Program integrity protection method and device, equipment and storage medium

Abstract

The invention discloses a program integrity protection method, which comprises the following steps of: performing feature processing on a program file package, generating program feature information, and taking the program feature information as an original text to be signed; signature processing is conducted on the original text to be signed, a digital envelope is generated, and program feature information is contained in the digital envelope; writing the generated digital envelope into the program file package; when the program file package needs to be subjected to signature verification, the digital envelope in the program file is obtained, signature verification is conducted on the program feature information in the digital envelope, and if signature verification is passed, it is considered that the program file package has integrity. The invention further discloses a device for realizing the program integrity protection method, computer equipment and a storage medium. According to the method, the security and integrity of the software program in the distribution and deployment process are effectively ensured.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and information security technology, and in particular to a method, apparatus, device and storage medium for program integrity protection based on digital certificates. Background Technology

[0002] Regarding Java program integrity protection, the JDK provides the Jarsign solution, which primarily involves adding a file containing class information to the META-INF file within the JAR package. However, this method does not support signatures using national cryptographic standards or post-quantum cryptography, and its verification of trust in national cryptographic signature certificates is insufficient. Furthermore, the explicit class information file format is too obvious and vulnerable to attack, making its security insufficient to meet current requirements. As for Zip packages, current methods mainly rely on manual comparison of the package digest information obtained during package extraction to ensure integrity, but security remains difficult to guarantee.

[0003] Therefore, through beneficial exploration and research, the applicant has found a solution to the above problems, and the technical solution to be introduced below is the result of this research. Summary of the Invention

[0004] One of the technical problems to be solved by the present invention is to provide a digital certificate-based program integrity protection method to ensure the security and integrity of software programs during the distribution and deployment process, in order to address the shortcomings of the prior art.

[0005] The second technical problem to be solved by the present invention is to provide a program integrity protection device for implementing the above-mentioned program integrity protection method.

[0006] The third technical problem to be solved by the present invention is to provide a computer device for implementing the above-mentioned program integrity protection method.

[0007] The fourth technical problem to be solved by the present invention is to provide a computer-readable storage medium for implementing the above-mentioned program integrity protection method.

[0008] As a first aspect of the present invention, a method for protecting program integrity includes:

[0009] The program file package is characterized and program feature information is generated, and the program feature information is used as the original text to be signed;

[0010] The original text to be signed is signed, and a digital envelope is generated, which contains program feature information.

[0011] Write the generated digital envelope into the program file package; and

[0012] When it is necessary to verify the signature of the program file package, the digital envelope inside the program file is obtained, and the program feature information in the digital envelope is verified. If the verification is successful, the program file package is considered to be complete.

[0013] In a preferred embodiment of the present invention, the program file package is a zip package or a jar package.

[0014] In a preferred embodiment of the present invention, the step of performing feature processing on the program file package and generating program feature information includes:

[0015] Traverse all files within the program file package and perform digest processing on each file to obtain the file digest value of each file within the program file package;

[0016] The file digest values ​​of each file within the program file package are concatenated and merged to form a single merged file digest value; and

[0017] The file's merged digest value is processed into a digest, and the generated digest value is used as the final program feature information.

[0018] In a preferred embodiment of the present invention, the algorithm used for the digest processing is the SHA-2 hash algorithm or the SM3 hash algorithm.

[0019] In a preferred embodiment of the present invention, the original text to be signed is signed, and a digital envelope is generated, including:

[0020] Obtain the original text to be signed and the name of the program file package, and store the obtained original text to be signed and the name of the program file package in a database; and

[0021] Using a code signing certificate that proves the origin of the program, a signing algorithm is used to sign the obtained original text to be signed and a digital envelope is generated.

[0022] In a preferred embodiment of the present invention, the digital envelope is a #PKCS7 digital envelope.

[0023] In a preferred embodiment of the present invention, the signature algorithm used in the signature processing is one of the following: RSA algorithm, SM2 algorithm, Dilithium algorithm, or Kyber algorithm.

[0024] In a preferred embodiment of the present invention, the generated digital envelope is written into the comment section of the program file package.

[0025] In a preferred embodiment of the present invention, the step of obtaining the digital envelope within the program file and verifying the program feature information in the digital envelope includes:

[0026] Obtain the comment entries of the program file package and determine whether the comment entries of the program file package are empty. If they are empty, directly determine that the signature verification has failed and output an alarm message.

[0027] When the comment item of the program file package is not empty, the digital envelope in the comment item of the program file package is parsed and the integrity of the digital envelope is verified according to the parsing result. At the same time, the certificate chain verification of the signer's certificate is performed. If the verification fails, the signature verification is directly judged to have failed and a warning message is output.

[0028] After successful verification of the digital envelope integrity and certificate chain, the program feature information protected by the digital certificate signature within the digital envelope of the program file package is obtained, and feature processing is performed on the current program file package to generate the current program feature information; and

[0029] The obtained program feature information is compared with the generated current program feature information. If the comparison is consistent, the signature verification is considered successful and the program file package is considered complete. If the comparison is inconsistent, the signature verification is considered to have failed and a warning message is output.

[0030] As a second aspect of the present invention, a program integrity protection device for implementing the above-described program integrity protection method includes:

[0031] The program feature processing module is used to perform feature processing on the program file package and generate program feature information, which is then used as the original text to be signed.

[0032] A digital envelope generation module is used to sign the original text to be signed and generate a digital envelope containing program feature information.

[0033] A digital envelope writing module, wherein the digital envelope writing module is used to write the generated digital envelope into the program file; and

[0034] The signature verification module is used to obtain the digital envelope in the program file when it is necessary to verify the signature of the program file package, and to verify the program feature information in the digital envelope. If the signature verification is successful, the program file package is considered to be complete.

[0035] As a third aspect of the present invention, a computer device for implementing a program integrity protection method includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0036] The program file package is characterized and program feature information is generated, and the program feature information is used as the original text to be signed;

[0037] The original text to be signed is signed, and a digital envelope is generated, which contains program feature information.

[0038] Write the generated digital envelope into the program file; and

[0039] When it is necessary to verify the signature of the program file package, the digital envelope inside the program file is obtained, and the program feature information in the digital envelope is verified. If the verification is successful, the program file package is considered to be complete.

[0040] As a fourth aspect of the present invention, a computer-readable storage medium for implementing the above-described program integrity protection method stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0041] The program file package is characterized and program feature information is generated, and the program feature information is used as the original text to be signed;

[0042] The original text to be signed is signed, and a digital envelope is generated, which contains program feature information.

[0043] Write the generated digital envelope into the program file; and

[0044] When it is necessary to verify the signature of the program file package, the digital envelope inside the program file is obtained, and the program feature information in the digital envelope is verified. If the verification is successful, the program file package is considered to be complete.

[0045] Due to the adoption of the above technical solution, the beneficial effects of the present invention are as follows:

[0046] 1. This invention uses digital certificates + national cryptographic and quantum-resistant algorithm signatures to extract program features, saves the program features in the program file package, and effectively ensures the security and integrity of the software program during distribution and deployment through the corresponding signature verification program;

[0047] 2. This invention supports various digital certificate-based signature algorithms (including quantum-resistant signature algorithms), enabling greater flexibility and supporting certificate chain trust checks on various signature certificates, resulting in stronger security;

[0048] 3. This invention can provide protection for zip files, jar files, etc., and has a wide range of applications.

[0049] 4. This invention places the signature information in the comment section of the program file package, making the signature an integral part of the program package and not affecting any files within the package, thus providing high concealment. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a flowchart of one embodiment of the program integrity protection method of the present invention.

[0052] Figure 2 This is a flowchart illustrating the digital signature generation process of an application embodiment of the program integrity protection method of the present invention.

[0053] Figure 3 This is a flowchart of digital signature verification, representing an application embodiment of the program integrity protection method of the present invention.

[0054] Figure 4 This is a schematic diagram of one embodiment of the program integrity protection device of the present invention.

[0055] Figure 5 This is an internal structural diagram of the computer device of the present invention. Detailed Implementation

[0056] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below with reference to specific illustrations.

[0057] See Figure 1 The diagram illustrates a method for protecting program integrity, which includes the following steps:

[0058] Step S10: Perform feature processing on the program file package and generate program feature information, which is then used as the original text to be signed. In this embodiment, the program file package is a zip file or a jar file.

[0059] Step S20: Sign the original text to be signed and generate a digital envelope containing program feature information.

[0060] Step S30: Write the generated digital envelope into the program file package. Specifically, the generated digital envelope is written into the comment section of the program file package. The signature is integrated with the program package and does not affect any files within the package, thus providing high concealment.

[0061] Step S40: When it is necessary to verify the signature of the program file package, obtain the digital envelope inside the program file and verify the program feature information in the digital envelope. If the verification is successful, the program file package is considered to be complete.

[0062] In step S10, the program file package undergoes feature processing to generate program feature information, including the following steps:

[0063] Step S11: Traverse all files within the program file package (including directory hierarchy information within the package) and perform digest processing on each file to obtain the file digest value of each file within the program file package. In this embodiment, the digest processing algorithm used is the SHA-2 hash algorithm or the SM3 hash algorithm.

[0064] Step S12 involves concatenating and processing the file digest values ​​of each file within the program file package to form a single merged file digest value. In this embodiment, the digest processing algorithm used is either the SHA-2 hash algorithm or the SM3 hash algorithm, or a similar algorithm.

[0065] Step S13: Perform digest processing on the merged digest value of the file, and use the generated digest value as the final program feature information.

[0066] In step S20, the original text to be signed is signed, and a digital envelope is generated, including the following steps:

[0067] Step S21: Obtain the original text to be signed and the name of the program file package, and store the obtained original text to be signed and the name of the program file package in the database for easy auditing operations;

[0068] Step S22: Using a code signing certificate that proves the source of the program, the obtained original text to be signed is signed using a signing algorithm, and a digital envelope is generated. In this embodiment, the digital envelope is a #PKCS7 digital envelope, and the signing algorithm used for the signing process is an RSA algorithm, SM2 algorithm, Dilithium algorithm based on hybrid certificates or quantum-resistant certificates, or Kyber algorithm based on hybrid certificates or quantum-resistant certificates, or other related algorithms.

[0069] In step S40, a digital envelope is obtained from the program file, and the program feature information in the digital envelope is verified, including the following steps:

[0070] Step S41: Obtain the comment entries of the program file package and determine whether the comment entries of the program file package are empty. If they are not empty, proceed to step S42. If they are empty, directly determine that the signature verification failed and output an alarm message.

[0071] Step S42: Parse the digital envelope in the comment section of the program file package, verify the integrity of the digital envelope based on the parsing result, and verify the certificate chain of the signer's certificate. If the verification is successful, proceed to step S43; if the verification fails, directly determine that the signature verification has failed and output a warning message.

[0072] Step S43: Obtain the program feature information protected by digital certificate signature within the digital envelope of the program file package, perform feature processing on the current program file package, and generate the current program feature information;

[0073] Step S44: The obtained program feature information is compared with the generated current program feature information. If the comparison is consistent, the signature verification is considered successful and the program file package is considered to be complete. If the comparison is inconsistent, the signature verification is considered to have failed and a warning message is output.

[0074] This invention uses digital certificates plus national cryptographic and quantum-resistant algorithm signatures to extract program features, saves the program features in the program file package, and effectively ensures the security and integrity of the software program during distribution and deployment through the corresponding signature verification program;

[0075] See Figure 2 and Figure 3 The figure shows a specific application embodiment of the program integrity protection method of the present invention, which includes the following steps:

[0076] 1. Program signing operation steps

[0077] 1.1. The user client traverses all files (including directory hierarchy information within the package) in the program file package (zip or jar) and performs digest processing on each file;

[0078] 1.2. The user client concatenates and merges the summaries of all files obtained in step 1.1, performs summary processing on the concatenated summary information, and uses the generated summary information as the final program feature information;

[0079] 1.3. The user client sends the program feature information obtained in step 1.2 along with the program file package name to the signature server;

[0080] 1.4. Write the digital envelope returned by the signature server into the comment field of the program file package.

[0081] 2. Server-side signing operation steps based on digital certificates

[0082] 2.1. The signature server receives the original text to be signed and the name of the program file package transmitted in step 1.3, and stores this information in the database for auditing purposes;

[0083] 2.2. The signature server uses a code signing certificate that can prove the source of the program and a signature algorithm to sign the received plain text to be signed, generating a digital envelope;

[0084] 2.3. The signature server returns the generated digital envelope to the client.

[0085] 3. Procedure for Verification and Signature Check

[0086] 3.1. The client obtains the comment field of the program file package and determines whether the comment field is empty. If it is not empty, proceed to step 3.2. If it is empty, directly determine that the signature verification failed and output a warning message.

[0087] 3.2. The client parses the #PKCS7 digital envelope in the comment item of the program file package, verifies the integrity of the digital envelope, and performs certificate chain verification on the signer's certificate (a trusted certificate chain needs to be pre-configured). If the verification is successful, proceed to step 3.3. If the verification fails, the signature verification is directly determined to have failed, and a warning message is output.

[0088] 3.3. The client obtains the program characteristic information protected by the digital certificate signature in the #PKCS7 digital envelope;

[0089] 3.4. The client uses the methods in steps 1.1 and 1.2 to extract the program characteristic information of the current program file package;

[0090] 3.5. The client compares the two program feature information obtained in steps 3.3 and 3.4. If they match, the signature verification is successful and a success message is output. Otherwise, the signature verification fails and a warning message is output.

[0091] See Figure 4 The figure shows a program integrity protection device, including a program feature processing module 100, a digital envelope generation module 200, a digital envelope writing module 300, and a signature verification module 400.

[0092] The program feature processing module 100 is used to perform feature processing on the program file package and generate program feature information, which is then used as the original text to be signed. Specifically, the program feature processing module 100 includes a first file digest processing unit, a file digest concatenation and merging processing unit, and a second file digest processing unit. The first file digest processing unit is used to traverse all files within the program file package (including directory hierarchy information within the package) and perform digest processing on each file to obtain the file digest value of each file within the program file package. In this embodiment, the algorithm used for digest processing is the SHA-2 hash algorithm or the SM3 hash algorithm. The file digest concatenation and merging processing unit is used to concatenate and merge the file digest values ​​of each file within the program file package to form a merged file digest value. In this embodiment, the algorithm used for digest processing is the SHA-2 hash algorithm or the SM3 hash algorithm, or a related algorithm. The second file digest processing unit is used to perform digest processing on the merged file digest value and uses the generated digest value as the final program feature information.

[0093] The digital envelope generation module 200 is used to sign the original text to be signed and generate a digital envelope containing program characteristic information. Specifically, the digital envelope generation module 200 includes a storage processing unit and a digital envelope generation unit. The storage processing unit is used to obtain the original text to be signed and the program file package name, and stores the obtained original text to be signed and the program file package name in a database for easy auditing. The digital envelope generation unit is used to sign the obtained original text to be signed using a code signing certificate that can prove the source of the program and a signing algorithm, and generates a digital envelope. In this embodiment, the digital envelope is a #PKCS7 digital envelope, and the signing algorithm used for the signing process is an RSA algorithm, an SM2 algorithm, a Dilithium algorithm based on a hybrid certificate or a quantum-resistant certificate, or a Kyber algorithm based on a hybrid certificate or a quantum-resistant certificate, or other related algorithms.

[0094] The digital envelope writing module 300 is used to write the generated digital envelopes into the program file package.

[0095] The signature verification module 400 is used to obtain the digital envelope within the program file when signature verification of the program file package is required, and to verify the program feature information in the digital envelope. If the signature verification passes, the program file package is considered to be complete. Specifically, the signature verification module 400 includes a first judgment unit, a first verification unit, a program feature acquisition unit, and a second verification unit. The first judgment unit is used to obtain the comment items of the program file package and determine whether the comment items of the program file package are empty. If they are empty, the signature verification is directly determined to have failed, and an alarm message is output. The first verification unit is used to parse the digital envelope within the comment items of the program file package when the comment items of the program file package are not empty, and to verify the integrity of the digital envelope based on the parsing result. At the same time, it performs certificate chain verification on the signer's certificate. If the verification fails, the signature verification is directly determined to have failed, and a warning message is output. The program feature acquisition unit is used to obtain the program feature information protected by the digital certificate signature within the digital envelope of the program file package after the integrity of the digital envelope and the certificate chain verification are successful, and to perform feature processing on the current program file package and generate the current program feature information. The second verification unit is used to compare the acquired program feature information with the generated current program feature information. If the comparison is consistent, the signature verification is considered successful and the program file package is considered to be complete. If the comparison is inconsistent, the signature verification is considered to have failed and a warning message is output.

[0096] The modules in the program integrity protection device of the present invention can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0097] The present invention also provides a computer device for implementing the above-described program integrity protection method. This computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and the database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The database stores user information, log information, and files. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements one of the aforementioned program integrity protection methods.

[0098] Those skilled in the art will understand that Figure 5The structure shown is merely a block diagram of a portion of the structure related to this technical solution and does not constitute a limitation on the computer device to which this application solution is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0099] Specifically, the computer device of the present invention includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0100] Step S10: Perform feature processing on the program file package and generate program feature information, and use the program feature information as the original text to be signed;

[0101] Step S20: Sign the original text to be signed and generate a digital envelope containing program feature information.

[0102] Step S30: Write the generated digital envelope into the program file;

[0103] Step S40: When it is necessary to verify the signature of the program file package, obtain the digital envelope inside the program file and verify the program feature information in the digital envelope. If the verification is successful, the program file package is considered to be complete.

[0104] The present invention also provides a computer-readable storage medium for implementing the above-described program integrity protection method, wherein a computer program is stored thereon, and when executed by a processor, the computer program performs the following steps:

[0105] Step S10: Perform feature processing on the program file package and generate program feature information, and use the program feature information as the original text to be signed;

[0106] Step S20: Sign the original text to be signed and generate a digital envelope containing program feature information.

[0107] Step S30: Write the generated digital envelope into the program file;

[0108] Step S40: When it is necessary to verify the signature of the program file package, obtain the digital envelope inside the program file and verify the program feature information in the digital envelope. If the verification is successful, the program file package is considered to be complete.

[0109] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0110] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for protecting program integrity, characterized in that, include: The program file package is characterized and program feature information is generated, and the program feature information is used as the original text to be signed; The original text to be signed is signed, and a digital envelope is generated, which contains program feature information. Write the generated digital envelope into the program file package; as well as When it is necessary to verify the signature of the program file package, the digital envelope inside the program file is obtained, and the program feature information in the digital envelope is verified. If the verification is successful, the program file package is considered to be complete.

2. The program integrity protection method as described in claim 1, characterized in that, The program file package is a zip file or a jar file.

3. The program integrity protection method as described in claim 1, characterized in that, The process of performing feature processing on the program file package and generating program feature information includes: Traverse all files within the program file package and perform digest processing on each file to obtain the file digest value of each file within the program file package; The file digest values ​​of each file within the program file package are concatenated and merged to form a single merged file digest value; and The file's merged digest value is processed into a digest, and the generated digest value is used as the final program feature information.

4. The program integrity protection method as described in claim 3, characterized in that, The algorithm used for the digest processing is either the SHA-2 hash algorithm or the SM3 hash algorithm.

5. The program integrity protection method as described in claim 3, characterized in that, The original text to be signed is signed, and a digital envelope is generated, including: Obtain the original text to be signed and the name of the program file package, and store the obtained original text to be signed and the name of the program file package in a database; and Using a code signing certificate that proves the origin of the program, a signing algorithm is used to sign the obtained original text to be signed and a digital envelope is generated.

6. The program integrity protection method as described in claim 5, characterized in that, The digital envelope is a #PKCS7 digital envelope.

7. The program integrity protection method as described in claim 5, characterized in that, The signature processing uses a signature algorithm that includes one of the following: RSA algorithm, SM2 algorithm, Dilithium algorithm, or Kyber algorithm.

8. The program integrity protection method as described in claim 5, characterized in that, Write the generated digital envelope into the comment section of the program file package.

9. The program integrity protection method as described in claim 8, characterized in that, The step of obtaining the digital envelope within the program file and verifying the program feature information in the digital envelope includes: Obtain the comment entries of the program file package and determine whether the comment entries of the program file package are empty. If they are empty, directly determine that the signature verification has failed and output an alarm message. When the comment item of the program file package is not empty, the digital envelope in the comment item of the program file package is parsed and the integrity of the digital envelope is verified according to the parsing result. At the same time, the certificate chain verification of the signer's certificate is performed. If the verification fails, the signature verification is directly judged to have failed and a warning message is output. After successful verification of the digital envelope integrity and certificate chain, the program feature information protected by the digital certificate signature within the digital envelope of the program file package is obtained, and feature processing is performed on the current program file package to generate the current program feature information; and The obtained program feature information is compared with the generated current program feature information. If the comparison is consistent, the signature verification is considered successful and the program file package is considered complete. If the comparison is inconsistent, the signature verification is considered to have failed and a warning message is output.

10. A program integrity protection device, characterized in that, include: The program feature processing module is used to perform feature processing on the program file package and generate program feature information, which is then used as the original text to be signed. A digital envelope generation module is used to sign the original text to be signed and generate a digital envelope containing program feature information. A digital envelope writing module, which is used to write the generated digital envelope into the program file; as well as The signature verification module is used to obtain the digital envelope in the program file when it is necessary to verify the signature of the program file package, and to verify the program feature information in the digital envelope. If the signature verification is successful, the program file package is considered to be complete.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the program integrity protection method as described in any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the program integrity protection method as described in any one of claims 1 to 9.

Images