Signature property transmission method and device, equipment and medium

Abstract

The invention discloses a signature property transmission method and device, equipment and a medium, and relates to the technical field of software integrity protection. Comprising the following steps: configuring corresponding signature property expression methods and abstract calculation processes based on different types of signature properties; performing digest value calculation on the to-be-protected software based on the digest calculation process to obtain a preset number of first target digest values, and signing each first target digest value to obtain a preset number of signature values; performing signature verification operation on the to-be-verified software based on the to-be-verified signature value and the abstract calculation process, obtaining a corresponding abstract baseline value, and comparing a second target abstract value obtained after each abstract calculation in the abstract calculation process in the signature verification process with the abstract baseline value; and based on the comparison result, identifying the signature property of the corresponding signature value to be verified through a signature property expression method to obtain a corresponding signature verification result. Therefore, the signature property can be identified in the software integrity verification process.

Description

Technical Field

[0001] The present invention relates to the technical field of software integrity protection, and in particular to a signature property transmission method, device, equipment and medium. Background Art

[0002] In the field of software integrity protection, software integrity is generally ensured by signing the certificate verification summary, and the software is allowed to run if the verification passes. When verifying software integrity, it is usually necessary to identify and handle different types of signatures. Code that is allowed to run in a production environment is "official signed", and code that is not allowed to run in a production environment is "test signed"; for example, there are "strong signatures" that require complete verification of the certificate chain, validity period, revocation status, etc., "loose signatures" that require verification of the certificate chain and validity period, and "weak signatures" that only require basic certificate chain verification.

[0003] At present, to realize the recognition of different signature types, there are generally two solutions: one is to distinguish through different private keys and certificates; that is, signatures of different natures are encrypted with different private keys and correspond to different verification certificates. At the same time, signatures of different natures can be verified by certificates and digest values, so that the nature of the signatures can be distinguished by judging the verification certificate and specific processing can be implemented. However, this solution requires additional application for signature private keys and certificates, which brings additional complexity and security risks such as private key protection, certificate management, and certificate parsing. The other is to distinguish by adding additional information; that is, the nature of the signature is identified by adding additional data, and the nature of the signature is distinguished by this information during the integrity verification process, so as to implement specific processing. However, this solution needs to consider the complexity and security risks of the storage, transmission, and parsing process of additional information. The above two solutions cannot complete the verification of the signature nature at the same time as the integrity verification. After the conventional integrity verification mechanism is completed, the signature nature of the software needs to be further verified. Therefore, the identification of the signature nature cannot be completed synchronously with the software integrity verification, and there is a TOCTOU (time-of-check-to-time-of-use, a software vulnerability) risk.

[0004] From the above, it can be seen that how to identify the signature properties in the process of software integrity verification is an urgent problem to be solved. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a signature property transmission method, device, equipment and medium, which can realize the identification of signature properties during the software integrity verification process. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a signature property delivery method, comprising:

[0007] The corresponding signature property expression method and digest calculation process are configured based on different types of signature properties; the digest calculation process is a calculation process based on a number of identical or different digest algorithms to perform one or more digest calculations to obtain a digest value; the signature property expression method is a method for expressing the signature property of the signature value based on the corresponding digest calculation times when the signature value verification is successful;

[0008] Based on the digest calculation process, a digest value is calculated for the software to be protected to obtain a preset number of first target digest values, and each of the first target digest values ​​is signed to obtain the preset number of signature values; wherein different signature values ​​correspond to different signature properties;

[0009] Based on the signature value to be verified and the digest calculation process, the software to be verified is verified and a corresponding digest baseline value is obtained, and a second target digest value obtained after each digest calculation in the digest calculation process during the verification process is compared with the digest baseline value, and based on the comparison result and through the signature property expression method, the signature property of the corresponding signature value to be verified is identified to obtain a corresponding verification result; the signature value to be verified is any one of the preset number of signature values.

[0010] Optionally, the different types of signature properties include the preset number of signature complexities.

[0011] Optionally, the performing digest value calculation on the software to be protected based on the digest calculation process to obtain a preset number of first target digest values ​​includes:

[0012] If the digest calculation process corresponding to any signature complexity is to perform digest calculation only once, then perform digest calculation once on the software to be protected based on the first digest algorithm to obtain a corresponding first target digest value;

[0013] If the digest calculation process corresponding to any signature complexity is to perform N digest calculations, where N is an integer not less than 2, then in the first digest calculation, a digest calculation is performed on the software to be protected based on the first digest algorithm to obtain a corresponding digest calculation result; in the nth digest calculation, a digest calculation result obtained after the n-1th digest calculation is performed based on the second digest algorithm to obtain a corresponding digest calculation result; and the digest calculation result obtained after the Nth digest calculation is determined as the corresponding first target digest value; where n is an integer not less than 2 and not greater than N;

[0014] The first digest algorithm and the second digest algorithm are any digest algorithms in a preset digest algorithm set, the preset digest algorithm set includes at least an SM3 algorithm and a SHA256 algorithm, and the first digest algorithm and the second digest algorithm are the same or different digest algorithms.

[0015] Optionally, before configuring the signature property expression method and the digest calculation process corresponding to different types of signature properties, the method further includes:

[0016] Allocating a corresponding signature key to the signature operation of the software to be protected;

[0017] A signature verification certificate corresponding to the signature verification operation is generated based on the signature key.

[0018] Optionally, signing the plurality of first target digest values ​​to obtain a plurality of signature values ​​with different signature properties includes:

[0019] The plurality of first target digest values ​​are signed based on the signature key to obtain a plurality of signature values ​​with different signature properties.

[0020] Optionally, the performing of a signature verification operation on the software to be verified based on the signature value to be verified and the digest calculation process and obtaining a corresponding digest baseline value, and comparing a second target digest value obtained after each digest calculation in the digest calculation process during the signature verification process with the digest baseline value, and identifying the signature property of the corresponding signature value to be verified based on the comparison result and by the signature property expression method to obtain a corresponding signature verification result, including:

[0021] Performing a verification operation on the signature value to be verified of the software to be verified based on the verification certificate to obtain a corresponding digest baseline value;

[0022] Performing a digest calculation on the software to be verified to obtain a current second target digest value, and counting the corresponding number of digest calculations;

[0023] comparing the current second target summary value with the summary baseline value;

[0024] If the comparison result shows that the current second target digest value is consistent with the digest baseline value, the verification of the signature value to be verified is determined to be successful, and the corresponding signature complexity is determined based on the current number of digest calculations; wherein n digest calculations correspond to the nth signature complexity, and n is an integer not less than 2 and not greater than N;

[0025] If the comparison result shows that the current second target digest value is inconsistent with the digest baseline value, a digest calculation is performed on the current second target digest value to obtain a new current second target digest value, and the corresponding digest calculation times are updated, and then the process jumps to comparing the current second target digest value with the digest baseline value until the verification of the signature value to be verified is successful.

[0026] Optionally, after identifying the signature property of the corresponding signature value to be verified by the signature property expression method to obtain the corresponding signature verification result, the method further includes:

[0027] Based on the signature property of the signature value to be verified, corresponding processing operations are performed on the software to be verified.

[0028] In a second aspect, the present application provides a signature property transmission device, including:

[0029] A signature property configuration module, used to configure corresponding signature property expression methods and digest calculation processes based on different types of signature properties; the digest calculation process is a calculation process that performs one or more digest calculations based on a number of identical or different digest algorithms to obtain a digest value; the signature property expression method is a method for expressing the signature property of the signature value based on the corresponding number of digest calculations when the signature value verification is successful;

[0030] a signature value generating module, configured to calculate a digest value of the protected software based on the digest calculation process to obtain a preset number of first target digest values, and to sign each of the first target digest values ​​to obtain the preset number of signature values; wherein different signature values ​​correspond to different signature properties;

[0031] A signature value verification module is used to verify the software to be verified based on the signature value to be verified and the digest calculation process and obtain a corresponding digest baseline value, and compare the second target digest value obtained after each digest calculation in the digest calculation process during the verification process with the digest baseline value, identify the signature property of the corresponding signature value to be verified based on the comparison result and through the signature property expression method to obtain a corresponding verification result; the signature value to be verified is any one of the preset number of signature values.

[0032] In a third aspect, the present application provides an electronic device, including:

[0033] Memory, used to store computer programs;

[0034] The processor is used to execute the computer program to implement the aforementioned signature property transmission method.

[0035] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned signature property transfer method when executed by a processor.

[0036] The present application provides a signature property transfer method, which first configures corresponding signature property expression methods and digest calculation processes based on different types of signature properties; the digest calculation process is a calculation process for performing one or more digest calculations based on several identical or different digest algorithms to obtain a digest value; the signature property expression method is a method for expressing the signature property of a signature value corresponding to the digest value through the digest value calculation result obtained by the digest calculation process; then, based on the digest calculation process, a digest value calculation is performed on the protected software to obtain several target digest values, and the several target digest values ​​are signed to obtain several signature values ​​with different signature properties; finally, based on the signature value to be verified and the digest calculation process, a signature verification operation is performed on the software to be verified, and during the verification process, the signature property of the corresponding signature value to be verified is identified through the signature property expression method to obtain a corresponding verification result; the signature value to be verified is any one of several signature values ​​with different signature properties.

[0037] As can be seen from the above, the present application configures corresponding summary calculation processes based on different types of signature properties, and performs signature operations on the protected software based on the summary calculation process to obtain several signature values ​​with different signature properties. That is, by presetting the use of multiple combinations of different or the same summary algorithms in the software integrity protection scenario to represent additional information such as signature properties and achieve information transmission, it is possible to identify signature properties during the software integrity verification process. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0039] Figure 1 A flow chart of a signature property transfer method disclosed in this application;

[0040] Figure 2 A schematic diagram of a signing process disclosed in this application;

[0041] Figure 3 A schematic diagram of a signature verification process disclosed in this application;

[0042] Figure 4A schematic diagram of a signature property transmission device disclosed in this application;

[0043] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] At present, to realize the recognition of different signature types, generally two solutions are adopted: one is to distinguish through different private keys and certificates. However, this solution requires additional application for signature private keys and certificates, which brings additional private key protection, certificate management, certificate parsing and other related complexities and security risks. The other is to add additional information for distinction. However, this solution needs to consider the complexity and security risks of the storage, transmission and parsing process of additional information. The above two solutions cannot complete the verification of signature properties at the same time as the integrity verification. After the conventional integrity verification mechanism is completed, the signature properties of the software need to be further verified. Therefore, the identification of signature properties cannot be completed synchronously with the software integrity verification, and there is a TOCTOU risk. To this end, the present application provides a signature property transmission scheme that can realize the identification of signature properties during the software integrity verification process.

[0046] See also Figure 1 As shown, the embodiment of the present application discloses a signature property transmission method, including:

[0047] Step S11: configuring corresponding signature property expression methods and digest calculation processes based on different types of signature properties.

[0048] In this embodiment, before signing the software to be protected, it is necessary to assign a corresponding key to the signing process and generate a corresponding verification certificate based on the key, so as to ensure the integrity of the software by verifying the signature of the summary through the certificate. Specifically, before configuring the corresponding signature property expression method and summary calculation process based on different types of signature properties, it may also include: assigning a corresponding signature key to the signing operation of the software to be protected; generating a verification certificate corresponding to the verification operation based on the signature key. That is, by verifying the legitimacy of the basic certificate chain of the signature key and the verification certificate, the data security of the software to be protected and the software to be verified is ensured, and the theft of software data information by a third party is prevented.

[0049] In this embodiment, the digest calculation process is a calculation process of performing one or more digest calculations based on several identical or different digest algorithms to obtain a digest value; the signature property expression method is a method of expressing the signature property of the signature value based on the corresponding number of digest calculations when the signature value is successfully verified; the specific type of the digest algorithm can be determined according to the actual application situation and is not specifically limited here. For example, in a specific implementation, the digest algorithm includes the SM3 algorithm and the SHA256 algorithm.

[0050] Furthermore, the signature properties characterize the signature type and the corresponding processing logic, which need to be determined according to the actual application scenario and are not specifically limited here. For example, the code running in the production environment is allowed to be "formally signed", while the code running in the production environment is not allowed to be "test signed"; "strong signature" that requires complete verification of the certificate chain, validity period, revocation status, etc. during verification, "loose signature" that requires verification of the certificate chain and validity period, and "weak signature" that only requires basic certificate chain verification. Specifically, the different types of signature properties include the preset number of signature complexities. For example, in a specific implementation, the signature process corresponding to the first signature complexity is a signature process that performs a digest calculation based on the SM3 algorithm and obtains a signature value based on the signature key; the signature process corresponding to the second signature complexity is a signature process that performs a first digest calculation based on the SM3 algorithm, then performs a second digest calculation based on the SHA256 algorithm, and obtains a signature value based on the signature key; the signature process corresponding to the third signature complexity is a signature process that performs a first digest calculation based on the SM3 algorithm, then performs a second digest calculation based on the SHA256 algorithm, and then performs a third digest calculation based on the SHA256 algorithm and obtains a signature value based on the signature key. Accordingly, the second digest calculation based on the SHA256 algorithm may include: performing a digest calculation on the result of the first digest calculation of the SM3 algorithm based on the SHA256 algorithm; and the third digest calculation based on the SHA256 algorithm may include: performing a digest calculation on the result of the second digest calculation of the SHA256 algorithm based on the SHA256 algorithm. That is, signature values ​​representing different signature properties are obtained through signature processes of different complexities, so as to determine the signature property of the signature value to be verified during the signature verification operation of the software to be verified, and execute the pre-configured processing logic.

[0051] Step S12: Based on the digest calculation process, a digest value is calculated for the software to be protected to obtain a preset number of first target digest values, and each of the first target digest values ​​is signed to obtain the preset number of signature values.

[0052] In this embodiment, the protected software is signed based on the digest calculation process to obtain a plurality of signature values ​​with different signature properties. That is, the plurality of first target digest values ​​are signed based on the signature key to obtain a plurality of signature values ​​with different signature properties. Specifically, performing a digest value calculation on the software to be protected based on the digest calculation process to obtain a preset number of first target digest values ​​may include: if the digest calculation process corresponding to any signature complexity is to perform only one digest calculation, then performing a digest calculation on the software to be protected based on the first digest algorithm to obtain the corresponding first target digest value; if the digest calculation process corresponding to any signature complexity is to perform N digest calculations, where N is an integer not less than 2, then in the first digest calculation, performing a digest calculation on the software to be protected based on the first digest algorithm to obtain a corresponding digest calculation result; in the nth digest calculation, performing a digest calculation on the digest calculation result obtained after the n-1th digest calculation based on the second digest algorithm to obtain the corresponding digest calculation result; and determining the digest calculation result obtained after the Nth digest calculation as the corresponding first target digest value; where n is an integer not less than 2 and not greater than N; wherein the first digest algorithm and the second digest algorithm are any digest algorithms in a preset digest algorithm set, the preset digest algorithm set at least includes an SM3 algorithm and a SHA256 algorithm, and the first digest algorithm and the second digest algorithm are the same or different digest algorithms. That is, based on the SM3 algorithm, a digest calculation is performed on the software to be protected to obtain a first digest value, and the first digest value is signed using the signature key to obtain a signature value with a first signature complexity; based on the SHA256 algorithm, a digest calculation is performed on the first digest value to obtain a second digest value, and the second digest value is signed using the signature key to obtain a signature value with a second signature complexity; based on the SHA256 algorithm, a digest calculation is performed on the second digest value to obtain a third digest value, and the third digest value is signed using the signature key to obtain a signature value with a third signature complexity.

[0053] Step S13: Based on the signature value to be verified and the digest calculation process, the software to be verified is verified and a corresponding digest baseline value is obtained, and a second target digest value obtained after each digest calculation in the digest calculation process during the verification process is compared with the digest baseline value, and based on the comparison result and through the signature property expression method, the signature property of the corresponding signature value to be verified is identified to obtain a corresponding verification result.

[0054] In this embodiment, a verification operation is performed on the software to be verified based on the signature value to be verified, and the corresponding signature properties are identified during the verification process to obtain a corresponding verification result. The verification result is the signature property identification result of the signature to be verified. In a specific implementation, a verification operation is performed on the signature value to be verified based on the verification certificate to obtain a corresponding summary baseline value; a summary calculation is performed on the software to be verified based on the SM3 algorithm to obtain a first verification summary value, and the first verification summary value is compared with the summary baseline value; if the first verification summary value is consistent with the summary baseline value, the signature property of the signature value to be verified is identified as the first signature complexity, and a first verification result is obtained; if the first verification summary value is inconsistent with the summary baseline value, a summary calculation is performed on the first verification summary value based on the SHA256 algorithm to obtain a second verification summary value, and The second verification digest value is compared with the digest baseline value; if the second verification digest value is consistent with the digest baseline value, the signature property of the signature value to be verified is identified as the second signature complexity, and a second verification result is obtained; if the second verification digest value is inconsistent with the digest baseline value, a digest calculation is performed on the second verification digest value based on the SHA256 algorithm to obtain a third verification digest value, and the third verification digest value is compared with the digest baseline value; if the third verification digest value is consistent with the digest baseline value, the signature property of the signature value to be verified is identified as the third signature complexity, and a third verification result is obtained.Specifically, the method of performing a verification operation on the software to be verified based on the signature value to be verified and the digest calculation process and obtaining a corresponding digest baseline value, and comparing the second target digest value obtained after each digest calculation in the digest calculation process during the verification process with the digest baseline value, identifying the signature property of the corresponding signature value to be verified based on the comparison result and using the signature property expression method to obtain a corresponding verification result, may include: performing a verification operation on the signature value to be verified of the software to be verified based on the verification certificate to obtain a corresponding digest baseline value; performing a digest calculation on the software to be verified to obtain a current second target digest value, and counting the corresponding digest calculation times; and The value is compared with the digest baseline value; if the comparison result shows that the current second target digest value is consistent with the digest baseline value, it is determined that the verification of the signature value to be verified is successful, and the corresponding signature complexity is determined based on the current number of digest calculations; wherein n digest calculations correspond to the nth signature complexity, and n is an integer not less than 2 and not greater than N; if the comparison result shows that the current second target digest value is inconsistent with the digest baseline value, a digest calculation is performed on the current second target digest value to obtain a new current second target digest value, and the corresponding number of digest calculations is updated, and then the process jumps to the comparison of the current second target digest value with the digest baseline value until the verification of the signature value to be verified is successful. That is, the digest value of the software to be verified is calculated through the pre-configured digest calculation process, and the calculated verification digest value is compared with the digest baseline value obtained by verifying the certificate to obtain the corresponding verification result.

[0055] Furthermore, after obtaining the verification result, the software to be verified needs to be processed according to the processing logic corresponding to the signature property. Specifically, the software to be verified is verified based on the signature value to be verified, and the corresponding signature property is identified during the verification process to obtain the corresponding verification result. It can also include: performing corresponding processing operations on the software to be verified based on the processing logic corresponding to the signature property of the signature value to be verified.

[0056] As can be seen from the above, the embodiment of the present application configures corresponding digest calculation processes based on different types of signature properties, and signs the protected software based on the digest calculation process to obtain several signature values ​​with different signature properties, wherein the digest calculation process is a signature process that performs one or more digest calculations based on several digest algorithms to obtain signature values; that is, by presetting the use of multiple combinations of different or the same digest algorithms in the software integrity protection scenario to represent additional information such as signature properties and achieve information transmission information, it is possible to identify signature properties during the software integrity verification process.

[0057] Furthermore, the present application provides a specific signature property transmission method, including:

[0058] See also Figure 2 As shown, in this embodiment, first, the corresponding key pair is allocated to the signing and verification process and a certificate is generated. The signature property information to be transmitted and the corresponding digest algorithm selection and combination utilization method are agreed. In this embodiment, it is agreed that only the SM3 algorithm is used to calculate the digest value and the signature is a "weak signature"; it is agreed that on the basis of the above digest value calculation method, the SHA256 algorithm is used again to calculate the digest value and sign it as a "loose signature"; it is agreed that on the basis of the above digest value calculation method, the SHA256 method is used again to calculate the digest value and sign it as a "strong signature". The digest value of the protected software is calculated by the SM3 algorithm, recorded as HASH1. The signature operation is performed on HASH1 to obtain a weak signature value. The digest value of the protected software is calculated by the SM3 algorithm, recorded as HASH1. The digest value of HASH1 is calculated by the SHA256 algorithm, recorded as HASH2. The signature operation is performed on HASH2 to obtain a loose signature value. The digest value of the protected software is calculated by the SM3 algorithm, recorded as HASH1. The digest value of HASH1 is calculated by the SHA256 algorithm, recorded as HASH2. The digest value of HASH2 is calculated by the SHA256 algorithm and recorded as HASH3. The signature operation is performed on HASH3 to obtain a strong signature value.

[0059] For further information, see Figure 3 As shown, in this embodiment, the signature verification operation is performed for the above three signatures with different signature properties. First, the signature value needs to be verified by the signature verification certificate to obtain the summary baseline, which is recorded as HASH_BASELINE. The summary value is calculated by the SM3 algorithm for the verification software, which is recorded as HASH1'. It is judged whether HASH1' is equal to HASH_BASELINE. If they are equal, the signature value is identified as a weak signature. According to the agreement, the certificate verification strength is further judged and the corresponding processing is performed according to the result. If they are not equal, HASH1' is continued to be calculated by SHA256 to obtain the summary value, which is recorded as HASH2'. It is judged whether HASH2' is equal to HASH_BASELINE. If they are equal, the signature value is identified as a loose signature. According to the agreement, the certificate verification strength is further judged and the corresponding processing is performed according to the result. If they are not equal, HASH2' is continued to be calculated by SHA256 to obtain the summary value, which is recorded as HASH3'. It is judged whether HASH3' is equal to HASH_BASELINE. If they are equal, the signature value is identified as a strong signature. According to the agreement, the certificate verification strength is further judged and the corresponding processing is performed according to the result. If they are not equal, the software integrity check fails.

[0060] As can be seen from the above, in the integrity protection scenario, the embodiment of the present application uses a preset agreement to use multiple combinations of different or the same digest algorithms to represent additional information such as signature properties and complete information transmission; and at the verification end, according to the preset agreement, the information to be transmitted is obtained by using the above different digest algorithms or multiple combinations of the same digest algorithm. This realizes the identification of signature properties during the software integrity verification process.

[0061] See also Figure 4 As shown, the embodiment of the present application discloses a signature property transmission device, including:

[0062] The signature property configuration module 11 is used to configure corresponding signature property expression methods and digest calculation processes based on different types of signature properties; the digest calculation process is a calculation process based on a number of identical or different digest algorithms to perform one or more digest calculations to obtain a digest value; the signature property expression method is a method for expressing the signature property of the signature value based on the corresponding digest calculation times when the signature value verification is successful;

[0063] The signature value generating module 12 is used to calculate the summary value of the protected software based on the summary calculation process to obtain a preset number of first target summary values, and to sign each of the first target summary values ​​to obtain the preset number of signature values; wherein different signature values ​​correspond to different signature properties;

[0064] The signature value verification module 13 is used to verify the software to be verified based on the signature value to be verified and the digest calculation process and obtain the corresponding digest baseline value, and compare the second target digest value obtained after each digest calculation in the digest calculation process during the verification process with the digest baseline value, identify the signature property of the corresponding signature value to be verified based on the comparison result and through the signature property expression method to obtain the corresponding verification result; the signature value to be verified is any one of the preset number of signature values.

[0065] As can be seen from the above, the embodiments of the present application configure corresponding summary calculation processes based on different types of signature properties, and sign the protected software based on the summary calculation process to obtain several signature values ​​with different signature properties. That is, by presetting multiple combinations of different or the same summary algorithms in the software integrity protection scenario to represent additional information such as signature properties and achieve information transmission, it is possible to identify signature properties during the software integrity verification process.

[0066] In some specific implementations, the signature value generating module 12 may specifically include:

[0067] a first digest calculation unit, configured to perform a digest calculation on the software to be protected based on a first digest algorithm to obtain a corresponding first target digest value if the digest calculation process corresponding to any signature complexity is to perform only one digest calculation;

[0068] The Nth digest calculation unit is used for, if the digest calculation process corresponding to any signature complexity is to perform N digest calculations, where N is an integer not less than 2, then in the first digest calculation, a digest calculation is performed on the to-be-protected software based on the first digest algorithm to obtain a corresponding digest calculation result; in the nth digest calculation, a digest calculation is performed on the digest calculation result obtained after the n-1th digest calculation based on the second digest algorithm to obtain a corresponding digest calculation result; and the digest calculation result obtained after the Nth digest calculation is determined as the corresponding first target digest value; where n is an integer not less than 2 and not greater than N;

[0069] a signature value generating unit, configured to sign the plurality of first target digest values ​​based on the signature key to obtain a plurality of signature values ​​having different signature properties;

[0070] The first digest algorithm and the second digest algorithm are any digest algorithms in a preset digest algorithm set, the preset digest algorithm set includes at least an SM3 algorithm and a SHA256 algorithm, and the first digest algorithm and the second digest algorithm are the same or different digest algorithms.

[0071] In some specific implementations, the signature value verification module 13 may specifically include:

[0072] A digest baseline value generating unit, configured to perform a verification operation on the signature value to be verified of the software to be verified based on the verification certificate, so as to obtain a corresponding digest baseline value;

[0073] a summary baseline value comparison unit, configured to compare the current second target summary value with the summary baseline value;

[0074] A signature complexity determination unit, configured to determine that the verification of the signature value to be verified is successful if the comparison result shows that the current second target digest value is consistent with the digest baseline value, and determine the corresponding signature complexity based on the current number of digest calculations; wherein n digest calculations correspond to the nth signature complexity, and n is an integer not less than 2 and not greater than N;

[0075] The summary baseline value comparison step jump unit is used to perform a summary calculation on the current second target summary value to obtain a new current second target summary value if the comparison result shows that the current second target summary value is inconsistent with the summary baseline value, and update the corresponding number of summary calculations, and then jump to the step of comparing the current second target summary value with the summary baseline value until the verification of the signature value to be verified is successful.

[0076] In some specific implementations, the signature property transmission device may further include:

[0077] A key configuration module, used to allocate a corresponding signature key to the signature operation of the software to be protected;

[0078] A certificate generation module, used to generate a signature verification certificate corresponding to the signature verification operation based on the signature key;

[0079] The operation execution module is used to execute corresponding processing operations on the software to be verified based on the signature property of the signature value to be verified.

[0080] Furthermore, the present application also discloses an electronic device. Figure 5 1 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the signature property transfer method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0081] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0082] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0083] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the signature property transfer method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0084] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned signature property transfer method is implemented. The specific steps of the method can be referred to the corresponding contents disclosed in the aforementioned embodiment, and will not be repeated here.

[0085] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0086] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0087] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0088] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0089] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A signature property delivery method, characterized in that: include: Configure corresponding signature property expression methods and summary calculation processes based on different types of signature properties; The digest calculation process is a calculation process that performs one or more digest calculations based on a number of identical or different digest algorithms to obtain a digest value; the signature property expression method is a method for expressing the signature property of the signature value based on the corresponding number of digest calculations when the signature value verification succeeds; Based on the digest calculation process, a digest value is calculated for the software to be protected to obtain a preset number of first target digest values, and each of the first target digest values ​​is signed to obtain the preset number of signature values; wherein different signature values ​​correspond to different signature properties; Based on the signature value to be verified and the digest calculation process, the software to be verified is verified and a corresponding digest baseline value is obtained, and a second target digest value obtained after each digest calculation in the digest calculation process during the verification process is compared with the digest baseline value, and based on the comparison result and through the signature property expression method, the signature property of the corresponding signature value to be verified is identified to obtain a corresponding verification result; the signature value to be verified is any one of the preset number of signature values.

2. The signature property delivery method according to claim 1, characterized in that: The different types of signature properties include the preset number of signature complexities.

3. The signature property delivery method according to claim 2, characterized in that: The step of calculating the digest value of the software to be protected based on the digest calculation process to obtain a preset number of first target digest values ​​includes: If the digest calculation process corresponding to any signature complexity is to perform digest calculation only once, then perform digest calculation once on the software to be protected based on the first digest algorithm to obtain a corresponding first target digest value; If the digest calculation process corresponding to any signature complexity is to perform N digest calculations, where N is an integer not less than 2, then in the first digest calculation, a digest calculation is performed on the software to be protected based on the first digest algorithm to obtain a corresponding digest calculation result; in the nth digest calculation, a digest calculation result obtained after the n-1th digest calculation is performed based on the second digest algorithm to obtain a corresponding digest calculation result; and the digest calculation result obtained after the Nth digest calculation is determined as the corresponding first target digest value; where n is an integer not less than 2 and not greater than N; The first digest algorithm and the second digest algorithm are any digest algorithms in a preset digest algorithm set, the preset digest algorithm set includes at least an SM3 algorithm and a SHA256 algorithm, and the first digest algorithm and the second digest algorithm are the same or different digest algorithms.

4. The signature property delivery method according to claim 3, characterized in that: Before configuring the signature property expression method and the digest calculation process corresponding to the different types of signature properties, the method further includes: Allocating a corresponding signature key to the signature operation of the software to be protected; A signature verification certificate corresponding to the signature verification operation is generated based on the signature key.

5. The signature property delivery method according to claim 4, characterized in that: The step of signing the plurality of first target digest values ​​to obtain a plurality of signature values ​​having different signature properties includes: The plurality of first target digest values ​​are signed based on the signature key to obtain a plurality of signature values ​​with different signature properties.

6. The signature property delivery method according to claim 4, characterized in that: The method of performing a signature verification operation on the software to be verified based on the signature value to be verified and the digest calculation process and obtaining a corresponding digest baseline value, and comparing a second target digest value obtained after each digest calculation in the digest calculation process during the signature verification process with the digest baseline value, and identifying the signature property of the corresponding signature value to be verified based on the comparison result and using the signature property expression method to obtain a corresponding signature verification result, includes: Performing a verification operation on the signature value to be verified of the software to be verified based on the verification certificate to obtain a corresponding digest baseline value; Performing a digest calculation on the software to be verified to obtain a current second target digest value, and counting the corresponding number of digest calculations; comparing the current second target summary value with the summary baseline value; If the comparison result shows that the current second target digest value is consistent with the digest baseline value, the verification of the signature value to be verified is determined to be successful, and the corresponding signature complexity is determined based on the current number of digest calculations; wherein n digest calculations correspond to the nth signature complexity, and n is an integer not less than 2 and not greater than N; If the comparison result shows that the current second target digest value is inconsistent with the digest baseline value, a digest calculation is performed on the current second target digest value to obtain a new current second target digest value, and the corresponding digest calculation times are updated, and then the process jumps to comparing the current second target digest value with the digest baseline value until the verification of the signature value to be verified is successful.

7. The signature property transmission method according to any one of claims 1 to 6, characterized in that: After identifying the signature property of the corresponding signature value to be verified by the signature property expression method to obtain the corresponding signature verification result, the method further includes: Based on the signature property of the signature value to be verified, corresponding processing operations are performed on the software to be verified.

8. A signature property transmission device, characterized in that: include: A signature property configuration module is used to configure the corresponding signature property expression method and summary calculation process based on different types of signature properties; The digest calculation process is a calculation process that performs one or more digest calculations based on a number of identical or different digest algorithms to obtain a digest value; the signature property expression method is a method for expressing the signature property of the signature value based on the corresponding number of digest calculations when the signature value verification succeeds; a signature value generating module, configured to calculate a digest value of the protected software based on the digest calculation process to obtain a preset number of first target digest values, and to sign each of the first target digest values ​​to obtain the preset number of signature values; wherein different signature values ​​correspond to different signature properties; A signature value verification module is used to verify the software to be verified based on the signature value to be verified and the digest calculation process and obtain a corresponding digest baseline value, and compare the second target digest value obtained after each digest calculation in the digest calculation process during the verification process with the digest baseline value, identify the signature property of the corresponding signature value to be verified based on the comparison result and through the signature property expression method to obtain a corresponding verification result; the signature value to be verified is any one of the preset number of signature values.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the signature property delivery method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the signature property delivery method according to any one of claims 1 to 7 is implemented.

Images