongs; obtaining original data of the software installation package to be signed, adding the fingerprint, the timestamp and the CRL file of the user terminal equipment, and performing digital signature to obtain signature data of the software installation package; encrypting the original data of the software installation package by using a public key in the user digital certificate to obtain a digital envelope I, and encrypting the digital envelope I for the second time by using a public key in the organization digital certificate to obtain a digital envelope II; and packaging the digital envelope II and the signature data of the software installation package into a software installation release package. The invention aims to optimize the code signature process, implement strict state check and improve the security and reliability of code signature.

Description

Technical Field

[0001] This invention relates to the field of software signature verification technology, and specifically to a software installation package signing method and system based on digital certificate status checking. Background Technology

[0002] Software installation package code signing is an important technical means to ensure the trustworthiness and security of software. By implementing code signing, the identity of the software developer can be verified, and it can be ensured that the software has not been tampered with or damaged during transmission or storage.

[0003] The keys and certificates used for signing software installation package code are kept by the software developer. During the software release phase, the developer signs the software and sends the signed package and related signing information to the recipient. To ensure the security of code signing, developers need to properly manage their signing keys. If a key is discovered to be leaked or lost, it should be reported to the certificate authority immediately so that the key can be revoked in a timely manner, preventing others from using stolen keys to impersonate the developer and release malicious software. In this case, the code signing certificate needs to be declared to the software recipient that it has not been revoked by the certificate authority and is valid at the time of the signing operation. However, the above conventional methods can only ensure that the package is tamper-proof; any changes to the package, regardless of where it is distributed, will be detected by the system. But in practice, the following problems still exist: First, it cannot provide a strictly controlled software release process for a specific organization (such as an enterprise or unit), nor can it provide targeted installation and deployment services (such as software packages released only for a specific organization).

[0004] Second, it cannot provide a strictly controllable software release process for a specific installation and deployment personnel (such as an important system administrator), and cannot provide targeted installation and deployment services.

[0005] Third, it is impossible to release a dedicated, independent software installation package for a specific terminal (or a few specific terminals), and it is impossible to avoid the security risks caused by copying between different terminals.

[0006] Fourth, in offline mode, the software recipient may not be able to obtain the certificate's validity status in a timely manner.

[0007] Therefore, the above problems must be solved by enhancing code signing and verification mechanisms and system security to meet the targeted installation and deployment service requirements of software publishers and users. Summary of the Invention

[0008] Based on the above background, this invention provides a software installation package signing method and system based on digital certificate status checks, aiming to optimize the code signing process, implement strict status checks, and improve the security and reliability of code signing. Specifically, the following technical solution is adopted: The first aspect of this invention provides a software installation package signing method based on digital certificate status checking, comprising: Obtain the fingerprint of the user's terminal device and the user's digital certificate that initiated the software installation package code signing request, as well as the organization's digital certificate of the user's organization; Obtain the original data of the software installation package to be signed, and after adding the fingerprint, timestamp, and CRL file of the user terminal device, perform digital signing to obtain the software installation package signature data; The original data of the software installation package is encrypted using the public key in the user's digital certificate to obtain digital envelope one, and digital envelope one is encrypted a second time using the public key in the organization's digital certificate to obtain digital envelope two. The digital envelope is then encapsulated together with the software installation package signature data and packaged into the software installation and distribution package.

[0009] Furthermore, the process of encapsulating the digital envelope along with the software installation package signature data into the software installation and distribution package also includes: The trust chain, status query information, and timestamp are encapsulated together with the digital envelope and the software installation package signature data into the software installation and distribution package.

[0010] Furthermore, the process of encapsulating the digital envelope along with the software installation package signature data into the software installation and distribution package also includes: The software installation package may contain some or all of the following: basic data, description information, algorithm information, and verifiable certificate information.

[0011] Furthermore, the software installation package signing method also includes: The software installation package is distributed to the target organization's front-end service; The front-end service decrypts the received software installation and distribution package, decrypts digital envelope two based on the private key corresponding to the public key in the organization's digital certificate to obtain digital envelope one, and forwards digital envelope one and the software installation package signature data together to the target user terminal. The target user terminal decrypts the digital envelope based on the private key corresponding to the public key in the user's digital certificate to obtain the original data of the software installation package, and verifies the validity of the signature data of the software installation package based on the user terminal device fingerprint.

[0012] Furthermore, the verification of the validity of the software installation package signature data based on the user terminal device fingerprint includes: The first verification operation is performed on the signature data of the software installation package based on the digital certificate provided by the software publisher, and the operation result is one. The second signature verification operation is performed based on the original data of the software installation package and the fingerprint of the user terminal device collected locally, and the second operation result is obtained. If the first and second operation results are equal, the verification passes.

[0013] Furthermore, the verification of the validity of the software installation package signature data based on the user terminal device fingerprint also includes: The front-end service decrypts the received software installation and distribution package to obtain the trust chain, status query information, and timestamp, and then forwards it to the target user terminal. The target user terminal verifies the validity of the software installation package signature data based on the acquired trust chain, status query information, and timestamp.

[0014] Furthermore, the validity verification of the software installation package signature data based on the acquired trust chain, state query information, and timestamp includes: The CRL file is obtained based on the trust chain and state query information, and the timestamp is checked to see if it is within the valid time of the CRL, which includes thisUpdate and nextUpdate in the CRL file. Check if the current time during the verification process is between the timestamp and nextUpdate; If the timestamp is within the valid time of the CRL and the current time is between the timestamp and nextUpdate, then the verification passes.

[0015] Furthermore, the verification of the validity of the software installation package signature data based on the user terminal device fingerprint also includes: The front-end service decapsulates the received software installation package to obtain some or all of the following: basic data of the software installation package, description information, algorithm information, and verifiable certificate information, and forwards them to the target user terminal. The target user terminal verifies the validity of the software installation package signature data based on some or all of the acquired software installation package basic data, description information, algorithm information, and verifiable certificate information.

[0016] A second aspect of the present invention provides a software installation package signing system based on digital certificate status checking, used to perform the method described in the first aspect above, comprising: The code signing generation system is configured on the software development side and includes a first cryptographic module for generating software installation and distribution packages and distributing them to the target organization as a front-end service. The target organization's front-end service is equipped with a second cryptographic module, which is used to decrypt digital envelope two in the software installation and distribution package to obtain digital envelope one and the software installation package signature data, and forward digital envelope one and the software installation package signature data together to the target user terminal; The code signature verification system is configured on the user terminal and includes a third cryptographic module for decrypting the digital envelope to obtain the software installation package signature data, and for verifying the validity of the software installation package signature data based on the user terminal device fingerprint.

[0017] Furthermore, the code signing generation system is also used to encapsulate the trust chain, state query information, and timestamp together with the digital envelope and the software installation package signature data to generate a software installation and distribution package; The code signing verification system is also used to verify the validity of the software installation package signature data based on the acquired trust chain, status query information, and timestamp.

[0018] The beneficial effects of this invention include: 1) The solution of the present invention can enhance the security of code signing and verification, and can achieve strict control over the entire process of software package installation protection for specific organizations, specific operators, specific terminals, and specific time periods.

[0019] 2) The solution of the present invention embeds the certificate status information during code signing into the software installation and distribution package, so that the software recipient can easily verify the source and integrity of the software through this information.

[0020] 3) Using the solution of this invention, the software recipient does not need to personally visit the certificate authority to inquire about the certificate status information. This process simplifies the code signature verification process and enhances the applicability of code signature verification, enabling efficient operation even in offline standalone environments. Attached Figure Description

[0021] Figure 1 A flowchart illustrating an embodiment of the software installation package signing method of the present invention. Figure 1 .

[0022] Figure 2 This is a schematic diagram of the software installation and distribution package composition in an embodiment of the software installation package signing method of the present invention.

[0023] Figure 3 A flowchart illustrating an embodiment of the software installation package signing method of the present invention. Figure 2 .

[0024] Figure 4 This is a schematic diagram illustrating the composition of an embodiment of the software installation package signing system of the present invention. Detailed Implementation

[0025] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0026] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.

[0027] See Figure 1 The first embodiment of the present invention illustrates a software installation package signing method based on digital certificate status checking, comprising the following steps: S1. Obtain the fingerprint of the user terminal device that initiated the software installation package code signing request, the user's digital certificate, and the organization's digital certificate.

[0028] Specifically, the user terminal device fingerprint, user digital certificate, and organization digital certificate of the user's organization can be provided to the software developer by the user terminal that initiates the software installation package code signing request, for use in the subsequent signature verification process. The use of the user terminal device fingerprint and user digital certificate ensures that the subsequent software package installation operation is performed by specific personnel on specific devices, while the organization digital certificate ensures that the subsequent software package installation is executed within a specific organization (such as an enterprise or unit), thereby strengthening the security measures for software package signing and installation.

[0029] S2. Obtain the original data of the software installation package to be signed, and add the user terminal device fingerprint, timestamp, and CRL file before digitally signing to obtain the software installation package signature data.

[0030] Specifically, software publishers can digitally sign their software based on their own digital certificates and provide these certificates to user terminals for subsequent verification.

[0031] S3. Use the public key in the user's digital certificate to encrypt the original data of the software installation package to obtain digital envelope one, and use the public key in the organization's digital certificate to encrypt digital envelope one a second time to obtain digital envelope two.

[0032] Preferably, the above-mentioned digital envelope conforms to the digital envelope data type in Part 9 of the "GMT 0010-2012 SM2 cryptographic algorithm encrypted signature message syntax specification".

[0033] S4. Encapsulate the digital envelope along with the software installation package signature data into the software installation and distribution package.

[0034] As a further preferred embodiment, step S4 also includes: The trust chain, status query information, and timestamp are encapsulated together with the digital envelope and the software installation package signature data into the software installation and distribution package.

[0035] The trust chain and state query information includes the CRL publication point address and the CRL file obtained at the code signing time.

[0036] Timestamps are used to record the time of signature generation and the time of software release or update, which is crucial for tracking historical versions of software and verifying its timeliness. Preferably, timestamps conform to the "GB / T 20520-2006 Information Security Technology Public Key Infrastructure Timestamp Specification".

[0037] As a further preferred embodiment, step S4 also includes: The software installation package may contain some or all of the following: basic data, description information, algorithm information, and verifiable certificate information.

[0038] The basic data of the software installation package provides information such as the version, file type, and size of the software installation package.

[0039] The description information provides functional descriptions of the software installation package, environmental information, and metadata including developer comments, specific configuration data, or other additional information, which provides users with additional context about the software.

[0040] The algorithm information includes the signature algorithm and hash algorithm used, which ensure the security and immutability of the signature. Preferably, the signature algorithm conforms to GMT 0003.1-2012 SM2 Elliptic Curve Public Key Cryptography Algorithm; and the hash algorithm conforms to GMT 0004-2012 SM3 Cryptographic Hash Algorithm.

[0041] Verifiable certificate information includes personal certificates, the issuing authority of digital certificates for organizations, certificate serial numbers, certificate validity periods, and information about the certificate holder (such as organization name, individual name, etc.), as well as the public key used for signing. This information is used to verify the identity of the signer. Preferably, digital certificates conform to the "GMT 0015-2012 Digital Certificate Format Specification Based on SM2 Cryptographic Algorithm".

[0042] The above information can be used in the subsequent signature verification process. The specific usage method can be determined according to actual needs, and no specific restrictions are made here.

[0043] As a preferred embodiment, in this example, the complete software installation and distribution package consists of the following: Figure 2 As shown.

[0044] See Figure 3 The software installation package signing method in this embodiment also includes a verification process, specifically including: S5. A pre-service that distributes software installation packages to target organizations.

[0045] S6. The front-end service decrypts the received software installation and distribution package, decrypts digital envelope two based on the private key corresponding to the public key in the organization's digital certificate, obtains digital envelope one, and forwards digital envelope one and the software installation package signature data together to the target user terminal.

[0046] S7. The target user terminal decrypts the digital envelope one based on the private key corresponding to the public key in the user's digital certificate, obtains the original data of the software installation package, and verifies the validity of the software installation package signature data based on the user terminal device fingerprint.

[0047] In a preferred embodiment, step S7, verifying the validity of the software installation package signature data based on the user terminal device fingerprint, includes: The first verification operation is performed on the signature data of the software installation package based on the digital certificate provided by the software publisher, and the operation result is one. The second signature verification operation is performed based on the original data of the software installation package and the fingerprint of the user terminal device collected locally, and the second operation result is obtained. If result 1 and result 2 are equal, the verification passes. If the verification fails, the verification stops and a verification failure message is displayed.

[0048] As a further preferred implementation, step S7, verifying the validity of the software installation package signature data based on the user terminal device fingerprint, further includes: The front-end service decrypts the received software installation and distribution package to obtain the trust chain, status query information, and timestamp, and then forwards it to the target user terminal. The target user terminal verifies the validity of the software installation package signature data based on the obtained trust chain, status query information, and timestamp.

[0049] As a preferred implementation, the above-mentioned validity verification includes: The CRL file is obtained based on the trust chain and state query information, and the timestamp is checked to see if it is within the valid time of the CRL, which includes thisUpdate and nextUpdate in the CRL file. Check if the current time during the verification process is between the timestamp and nextUpdate; If the timestamp is within the valid time of the CRL and the current time is between the timestamp and nextUpdate, then the verification passes.

[0050] As a further preferred implementation, step S7, verifying the validity of the software installation package signature data based on the user terminal device fingerprint, further includes: The front-end service decrypts the received software installation package to obtain some or all of the basic data, description information, algorithm information, and verifiable certificate information of the software installation package, and forwards them to the target user terminal. The target user terminal verifies the validity of the software installation package signature data based on several or all of the acquired software installation package basic data, description information, algorithm information, and verifiable certificate information. The specific verification method can be determined according to actual needs and is not specifically limited here.

[0051] See Figure 4 The second embodiment of the present invention illustrates a software installation package signing system based on digital certificate status checking, used to execute the software installation package signing method shown in the first embodiment above, comprising: The code signing generation system is configured on the software development side and includes a first cryptographic module for generating software installation and distribution packages and distributing them to the target organization as a front-end service. The target organization's front-end service is equipped with a second cryptographic module, which is used to decrypt digital envelope two in the software installation and distribution package to obtain digital envelope one and the software installation package signature data, and forward digital envelope one and the software installation package signature data together to the target user terminal; The code signature verification system is configured on the user terminal and includes a third cryptographic module for decrypting the digital envelope to obtain the software installation package signature data, and for verifying the validity of the software installation package signature data based on the user terminal device fingerprint.

[0052] As a further preferred embodiment, in this embodiment, the code signing generation system is also used to encapsulate the trust chain, state query information, and timestamp together with the digital envelope and the software installation package signature data to generate a software installation and distribution package; Correspondingly, the code signing verification system is also used to verify the validity of the software installation package signature data based on the acquired trust chain, state query information, and timestamp.

[0053] The specific functions of the software installation package signing system in this embodiment can be implemented with reference to the methods shown in the foregoing embodiments, and will not be described in detail here.

[0054] It should be noted that the method of this embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this embodiment, and the multiple devices will interact with each other to complete the method described.

[0055] The embodiments of this invention are intended to cover all such substitutions, modifications, and variations falling within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this invention should be included within the protection scope of this invention.

Claims

1. A software installation package signing method based on digital certificate status check, characterized in that: include: Obtain the fingerprint of the user terminal device that initiated the software installation package code signing request, the user's digital certificate, and the organization digital certificate of the organization to which the user belongs; Obtain the original data of the software installation package to be signed, and add the user terminal device fingerprint, timestamp and CRL file to perform digital signing to obtain the software installation package signature data; Using the public key in the user digital certificate to encrypt the original data of the software installation package to obtain digital envelope 1, and using the public key in the organization digital certificate to encrypt digital envelope 1 for a second time to obtain digital envelope 2; The digital envelope 2 and the software installation package signature data are encapsulated into a software installation release package.

2. The software installation package signing method based on digital certificate status check according to claim 1, characterized in that: The step of encapsulating the digital envelope 2 together with the software installation package signature data into the software installation release package further includes: The trust chain, status query information and timestamp are encapsulated into a software installation release package together with the digital envelope 2 and the software installation package signature data.

3. The software installation package signing method based on digital certificate status check according to claim 2, characterized in that: The step of encapsulating the digital envelope 2 together with the software installation package signature data into the software installation release package further includes: Package some or all of the basic data, description information, algorithm information, and verifiable certificate information of the software installation package into the software installation release package.

4. The software installation package signing method based on digital certificate status check according to any one of claims 1 to 3, characterized in that: Also includes: A pre-service for publishing the software installation release package to the target organization; The front-end service unseals the received software installation release package, decrypts the digital envelope 2 based on the private key corresponding to the public key in the digital certificate of the organization, obtains the digital envelope 1, and forwards the digital envelope 1 and the software installation package signature data to the target user terminal; The target user terminal decrypts the digital envelope 1 based on the private key corresponding to the public key in the user digital certificate, obtains the original data of the software installation package, and verifies the validity of the signature data of the software installation package based on the user terminal device fingerprint.

5. The software installation package signing method based on digital certificate status check according to claim 4, characterized in that: The verification of the validity of the signature data of the software installation package based on the fingerprint of the user terminal device includes: Performing a first signature verification operation on the signature data of the software installation package based on the digital certificate provided by the software publisher to obtain operation result 1; Perform a second signature verification operation based on the acquired original data of the software installation package and the locally collected fingerprint of the user terminal device to obtain a second operation result; If the operation result one and the operation result two are equal, the verification passes.

6. The software installation package signing method based on digital certificate status check according to claim 5, characterized in that: The verification of the validity of the signature data of the software installation package based on the fingerprint of the user terminal device also includes: The front-end service unpacks the received software installation release package to obtain the trust chain, status query information and timestamp, and forwards it to the target user terminal; The target user terminal verifies the validity of the signature data of the software installation package based on the obtained trust chain, status query information and timestamp.

7. The software installation package signing method based on digital certificate status check according to claim 6, characterized in that: The verification of the validity of the software installation package signature data based on the obtained trust chain, status query information and timestamp includes: Obtain the CRL file based on the trust chain and status query information, and check whether the timestamp is within the validity period of the CRL, which includes thisUpdate and nextUpdate in the CRL file; Check if the current time when verification is performed is between the timestamp and nextUpdate; If the timestamp is within the validity period of the CRL and the current time is between the timestamp and nextUpdate, the verification passes.

8. The software installation package signing method based on digital certificate status check according to claim 6 or 7, characterized in that: The verification of the validity of the signature data of the software installation package based on the fingerprint of the user terminal device also includes: The front-end service decrypts the received software installation release package to obtain some or all of the basic data, description information, algorithm information, and verifiable certificate information of the software installation package, and forwards it to the target user terminal; The target user terminal verifies the validity of the signature data of the software installation package based on some or all of the acquired basic data, description information, algorithm information, and verifiable certificate information of the software installation package.

9. A software installation package signature system based on digital certificate status check, used to execute the method according to any one of claims 1 to 8, characterized in that: include: A code signature generation system, which is configured on the software development side and is configured with a first cryptographic module, is used to generate a software installation release package and publish it to the front-end service of the target organization; The front-end service of the target organization is configured with a second cryptographic module for decrypting the digital envelope 2 in the software installation release package to obtain the digital envelope 1 and the signature data of the software installation package, and forwarding the digital envelope 1 and the signature data of the software installation package to the target user terminal; The code signature verification system is configured in a user terminal and is equipped with a third cryptographic module for decrypting a digital envelope, obtaining software installation package signature data, and verifying the validity of the software installation package signature data based on the user terminal device fingerprint.

10. The software installation package signature system based on digital certificate status check according to claim 9, characterized in that: The code signature generation system is also used to encapsulate the trust chain, status query information and timestamp together with the digital envelope 2 and the software installation package signature data to generate a software installation release package; The code signature verification system is also used to verify the validity of the software installation package signature data based on the obtained trust chain and status query information and timestamp.

Images