Method and device for carrying out signature reinforcement on swan mongolian HAP packet, and medium

Abstract

The invention discloses a method and equipment for carrying out signature reinforcement on a swan HAP packet and a medium, and the method comprises the steps: executing a swan original signature, and generating an HAP application packet; the method comprises the following steps: generating Manifest signature data according to an HAP application package, and embedding the Manifest signature data into an HAP Signing Block signature block; executing signature verification of the original signature of the swan gap; the method comprises the following steps: acquiring Manifest signature data from an HAP Signing Block signature block; performing signature verification on the HAP application package according to the Manifest signature data; after the signature verification is passed, installing an HAP application package on the POS terminal equipment, and storing Manifest signature data; and periodically obtaining the saved application list file signature from the installation position, and carrying out self-inspection on the installed HAP application package according to the application list file signature. According to the method, the security of the HAP application package can be improved, and the security requirement of the financial POS industry is met.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device and medium for signing and reinforcing a Hongmeng HAP package. Background Art

[0002] HAP (Harmony Application Package) is the application package format of the Hongmeng system. Similar to the APK package design of the Android system, the HAP package is actually based on the ZIP file format specification. The signed HAP simply inserts the Hongmeng customized "signature data block" without destroying the native ZIP format.

[0003] A standard ZIP file consists of five parts: a local file header (one for each file), data (the actual data of the file, which may or may not be compressed), a data descriptor, a central directory file header (a record for each file), and an end of central directory record (the end position of the compressed file, hereinafter referred to as EOCD, there is only one in the world).

[0004] When we compress multiple files into a ZIP package, the multiple files are stored separately in the ZIP package, and each file generates an entry (record). The entry includes the local file header at the front, the data in the middle (the actual data of the file, which may be compressed or not), and the data descriptor at the end (this exists conditionally). That is, a single entry contains: local file header + data +

[0005] data descriptor; after all the entries of the files are stored, the central directory file header is generated. Each file will correspond to a central directory file header. After all the central directory file headers are completed, an EOCD will be added. A ZIP file has only one EOCD. Among them, the central directory file header records the location information of each entry. When the ZIP file is decompressed, the entry is quickly located according to the central directory without reading the entire file for search.

[0006] HAP is the installation package of the application. In order to ensure the integrity and reliable source of the OpenHarmony application, the application needs to be signed when the application is built. Only the signed application can be installed, run and debugged on the real device. The signature scheme of the standard HAP is to add a HAP Signing Block before the central directory file area without destroying the records in the central directory file area. Its structure is as follows: Figure 1 The HAP package application signature verification and installation process is divided into two parts: first, the HAP Singing Block signature block is taken out for signature verification, and second, it is decompressed and installed in the ZIP file format.

[0007] Hongmeng standard HAP signature adopts PKI technology and supports signatures of RSA and ECC algorithms. The HAP Signing Block signature block mainly consists of two parts:

[0008] 1. HAP SigningBlockData: specific data of the signature block, including multiple sub-blocks of different types, such as profile blocks and signature blocks;

[0009] 2. HAP SigningBlockHeader signature block header, fixed to 32 bytes, contains the judgment flag and length information of the entire signature block;

[0010] Among them, HAPSigningBlockData contains two standard pkcs#7 signature files, namely the profile signature and the application signature. The application signature is the signature of the unsigned original ZIP compressed file package. During the installation phase of the application, the OpenHarmony user program framework subsystem is responsible for the installation of the application. After receiving the application installation package, the application framework subsystem needs to parse the signature data of the installation package, and then use the API of the application integrity verification module to verify the signature. Only after the verification is successful is the application allowed to be installed. When verifying the signature data of the installation package, the application integrity verification module will use the system preset public key certificate for signature verification. The signature verification process is as follows:

[0011] Parse the HAP Signing Block to obtain the Profile signature and application signature;

[0012] Verify the signature of the Profile file using the preset Profile verification public key certificate;

[0013] Verify the application signature through the preset application signature verification public key certificate;

[0014] From the above process, it can be seen that after the signature verification is passed, the HAP package will be processed as a standard ZIP file, directly decompressed and installed to the specified location, and the original HAP installation package will no longer be saved, and the signature information in the HAP Signing Block will no longer be retained. That is, the signature verification of the application is only performed once during the application installation phase, and cannot be verified later. Therefore, if the application is illegally tampered with after installation, the system will not be able to identify and trace it.

[0015] In the financial POS industry, there are clear security standards for the protection of applications after installation. Taking the PCI security specification requirements as an example, it requires POS terminal payment devices to perform system self-checks at system startup and every 24 hours, and it is necessary to re-verify the authenticity and integrity of installed applications. From the above description of the Hongmeng native signature scheme, it can be seen that since the native signature of Hongmeng HAP is lost after the application is installed, it cannot meet the self-check requirement of periodically re-verifying the integrity of the application after installation. Summary of the invention

[0016] In view of this, the purpose of the present invention is to propose a method for signature reinforcement of the Hongmeng HAP package, adding an application manifest file on the basis of the Hongmeng HAP native signature to save the file name and hash value of each application file of the HAP application package and its manifest signature file, thereby realizing security self-check of the HAP application package, improving the security of the HAP application package, and meeting the security requirements of the financial POS industry.

[0017] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0018] The present invention provides a method for signing and reinforcing a Hongmeng HAP package, comprising the following steps:

[0019] Step 1: Execute the Hongmeng native signature to generate the Hongmeng standard HAP application package;

[0020] Step 2: Generate Manifest signature data according to the HAP application package, and embed the Manifest signature data into the HAP Signing Block of the HAP application package;

[0021] Step 3: Verify the Hongmeng native signature. After the verification is passed, proceed to step 4.

[0022] Step 4: Get the Manifest signature data from the HAP Signing Block.

[0023] Step 5: Verify the signature of the HAP application package according to the Manifest signature data; after the signature verification is passed, install the HAP application package on the POS terminal device and save the Manifest signature data at the installation location;

[0024] Step 6: Periodically obtain the saved application manifest file signature from the installation location, and perform a self-check on the installed HAP application package according to the application manifest file signature.

[0025] Furthermore, the step 2 specifically includes:

[0026] Step 21: parsing the HAP application package, obtaining the file name of each application file in the HAP application package, and calculating the hash value corresponding to each application file in the HAP application package in turn according to the hash algorithm;

[0027] Step 22: Generate an application list file according to the file names and hash values ​​corresponding to all application files in the HAP application package;

[0028] Step 23: Use the application signature private key to sign the application manifest file to generate a manifest signature file;

[0029] Step 24: embed the manifest signature data consisting of the application manifest file and the manifest signature file into the HAP Signing Block of the HAP application package to complete the signing.

[0030] Furthermore, the manifest signature file adopts the PCKS#7 format, and the manifest signature file includes the digital signature information of the application manifest file and the application signature certificate used.

[0031] Furthermore, the step 24 specifically includes:

[0032] Step 241: The HAP Signing Block of the HAP application package includes the HAPSigningBlockHeader signature block header and the HAP SigningBlockData signature block specific data;

[0033] Step 242: Set corresponding header information and data information according to the Manifest signature data;

[0034] Step 243: embed the header information into HAP SigningBlockHeader; the header information includes type, length and offset, and the type includes the ID corresponding to the Manifest signature data;

[0035] Step 244: embed the data information into HAP SigningBlockData, where the data information includes an offset and Manifest signature data.

[0036] Furthermore, in step 4, obtaining the Manifest signature data from the HAP Signing Block signature block specifically includes:

[0037] Step 41: According to the ID corresponding to the Manifest signature data, parse the header information matching the ID from the HAP SigningBlockHeader;

[0038] Step 42: Obtain the offset of the record from the header information;

[0039] Step 43: Find the corresponding data information from HAP SigningBlockData according to the offset;

[0040] Step 44: Obtain the corresponding Manifest signature data from the data information to obtain the application manifest file and the manifest signature file.

[0041] Furthermore, the step 5 specifically includes:

[0042] Step 51: When the POS terminal device leaves the factory, the manufacturer pre-installs the application signature certificate used for signature verification in the POS terminal device;

[0043] Step 52: Use the pre-installed application signature certificate to verify the signature of the manifest signature file;

[0044] Step 53: After the signature verification is passed, the file name of each application file in the HAP application package is parsed in turn, and the hash value corresponding to each application file in the HAP application package is calculated in turn according to the hash algorithm;

[0045] Step 54: Compare the file name and hash value of each application file in the HAP application package with the file name and hash value of each application file recorded in the application list file one by one, and determine whether each application file in the HAP application package is consistent with each application file recorded in the application list file. If so, it proves that the HAP application package is legal, the verification passes, and the process goes to step 55; if not, it is determined that the HAP application package is damaged, and the verification fails;

[0046] Step 55: decompress the HAP application package and install the decompressed HAP application package in the corresponding installation directory;

[0047] Step 56: Store the application manifest file and manifest signature file in corresponding locations of the installation directory.

[0048] Furthermore, the step 6 specifically includes:

[0049] Step 61: When the POS terminal device is powered on and reaches a set self-check time, scan the installation directories of all applications in the POS terminal device;

[0050] Step 62: Retrieve the corresponding application manifest file and manifest signature file from the corresponding location of the installation directory;

[0051] Step 63: Use the pre-installed application signature certificate to verify the signature of the manifest signature file;

[0052] Step 64: After the signature verification is passed, the file name of each application file in the installation directory is parsed in turn, and the hash value corresponding to each application file in the installation directory is calculated in turn according to the hash algorithm;

[0053] Step 65: Compare the file name and hash value of each application file in the installation directory with the file name and hash value of each application file recorded in the application manifest file one by one to determine whether each application file in the installation directory is consistent with each application file recorded in the application manifest file. If so, it proves that all application files in the installation directory are legal and the verification passes; if not, it is determined that all application files in the installation directory have been illegally tampered with, the verification fails, and they are deleted and an alarm is issued.

[0054] Furthermore, the set self-check time is to perform a self-check regularly every 24 hours.

[0055] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements a method for signing and reinforcing the Hongmeng HAP package as described above.

[0056] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements a method for signing and reinforcing the Hongmeng HAP package as described above.

[0057] By adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art:

[0058] 1. This signature verification scheme first generates an application manifest file based on the file name and hash value corresponding to each application file in the HAP application package, and then signs the application manifest file to generate a manifest signature file; by protecting the authenticity and integrity of the application manifest file, the application file is tamper-proof, so there is no need to perform a separate signature verification on each application file, which can significantly improve the efficiency of application signing and the performance of system self-checking verification.

[0059] 2. By embedding the Manifest signature data in the HAP Signing Block, the Manifest can be signed after the HarmonyOS native signature without destroying the original HAP signature information and package format, ensuring the forward compatibility of the signed HAP application package. The signed HAP application package can still be verified through the HarmonyOS standard process.

[0060] 3. After installation, the HAP application package signed by Manifest can still save the Manifest signature data (including the application manifest file and the manifest signature file), thereby meeting the application's anti-tampering self-checking requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1 It is an execution flow chart of a method for signing and reinforcing a Hongmeng HAP package provided by an embodiment of the present invention.

[0063] Figure 2 It is a schematic diagram of the signature position provided by an embodiment of the present invention.

[0064] Figure 3 It is a schematic diagram of an electronic device provided by an embodiment of the present invention.

[0065] Figure 4 It is a schematic diagram of a computer-readable storage medium provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The present invention will be further described in detail below in conjunction with the accompanying drawings and examples. It is particularly noted that the following examples are only used to illustrate the present invention, but are not intended to limit the scope of the present invention. Similarly, the following examples are only partial embodiments of the present invention rather than all embodiments, and all other embodiments obtained by those of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0067] Through the analysis of the native signature format of Hongmeng applications, it can be known that Hongmeng applications are actually based on compressed files in ZIP format, and a signature data block is added before the central directory file area. The design idea of ​​the present invention is to directly sign the entire signed Hongmeng HAP application package (the file itself has been signed by the native Hongmeng application) for a second time, and add a special application manifest file signature (Manifest signature data) to the HAP Signing Block signature block of the HAP application package to achieve the purpose of adding the signature information of the application manifest file and ensuring that the added signature information will not affect the installation process of the original Hongmeng application, and embed the generated Manifest signature data into the HAP Signing Block signature block between the compressed file content source data and the directory source data.

[0068] See also Figure 1 and Figure 2 , a method for signing and reinforcing a Hongmeng HAP package of the present invention comprises the following steps:

[0069] Step 1: Execute the Hongmeng native signature to generate the Hongmeng standard HAP application package;

[0070] Step 2: Generate Manifest signature data according to the HAP application package, and embed the Manifest signature data into the HAP Signing Block of the HAP application package;

[0071] In this embodiment, step 2 specifically includes:

[0072] Step 21, parse the HAP application package, obtain the file name of each application file in the HAP application package, and calculate the hash value corresponding to each application file in the HAP application package in turn according to the hash algorithm (such as SHA-256); the hash value is a "data fingerprint" obtained by the hash algorithm, which is a set of binary values ​​obtained by encrypting a set of input information of any length. The main feature of the hash value is uniqueness, that is, once any slight change occurs to the original data, its hash value will also change significantly. The hash value can be regarded as the DNA or ID card of a piece of data (such as a file or string), which is used for file verification or signature.

[0073] Step 22: Generate an application manifest file (MANIFEST.SF) according to the file names and hash values ​​corresponding to all application files in the HAP application package;

[0074] Step 23: Use the application signature private key to sign the application manifest file and generate a manifest signature file (CERT.SGN); use the hash function to perform digest calculation on the application file to be signed to generate a fixed-length hash value, and then use the application signature private key to encrypt the hash value to generate a digital signature. The hash value and signature together ensure the security and authenticity of the information.

[0075] In this embodiment, the manifest signature file adopts the PCKS#7 format, and the manifest signature file includes the digital signature information of the application manifest file and the application signature certificate used. The PCKS#7 format is widely supported and used, and can provide a consistent signing and verification process between different systems and applications.

[0076] Step 24: embed the manifest signature data consisting of the application manifest file and the manifest signature file into the HAP Signing Block of the HAP application package to complete the signing.

[0077] The signature verification scheme first generates an application manifest file according to the file name and hash value corresponding to each application file in the HAP application package, and then signs the application manifest file to generate a manifest signature file. By protecting the authenticity and integrity of the application manifest file, the application file is tamper-proof, thereby eliminating the need to perform separate signature verification on each application file, which can significantly improve the efficiency of application signing and the performance of system self-check verification.

[0078] The specific contents of MANIFEST.SF and CERT.SGN are designed as follows:

[0079]

[0080]

[0081]

[0082] In this embodiment, step 24 specifically includes:

[0083] Step 241: The HAP Signing Block of the HAP application package includes the HAPSigningBlockHeader signature block header and the HAP SigningBlockData signature block specific data;

[0084] Step 242: Set corresponding header information and data information according to the Manifest signature data;

[0085] Step 243: embed the header information into HAP SigningBlockHeader; the header information includes type, length and offset, and the type includes the ID corresponding to the Manifest signature data, for example, the ID is 0x4e505420;

[0086] Step 244: embed the data information into HAP SigningBlockData, wherein the data information includes an offset and Manifest signature data. The offset can be used to associate the header information with the data information, and the Manifest signature data in the data information can be quickly found.

[0087] By embedding the Manifest signature data in the HAP Signing Block, the Manifest can be signed after the HarmonyOS native signature without destroying the original HAP signature information and package format, thus ensuring the forward compatibility of the signed HAP application package. The signed HAP application package can still be verified through the HarmonyOS standard process.

[0088] After the HAP application package is signed by Hongmeng native, the Manifest is signed and the Manifest signature data described above is embedded into the HAP Signing Block. The HAP Signing Block format is designed as follows:

[0089]

[0090]

[0091]

[0092] The data format written into the custom data location of the HAP Signing Block is as follows. The signature data is encoded in DER format and stored in little endian, HapSigningBlockData:

[0093]

[0094] Step 3: Verify the Hongmeng native signature. After the verification is passed, proceed to step 4.

[0095] Step 4: Get the Manifest signature data from the HAP Signing Block.

[0096] In this embodiment, the step 4 of obtaining the Manifest signature data from the HAP Signing Block specifically includes:

[0097] Step 41: According to the ID corresponding to the Manifest signature data, parse the header information matching the ID from the HAP SigningBlockHeader; that is, parse the header information with the ID 0x4e505420 from the HAP SigningBlockHeader;

[0098] Step 42: Obtain the offset of the record from the header information;

[0099] Step 43: Find the corresponding data information from HAP SigningBlockData according to the offset;

[0100] Step 44: Obtain the corresponding Manifest signature data from the data information to obtain the application manifest file and the manifest signature file.

[0101] Step 5: Verify the signature of the HAP application package according to the Manifest signature data; after the signature verification is passed, install the HAP application package on the POS terminal device and save the Manifest signature data at the installation location;

[0102] In this embodiment, step 5 specifically includes:

[0103] Step 51: When the POS terminal device leaves the factory, the manufacturer pre-installs the application signature certificate used for signature verification in the POS terminal device;

[0104] Step 52: Use the pre-installed application signature certificate to verify the signature of the manifest file, so as to verify the authenticity and integrity of the application manifest file. If the signature verification passes, it means that the application manifest file is authentic and complete, and can be used as a basis for subsequent verification; if the signature verification fails, it means that the application manifest file is unauthentic and / or incomplete, and cannot be used as a basis for subsequent verification;

[0105] Step 53: After the signature verification is passed, the file name of each application file in the HAP application package is parsed in turn, and the hash value corresponding to each application file in the HAP application package is calculated in turn according to the hash algorithm;

[0106] Step 54: Compare the file name and hash value of each application file in the HAP application package with the file name and hash value of each application file recorded in the application list file one by one, and determine whether each application file in the HAP application package is consistent with each application file recorded in the application list file. If so, it proves that the HAP application package is legal, the verification passes, and the process goes to step 55; if not, it is determined that the HAP application package is damaged, and the verification fails;

[0107] Step 55: decompress the HAP application package and install the decompressed HAP application package in the corresponding installation directory;

[0108] Step 56: Store the application manifest file and manifest signature file in the corresponding location of the installation directory (e.g., . / SIGN-INF / directory) and save them persistently for subsequent signature verification during the POS terminal device self-check. The HAP application package signed by the Manifest can still save the Manifest signature data (including the application manifest file and the manifest signature file) after installation, thereby meeting the application's anti-tampering self-check requirements.

[0109] Step 6: Periodically obtain the saved application manifest file signature from the installation location, and perform a self-check on the installed HAP application package according to the application manifest file signature.

[0110] In this embodiment, step 6 specifically includes:

[0111] Step 61: When the POS terminal device is powered on and reaches a set self-checking time, the set self-checking time is to perform a self-checking once every 24 hours; scan the installation directories of all applications in the POS terminal device;

[0112] Step 62: Take out the corresponding application manifest file and manifest signature file from the corresponding location of the installation directory (such as: . / SIGN-INF / directory);

[0113] Step 63: Use the pre-installed application signature certificate to verify the signature of the manifest file; thereby verifying the authenticity and integrity of the application manifest file. If the signature verification passes, it means that the application manifest file is authentic and complete, and can be used as a basis for subsequent verification; if the signature verification fails, it means that the application manifest file is unauthentic and / or incomplete, and cannot be used as a basis for subsequent verification;

[0114] Step 64: After the signature verification is passed, the file name of each application file in the installation directory is parsed in turn, and the hash value corresponding to each application file in the installation directory is calculated in turn according to the hash algorithm;

[0115] Step 65: Compare the file name and hash value of each application file in the installation directory with the file name and hash value of each application file recorded in the application manifest file one by one to determine whether each application file in the installation directory is consistent with each application file recorded in the application manifest file. If so, it proves that all application files in the installation directory are legal and the verification passes; if not, it is determined that all application files in the installation directory have been illegally tampered with, the verification fails, and they are deleted and an alarm is issued.

[0116] like Figure 3As shown, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method when executing the program.

[0117] like Figure 4 As shown, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above method is implemented.

[0118] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0119] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0120] The above descriptions are only some embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any equivalent device or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for signing and reinforcing a Hongmeng HAP package, characterized in that: The steps include: Step 1: Execute the Hongmeng native signature to generate the Hongmeng standard HAP application package; Step 2: Generate Manifest signature data according to the HAP application package, and embed the Manifest signature data into the HAP Signing Block of the HAP application package; Step 3: Verify the Hongmeng native signature. After the verification is passed, proceed to step 4. Step 4: Get the Manifest signature data from the HAP Signing Block. Step 5: Verify the HAP application package based on the Manifest signature data. After the signature verification is passed, install the HAP application package on the POS terminal device and save the Manifest signature data at the installation location. Step 6: Periodically obtain the saved application manifest file signature from the installation location, and perform a self-check on the installed HAP application package according to the application manifest file signature.

2. A method for signing and reinforcing a Hongmeng HAP package as claimed in claim 1, characterized in that: The step 2 specifically includes: Step 21: parsing the HAP application package, obtaining the file name of each application file in the HAP application package, and calculating the hash value corresponding to each application file in the HAP application package in turn according to the hash algorithm; Step 22: Generate an application list file according to the file names and hash values ​​corresponding to all application files in the HAP application package; Step 23: Use the application signature private key to sign the application manifest file to generate a manifest signature file; Step 24: embed the manifest signature data consisting of the application manifest file and the manifest signature file into the HAP Signing Block of the HAP application package to complete the signing.

3. A method for signing and reinforcing a Hongmeng HAP package as claimed in claim 2, characterized in that: The manifest signature file adopts the PCKS#7 format, and the manifest signature file includes the digital signature information of the application manifest file and the application signature certificate used.

4. A method for signing and reinforcing a Hongmeng HAP package as claimed in claim 3, characterized in that: The step 24 specifically includes: Step 241: The HAP Signing Block of the HAP application package includes a HAP SigningBlockHeader signature block header and HAP SigningBlockData signature block specific data; Step 242: Set corresponding header information and data information according to the Manifest signature data; Step 243: embed the header information into HAP SigningBlockHeader; the header information includes type, length and offset, and the type includes the ID corresponding to the Manifest signature data; Step 244: embed the data information into HAP SigningBlockData, where the data information includes an offset and Manifest signature data.

5. A method for signing and reinforcing a Hongmeng HAP package as claimed in claim 4, characterized in that: The step 4 of obtaining the manifest signature data from the HAP Signing Block specifically includes: Step 41: According to the ID corresponding to the Manifest signature data, parse the header information matching the ID from the HAP SingingBlockHeader; Step 42: Obtain the offset of the record from the header information; Step 43: Find the corresponding data information from HAP SigningBlockData according to the offset; Step 44: Obtain the corresponding Manifest signature data from the data information to obtain the application manifest file and the manifest signature file.

6. A method for signing and reinforcing a Hongmeng HAP package as claimed in claim 5, characterized in that: The step 5 specifically includes: Step 51: When the POS terminal device leaves the factory, the manufacturer pre-installs the application signature certificate used for signature verification in the POS terminal device; Step 52: Use the pre-installed application signature certificate to verify the signature of the manifest signature file; Step 53: After the signature verification is passed, the file name of each application file in the HAP application package is parsed in turn, and the hash value corresponding to each application file in the HAP application package is calculated in turn according to the hash algorithm; Step 54: Compare the file name and hash value of each application file in the HAP application package with the file name and hash value of each application file recorded in the application list file one by one, and determine whether each application file in the HAP application package is consistent with each application file recorded in the application list file. If so, it proves that the HAP application package is legal, the verification passes, and the process goes to step 55; if not, it is determined that the HAP application package is damaged, and the verification fails; Step 55: decompress the HAP application package and install the decompressed HAP application package in the corresponding installation directory; Step 56: Store the application manifest file and manifest signature file in corresponding locations of the installation directory.

7. A method for signing and reinforcing a Hongmeng HAP package as claimed in claim 6, characterized in that: The step 6 specifically includes: Step 61: When the POS terminal device is powered on and reaches a set self-check time, scan the installation directories of all applications in the POS terminal device; Step 62: Retrieve the corresponding application manifest file and manifest signature file from the corresponding location of the installation directory; Step 63: Use the pre-installed application signature certificate to verify the signature of the manifest signature file; Step 64: After the signature verification is passed, the file name of each application file in the installation directory is parsed in turn, and the hash value corresponding to each application file in the installation directory is calculated in turn according to the hash algorithm; Step 65: Compare the file name and hash value of each application file in the installation directory with the file name and hash value of each application file recorded in the application manifest file one by one to determine whether each application file in the installation directory is consistent with each application file recorded in the application manifest file. If so, it proves that all application files in the installation directory are legal and the verification passes; if not, it is determined that all application files in the installation directory have been illegally tampered with, the verification fails, and they are deleted and an alarm is issued.

8. A method for signing and reinforcing a Hongmeng HAP package as claimed in claim 7, characterized in that: The set self-check time is to perform a self-check regularly every 24 hours.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements a method for signing and reinforcing the Hongmeng HAP package as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, it implements a method for signing and reinforcing the Hongmeng HAP package as described in any one of claims 1 to 8.

Images