A signature property transfer method, apparatus, device and medium

Abstract

The application discloses a signature property transmission method and device, equipment and medium, and relates to the technical field of software integrity protection. The method comprises the following steps: based on different types of signature property configuration, corresponding signature property expression methods and digest calculation processes are configured; based on the digest calculation process, digest value calculation is performed on the software to be protected to obtain a preset number of first target digest values, and signature is performed on the first target digest values to obtain a preset number of signature values; based on the signature value to be verified and the digest calculation process, signature verification is performed on the software to be verified to obtain a corresponding digest baseline value, the second target digest value obtained after each digest calculation in the digest calculation process in the signature verification process is compared with the digest baseline value, based on the comparison result and through the signature property expression method, the signature property of the corresponding signature value to be verified is recognized, and a corresponding signature verification result is obtained. Therefore, the signature property can be recognized in the software integrity verification process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software integrity protection, and in particular to a signature property transmission method, device, equipment and medium. BACKGROUND

[0002] In the field of software integrity protection, the signature of the certificate verification digest is generally used to ensure software integrity, and the verification is passed to allow the software to run. When verifying software integrity, different types of signatures need to be identified and specially processed. The code allowed to run in the production environment is "officially signed", and the code not allowed to run in the production environment is "test signature"; for example, "strong signature" requires complete verification of certificate chain, validity period, revocation status, "relaxed signature" requires verification of certificate chain and validity period, and "weak signature" only needs to verify the basic certificate chain.

[0003] At present, to realize the identification of different signature types, the following two schemes are generally used: one is to distinguish by different private keys and certificates; that is, different nature signatures are encrypted by different private keys, and correspond to different signature certificates, and different nature signatures can be verified by certificate and digest value, so as to distinguish the signature nature by judging the signature certificate and implement specific processing. However, this scheme needs to apply for additional signature private key and certificate, thus bringing additional private key protection, certificate management, certificate analysis and other related complexity and security risks. The other is to add additional information for distinction; that is, additional data is added to identify the signature nature, and the signature nature is distinguished by the information in the integrity verification process, so as to implement specific processing. However, this scheme needs to consider the complexity and security risk of the saving, transmission and analysis process of the additional information. The above two schemes cannot complete the verification of signature nature at the same time of integrity verification, and need to further verify the signature nature of the software after the completion of the regular integrity verification mechanism, so as to realize the identification of signature nature at the same time of software integrity verification, and there is a TOCTOU (time-of-check-to-time-of-use, a software vulnerability) risk.

[0004] From the above, how to realize the identification of signature nature in the process of software integrity verification is an urgent problem to be solved. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a signature property transmission method, device, equipment and medium, which can realize the identification of signature nature in the process of software integrity verification. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a signature property transmission method, comprising:

[0007] The corresponding signature property expression method and the digest calculation process are configured based on the signature properties of different types; the digest calculation process is a calculation process of performing one or more digest calculations based on several same or different digest algorithms to obtain a digest value; and the signature property expression method is a method of expressing the signature properties of the signature values based on the corresponding number of digest calculations when the signature values are verified successfully;

[0008] The digest value calculation of the to-be-protected software is performed based on the digest calculation process to obtain a preset number of first target digest values, and each of the first target digest values is signed to obtain the preset number of signature values; different signature values correspond to different signature properties.

[0009] The to-be-verified software is verified based on the to-be-verified signature value and the digest calculation process to obtain a corresponding digest baseline value, and a second target digest value obtained after each digest calculation in the digest calculation process in the verification process is compared with the digest baseline value, the signature properties of the corresponding to-be-verified signature value are identified based on the comparison result and through the signature property expression method, and a corresponding verification result is obtained; the to-be-verified signature value is any one of the preset number of signature values.

[0010] Optionally, the different types of signature properties include the preset number of signature complexities.

[0011] Optionally, the digest value calculation of the to-be-protected software based on the digest calculation process to obtain a preset number of first target digest values includes:

[0012] If the digest calculation process corresponding to any one signature complexity is only one digest calculation, then one digest calculation of the to-be-protected software is performed based on a first digest algorithm to obtain a corresponding first target digest value.

[0013] If the digest calculation process corresponding to any one signature complexity is N times of digest calculation, where N is an integer not less than 2, then in the first digest calculation, one digest calculation of the to-be-protected software is performed based on a first digest algorithm to obtain a corresponding digest calculation result; in the n-th digest calculation, one digest calculation of the digest calculation result obtained after the (n-1)-th digest calculation is performed based on a second digest algorithm to obtain a corresponding digest calculation result; and the digest calculation result obtained after the N-th digest calculation is determined as the corresponding first target digest value; where n is an integer not less than 2 and not more than N.

[0014] The first and second digest algorithms are any digest algorithm in a preset digest algorithm set, the preset digest algorithm set at least includes SM3 algorithm and SHA256 algorithm, and the first and second digest algorithms are the same or different digest algorithms.

[0015] Optionally, before the corresponding signature property expression method and the digest calculation process are configured based on the different types of signature properties, the method further includes:

[0016] A signature key is assigned to the signature operation on the software to be protected.

[0017] A signature verification certificate corresponding to the signature verification operation is generated based on the signature key.

[0018] Optionally, the signature values with different signature properties are obtained by signing the first target digest values based on the signature key.

[0019] The signature values with different signature properties are obtained by signing the first target digest values based on the signature key.

[0020] Optionally, the signature property of the signature value to be verified is identified based on the comparison result and the signature property expression method to obtain a corresponding signature verification result, including:

[0021] The signature value to be verified of the software to be verified is verified based on the signature verification certificate to obtain a corresponding digest baseline value.

[0022] The current second target digest value is obtained by performing a digest calculation on the software to be verified, and a corresponding digest calculation number is counted.

[0023] The current second target digest value is compared with the digest baseline value.

[0024] If the comparison result shows that the current second target digest value is consistent with the digest baseline value, it is determined that the signature verification of the signature value to be verified is successful, and a corresponding signature complexity is determined based on the current digest calculation number; wherein, n-time digest calculation corresponds to the nth signature complexity, and n is an integer not less than 2 and not greater than N.

[0025] If the comparison result shows that the current second target digest value is inconsistent with the digest baseline value, the current second target digest value is subjected to a digest calculation to obtain a new current second target digest value, and the corresponding digest calculation times are updated, and then the current second target digest value is compared with the digest baseline value until the signature verification of the to-be-verified signature value succeeds.

[0026] Optionally, after the signature property of the to-be-verified signature value is identified by the signature property expression method to obtain a corresponding signature verification result, the method further includes:

[0027] Performing a corresponding processing operation on the to-be-verified software based on the signature property of the to-be-verified signature value.

[0028] In a second aspect, the present application provides a signature property transmission device, comprising:

[0029] A signature property configuration module is configured to configure a corresponding signature property expression method and a digest calculation process based on different types of signature properties; the digest calculation process is a calculation process of obtaining a digest value by performing one or more digest calculations based on a plurality of same or different digest algorithms; and the signature property expression method is a method of expressing the signature property of a signature value based on a corresponding digest calculation times when the signature value is successfully verified.

[0030] A signature value generation module is configured to perform a digest value calculation on to-be-protected software based on the digest calculation process to obtain a preset number of first target digest values, and perform a signature on each of the first target digest values to obtain a preset number of signature values; wherein different signature values correspond to different signature properties.

[0031] A signature value verification module is configured to perform a signature verification operation on to-be-verified software based on a to-be-verified signature value and the digest calculation process, and obtain a corresponding digest baseline value, and compare a second target digest value obtained after each digest calculation in the digest calculation process with the digest baseline value in the signature verification process, identify the signature property of the to-be-verified signature value based on the comparison result and by the signature property expression method, and obtain a corresponding signature verification result; the to-be-verified signature value is any one of the preset number of signature values.

[0032] In a third aspect, the present application provides an electronic device, comprising:

[0033] A memory is configured to save a computer program.

[0034] A processor is configured to execute the computer program to implement the signature property transmission method described above.

[0035] In a fourth aspect, the present application provides a computer readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned signature property transfer method.

[0036] The present application provides a signature property transfer method, which first configures a corresponding signature property expression method and an abstract calculation process based on different types of signature properties; the abstract calculation process is a calculation process of performing one or more abstract calculations based on several same or different abstract algorithms to obtain an abstract value; the signature property expression method is a method of expressing the signature property of a signature value corresponding to the abstract value through the calculation result of the abstract value obtained by the abstract calculation process; then, the abstract value calculation is performed on the software to be protected based on the abstract calculation process to obtain several target abstract values, and the signature is performed on the several target abstract values to obtain several signature values with different signature properties; finally, the signature verification operation is performed on the software to be verified based on the signature value to be verified and the abstract calculation process, and the signature property of the corresponding signature value to be verified is identified through the signature property expression method in the signature verification process to obtain the corresponding signature verification result; the signature value to be verified is any one of the several signature values with different signature properties.

[0037] As can be seen from the above, the present application configures a corresponding abstract calculation process based on different types of signature properties, and performs signature operation on the software to be protected based on the abstract calculation process to obtain several signature values with different signature properties, that is, by using different or same abstract algorithms in multiple combinations in the software integrity protection scenario to represent the signature property and other additional information and achieve information transfer, the signature property can be identified in the software integrity verification process. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on the provided drawings.

[0039] Figure 1 A signature property transfer method flowchart disclosed by the present application;

[0040] Figure 2 A signature process schematic diagram disclosed by the present application;

[0041] Figure 3 A signature verification process schematic diagram disclosed by the present application;

[0042] Figure 4A schematic diagram of a signature property transmission device disclosed in the present application is shown in the figure.

[0043] Figure 5 An electronic device structure diagram disclosed in the present application is shown in the figure. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be clearly and completely described in combination with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0045] Currently, to realize the identification of different signature types, the following two schemes are generally used: one is to distinguish by different private keys and certificates. However, this scheme needs to apply for additional signature private keys and certificates, thus bringing additional private key protection, certificate management, certificate analysis and other related complexity and security risks. The other is to distinguish by adding additional information. However, this scheme needs to consider the complexity and security risks of the saving, transmission and analysis process of the additional information. The above two schemes cannot complete the verification of the signature property while verifying the integrity, and need to further verify the signature property of the software after the completion of the conventional integrity verification mechanism, thus cannot complete the identification of the signature property simultaneously with the software integrity verification, and there is a TOCTOU risk. Therefore, the present application provides a signature property transmission scheme, which can realize the identification of the signature property in the software integrity verification process.

[0046] Referring to Figure 1 The embodiment disclosed in the present application discloses a signature property transmission method, which comprises:

[0047] In step S11, the signature property expression method and the digest calculation process corresponding to different types of signature properties are configured.

[0048] In the embodiment, before signing the software to be protected, the signature process needs to be allocated with a corresponding key, and a corresponding signature verification certificate is generated according to the key, so as to ensure the software integrity by verifying the signature of the digest through the certificate. Specifically, before the configuration of the signature property expression method and the digest calculation process corresponding to different types of signature properties, the signature operation of the software to be protected can also be allocated with a corresponding signature key, and a signature verification certificate corresponding to the signature verification operation can be generated based on the signature key. That is, by performing basic certificate chain legality verification on the signature key and the signature verification certificate, the data security of the software to be protected and the software to be verified is ensured, and the software data information is prevented from being stolen by a third party.

[0049] In this embodiment, the digest calculation process is a calculation process of performing one or more digest calculations based on one or more same or different digest algorithms to obtain a digest value; the signature property expression method is a method of expressing the signature property of the signature value based on the number of digest calculations corresponding to the successful signature verification of the signature value; and the specific type of the digest algorithm can be determined according to actual application, which is not specifically limited here. For example, in a specific implementation, the digest algorithm includes an SM3 algorithm and an SHA256 algorithm.

[0050] Further, the signature property is a property representing the signature type and the corresponding processing logic, which needs to be determined according to the actual application scenario, which is not specifically limited here. For example, the code allowed to run in the production environment is “formally signed”, the code not allowed to run in the production environment is “test signed”, the “strong signature” requiring complete verification of the certificate chain, validity period, revocation status, the “lenient signature” requiring verification of the certificate chain and validity period, and the “weak signature” only requiring basic certificate chain verification. Specifically, the different types of signature properties include the preset number of signature complexities. For example, in a specific implementation, the first signature complexity corresponds to a signature process based on the SM3 algorithm to perform one digest calculation and based on the signature key to obtain a signature value; the second signature complexity corresponds to a signature process based on the SM3 algorithm to perform a first digest calculation, then based on the SHA256 algorithm to perform a second digest calculation and based on the signature key to obtain a signature value; and the third signature complexity corresponds to a signature process based on the SM3 algorithm to perform a first digest calculation, then based on the SHA256 algorithm to perform a second digest calculation, and then based on the SHA256 algorithm to perform a third digest calculation and based on the signature key to obtain a signature value. Correspondingly, the second digest calculation based on the SHA256 algorithm can include digest calculation based on the SHA256 algorithm on the first digest calculation result of the SM3 algorithm; and the third digest calculation based on the SHA256 algorithm can include digest calculation based on the SHA256 algorithm on the second digest calculation result of the SHA256 algorithm. That is, the signature value representing different signature properties is obtained through signature processes with different complexities, so as to determine the signature property of the signature value to be verified in the signature verification process of the software to be verified, and execute the processing logic configured in advance.

[0051] In step S12, the digest value of the software to be protected is calculated based on the digest calculation process to obtain a preset number of first target digest values, and each first target digest value is signed to obtain the preset number of signature values.

[0052] In this embodiment, the software to be protected is signed based on the summary calculation process to obtain a plurality of signature values with different signature properties. That is, the plurality of first target summary values are signed based on the signature key to obtain a plurality of signature values with different signature properties. Specifically, the summary value calculation of the software to be protected based on the summary calculation process to obtain a preset number of first target summary values can include: if the summary calculation process corresponding to any one signature complexity is only one summary calculation, then one summary calculation of the software to be protected is performed based on the first summary algorithm to obtain the corresponding first target summary value; if the summary calculation process corresponding to any one signature complexity is N summary calculations, where N is an integer not less than 2, then in the first summary calculation, one summary calculation of the software to be protected is performed based on the first summary algorithm to obtain the corresponding summary calculation result; in the nth summary calculation, one summary calculation of the summary calculation result obtained after the (n-1)th summary calculation is performed based on the second summary algorithm to obtain the corresponding summary calculation result; and the summary calculation result obtained after the Nth summary calculation is determined as the corresponding first target summary value; where n is an integer not less than 2 and not greater than N; wherein the first summary algorithm and the second summary algorithm are any summary algorithm in the preset summary algorithm set, the preset summary algorithm set at least includes SM3 algorithm and SHA256 algorithm, and the first summary algorithm and the second summary algorithm are the same or different summary algorithm. That is, the summary calculation of the software to be protected is performed based on the SM3 algorithm to obtain a first summary value, and the first summary value is signed using the signature key to obtain a signature value with a first signature complexity; the first summary value is summarized based on the SHA256 algorithm to obtain a second summary value, and the second summary value is signed using the signature key to obtain a signature value with a second signature complexity; the second summary value is summarized based on the SHA256 algorithm to obtain a third summary value, and the third summary value is signed using the signature key to obtain a signature value with a third signature complexity.

[0053] Step S13, based on the signature value to be verified and the summary calculation process, the software to be verified is signed and the corresponding summary baseline value is obtained, and the second target summary value obtained after each summary calculation in the summary calculation process during the signature verification process is compared with the summary baseline value, based on the comparison result and through the signature property expression method, the signature property of the corresponding signature value to be verified is identified to obtain the corresponding signature verification result.

[0054] In the embodiment, the signature verification operation is performed on the to-be-verified software based on a to-be-verified signature value, and the signature property is identified in the signature verification process to obtain a corresponding signature verification result. The signature verification result is a signature property identification result of the to-be-verified signature. In a specific implementation, the to-be-verified signature value is verified based on the signature verification certificate to obtain a corresponding digest baseline value; the to-be-verified software is subjected to digest calculation based on the SM3 algorithm to obtain a first verification digest value, and the first verification digest value is compared with the digest baseline value; if the first verification digest value is consistent with the digest baseline value, the signature property of the to-be-verified signature value is identified as the first signature complexity, and a first signature verification result is obtained; if the first verification digest value is inconsistent with the digest baseline value, the first verification digest value is subjected to digest calculation based on the SHA256 algorithm to obtain a second verification digest value, and the second verification digest value is compared with the digest baseline value; if the second verification digest value is consistent with the digest baseline value, the signature property of the to-be-verified signature value is identified as the second signature complexity, and a second signature verification result is obtained; if the second verification digest value is inconsistent with the digest baseline value, the second verification digest value is subjected to digest calculation based on the SHA256 algorithm to obtain a third verification digest value, and the third verification digest value is compared with the digest baseline value; if the third verification digest value is consistent with the digest baseline value, the signature property of the to-be-verified signature value is identified as the third signature complexity, and a third signature verification result is obtained.Specifically, the signature verification operation on the software to be verified based on the signature value to be verified and the digest calculation process, and obtaining the corresponding digest baseline value, and comparing the second target digest value obtained after each digest calculation in the digest calculation process with the digest baseline value, identifying the signature property of the signature value to be verified based on the comparison result and through the signature property expression method, to obtain the corresponding signature verification result, can include: verifying the signature value to be verified of the software to be verified based on the signature certificate to obtain the corresponding digest baseline value; performing one digest calculation on the software to be verified to obtain the current second target digest value, and counting the corresponding number of digest calculations; comparing the current second target digest value with the digest baseline value; if the comparison result shows that the current second target digest value is consistent with the digest baseline value, it is determined that the signature verification of the signature value to be verified is successful, and the corresponding signature complexity is determined based on the current number of digest calculations; wherein the n-th signature complexity corresponds to n times of digest calculation, and n is an integer not less than 2 and not greater than N; if the comparison result shows that the current second target digest value is inconsistent with the digest baseline value, one digest calculation is performed on the current second target digest value to obtain a new current second target digest value, and the corresponding number of digest calculations is updated, and then the comparison of the current second target digest value with the digest baseline value is jumped to until the signature verification of the signature value to be verified is successful. That is, the digest value of the software to be verified is calculated through the digest calculation process configured in advance, and the verification digest value obtained by calculation is compared with the digest baseline value obtained by the signature certificate to obtain the corresponding signature verification result.

[0055] Further, after obtaining the verification result, the software to be verified needs to be processed according to the processing logic corresponding to the signature property. Specifically, after the signature verification operation on the software to be verified based on the signature value to be verified, and identifying the corresponding signature property in the signature verification process to obtain the corresponding signature verification result, it can further include: performing corresponding processing operation on the software to be verified based on the processing logic corresponding to the signature property of the signature value to be verified.

[0056] As can be seen from the above, the embodiments of the present application configure corresponding digest calculation processes based on different types of signature properties, and perform signature operation on the software to be protected based on the digest calculation process to obtain a plurality of signature values with different signature properties, wherein the digest calculation process is a signature process based on one or more digest algorithms to obtain a signature value; that is, by presetting the use of different or same digest algorithms in multiple combinations in the software integrity protection scene to represent the signature property and other additional information and achieve information transmission, the signature property can be identified in the software integrity verification process.

[0057] Further, the application provides a specific signature property transmission method, comprising:

[0058] Referring to Figure 2 In the embodiment, first, the signature and verification process are assigned with corresponding key pairs and certificates are generated. The signature property information to be transmitted and the corresponding digest algorithm selection and combination utilization method are agreed. In the embodiment, it is agreed that only the SM3 algorithm is used to calculate the digest value and sign as a "weak signature"; it is agreed that on the basis of the above digest value calculation method, the SHA256 algorithm is used again to calculate the digest value and sign as a "loose signature"; it is agreed that on the basis of the above digest value calculation method, the SHA256 method is used again to calculate the digest value and sign as a "strong signature". The digest value of the software to be protected is calculated by the SM3 algorithm, denoted as HASH1. The HASH1 is signed to obtain a weak signature value. The digest value of the software to be protected is calculated by the SM3 algorithm, denoted as HASH1. The digest value of HASH1 is calculated by the SHA256 algorithm, denoted as HASH2. The HASH2 is signed to obtain a loose signature value. The digest value of the software to be protected is calculated by the SM3 algorithm, denoted as HASH1. The digest value of HASH1 is calculated by the SHA256 algorithm, denoted as HASH2. The digest value of HASH2 is calculated by the SHA256 algorithm, denoted as HASH3. The HASH3 is signed to obtain a strong signature value.

[0059] Further, referring to Figure 3 In the embodiment, the verification operation is performed on the above three signatures with different signature properties. First, the signature value is verified by the verification certificate to obtain a digest baseline, denoted as HASH_BASELINE. The digest value of the software to be verified is calculated by the SM3 algorithm, denoted as HASH1'. It is judged whether HASH1' is equal to HASH_BASELINE. If they are equal, the signature value is identified as a weak signature, and the verification strength of the certificate is further judged according to the agreement and the corresponding processing is performed according to the result. If they are not equal, the digest value of HASH1' is calculated by the SHA256 algorithm, denoted as HASH2'. It is judged whether HASH2' is equal to HASH_BASELINE. If they are equal, the signature value is identified as a loose signature, and the verification strength of the certificate is further judged according to the agreement and the corresponding processing is performed according to the result. If they are not equal, the digest value of HASH2' is calculated by the SHA256 algorithm, denoted as HASH3'. It is judged whether HASH3' is equal to HASH_BASELINE. If they are equal, the signature value is identified as a strong signature, and the verification strength of the certificate is further judged according to the agreement and the corresponding processing is performed according to the result. If they are not equal, the software integrity check fails.

[0060] From the above, the embodiment of the present application uses different or same digest algorithm multiple combinations to represent additional information such as signature property and complete information transmission in integrity protection scenario through preset agreement; and according to the preset agreement, the to-be-transmitted information is obtained by using the above different digest algorithm or same digest algorithm multiple combinations at the verification end. Thus, the signature property is identified in the software integrity verification process.

[0061] Referring to Figure 4 As shown in the figure, the embodiment of the present application discloses a signature property transmission device, which comprises:

[0062] The signature property configuration module 11 is configured to configure the corresponding signature property expression method and digest calculation process based on different types of signature properties; the digest calculation process is a calculation process of performing one or more digest calculations based on a plurality of same or different digest algorithms to obtain a digest value; and the signature property expression method is a method of expressing the signature property of the signature value based on the corresponding number of digest calculations when the signature value is verified successfully;

[0063] The signature value generation module 12 is configured to calculate the digest value of the to-be-protected software based on the digest calculation process to obtain a preset number of first target digest values, and to sign each of the first target digest values to obtain the preset number of signature values; wherein different signature values correspond to different signature properties;

[0064] The signature value verification module 13 is configured to perform a verification operation on the to-be-verified software based on the to-be-verified signature value and the digest calculation process, and to obtain a corresponding digest baseline value, and to compare the second target digest value obtained after each digest calculation in the digest calculation process with the digest baseline value in the verification process, and to identify the signature property of the corresponding to-be-verified signature value based on the comparison result and through the signature property expression method, so as to obtain a corresponding verification result; the to-be-verified signature value is any one of the preset number of signature values.

[0065] From the above, the embodiment of the present application configures the corresponding digest calculation process based on different types of signature properties, and performs a signature operation on the to-be-protected software based on the digest calculation process, so as to obtain a plurality of signature values with different signature properties, that is, the signature property and other additional information are represented by using different or same digest algorithm multiple combinations in the software integrity protection scenario, and information transmission is achieved, so that the signature property can be identified in the software integrity verification process.

[0066] In some specific embodiments, the signature value generation module 12 can specifically comprise:

[0067] The first digest calculation unit is configured to perform one-time digest calculation on the software to be protected based on a first digest algorithm to obtain a corresponding first target digest value if the digest calculation process corresponding to any one signature complexity is one-time digest calculation.

[0068] The Nth digest calculation unit is configured to perform one-time digest calculation on the software to be protected based on a first digest algorithm to obtain a corresponding digest calculation result at the first time of digest calculation if the digest calculation process corresponding to any one signature complexity is N-time digest calculation, where N is an integer not less than 2; perform one-time digest calculation on the digest calculation result obtained after the (n-1)th time of digest calculation based on a second digest algorithm to obtain a corresponding digest calculation result at the nth time of digest calculation; and determine the digest calculation result obtained after the Nth time of digest calculation as a corresponding first target digest value, where n is an integer not less than 2 and not greater than N.

[0069] The signature value generation unit is configured to perform signature on the plurality of first target digest values based on the signature key to obtain a plurality of signature values with different signature properties.

[0070] The first digest algorithm and the second digest algorithm are any digest algorithm in a preset digest algorithm set, the preset digest algorithm set at least includes SM3 algorithm and SHA256 algorithm, and the first digest algorithm and the second digest algorithm are the same or different digest algorithms.

[0071] In some embodiments, the signature value verification module 13 can specifically include:

[0072] The digest baseline value generation unit is configured to perform verification operation on the to-be-verified signature value of the software to be verified based on the signature verification certificate to obtain a corresponding digest baseline value.

[0073] The digest baseline value comparison unit is configured to compare the current second target digest value with the digest baseline value.

[0074] The signature complexity determination unit is configured to determine that the signature verification of the to-be-verified signature value is successful if the comparison result shows that the current second target digest value is consistent with the digest baseline value, and determine a corresponding signature complexity based on the current number of digest calculation; where the n-time digest calculation corresponds to the nth signature complexity, and n is an integer not less than 2 and not greater than N.

[0075] The abstract baseline value comparison step jumps to a unit for comparing the current second target abstract value with the abstract baseline value, and if the comparison result shows that the current second target abstract value is inconsistent with the abstract baseline value, performing an abstract calculation on the current second target abstract value to obtain a new current second target abstract value, updating the corresponding abstract calculation times, and then jumping to the step of comparing the current second target abstract value with the abstract baseline value until the signature verification of the to-be-verified signature value is successful.

[0076] In some embodiments, the signature property transfer device can further include:

[0077] A key configuration module is configured to assign a signature key to the signature operation of the to-be-protected software.

[0078] A certificate generation module is configured to generate a signature verification certificate corresponding to the signature verification operation based on the signature key.

[0079] An operation execution module is configured to perform a corresponding processing operation on the to-be-verified software based on the signature property of the to-be-verified signature value.

[0080] Further, the embodiment of the present application further discloses an electronic device, Figure 5 is an electronic device 20 structure diagram shown according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application. The electronic device 20, specifically can include: at least one processor 21, at least one memory 22, power supply 23, communication interface 24, input output interface 25 and communication bus 26. Wherein, the memory 22 is used to store computer program, the computer program is loaded and executed by the processor 21, to realize the related steps in the signature property transfer method disclosed in any preceding embodiment. In addition, the electronic device 20 in the embodiment specifically can be electronic computer.

[0081] In the embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create data transmission channel between the electronic device 20 and external device, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which is not limited specifically herein; the input output interface 25 is used to obtain external input data or output data to the outside world, and the specific interface type can be selected according to the specific application needs, which is not limited specifically herein.

[0082] In addition, the memory 22 as the carrier of resource storage can be read-only memory, random access memory, disk or optical disk, etc., and the resources stored thereon can include operating system 221, computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0083] The operating system 221 is configured to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of performing the signature property transfer method disclosed in any of the above embodiments by the electronic device 20, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0084] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the signature property transfer method disclosed above. For the specific steps of the method, please refer to the corresponding content disclosed in the above embodiments, which will not be repeated here.

[0085] Each embodiment in the present specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. For the same or similar parts between each embodiment, please refer to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and please refer to the method part for the relevant part.

[0086] The skilled person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0087] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0088] Finally, it needs to be pointed out that in this document, relational terms such as first and second and the like can only be intended to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the stated element.

[0089] The above detailed description of the technical solutions provided by the present application has been provided, and the principles and implementation modes of the present application have been described by applying specific examples. The above description of the examples is only for the purpose of helping to understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed, and the above description of the content of the specification should not be understood as a limitation of the present application.

Claims

1. A signature property transfer method characterized by, The application relates to a signature property expression method and a signature verification method. The application comprises: configuring corresponding signature property expression methods and digest calculation processes based on different types of signature properties; the digest calculation process is a calculation process for carrying out one or more times of digest calculation based on several same or different digest algorithms to obtain a digest value; the signature property expression method is a method for expressing the signature property of a signature value based on the corresponding number of times of digest calculation when the signature value is verified successfully; based on the digest calculation process, digest values of to-be-protected software are calculated to obtain a preset number of first target digest values, and each first target digest value is signed to obtain the preset number of signature values; wherein different signature values correspond to different signature properties; 2. The method of claim 1, wherein, based on a to-be-verified signature value and the digest calculation process, a signature verification operation is carried out on to-be-verified software to obtain a corresponding digest baseline value, and a second target digest value obtained after each time of digest calculation in the digest calculation process in the signature verification process is compared with the digest baseline value; based on the comparison result and through the signature property expression method, the signature property of the corresponding to-be-verified signature value is identified to obtain a corresponding signature verification result; the to-be-verified signature value is any one of the preset number of signature values.

3. The method of claim 2, wherein, The different types of signature properties include the preset number of signature complexities. The calculation of the digest values of the to-be-protected software based on the digest calculation process to obtain the preset number of first target digest values comprises: if the digest calculation process corresponding to any one signature complexity is only one time of digest calculation, then one time of digest calculation is carried out on the to-be-protected software based on a first digest algorithm to obtain a corresponding first target digest value; if the digest calculation process corresponding to any one signature complexity is N times of digest calculation, wherein N is an integer not less than 2, then in the first time of digest calculation, one time of digest calculation is carried out on the to-be-protected software based on a first digest algorithm to obtain a corresponding digest calculation result; in the n-th time of digest calculation, one time of digest calculation is carried out on the digest calculation result obtained after the (n-1)-th time of digest calculation based on a second digest algorithm to obtain a corresponding digest calculation result; and the digest calculation result obtained after the N-th time of digest calculation is determined as the corresponding first target digest value; wherein n is an integer not less than 2 and not more than N; 4. The method of claim 3, wherein, wherein the first digest algorithm and the second digest algorithm are any digest algorithm in a preset digest algorithm set, the preset digest algorithm set at least comprises an SM3 algorithm and an SHA256 algorithm, and the first digest algorithm and the second digest algorithm are same or different digest algorithms. Before the configuration of the corresponding signature property expression methods and digest calculation processes based on different types of signature properties, the method further comprises: allocating a corresponding signature key to the signature operation of the to-be-protected software; 5. The method of claim 4, wherein, generating a signature verification certificate corresponding to the signature verification operation based on the signature key. The signing of the several first target digest values to obtain several signature values with different signature properties comprises: the signing of the several first target digest values to obtain several signature values with different signature properties based on the signature key.

6. The method of claim 4, wherein, The signature verification value is verified based on the signature verification certificate, to obtain a corresponding digest baseline value; The digest of the to-be-verified software is calculated once to obtain a current second target digest value, and the corresponding number of digest calculations is counted; The current second target digest value is compared with the digest baseline value; If the comparison result shows that the current second target digest value is consistent with the digest baseline value, it is determined that the signature verification of the to-be-verified signature value is successful, and the corresponding signature complexity is determined based on the current number of digest calculations; wherein n times of digest calculation corresponds to the nth signature complexity, and n is an integer not less than 2 and not greater than N; If the comparison result shows that the current second target digest value is inconsistent with the digest baseline value, the current second target digest value is calculated once to obtain a new current second target digest value, and the corresponding number of digest calculations is updated, and then the current second target digest value is compared with the digest baseline value, until the signature verification of the to-be-verified signature value is successful. After the signature property of the to-be-verified signature value is identified based on the signature property expression method to obtain a corresponding signature verification result, the following steps are further included:

7. The method of signing property transfer according to any one of claims 1 to 6, characterized in that, Based on the signature property of the to-be-verified signature value, the to-be-verified software is executed corresponding processing operation. It includes:

8. A signature property transfer apparatus characterized by comprising: The signature property configuration module is configured to configure the corresponding signature property expression method and the digest calculation process based on different types of signature properties; The digest calculation process is a calculation process based on one or more digest algorithms to obtain a digest value; the signature property expression method is a method for expressing the signature property of the signature value based on the corresponding number of digest calculations when the signature value is successfully verified; The signature value generation module is configured to calculate the digest value of the to-be-protected software based on the digest calculation process to obtain a preset number of first target digest values, and sign each of the first target digest values to obtain the preset number of signature values; wherein different signature values correspond to different signature properties; The signature value verification module is configured to verify the to-be-verified software based on the to-be-verified signature value and the digest calculation process, and obtain a corresponding digest baseline value, and compare a second target digest value obtained after each digest calculation in the signature verification process with the digest baseline value, identify the signature property of the to-be-verified signature value based on the comparison result and through the signature property expression method, to obtain a corresponding signature verification result; the to-be-verified signature value is any one of the preset number of signature values. It includes:

9. An electronic device, comprising: ​ a memory for holding a computer program; a processor for executing the computer program to implement the signature property propagation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, a computer program product for holding a computer program which, when executed by a processor, implements the signature property propagation method according to any one of claims 1 to 7.

Images