CN104283860A - ELF file identification method and device based on code signature - Google Patents
ELF file identification method and device based on code signature Download PDFInfo
- Publication number
- CN104283860A CN104283860A CN201310288979.2A CN201310288979A CN104283860A CN 104283860 A CN104283860 A CN 104283860A CN 201310288979 A CN201310288979 A CN 201310288979A CN 104283860 A CN104283860 A CN 104283860A
- Authority
- CN
- China
- Prior art keywords
- file
- elf file
- signature
- elf
- mark
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
Abstract
The invention discloses an ELF file identification method based on a code signature. According to ELF file identification, an issuer provides evidence, and a caller (an operating system) verifies the evidence. The evidence of the issuer is the file signature of the issuer, and the signature is made in two steps that firstly, the issuers signs for the file identification, and secondly, the issuer signs for file features. The caller carries out verification in two steps that firstly, the caller extracts the signature of the file identification to verify the file identification and judges whether a file is loaded or not, and secondly, the caller extracts the signature of the file features to verify the file features and judges whether the file is executed or not, wherein the first step is named as admissibility verification, and the second step is named as acceptance verification. By means of the ELF file identification method, identification authentication and feature authentication of the ELF file are achieved, damage caused by illegal invasion and malicious software can be effectively prevented, the operational safety of a computer is ensured, and the optimal balance between the efficiency and safety of the operating system is achieved.
Description
Technical field
The present invention relates to network safety filed, specifically, relate to a kind of ELF document authentication method based on code signature and device.
Background technology
Along with the development of Linux, increasing individual and enterprise bring into use Linux, and especially numerous enterprise servers start to adopt (SuSE) Linux OS, and its fail safe is also subject to increasing challenge.Linking format (Executable and Linkable Format, referred to as ELF) can be performed and perform binary file format as topmost under Linux and Unix, naturally become the target of attack of virus and various malicious code.Fact proved have the Virus under many Linux to realize invasion by the method directly revising ELF file.Traditional Unix system (comprising Linux) can't carry out integrality to the code performed and legitimacy detects, and thus allows a lot of Virus and trojan horse program have an opportunity to take advantage of.
In order to ensure the fail safe of system, be necessary to provide effective authentication schemes to the multiple file of such as ELF file, to judge its legitimacy.At present, the main discrimination method adopted is that code is differentiated.Code differentiates it is a kind of method that effectively can prevent virus and the invasion of other malicious codes.For the code authentication scheme under Linux, although someone studies, but still mainly there is following problem at present: one is the method for carrying out signature verification when mounted, and by revising the attribute-executable of chmod system call control documents, but this method cannot trace routine install after any amendment to code, have certain limitation; Two is adopt PKI public key system, because PKI is based on third-party, can not ensure the real-time effectiveness of certificate, and CA root certificate is easily replaced, and also there is obvious leak; Three are signature discriminatings is first whole files loading is entered internal memory, and calculate its digital digest authenticity of authenticating documents and integrality again, this method is that one is differentiated afterwards, and performance is lower.
For the problem that the scheme existing defects differentiated file in correlation technique causes security of system to be on the hazard, at present effective solution is not yet proposed.
Summary of the invention
For the problem in correlation technique, the present invention proposes a kind of ELF document authentication method based on code signature and device, can effectively prevent ELF file from being utilized by hacker, becomes the instrument carrying out virus, wooden horse and malicious code and attack, guarantees operating system security.
Technical scheme of the present invention is achieved in that
According to an aspect of the present invention, a kind of ELF document authentication method based on code signature is provided.
The method comprises: user or system are when applying for performing ELF file, and first operating system nucleus scheduler program is differentiated the mark of described ELF file; If identification result is the mark of described ELF file is real, then further the feature of described ELF file is differentiated, and under the characteristic differentiation result of described ELF file is complete and real situation, allow to perform described ELF file;
If the mark of described ELF file is the characteristic differentiation result of fict or described ELF file is not complete and real, then refusal performs described ELF file.
Wherein, carry out discriminating to the mark of described ELF file to comprise: to the identification signature checking of described ELF file and the validity checking of signer mark.
And, the identification signature of described ELF file is with checking based on combined public-key scheme, and wherein, signature private key is the publisher of ELF file or the private key of author, when verifying the identification signature of described ELF file, using the publisher of described ELF file or the mark of author as PKI.
In addition, the mark of described ELF file differentiated or comprised: validity checking is carried out to the mark of signer, judging whether the author of ELF file and the mark of publisher are preset in trust list in operating system; And/or, the signature of file identification is carried out to the checking of digital signature, judge authenticity and the complete body of file identification.If signer mark is differentiated not pass through, then directly refuse loading ELF document.
Wherein, carry out discriminating to the feature of described ELF file to comprise: to the characteristic signature checking of described ELF file and the validity checking of signer mark.
And, the content signature of described ELF file is with discriminating based on combined public-key scheme, and wherein, signature private key is the publisher of ELF file or the private key of author, when differentiating the characteristic signature of described ELF file, using the publisher of described ELF file or the mark of author as PKI.
In addition, the feature of described ELF file differentiated or comprised: validity checking is carried out to the mark of signer, judging whether the author of ELF file and the mark of publisher are preset in trust list in operating system; And/or, the signature of file characteristic is carried out to the checking of digital signature, judge authenticity and the complete body of file identification.If file characteristic is differentiated not pass through, then refusal performs ELF file.
According to a further aspect in the invention, a kind of ELF file identification device based on code signature is additionally provided.
This device comprises: the first identification module, for when user or system perform ELF file in application, first differentiates the mark of ELF file; Second identification module, in be the mark of ELF file at identification result be real situation, differentiates the feature of ELF file further, and under the characteristic differentiation result of ELF file is complete and real situation, allows to perform ELF file; Control module, for being fict in the mark of ELF file or under the characteristic differentiation result of ELF file is not complete and real situation, refusal performs ELF file.
The mark that present invention achieves ELF file is differentiated and characteristic differentiation, can the destruction of anti-illegal-inbreak and Malware effectively, guarantees computer operation safety, and makes operating system efficiency obtain optimum balance with safety.
Accompanying drawing explanation
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, be briefly described to the accompanying drawing used required in embodiment below, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.
Fig. 1 is the schematic flow sheet of a kind of ELF document authentication method based on code signature according to the embodiment of the present invention;
Fig. 2 is schematic flow sheet ELF file being carried out to signature setting according to the embodiment of the present invention;
Fig. 3 is the schematic flow sheet ELF file of signature being carried out to verification operation according to the embodiment of the present invention;
Fig. 4 is the execution schematic flow sheet of the Linux security module according to the embodiment of the present invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, be clearly and completely described the technical scheme in the embodiment of the present invention, obviously, described embodiment is only the present invention's part embodiment, instead of whole embodiments.Based on the embodiment in the present invention, the every other embodiment that those of ordinary skill in the art obtain, all belongs to the scope of protection of the invention.
According to embodiments of the invention, provide a kind of ELF document authentication method based on code signature.
As shown in Figure 1, comprise according to the ELF document authentication method based on code signature of the embodiment of the present invention:
Step S101, user or system are when applying for performing ELF file, and first operating system nucleus scheduler program differentiates (this step has been come by call operation system kernel scheduler program, also can by means of other modes) to the mark of described ELF file;
Step S103, if the mark that identification result is described ELF file is real, then differentiates the feature of described ELF file further, and under the characteristic differentiation result of described ELF file is complete and real situation, allows to perform described ELF file;
Step S105, if the characteristic differentiation result that the mark of described ELF file is fict or described ELF file is not complete and real, then refusal performs described ELF file.
Wherein, carry out discriminating to the mark of described ELF file to comprise: to the identification signature checking of described ELF file and the validity checking of signer mark.
And, the identification signature of described ELF file is with checking based on combined public-key scheme, and wherein, signature private key is the publisher of ELF file or the private key of author, when verifying the identification signature of described ELF file, using the publisher of described ELF file or the mark of author as PKI.
In addition, the mark of described ELF file differentiated or comprised: one is carry out validity checking to the mark of signer, judging whether the author of ELF file and the mark of publisher are preset in trust list in operating system; Two is the checkings signature of file identification being carried out to digital signature, judges authenticity and the complete body of file identification.If signer mark is differentiated not pass through, then directly refuse loading ELF document.
Wherein, carry out discriminating to the feature of described ELF file to comprise: to the characteristic signature checking of described ELF file and the validity checking of signer mark.
And, the content signature of described ELF file is with discriminating based on combined public-key scheme, and wherein, signature private key is the publisher of ELF file or the private key of author, when differentiating the characteristic signature of described ELF file, using the publisher of described ELF file or the mark of author as PKI.
In addition, the feature of described ELF file differentiated or comprised: one is carry out validity checking to the mark of signer, judging whether the author of ELF file and the mark of publisher are preset in trust list in operating system; Two is the checkings signature of file characteristic being carried out to digital signature, judges authenticity and the complete body of file identification.If file characteristic is differentiated not pass through, then refusal performs ELF file.
According to embodiments of the invention, additionally provide a kind of ELF file identification device based on code signature.
This device comprises: the first identification module, in user or system when applying for performing ELF file, first (come by call operation system kernel scheduler program, also can by other means) be differentiated to the mark of ELF file; Second identification module, in be the mark of ELF file at identification result be real situation, differentiates the feature of ELF file further, and under the characteristic differentiation result of ELF file is complete and real situation, allows to perform ELF file; Control module, for being fict in the mark of ELF file or under the characteristic differentiation result of ELF file is not complete and real situation, refusal performs ELF file.
Principle, technique scheme of the present invention is described below.
In the present invention, described file differentiates the signature that comprises file and checking, performs international standard protocol; Described signature and checking are based on the public key system basis identified realizes; The described public key system based on mark produces public affairs, private key to key cryptosystem (only having Conbined public or double key (CPK) system signature could be provided with checking and encrypt and DecryptDecryption function at present) simultaneously by mark; Such as, suppose that entity identification is the private key that Alice, alice represent Alice, ALICE represents PKI, and the mapping algorithm of private key is σ 1, and the mapping algorithm of PKI is σ 2, so can draw: Alice → σ 1 → alice; Alice → σ 2 → ALICE.
Wherein, σ 1 only has in KMC's (Key Management Center, is abbreviated as KMC), therefore only have KMC to generate private key, and each user of σ 2 has, therefore, as long as each user knows that mark just can generate corresponding PKI.
In the present invention, it is produced evidence by file publisher that ELF file is differentiated, the mode of file called side experimental evidence is carried out.Evidence is the signature of publisher to file, and signature carries out in two steps: the first step, publisher signs to file identification, second step, and publisher signs to file characteristic.The checking of called side is also carried out in two steps: the first step, is accepting the stage, when system or user apply for performing ELF file, namely operating system nucleus scheduler program is before file is loaded into internal memory, the signature first extracting this file identification is verified, whether judges the loading of this file, claims to accept checking; Second step, is accepting the stage, and the signature of extraction document feature is verified, whether judges the execution of this file, claims to accept checking.
When reality is implemented, the framework realizing technique scheme of the present invention comprises five parts such as signature blocks, kernel security modules, authentication module, safety chip module and list list block, wherein,
Signature blocks is used for signing to the file identification of ELF file and file characteristic, provides authenticity proof.Wherein, file identification comprises the information such as the original author of file name, file size and file; File characteristic comprises file identification and file content, is the digital digest of file identification and file content data, can adopts SHA1 hash function.To the signature of file identification, also claim to accept signature; To the signature of file characteristic, also claim to accept signature.File characteristic provides the integraty of file identification and data to prove, therefore can using a bit of or data integrity code in file as file characteristic.Signature blocks generally exists can perform binary program mode.Need to sign to the ELF file of operating system before realizing security strategy, otherwise the ELF file of operating system also can be rejected execution owing to not having legitimate signature, causes operating system normally to run.
Kernel security modules is used for modifying to the debug procedures of operating system nucleus source code, first authentication module is turned to before host process scheduling ELF file, the authenticity of ELF file is loaded or is performed by authentication module decision request, can only be (be not namely tampered really by discriminating, the ELF file that the publisher allowed in list list issues), just allow to load or perform, otherwise refusal loads or performs.
Authentication module is used for verifying the signature of ELF file identification, claims to accept checking, makes loading whether judgement; Simultaneously also for verifying the signature of ELF file characteristic, claiming to accept checking, making execution whether judgement.Accept checking to carry out before acceptance checking, claim to differentiate in advance.Prior discriminating can improve the performance of operating system greatly, and this is also the key character that the present invention is different from other discrimination methods.
Safety chip module is used for the safety by hardware protection scheme protection system parameter and list list, and effectively prevent substitution attack and quantum computation attack, this is also the key character that the present invention is different from traditional signatures discrimination method.
List list block is a kind of configurability file, for managing legal publisher.The alone chip identification encryption of name, is stored in chip internal, calls in operating system nucleus when an operating system starts, forbid that consumer process is accessed.List list is also effective part of the present invention, can realize like this outside the ELF file of the legal publisher's signature allowed, and loads even if all the other have the ELF file of legitimate signature (signature is not in list list) also can be rejected or performs.
Based on above-mentioned framework, the signature flow process that the present invention relates generally to when reality is implemented is as follows with checking flow process:
Signature flow process confirmed that the ELF file in the software of safety was signed to the ELF file involved by computer internal operating system and some through test before enabling checking flow process correlation module, file after signature is considered as secure file, so please sign your name before execution signature, side confirms (can detect by existing anti-virus and Trojan software) file uninfecting virus and wooden horse.
As shown in Figure 2, signature process is divided into the following steps:
1), publisher first provides the ELF file identification that will issue authenticity proof, and namely publisher is to ELF file identification signature (signature computing is in safety chip);
2), by the signature value of file identification, signature time, signature agreement, version number and signer mark etc. pack, after then adopting ASN.1 coding, write the identification signature district of ELF file;
3), publisher first provides the ELF file characteristic that will issue authenticity proof, and namely publisher is to ELF file characteristic signature (signature computing is in safety chip);
4), by the signature value of file characteristic, signature time, signature agreement, version number and signer mark etc. pack, by the characteristic signature district of the data acquisition after packing with the ELF file after ASN.1 coding write signature.
Checking flow process is after installation and deployment authentication module of the present invention, kernel security modules, safety chip module and list list block, starts the flow process that ELF file validation performed to the whole cycle of system closing checks when os starting.Checking flow process relate to the scheduling etc. of the extraction of signing messages, the loading of list list and inquiry, safety chip module and kernel security modules.
(mark differentiated in figure to differentiate to have carried out merging simplify processes with file characteristic) as shown in Figure 3, checking flow process is divided into the following steps:
1), system or user apply for performing certain ELF file;
2), kernel security modules will call authentication module, apply for that the ELF file to application performs is verified;
3), authentication module from application perform ELF file identification signature district read identification signature data, file identification information is submitted to authentication module in the lump simultaneously;
4), authentication module carries out format check to signed data, if do not passed through, then return directly to kernel security modules the information (mainly for unsigned ELF file) that discriminating do not pass through, kernel security modules refusal performs request; If passed through, then proceed to step 5);
5), authentication module calculates digital digest to file identification, and digital digest and signing messages sent into safety chip module, carries out the checking of digital signature;
6) if checking is not passed through, then return discriminating not by information (situation for file identification is tampered) to kernel security modules, kernel security modules refusal performs request; Otherwise proceed to step 7);
7), identification signature is verified, then whether query signature person's mark is in list list, if not in list list, then return discriminating not by information to kernel security modules, kernel refusal performs request; Otherwise proceed to step 8);
8), authentication module extraction document content signature data from ELF file, simultaneously the data summarization of calculation document content (containing the additional information of ELF signature), submits to authentication module by signed data and digital digest.
9), authentication module checks the form legitimacy of signed data, and not by then returning discriminating not by information to kernel security modules, kernel security modules refuses the execution request of this ELF file; Otherwise proceed to step 10);
10), digital digest and signed data sent into safety chip module and carry out signature verification by authentication module, if checking is not passed through, then returns discriminating not by information to kernel security modules, and kernel security modules refusal performs the execution request of this ELF file; Otherwise proceed to step 11);
11) whether, after being verified, extracting signature mark, inquire about this mark and exist, if there is no then return discriminating not by information to kernel security modules in list list, kernel security modules refusal performs the execution request of this ELF file; Otherwise proceed to step 12);
12), kernel security modules loads this ELF file and performs.
In above-mentioned flow process, digital signature authentication is carried out in safety chip module, and the performance as fruit chip does not reach and requires or consider from fail safe and performance, and authentication module also can be adopted to realize the authentication function of digital signature.
When practical application, technique scheme of the present invention is applicable to Unix and (SuSE) Linux OS as kernel all operations system, comprise Android operation popular at present, now for the (SuSE) Linux OS of increasing income, technique scheme of the present invention is further described.
Linux security module (Linux Security Module, is abbreviated as LSM) is a lightweight generalized framework for access control of linux kernel.It makes various different safe access control model can realize out with the form of Linux UV-Vis spectra, user can select the security module be applicable to be loaded in linux kernel according to its demand, thus substantially increases flexibility and the ease for use of Linux safe access control mechanism.The present invention is exactly the access control framework that make use of Linux security module, adds to the signature verification of ELF file to realize the true and false discriminating of ELF file when kernel program is dispatched, thus the fail safe of lifting operating system.
Fig. 4 shows the implementation of Linux security module, wherein, user is when executive system is called, first by the error checking of original kernel interface successively n-back test, then carry out traditional DAC to check, and before the internal object being about to access kernel, call LSM by LSM Hook Function.LSM calls the legitimacy that concrete access control policy decides to access again.
Principle of the present invention is exactly realize verifying the file identification of ELF file signature and file content signature utilizing LSM Hook Function to call authentication module, result according to differentiating judges whether the execution allowing this ELF file, to reach the malicious attack preventing virus and trojan horse program.
Carry out linux system design with regard to realization of the present invention below, examples illustrates implementation process.
1. overall system design
Relate generally to following module: signature blocks, kernel security modules, authentication module, safety chip module, list list block.
2. modular design
(1) signature blocks
Signature blocks is a relatively independent module, and it is available to the signature management devices that publisher uses, and the ELF file carried out issuing for publisher is signed.
Signature blocks comprises following major function:
A, all ELF files under the ELF file of specifying or specified folder to be signed, generate the ELF file after signature;
B, have corresponding exception handling ability, as judged, whether file is ELF file and does not repeat signature etc. to the ELF file of having signed.
The key data structure that signature blocks relates to has:
A, signed data structure
B, ELF file data structure (as shown in table 1)
Table 1
See table 1, ELF header describes the tissue of whole file in file beginning, Section provides the every terms of information (as instruction, data, symbol table, relocation information etc.) of file destination, Program header table points out how to create process image, entrance containing each program header, Section header table comprises the entrance of each section, provides the information such as name, size, and wherein signed data is preserved hereof as a section.
(2) kernel security modules
Linux kernel security module (LSM) have employed the method by placing hook in kernel source code, arbitrates the access carried out kernel internal object, and these objects have: task, node node, file opened etc.Just before linux kernel is attempted to conduct interviews to internal object, the hook of a Linux security module (LSM) carries out one to authentication module and calls, thus to security module propose such problem " allowing access to perform? " security module carries out decision-making according to its security strategy, provide answer: allow, or refuse and then return a mistake.
Kernel security modules is exactly mainly in kernel, place a hook call authentication module and differentiate ELF file, determines whether allow load and execution according to the result differentiated.
(3) authentication module
Authentication module mainly to the realization of combined public-key scheme digital signature authentication protocol, to judge the true and false problem of ELF file.Authentication protocol is as follows:
The signature function of publisher:
SIGalice(h)=(s,c)
Wherein, alice is publisher, and h is signature object, i.e. file identification or file characteristic, and s is signed codevector, and c is check code.
The checking function of called side:
VERALICE(s)=c’
If c=c ', sign and approved.
(4) safety chip module
Safety chip module is the fail safe effectively being ensured list list by hardware protection scheme, is encrypted simultaneously and stores and use, can effectively prevent substitution attack and quantum computation attack to the PKI matrix of Conbined public or double key.The function of safety chip relates to COS system and application and development interface.Wherein COS system is divided into key management, Access Management Access, file system, message management and Driver Library five subsystems, and function opposite independent between five subsystems, is called by interface; Application and development interface can be divided into equipment control interface, file management interface, password management interface, key maintenance interface and cipher key service interface.
(5) list list block
List list block relates to maintenance, the storage of list and uses three aspects.The maintenance of list can develop that the list that a tool device carries out legal publisher for keeper increases, amendment and the maintenance of deleting, then by list cryptographic storage in safety chip; Storage is encrypted by the mark PKI of list list safety chip, and be stored in the place of safety of safety chip; Use is the private key DecryptDecryption corresponding with safety chip when os starting, is then buffered in operating system nucleus process, can inquire about this list list to determine that whether publisher is legal during system call authentication module.
3. implementation condition
Need before enforcement first to meet following precondition:
1), the key management system of Conbined public or double key is that publisher and terminal generate corresponding combination private key according to unique identification, and private key is write safety chip module (mode provided can be USB Key or Smart Card), and give publisher and user by secure way.
2), publisher has possessed the ELF file signature device based on combined public-key scheme.
3), user's (namely implementing the computer of authentication) has deployed the modules such as kernel security modules, authentication module, safety chip module.
4), user deploys list list block, and in safety chip module, has configured the publisher's identification list allowed.
5), before enabling kernel security modules, be the necessary relevant ELF file signature of operating system self-operating.
Concrete implementation step based on above-mentioned linux system is as follows:
1), publisher signs by the safety chip module of publisher to the ELF file that wanted sale room relates to, signature includes identification signature and content signature, with file fabrication and installation bag (the required ELF file of operating system again after signature, signed on behalf of signature or after first being assessed operating system self Programmable detection by authoritative third party by specific implementation side of the present invention temporarily, guarantee the fail safe of operating system itself);
2), user obtains the installation kit of having signed by legal means;
3), user whether assess publisher credible, and whether be tampered with verification tool checking installation kit, if allow the operation of this publisher and installation kit by checking, then check the mark whether having this publisher in list list, then do not add publisher's mark;
4), by the installation kit by checking dispose in a computer, enable kernel security modules.
In sum, by means of technique scheme of the present invention, the present invention can prevent virus and trojan horse program from utilizing ELF file to carry out malicious code attack effectively, thus improve the fail safe of operating system greatly, in the present invention, after ELF file is signed, information and the signing messages of publisher is just saved in this file, these information are the bases whether authenticating documents is true, complete, if contain malicious code in simultaneously signed ELF file, also can be reviewed publisher by signing messages and claim for indemnity.Signed file is even only have a bit to be modified, and checking is all unpassable.
And, the present invention can also realize the mode of active management, carry out us to ELF file to identify, in the present invention, owing to there being list list, thus the not all ELF file by legitimate signature all can be performed, the ELF file only having the publisher allowed in list list to sign can by checking, but the publisher that the user of such operating system trusts with regard to oneself administrative institute, the malicious attack that some incredible software publishing sides carry out can be prevented, and traditional anti-virus and trojan horse program identify based on enemy, adopt Passive Defence, depend on virus base and feature database, to emerging virus and wooden horse can only attack occur after the remedial measure that just can take, but be often hard to guard against.
In addition, the present invention can also realize prior authentication mechanism, just two parts that the signature of ELF file relates to identification signature and content signature are verified before file content data loads, (current most ELF file signature and authentication mechanism all only have the signature of file content to improve the performance of operating system greatly, just can verify after only having file data to load completely, namely verify, and the present invention utilizes dual signature afterwards, first can verify before file data loads).
In addition, the present invention can also improve systematic function, simplification system, in the present invention, because the present invention is based upon on mark identification system, identify and can obtain PKI by calculating, the authenticity that simultaneously computational process also achieves PKI proves, do not need by the 3rd PKI and publisher to be identified to realize binding, and because the present invention is based on combined public-key scheme, do not need third-party support, (based on third-party PKI public key system from card system, be difficult to realize on-line authentication when the ELF sigverif of operating system, namely the agreement of PKI signature verification completely can not be realized, fail safe there is certain defect).Thus making system more succinct, performance is higher.
The foregoing is only preferred embodiment of the present invention, not in order to limit the present invention, within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (8)
1. the ELF based on code signature can perform a linking format document authentication method, it is characterized in that, comprising:
User or system, when applying for performing ELF file, are first differentiated the mark of described ELF file;
If identification result is the mark of described ELF file is real, then further the feature of described ELF file is differentiated, and under the characteristic differentiation result of described ELF file is complete and real situation, allow to perform described ELF file;
If the mark of described ELF file is the characteristic differentiation result of fict or described ELF file is not complete and real, then refusal performs described ELF file.
2. ELF document authentication method according to claim 1, is characterized in that, carries out discriminating comprise the mark of described ELF file:
To the identification signature checking of described ELF file and the validity checking of signer mark.
3. ELF document authentication method according to claim 2, it is characterized in that, the identification signature of described ELF file and checking are based on combined public-key scheme, wherein, signature private key is the publisher of ELF file or the private key of author, when verifying the identification signature of described ELF file, using the publisher of described ELF file or the mark of author as PKI.
4. ELF document authentication method according to claim 1, it is characterized in that, carry out discriminating to the mark of described ELF file to comprise: carry out validity checking to the mark of signer, judge whether the author of ELF file and the mark of publisher are preset in trust list in operating system; And/or, the signature of file identification is carried out to the checking of digital signature, judge authenticity and the complete body of file identification.If signer mark is differentiated not pass through, then directly refuse loading ELF document.
5. ELF document authentication method according to claim 1, is characterized in that, carries out discriminating comprise the feature of described ELF file:
To the characteristic signature checking of described ELF file and the validity checking of signer mark.
6. ELF document authentication method according to claim 1, it is characterized in that, the content signature of described ELF file and discriminating are based on combined public-key scheme, wherein, signature private key is the publisher of ELF file or the private key of author, when differentiating the characteristic signature of described ELF file, using the publisher of described ELF file or the mark of author as PKI.
7. ELF document authentication method according to claim 1, is characterized in that, carries out discriminating comprise the feature of described ELF file:
Validity checking is carried out to the mark of signer, judges whether the author of ELF file and the mark of publisher are preset in trust list in operating system; And/or, the signature of file characteristic is carried out to the checking of digital signature, judge authenticity and the complete body of file identification.If file characteristic is differentiated not pass through, then refusal performs ELF file.
8., based on an ELF file identification device for code signature, it is characterized in that, comprising:
First authentication module, for when user or system perform ELF file in application, first differentiates the mark of described ELF file;
Second authentication module, for in be the mark of described ELF file at identification result be real situation, further the feature of described ELF file is differentiated, and under the characteristic differentiation result of described ELF file is complete and real situation, allow to perform described ELF file;
Control module, in be the characteristic differentiation result of fict or described ELF file in the mark of described ELF file be not complete and real situation, refusal performs described ELF file.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310288979.2A CN104283860A (en) | 2013-07-10 | 2013-07-10 | ELF file identification method and device based on code signature |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310288979.2A CN104283860A (en) | 2013-07-10 | 2013-07-10 | ELF file identification method and device based on code signature |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN104283860A true CN104283860A (en) | 2015-01-14 |
Family
ID=52258345
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310288979.2A Pending CN104283860A (en) | 2013-07-10 | 2013-07-10 | ELF file identification method and device based on code signature |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104283860A (en) |
Cited By (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105404823A (en) * | 2015-10-29 | 2016-03-16 | 浪潮电子信息产业股份有限公司 | Method and apparatus for controlling ELF file to run and operation system |
| CN105426749A (en) * | 2015-11-03 | 2016-03-23 | 浪潮电子信息产业股份有限公司 | Method for controlling running of ELF files on basis of signature mechanism |
| CN106815031A (en) * | 2017-02-22 | 2017-06-09 | 百度在线网络技术（北京）有限公司 | Kernel module loading method and device |
| CN107203716A (en) * | 2017-05-03 | 2017-09-26 | 中国科学院信息工程研究所 | A kind of linux kernel lightweight structured protection method and device |
| CN107480522A (en) * | 2017-08-14 | 2017-12-15 | 郑州云海信息技术有限公司 | A kind of ELF files executive control system and method |
| CN107786504A (en) * | 2016-08-26 | 2018-03-09 | 腾讯科技（深圳）有限公司 | ELF file publishing methods, ELF file verifications method, server and terminal |
| WO2020140257A1 (en) * | 2019-01-04 | 2020-07-09 | Baidu.Com Times Technology (Beijing) Co., Ltd. | Method and system for validating kernel objects to be executed by a data processing accelerator of a host system |
| CN111783072A (en) * | 2020-07-15 | 2020-10-16 | 北京同源华安软件科技有限公司 | Security control method and device under Linux system |
| CN113468485A (en) * | 2021-07-05 | 2021-10-01 | 桂林电子科技大学 | Digital signature and certificate verification program protection method based on Linux operating system |
| US11233652B2 (en) | 2019-01-04 | 2022-01-25 | Baidu Usa Llc | Method and system to derive a session key to secure an information exchange channel between a host system and a data processing accelerator |
| US11281251B2 (en) | 2019-01-04 | 2022-03-22 | Baidu Usa Llc | Data processing accelerator having a local time unit to generate timestamps |
| US11328075B2 (en) | 2019-01-04 | 2022-05-10 | Baidu Usa Llc | Method and system for providing secure communications between a host system and a data processing accelerator |
| US11374734B2 (en) | 2019-01-04 | 2022-06-28 | Baidu Usa Llc | Method and system for key distribution and exchange for data processing accelerators |
| US11409534B2 (en) | 2019-01-04 | 2022-08-09 | Baidu Usa Llc | Attestation protocol between a host system and a data processing accelerator |
| US11609766B2 (en) | 2019-01-04 | 2023-03-21 | Baidu Usa Llc | Method and system for protecting data processed by data processing accelerators |
| US11616651B2 (en) | 2019-01-04 | 2023-03-28 | Baidu Usa Llc | Method for establishing a secure information exchange channel between a host system and a data processing accelerator |
| US11693970B2 (en) | 2019-01-04 | 2023-07-04 | Baidu Usa Llc | Method and system for managing memory of data processing accelerators |
| US11799651B2 (en) | 2019-01-04 | 2023-10-24 | Baidu Usa Llc | Data processing accelerator having a security unit to provide root trust services |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1512355A (en) * | 2002-12-30 | 2004-07-14 | 成都三零盛安信息系统有限公司 | Code signature verifying method of ELF file form |
| CN1633071A (en) * | 2005-01-14 | 2005-06-29 | 南相浩 | Method and apparatus for cipher key generation based on identification |
| CN1832403A (en) * | 2006-04-24 | 2006-09-13 | 北京易恒信认证科技有限公司 | CPK credibility authorization system |
| CN101340282A (en) * | 2008-05-28 | 2009-01-07 | 北京易恒信认证科技有限公司 | Generation method of composite public key |
| CN101520832A (en) * | 2008-12-22 | 2009-09-02 | 康佳集团股份有限公司 | System and method for verifying file code signature |
| CN103036894A (en) * | 2012-12-19 | 2013-04-10 | 福建联迪商用设备有限公司 | Intelligent terminal application program installing file networking digital signature method |
-
2013
- 2013-07-10 CN CN201310288979.2A patent/CN104283860A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1512355A (en) * | 2002-12-30 | 2004-07-14 | 成都三零盛安信息系统有限公司 | Code signature verifying method of ELF file form |
| CN1633071A (en) * | 2005-01-14 | 2005-06-29 | 南相浩 | Method and apparatus for cipher key generation based on identification |
| CN1832403A (en) * | 2006-04-24 | 2006-09-13 | 北京易恒信认证科技有限公司 | CPK credibility authorization system |
| CN101340282A (en) * | 2008-05-28 | 2009-01-07 | 北京易恒信认证科技有限公司 | Generation method of composite public key |
| CN101520832A (en) * | 2008-12-22 | 2009-09-02 | 康佳集团股份有限公司 | System and method for verifying file code signature |
| CN103036894A (en) * | 2012-12-19 | 2013-04-10 | 福建联迪商用设备有限公司 | Intelligent terminal application program installing file networking digital signature method |
Cited By (26)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105404823B (en) * | 2015-10-29 | 2018-02-23 | 浪潮电子信息产业股份有限公司 | A kind of method, apparatus and operating system of control ELF running papers |
| CN105404823A (en) * | 2015-10-29 | 2016-03-16 | 浪潮电子信息产业股份有限公司 | Method and apparatus for controlling ELF file to run and operation system |
| CN105426749A (en) * | 2015-11-03 | 2016-03-23 | 浪潮电子信息产业股份有限公司 | Method for controlling running of ELF files on basis of signature mechanism |
| CN105426749B (en) * | 2015-11-03 | 2018-08-14 | 浪潮电子信息产业股份有限公司 | A method of ELF running papers are controlled based on signature mechanism |
| CN107786504B (en) * | 2016-08-26 | 2020-09-04 | 腾讯科技（深圳）有限公司 | ELF file release method, ELF file verification method, server and terminal |
| CN107786504A (en) * | 2016-08-26 | 2018-03-09 | 腾讯科技（深圳）有限公司 | ELF file publishing methods, ELF file verifications method, server and terminal |
| CN106815031A (en) * | 2017-02-22 | 2017-06-09 | 百度在线网络技术（北京）有限公司 | Kernel module loading method and device |
| CN106815031B (en) * | 2017-02-22 | 2020-03-24 | 百度在线网络技术（北京）有限公司 | Kernel module loading method and device |
| CN107203716A (en) * | 2017-05-03 | 2017-09-26 | 中国科学院信息工程研究所 | A kind of linux kernel lightweight structured protection method and device |
| CN107203716B (en) * | 2017-05-03 | 2020-05-22 | 中国科学院信息工程研究所 | Lightweight structured protection method and device for Linux kernel |
| CN107480522B (en) * | 2017-08-14 | 2020-05-08 | 苏州浪潮智能科技有限公司 | ELF file execution control system and method |
| CN107480522A (en) * | 2017-08-14 | 2017-12-15 | 郑州云海信息技术有限公司 | A kind of ELF files executive control system and method |
| US11392687B2 (en) * | 2019-01-04 | 2022-07-19 | Baidu Usa Llc | Method and system for validating kernel objects to be executed by a data processing accelerator of a host system |
| US11374734B2 (en) | 2019-01-04 | 2022-06-28 | Baidu Usa Llc | Method and system for key distribution and exchange for data processing accelerators |
| CN112292678A (en) * | 2019-01-04 | 2021-01-29 | 百度时代网络技术（北京）有限公司 | Method and system for validating a kernel object to be executed by a data processing accelerator of a host system |
| US11799651B2 (en) | 2019-01-04 | 2023-10-24 | Baidu Usa Llc | Data processing accelerator having a security unit to provide root trust services |
| US11233652B2 (en) | 2019-01-04 | 2022-01-25 | Baidu Usa Llc | Method and system to derive a session key to secure an information exchange channel between a host system and a data processing accelerator |
| US11281251B2 (en) | 2019-01-04 | 2022-03-22 | Baidu Usa Llc | Data processing accelerator having a local time unit to generate timestamps |
| US11328075B2 (en) | 2019-01-04 | 2022-05-10 | Baidu Usa Llc | Method and system for providing secure communications between a host system and a data processing accelerator |
| US11693970B2 (en) | 2019-01-04 | 2023-07-04 | Baidu Usa Llc | Method and system for managing memory of data processing accelerators |
| WO2020140257A1 (en) * | 2019-01-04 | 2020-07-09 | Baidu.Com Times Technology (Beijing) Co., Ltd. | Method and system for validating kernel objects to be executed by a data processing accelerator of a host system |
| US11409534B2 (en) | 2019-01-04 | 2022-08-09 | Baidu Usa Llc | Attestation protocol between a host system and a data processing accelerator |
| US11609766B2 (en) | 2019-01-04 | 2023-03-21 | Baidu Usa Llc | Method and system for protecting data processed by data processing accelerators |
| US11616651B2 (en) | 2019-01-04 | 2023-03-28 | Baidu Usa Llc | Method for establishing a secure information exchange channel between a host system and a data processing accelerator |
| CN111783072A (en) * | 2020-07-15 | 2020-10-16 | 北京同源华安软件科技有限公司 | Security control method and device under Linux system |
| CN113468485A (en) * | 2021-07-05 | 2021-10-01 | 桂林电子科技大学 | Digital signature and certificate verification program protection method based on Linux operating system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104283860A (en) | ELF file identification method and device based on code signature | |
| CN111049825B (en) | Secure multi-party computing method and system based on trusted execution environment | |
| JP6370722B2 (en) | Inclusive verification of platform to data center | |
| JP4113274B2 (en) | Authentication apparatus and method | |
| KR100868121B1 (en) | Method for using trusted, hardware-based identity credentials in runtime package signature to secure mobile communications and high-value transaction execution | |
| CN108055133B (en) | Key security signature method based on block chain technology | |
| US6381698B1 (en) | System and method for providing assurance to a host that a piece of software possesses a particular property | |
| CN102077208B (en) | The method and system of the licence of protected content is provided to application program collection | |
| US9064129B2 (en) | Managing data | |
| CN106991298B (en) | Access method of application program to interface, authorization request method and device | |
| US10867058B2 (en) | Method and system for protecting secure computer systems from insider threats | |
| CN109905360B (en) | Data verification method and terminal equipment | |
| CN111431707B (en) | Service data information processing method, device, equipment and readable storage medium | |
| JP2005535945A (en) | How to protect the integrity of a computer program | |
| KR20180089670A (en) | Method for generating and verifying an digital signature or message authentication code based on a block chain that does not require key management | |
| CN108496323B (en) | Certificate importing method and terminal | |
| CN110830257B (en) | File signature method and device, electronic equipment and readable storage medium | |
| CN110708162A (en) | Resource acquisition method and device, computer readable medium and electronic equipment | |
| KR101890584B1 (en) | Method for providing certificate service based on m of n multiple signatures and server using the same | |
| CN111585995A (en) | Method and device for transmitting and processing safety wind control information, computer equipment and storage medium | |
| CN110826034B (en) | File signature method and device, electronic equipment and readable storage medium | |
| CN111489157B (en) | Method and system for controlling blockchain transaction | |
| CN114387137A (en) | Block chain-based electronic contract signing method, device, equipment and storage medium | |
| KR20180041052A (en) | Method for providing certificate service based on m of n multiple signatures and server using the same | |
| Ba et al. | User-policy-based dynamic remote attestation in cloud computing |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20150114 |
|
| WD01 | Invention patent application deemed withdrawn after publication |