Automatic signature method and device for drive program in Linux kernel

Abstract

The invention discloses an automatic signature method and device for a drive program in a Linux kernel, and belongs to the field of computer security. The method comprises the following steps: generating a signature file containing a corresponding key pair based on identity information of a signer; importing a public key based on the generated random password, sending a key registration request, encrypting the random password, and writing the encrypted random password into a temporary file; the system is restarted, a key registration request is received, a hook function is triggered to take over the registration process, the random password in the temporary file is decrypted firstly and verified with the random password when the public key is imported, and when the random password is verified successfully, the public key and the identity information of the corresponding signer are written into the key ring; and signing the drive program by using the signature file so as to perform signature verification by using the key ring when a signer loads the drive program. According to the method, except for triggering the signature program to execute, the whole signature process is completely automatic, the possibility of misoperation is eliminated, and automatic high-efficiency signature is completely realized.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security, and in particular to an automatic signing method and device for a driver in a Linux kernel. Background Art

[0002] In order to enhance the security of the system, the Linux kernel has added a driver signature check mechanism. When loading a driver, the kernel will check the driver's signature. If the signature does not exist or the signature verification fails, it will be forced to exit and the driver loading will fail. When malware loads a driver, the signature verification fails and the driver cannot be loaded. The driver signature check mechanism can not only prevent malware or attackers from loading unauthorized kernel programs, but also prevent the system from loading tampered drivers, thereby protecting the system from attacks.

[0003] However, the traditional driver signing method requires manual input of passwords, registration keys, etc. The process is cumbersome and requires user intervention. There are many options and users are prone to making mistakes, which greatly affects the signing efficiency.

[0004] Therefore, there is an urgent need to provide a method and device for automatically signing a driver in a Linux kernel. Summary of the invention

[0005] In order to solve the problems of poor automation and low signature efficiency of traditional driver signature methods, an embodiment of the present invention provides a method and device for automatically signing a driver in a Linux kernel.

[0006] On the one hand, a method for automatically signing a driver in a Linux kernel is provided, the method comprising:

[0007] Based on the input signer identity information, generate a signature file containing a key pair corresponding to the signer identity information; wherein the key pair includes a public key and a private key;

[0008] Import the public key based on the generated random password, issue a key registration request, and encrypt the random password and write it to a temporary file;

[0009] Restart the system, receive the key registration request, trigger the hook function to take over the registration process, first decrypt the random password in the temporary file, and verify it with the random password when the public key is imported. When the random password verification succeeds, write the public key and the corresponding signer identity information into the key ring;

[0010] The driver is signed by using the signature file, so that when the signer loads the driver, the key ring is used to perform signature verification.

[0011] On the other hand, a device for automatically signing a driver in a Linux kernel is provided, which is used to implement the steps described in any method embodiment of the specification, and the device includes:

[0012] A generating unit, configured to generate a signature file containing a key pair corresponding to the signer identity information based on the input signer identity information; wherein the key pair includes a public key and a private key;

[0013] An import unit, used to import a public key based on a generated random password, issue a key registration request, and encrypt the random password and write it into a temporary file;

[0014] A verification unit is used to restart the system, receive the key registration request, trigger the hook function to take over the registration process, first decrypt the random password in the temporary file, and verify it with the random password when the public key is imported. When the random password verification succeeds, the public key and the corresponding signer identity information are written into the key ring;

[0015] The signature unit is used to sign the driver program using the signature file, so that when the signer loads the driver program, the key ring is used to perform signature verification.

[0016] On the other hand, a computer device is provided, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned method.

[0017] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0018] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0019] The technical solution provided by the present invention can at least bring the following beneficial effects:

[0020] In the traditional driver signing method, the signer's identity information needs to be manually input, the password for importing the public key needs to be manually set, and the system needs to be restarted multiple times. The MOK management interface pops up for manual password input to select the registration key option, etc. The process is cumbersome and the user needs to intervene in the operation. There are many options, and users are prone to errors, which greatly affects the signing efficiency. This solution only requires manual input of the signer's identity information and triggers the execution of the automatic signing program. It can automatically generate the signature file, import the public key, automatically register the key, automatically verify the password, and automatically sign and verify the signature. The whole process is automated, which reduces manual intervention, eliminates the possibility of misoperation, fully realizes automated signing, and improves signing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 This is a flow chart of an automatic signing method for a driver in a Linux kernel provided by an embodiment of the present invention;

[0023] Figure 2 This is a structural diagram of an automatic signature device for a driver in a Linux kernel provided by an embodiment of the present invention;

[0024] Figure 3 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] The specific implementation of the above concept is described below.

[0027] Please refer to Figure 1 , an embodiment of the present invention provides an automatic signing method for a driver in a Linux kernel, the method comprising:

[0028] Step 100: Based on the input signer identity information, generate a signature file containing a key pair corresponding to the signer identity information; wherein the key pair includes a public key and a private key;

[0029] Step 102: importing the public key based on the generated random password, issuing a key registration request, and encrypting the random password and writing it into a temporary file;

[0030] Step 104: Restart the system, receive the key registration request, trigger the hook function to take over the registration process, first decrypt the random password in the temporary file, and verify it with the random password when the public key is imported. When the random password verification succeeds, write the public key and the corresponding signer identity information into the key ring;

[0031] Step 106: Sign the driver using the signature file so that when the signer loads the driver, the key ring is used to perform signature verification.

[0032] In the embodiment of the present invention, in the traditional driver signature method, it is necessary to manually input the signer's identity information, manually set the password for importing the public key, and restart the system multiple times, and pop up the MOK management interface for manual input of the password to select the registration key option, etc. The process operation is cumbersome, the user needs to intervene in the operation, there are many options, and the user is prone to errors, which greatly affects the signature efficiency. In this solution, only the signer's identity information is manually input, and the automatic signature program is triggered to execute, and the signature file can be automatically generated, the public key is imported, the key is automatically registered, the password is automatically verified, and the signature and signature verification are automatically signed. The whole process is automated, which reduces manual intervention, eliminates the possibility of misoperation, fully realizes automated signature, and improves signature efficiency.

[0033] Described below Figure 1 How the various steps are performed.

[0034] For step 100:

[0035] In this step, the signer identity information may include company registration related information and contact information. Based on the signer identity information, a signature file and a key pair are generated. The signature file includes company registration information, contact information, digest algorithm, key pair and other information.

[0036] Regarding step 102:

[0037] In this step, there is no need to manually set a password. A random password is automatically generated to import the public key into the signature database, triggering the key registration request function check_mok_request. At the same time, the random password is encrypted and written into a temporary file for backup for password verification.

[0038] Regarding step 104:

[0039] Since the key registration request requires a system restart to take effect, the system is automatically restarted without manual restart.

[0040] In order to realize automatic registration, in the embodiment of the present invention, the step of "receiving a key registration request" may include: using the ftrace tool to hook the function of the key registration request.

[0041] In this embodiment, the check_mok_request function of the key registration request is hooked by the ftrace tool to automatically receive the key registration request. After receiving the registration request, the hook function is triggered to take over the registration process. The menu option of the MOK management interface will no longer pop up, and the user will not be allowed to participate. Instead, the random password is directly read from the temporary file and decrypted, and then verified with the random password when the public key is imported. After successful verification, the public key is permanently added to the password list. At the same time, the key list is added to the system key ring. Therefore, the automatic registration process no longer requires the user to make multiple selections and enter passwords, and does not require multiple system restarts, which improves automation and signature efficiency.

[0042] In the embodiment of the present invention, when the random password verification fails, it indicates that the public key fails to correspond to the key registration request, and the key registration process ends. The public key and the corresponding signer identity information are not written into the key ring, and the next key registration request is awaited.

[0043] Regarding step 106:

[0044] In some implementations, signing the driver using the signature file includes:

[0045] Calculate the driver's digest using a digest algorithm, and encrypt the digest using the private key in the signature file to generate signature information;

[0046] The signature information, the identity information of the signer in the signature file and a special character string of fixed length are concatenated to generate a marking character string;

[0047] Append the tag string to the end of the driver.

[0048] In this embodiment, a tag string is first generated using the three information, and the tag string is appended to the end of the driver. It can be understood that the summary information in the tag string is the original summary that has not been tampered with during the signing.

[0049] In some implementations, after the driver is signed using the signature file, the method further includes:

[0050] Check whether the end of the driver contains a special string. If it does, the signature is successful, otherwise the signature fails.

[0051] In this embodiment, it is only necessary to detect whether the fixed length at the end of the driver is a set special character string to detect whether the signature is successful, without the need to detect all the marking character strings, thus saving time.

[0052] In some implementations, when the signer loads the driver, the key ring is used to perform signature verification, including:

[0053] Read the tag string at the end of the driver, intercept the special string of fixed length, and obtain the signature information and signer identity information;

[0054] Based on the signer's identity information, search for the corresponding public key from the key ring;

[0055] Decrypt the digest using the public key, and use the digest algorithm to restore the digest when the driver was signed;

[0056] Using the same digest algorithm, calculate the driver's current digest and compare it with the digest when signing;

[0057] If they are equal, the signature verification is successful and the driver is loaded;

[0058] If they are not equal, the signature verification fails and the driver loading fails.

[0059] In this embodiment, when the signer loads the driver, he / she enters his / her signer identity information. Then, the signer identity information can be used to find the corresponding public key from the key ring to decrypt the marker string at the end of the driver and obtain the summary when the driver was signed.

[0060] If the driver is tampered with, the current digest of the driver will change and be inconsistent with the digest when it was signed, and the signature verification will fail; if a malicious Trojan loads the driver, it cannot enter the correct signer identity information and cannot decrypt the digest when the driver was signed, and the signature verification will also fail. Therefore, this embodiment can not only prevent malware or attackers from loading unauthorized kernel programs, but also prevent the system from loading tampered drivers, thereby protecting the system from attacks.

[0061] Please refer to Figure 2 The embodiment of the present invention provides an automatic signing device for a driver in a Linux kernel, which is used to implement the steps of any method embodiment in the specification, and the device includes:

[0062] The generating unit 201 is used to generate a signature file containing a key pair corresponding to the signer identity information based on the input signer identity information; wherein the key pair includes a public key and a private key;

[0063] The import unit 202 is used to import the public key based on the generated random password, issue a key registration request, and encrypt the random password and write it into a temporary file;

[0064] Verification unit 203 is used to restart the system, receive the key registration request, trigger the hook function to take over the registration process, first decrypt the random password in the temporary file, and verify it with the random password when the public key is imported. When the random password verification succeeds, the public key and the corresponding signer identity information are written into the key ring;

[0065] The signature unit 204 is used to sign the driver using the signature file so that when the signer loads the driver, the key ring is used to perform signature verification.

[0066] In one embodiment of the present invention, when the verification unit 203 receives the key registration request, it is used to: use the ftrace tool to hook the function of the key registration request.

[0067] In one embodiment of the present invention, when the signature unit 204 executes the signing of the driver using the signature file, it is used to:

[0068] Calculate the driver's digest using a digest algorithm, and encrypt the digest using the private key in the signature file to generate signature information;

[0069] The signature information, the identity information of the signer in the signature file and a special character string of fixed length are concatenated to generate a marking character string;

[0070] Append the tag string to the end of the driver.

[0071] In one embodiment of the present invention, after signing the driver using the signature file, the signature unit 204 is further used to:

[0072] Check whether the end of the driver contains a special string. If it does, the signature is successful, otherwise the signature fails.

[0073] In one embodiment of the present invention, the signature unit 204 uses the key ring to perform signature verification when the signer loads the driver, including:

[0074] Read the tag string at the end of the driver, intercept the special string of fixed length, and obtain the signature information and signer identity information;

[0075] Based on the signer's identity information, search for the corresponding public key from the key ring;

[0076] Decrypt the digest using the public key, and use the digest algorithm to restore the digest when the driver was signed;

[0077] Using the same digest algorithm, calculate the driver's current digest and compare it with the digest when signing;

[0078] If they are equal, the signature verification is successful and the driver is loaded;

[0079] If they are not equal, the signature verification fails and the driver loading fails.

[0080] In one embodiment of the present invention, when the random password verification fails, the verification unit 203 ends the key registration process, does not write the public key and the corresponding signer identity information into the key ring, and waits for the next key registration request.

[0081] It should be noted that the automatic signature device for the driver in the Linux kernel provided in the above embodiment is only illustrated by the division of the above functional units. In actual applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. In addition, the above device embodiment and the method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0082] The embodiment of the present application also provides a computer device, please refer to Figure 3 The computer device includes a processor and a memory, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the automatic signing method of the driver in the Linux kernel provided by the above-mentioned method embodiments.

[0083] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the automatic signing method for a driver in the Linux kernel provided by the above-mentioned method embodiments.

[0084] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes any of the automatic signing methods for drivers in the Linux kernel in the above embodiments.

[0085] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0086] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application or some parts of the embodiments.

[0087] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0088] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for automatically signing a driver in a Linux kernel, characterized in that: The method comprises: Based on the input signer identity information, generate a signature file containing a key pair corresponding to the signer identity information; wherein the key pair includes a public key and a private key; Import the public key based on the generated random password, issue a key registration request, and encrypt the random password and write it to a temporary file; Restart the system, receive the key registration request, trigger the hook function to take over the registration process, first decrypt the random password in the temporary file, and verify it with the random password when the public key is imported. When the random password verification succeeds, write the public key and the corresponding signer identity information into the key ring; The driver is signed by using the signature file, so that when the signer loads the driver, the key ring is used to perform signature verification.

2. The method according to claim 1, characterized in that The receiving the key registration request includes: using an ftrace tool to hook a function of the key registration request.

3. The method according to claim 1, characterized in that The step of signing the driver using the signature file includes: Calculating the driver's digest using a digest algorithm, and encrypting the digest using the private key in the signature file to generate signature information; The signature information, the identity information of the signer in the signature file and a special character string of fixed length are concatenated to generate a marking character string; Append the tag string to the end of the driver.

4. The method according to claim 3, characterized in that After the driver is signed by using the signature file, the method further includes: Check whether the end of the driver contains the special character string. If so, the signature is successful, otherwise the signature fails.

5. The method according to claim 3, characterized in that When the signer loads the driver, the key ring is used to perform signature verification, including: Read the mark character string at the end of the driver, intercept the special character string of fixed length, and obtain the signature information and the signer identity information; Based on the signer identity information, searching for a corresponding public key from the key ring; Decrypting the digest using the public key, and restoring the digest when the driver was signed using the digest algorithm; Using the same digest algorithm, calculate the current digest of the driver and compare it with the digest when signing; If they are equal, the signature verification is successful and the driver is loaded; If they are not equal, the signature verification fails and the loading of the driver fails.

6. The method according to any one of claims 1 to 5, characterized in that When the random password verification fails, the following steps are performed: the key registration process is terminated, the public key and the corresponding signer identity information are not written into the key ring, and the next key registration request is waited for.

7. An automatic signing device for a driver in a Linux kernel, used to implement the steps of any of the methods described in claims 1-6, characterized in that: The device comprises: A generating unit, configured to generate a signature file containing a key pair corresponding to the signer identity information based on the input signer identity information; wherein the key pair includes a public key and a private key; An import unit, used to import a public key based on a generated random password, issue a key registration request, and encrypt the random password and write it into a temporary file; A verification unit is used to restart the system, receive the key registration request, trigger the hook function to take over the registration process, first decrypt the random password in the temporary file, and verify it with the random password when the public key is imported. When the random password verification succeeds, the public key and the corresponding signer identity information are written into the key ring; The signature unit is used to sign the driver program using the signature file, so that when the signer loads the driver program, the key ring is used to perform signature verification.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-6.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images