[go: up one dir, main page]

CN106603242A - Offline digital signature verification method and system for domestic operating system - Google Patents

Offline digital signature verification method and system for domestic operating system Download PDF

Info

Publication number
CN106603242A
CN106603242A CN201611245857.5A CN201611245857A CN106603242A CN 106603242 A CN106603242 A CN 106603242A CN 201611245857 A CN201611245857 A CN 201611245857A CN 106603242 A CN106603242 A CN 106603242A
Authority
CN
China
Prior art keywords
digital signature
certificate
operating system
checking
application software
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201611245857.5A
Other languages
Chinese (zh)
Inventor
肖新光
赵梓旭
王辛宇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Harbin Antiy Technology Co Ltd
Original Assignee
Harbin Antiy Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Harbin Antiy Technology Co Ltd filed Critical Harbin Antiy Technology Co Ltd
Priority to CN201611245857.5A priority Critical patent/CN106603242A/en
Publication of CN106603242A publication Critical patent/CN106603242A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

The invention provides an offline digital signature verification method and system for a domestic operating system. The method comprises: an application software digital signature certificate library is established and the digital signature certificate library is integrated into an existing domestic operating system; to-be-installed application software code is loaded, a software HASH value is calculated, and a digital signature part is extracted; whether all certificates in a digital signature certificate chain is legal is determined; if so, whether all certificates in the digital signature certificate chain are within validity is verified; if so, whether all certificates in the digital signature certificate chain are revoked or not is determined; if revoked certificates exist among all the certificates in the digital signature certificate chain, the digital signature is determined to be illegal and does not pass the verification, and exit from installation is carried out; and otherwise, verification is done successfully, a software installation environment is detected, and installation is carried out. Using the method provided by the invention, a problem that off-line signature verification can not be realized by the existing domestic operating system can be solved.

Description

A kind of digital signature offline verification method and system of domestic operating system
Technical field
The present invention relates to computer network security field, more particularly to a kind of digital signature authentication side of domestic operating system Method and system.
Background technology
Existing domestic operation is networking checking to digital signature authentication pattern, and concrete methods of realizing is to extract soft by networking The digital signature of part, and the hierarchical relationship of certificate chain in digital signature is parsed, verify the legal of root certificate, first class certificate etc. Property.But existing verification method is required to be carried out by networking, and domestic operating system itself lacks the authentication mechanism to digital signature, Cannot realize verifying digital signature in the case of offline.
The content of the invention
The present invention proposes a kind of digital signature offline verification method of domestic operating system, by domestic operating system The method of integrated digital signature verification mechanism, solving existing domestic operating system cannot carry out asking for off-line verification digital signature Topic, it is ensured that security of user when using software.
The present invention proposes a kind of digital signature offline verification method of domestic operating system, including:
Application software digital signature storehouse is set up, and the digital signature storehouse is integrated into into existing domestic operating system In;The digital signature storehouse includes root certificate, first class certificate and revocation list;
Application software code to be installed is loaded into, software for calculation HASH values simultaneously extract digital signature fragments;
Judge whether comprising digital signature fragments, if it is, continuing whether each certificate in the certificate chain for judge digital signature closes Method;Otherwise, digital signature is illegal, not by checking, exits installation;
Judge whether each certificate is legal in the certificate chain of digital signature, if it is, respectively demonstrate,proving in the certificate chain of checking digital signature Before the deadline whether book;Otherwise, digital signature is illegal, not by checking, exits installation;
Verify whether before the deadline each certificate in the certificate chain of digital signature, if it is, determining whether digital signature Each certificate whether there is and revoke in certificate chain;Otherwise, digital signature is illegal, not by checking, exits installation;
Judge that each certificate whether there is certificate revocation in the certificate chain of digital signature, if it is, digital signature is illegal, it is obstructed Checking is crossed, installation is exited;Otherwise, it is verified, inspection software installation environment is installed.
In described method, before application software code to be installed is loaded into, also include, whether inspection operation system needs more Newly, after being if it is updated, application software code to be installed is reloaded, otherwise, is loaded directly into application software generation to be installed Code.
In described method, the digital signature storehouse is by the certificate issued domestic operating system certificate authority person Statistics is obtained.
It is described to be integrated into the digital signature storehouse in existing domestic operating system, specially in described method It is integrated by the built-in application program of domestic operating system.
The present invention also proposes a kind of digital signature off-line verification system of domestic operating system, including:
Certificate library module, for setting up application software digital signature storehouse, and the digital signature storehouse is integrated into existing In having domestic operating system;The digital signature storehouse includes root certificate, first class certificate and revocation list;
Digital signature extraction module, is loaded into application software code to be installed, and software for calculation HASH values simultaneously extract digital signature fragments;
Signature judge module, for judging whether comprising digital signature fragments, if it is, continuing the certificate for judging digital signature Whether each certificate is legal in chain;Otherwise, digital signature is illegal, not by checking, exits installation;
Validity judgement module, it is whether legal for each certificate in the certificate chain for judging digital signature, if it is, checking numeral Before the deadline whether each certificate in the certificate chain of signature;Otherwise, digital signature is illegal, not by checking, exits installation;
Term of validity judge module, if it is, entering for each certificate in the certificate chain for verifying digital signature whether before the deadline One step judges in the certificate chain of digital signature each certificate with the presence or absence of revoking;Otherwise, digital signature is illegal, not by checking, Exit installation;
Certificate revocation judge module, for each certificate in the certificate chain for judging digital signature certificate revocation is whether there is, if it is, Then digital signature is illegal, not by checking, exits installation;Otherwise, it is verified, inspection software installation environment is installed.
In described system, also include, system update module, for before application software code to be installed is loaded into, checking Whether operating system needs to update, and after being if it is updated, reloads application software code to be installed, otherwise, directly adds Carry application software code to be installed.
In described system, the digital signature storehouse is by the certificate issued domestic operating system certificate authority person Statistics is obtained.
It is described to be integrated into the digital signature storehouse in existing domestic operating system, specially in described system It is integrated by the built-in application program of domestic operating system.
The present invention is essentially consisted in, and digital signature authentication is integrated under domestic operating system environment, is realized in offline mould Under formula, static signature confirmation is carried out to the software of developer, the development and application software refusal to not supporting is installed and used, it is ensured that Security of user when using software.
By technical scheme, it is possible to achieve set up stable authentication mechanism, Ke Yitong to domestic operating system Cross and update the renewal that operating system realizes verification stack room layout, realize checking application software digital signature under off-line mode.
Description of the drawings
In order to be illustrated more clearly that technical scheme of the invention or of the prior art, below will be to embodiment or prior art The accompanying drawing to be used needed for description is briefly described, it should be apparent that, drawings in the following description are only in the present invention Some embodiments recorded, for those of ordinary skill in the art, on the premise of not paying creative work, can be with Other accompanying drawings are obtained according to these accompanying drawings.
Fig. 1 is a kind of digital signature offline verification method flow chart of domestic operating system of the present invention;
Fig. 2 is a kind of digital signature off-line verification system structure diagram of domestic operating system of the present invention.
Specific embodiment
In order that those skilled in the art more fully understand the technical scheme in the embodiment of the present invention, and make the present invention's Above-mentioned purpose, feature and advantage can become apparent from understandable, and technical scheme in the present invention is made further in detail below in conjunction with the accompanying drawings Thin explanation.
The present invention proposes a kind of digital signature offline verification method of domestic operating system, by domestic operating system The method of integrated digital signature verification mechanism, solving existing domestic operating system cannot carry out asking for off-line verification digital signature Topic, it is ensured that security of user when using software.
The present invention proposes a kind of digital signature offline verification method of domestic operating system, as shown in figure 1, including:
S101:Application software digital signature storehouse is set up, and the digital signature storehouse is integrated into into existing domestic operation In system;The digital signature storehouse includes root certificate, first class certificate and revocation list;
S102:Application software code to be installed is loaded into, software for calculation HASH values simultaneously extract digital signature fragments;Extract digital signature Pretreatment work is done for the process of subsequent authentication in part;
S103:Judge whether comprising digital signature fragments, if it is, performing S104;Otherwise, digital signature is illegal, obstructed Checking is crossed, installation is exited;
S104:Judge whether each certificate is legal in the certificate chain of digital signature, if it is, performing S105;Otherwise, digital signature It is illegal, not by checking, exit installation;
S105:Verify whether before the deadline each certificate in the certificate chain of digital signature, if it is, performing S106;Otherwise, number Word signature is illegal, not by checking, exits installation;
S106:Judge that each certificate whether there is certificate revocation in the certificate chain of digital signature, if it is, digital signature does not conform to Method, not by checking, exits installation;Otherwise, it is verified, inspection software installation environment is installed.
In described method, before application software code to be installed is loaded into, also include, whether inspection operation system needs more Newly, after being if it is updated, application software code to be installed is reloaded, otherwise, is loaded directly into application software generation to be installed Code.Because digital signature storehouse is integrated in operating system, therefore the renewal to certificate repository can be by domestic operation The realization of more newly arriving of system, therefore the more new system before checking, while updating digital signature storehouse.
In described method, the digital signature storehouse is by the certificate issued domestic operating system certificate authority person Statistics is obtained.
It is described to be integrated into the digital signature storehouse in existing domestic operating system, specially in described method It is integrated by the built-in application program of domestic operating system.
The present invention also proposes a kind of digital signature off-line verification system of domestic operating system, as shown in Fig. 2 including:
Certificate library module 201, for setting up application software digital signature storehouse, and the digital signature storehouse is integrated into In existing domestic operating system;The digital signature storehouse includes root certificate, first class certificate and revocation list;
Digital signature extraction module 202, is loaded into application software code to be installed, and software for calculation HASH values simultaneously extract digital signature portion Point;
Signature judge module 203, for judging whether comprising digital signature fragments, if it is, continuing to judge digital signature Whether each certificate is legal in certificate chain;Otherwise, digital signature is illegal, not by checking, exits installation;
Validity judgement module 204, it is whether legal for each certificate in the certificate chain for judging digital signature, if it is, checking Before the deadline whether each certificate in the certificate chain of digital signature;Otherwise, digital signature is illegal, not by checking, exits peace Dress;
Term of validity judge module 205, for each certificate in the certificate chain for verifying digital signature whether before the deadline, if it is, Then determine whether in the certificate chain of digital signature each certificate with the presence or absence of revoking;Otherwise, digital signature is illegal, not by testing Card, exits installation;
Certificate revocation judge module 206, for each certificate in the certificate chain for judging digital signature certificate revocation is whether there is, if It is that then digital signature is illegal, not by checking, exits installation;Otherwise, it is verified, inspection software installation environment is pacified Dress.
In described system, also include, system update module, for before application software code to be installed is loaded into, checking Whether operating system needs to update, and after being if it is updated, reloads application software code to be installed, otherwise, directly adds Carry application software code to be installed.
In described system, the digital signature storehouse is by the certificate issued domestic operating system certificate authority person Statistics is obtained.
It is described to be integrated into the digital signature storehouse in existing domestic operating system, specially in described system It is integrated by the built-in application program of domestic operating system.
The present invention is essentially consisted in, and digital signature authentication is integrated under domestic operating system environment, is realized in offline mould Under formula, static signature confirmation is carried out to the software of developer, the development and application software refusal to not supporting is installed and used, it is ensured that Security of user when using software.
By technical scheme, it is possible to achieve set up stable authentication mechanism, Ke Yitong to domestic operating system Cross and update the renewal that operating system realizes verification stack room layout, realize checking application software digital signature under off-line mode.
Although depicting the present invention by embodiment, it will be appreciated by the skilled addressee that the present invention have it is many deformation and Change the spirit without deviating from the present invention, it is desirable to which appended claim includes these deformations and changes without deviating from the present invention's Spirit.

Claims (8)

1. a kind of digital signature offline verification method of domestic operating system, it is characterised in that include:
Application software digital signature storehouse is set up, and the digital signature storehouse is integrated into into existing domestic operating system In;The digital signature storehouse includes root certificate, first class certificate and revocation list;
Application software code to be installed is loaded into, software for calculation HASH values simultaneously extract digital signature fragments;
Judge whether comprising digital signature fragments, if it is, continuing whether each certificate in the certificate chain for judge digital signature closes Method;Otherwise, digital signature is illegal, not by checking, exits installation;
Judge whether each certificate is legal in the certificate chain of digital signature, if it is, respectively demonstrate,proving in the certificate chain of checking digital signature Before the deadline whether book;Otherwise, digital signature is illegal, not by checking, exits installation;
Verify whether before the deadline each certificate in the certificate chain of digital signature, if it is, determining whether digital signature Each certificate whether there is and revoke in certificate chain;Otherwise, digital signature is illegal, not by checking, exits installation;
Judge that each certificate whether there is certificate revocation in the certificate chain of digital signature, if it is, digital signature is illegal, it is obstructed Checking is crossed, installation is exited;Otherwise, it is verified, inspection software installation environment is installed.
2. the method for claim 1, it is characterised in that before application software code to be installed is loaded into, also include, checks Whether operating system needs to update, and after being if it is updated, reloads application software code to be installed, otherwise, directly adds Carry application software code to be installed.
3. method as claimed in claim 1 or 2, it is characterised in that the digital signature storehouse is by domestic operation system The certificate statistics that system certificate authority person issues is obtained.
4. method as claimed in claim 1 or 2, it is characterised in that it is described the digital signature storehouse is integrated into it is existing It is integrated specifically by the built-in application program of domestic operating system in domestic operating system.
5. the digital signature off-line verification system of a kind of domestic operating system, it is characterised in that include:
Certificate library module, for setting up application software digital signature storehouse, and the digital signature storehouse is integrated into existing In having domestic operating system;The digital signature storehouse includes root certificate, first class certificate and revocation list;
Digital signature extraction module, is loaded into application software code to be installed, and software for calculation HASH values simultaneously extract digital signature fragments;
Signature judge module, for judging whether comprising digital signature fragments, if it is, continuing the certificate for judging digital signature Whether each certificate is legal in chain;Otherwise, digital signature is illegal, not by checking, exits installation;
Validity judgement module, it is whether legal for each certificate in the certificate chain for judging digital signature, if it is, checking numeral Before the deadline whether each certificate in the certificate chain of signature;Otherwise, digital signature is illegal, not by checking, exits installation;
Term of validity judge module, if it is, entering for each certificate in the certificate chain for verifying digital signature whether before the deadline One step judges in the certificate chain of digital signature each certificate with the presence or absence of revoking;Otherwise, digital signature is illegal, not by checking, Exit installation;
Certificate revocation judge module, for each certificate in the certificate chain for judging digital signature certificate revocation is whether there is, if it is, Then digital signature is illegal, not by checking, exits installation;Otherwise, it is verified, inspection software installation environment is installed.
6. system as claimed in claim 5, it is characterised in that also include, system update module, for be loaded into it is to be installed should Before software code, whether inspection operation system needs to update, and after being if it is updated, reloads application software to be installed Code, otherwise, is loaded directly into application software code to be installed.
7. the system as described in claim 5 or 6, it is characterised in that the digital signature storehouse is by domestic operation system The certificate statistics that system certificate authority person issues is obtained.
8. the system as described in claim 5 or 6, it is characterised in that it is described the digital signature storehouse is integrated into it is existing It is integrated specifically by the built-in application program of domestic operating system in domestic operating system.
CN201611245857.5A 2016-12-29 2016-12-29 Offline digital signature verification method and system for domestic operating system Pending CN106603242A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201611245857.5A CN106603242A (en) 2016-12-29 2016-12-29 Offline digital signature verification method and system for domestic operating system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201611245857.5A CN106603242A (en) 2016-12-29 2016-12-29 Offline digital signature verification method and system for domestic operating system

Publications (1)

Publication Number Publication Date
CN106603242A true CN106603242A (en) 2017-04-26

Family

ID=58605076

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201611245857.5A Pending CN106603242A (en) 2016-12-29 2016-12-29 Offline digital signature verification method and system for domestic operating system

Country Status (1)

Country Link
CN (1) CN106603242A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109977679A (en) * 2019-02-22 2019-07-05 北京天地和兴科技有限公司 A kind of industry control safety equipment upgrade package installation method based on TCM chip
CN110532775A (en) * 2019-07-26 2019-12-03 苏州浪潮智能科技有限公司 A kind of Method and kit for of computer processes control
US11080429B2 (en) 2018-02-23 2021-08-03 Otis Elevator Company Safety circuit for an elevator system, device and method of updating such a safety circuit

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1898956A (en) * 2003-12-18 2007-01-17 松下电器产业株式会社 Method for authenticating and executing an application program
US20090320110A1 (en) * 2008-06-23 2009-12-24 Nicolson Kenneth Alexander Secure boot with optional components method
CN102300065A (en) * 2011-08-31 2011-12-28 四川长虹电器股份有限公司 Security authentication method for android-platform-based smart television software
US20130160147A1 (en) * 2011-12-16 2013-06-20 Dell Products L.P. Protected application programming interfaces
CN104753676A (en) * 2013-12-31 2015-07-01 北龙中网(北京)科技有限责任公司 Identity verifying method and device for mobile application developer

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1898956A (en) * 2003-12-18 2007-01-17 松下电器产业株式会社 Method for authenticating and executing an application program
US20090320110A1 (en) * 2008-06-23 2009-12-24 Nicolson Kenneth Alexander Secure boot with optional components method
CN102300065A (en) * 2011-08-31 2011-12-28 四川长虹电器股份有限公司 Security authentication method for android-platform-based smart television software
US20130160147A1 (en) * 2011-12-16 2013-06-20 Dell Products L.P. Protected application programming interfaces
CN104753676A (en) * 2013-12-31 2015-07-01 北龙中网(北京)科技有限责任公司 Identity verifying method and device for mobile application developer

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11080429B2 (en) 2018-02-23 2021-08-03 Otis Elevator Company Safety circuit for an elevator system, device and method of updating such a safety circuit
CN109977679A (en) * 2019-02-22 2019-07-05 北京天地和兴科技有限公司 A kind of industry control safety equipment upgrade package installation method based on TCM chip
CN110532775A (en) * 2019-07-26 2019-12-03 苏州浪潮智能科技有限公司 A kind of Method and kit for of computer processes control

Similar Documents

Publication Publication Date Title
US11360784B2 (en) Integrity manifest certificate
CN107911373B (en) A blockchain rights management method and system
CN110168552B (en) Validated boot and key rotation methods, devices, systems and media
CN104537293B (en) Authenticating device and system
US20040162985A1 (en) Credentials and digitally signed objects
US8881308B2 (en) Method to enable development mode of a secure electronic control unit
CN101969440B (en) Software certificate generating method
US20140075517A1 (en) Authorization scheme to enable special privilege mode in a secure electronic control unit
CN110831004B (en) Node identity authentication method and system suitable for Internet of Vehicles
CN105573828A (en) Operation processing method and device
CN103560889B (en) Precision identity authentication method between X509 digital certificate and certificate application
CN110989994A (en) Block chain-based code version management method and device, terminal and storage medium
CN102663320A (en) Method for terminal identification developers and dividing developers with different permissions
JP2005341552A5 (en)
CN112084484B (en) Equipment hardware safety detection method and device, electronic equipment and storage medium
US20230102889A1 (en) Non-fungible token-based platform for tracing software and revisions
EP4046044B1 (en) Secure data synchronization between offline and online systems
CN106603242A (en) Offline digital signature verification method and system for domestic operating system
WO2021027622A1 (en) Software package transmission method, software package transmission verification method, network device, and storage medium
CN104504308B (en) A kind of license validation method for forbidding virtual machine to use software
CN116189340A (en) Access control management method, system, device and medium based on PKI security authentication
CN105873044A (en) Application program issuance method based on Android platform, developer tracing method and developer tracing device
CN113890751B (en) Method, apparatus and readable storage medium for controlling federation chain rights voting
CN106569907A (en) System start-up file verifying and compiling method
CN112256305B (en) Block chain software updating method and system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information
CB02 Change of applicant information

Address after: 150028 Building 7, Innovation Plaza, Science and Technology Innovation City, Harbin Hi-tech Industrial Development Zone, Heilongjiang Province (838 Shikun Road)

Applicant after: Harbin antiy Technology Group Limited by Share Ltd

Address before: 150090 Room 506, No. 162 Hongqi Street, Nangang District, Harbin Development Zone, Heilongjiang Province

Applicant before: Harbin Antiy Technology Co., Ltd.

WD01 Invention patent application deemed withdrawn after publication
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20170426