CN110046493B - Data processing method, device, equipment and machine-readable medium - Google Patents

Data processing method, device, equipment and machine-readable medium Download PDF

Info

Publication number
CN110046493B
CN110046493B CN201810035991.5A CN201810035991A CN110046493B CN 110046493 B CN110046493 B CN 110046493B CN 201810035991 A CN201810035991 A CN 201810035991A CN 110046493 B CN110046493 B CN 110046493B
Authority
CN
China
Prior art keywords
certificate
system software
sub
feature
root
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201810035991.5A
Other languages
Chinese (zh)
Other versions
CN110046493A (en
Inventor
钟伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Banma Zhixing Network Hongkong Co Ltd
Original Assignee
Banma Zhixing Network Hongkong Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Banma Zhixing Network Hongkong Co Ltd filed Critical Banma Zhixing Network Hongkong Co Ltd
Priority to CN201810035991.5A priority Critical patent/CN110046493B/en
Publication of CN110046493A publication Critical patent/CN110046493A/en
Application granted granted Critical
Publication of CN110046493B publication Critical patent/CN110046493B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

The embodiment of the application provides a data processing method, a device, equipment and a machine-readable medium, wherein the method comprises the following steps: determining a certificate corresponding to system software according to the characteristics of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; and signing the system software by using the certificate corresponding to the system software. According to the method and the device, the security risk of mass equipment caused by signature leakage can be reduced to a certain extent, and the security protection capability of the equipment can be improved.

Description

Data processing method, device, equipment and machine-readable medium
Technical Field
The present application relates to the field of device security technologies, and in particular, to a data processing method, a data processing apparatus, a device, and a machine readable medium.
Background
Smart devices are typically equipped with an operating system to facilitate user access. Currently, operating systems are typically provided with super user rights (Root). Under the authority of the super user, actions such as data reading, writing, adding, deleting, modifying and the like beyond the general operation range can be performed, and the security of the operating system is important because the actions possibly relate to data necessary for the operation of the operating system.
The existing scheme can install system software for driving the equipment in the equipment before the equipment leaves the factory; in addition, in order to improve the security of an operating system, the existing scheme can also sign the system software before installing the system software for driving the device in the device; in this way, in the starting and running process of the operating system, signature verification can be performed on the system software, so as to judge whether the file corresponding to the system software is tampered or not through the signature verification.
However, existing schemes typically add the same signature to all devices, which if compromised, would lead to a threat to the security of all devices using the signature, e.g., an attacker may use the signature to sign a virus and induce the user to install the virus on a device, e.g., malware uses the signature to perform rights promotion on a device, etc. In practical applications, existing solutions will lead to a threat to the security of mass devices as the yield of the devices increases.
Disclosure of Invention
The technical problem to be solved by the embodiment of the application is to provide a data processing method, which can reduce the security risk of mass equipment caused by signature leakage to a certain extent, and further can improve the security protection capability of the equipment.
Correspondingly, the embodiment of the application also provides a data processing device, equipment, machine-readable medium and an operating system, which are used for guaranteeing the implementation and application of the method.
In order to solve the above problems, an embodiment of the present application discloses a data processing method, including:
determining a certificate corresponding to system software according to the characteristics of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate;
and signing the system software by using the certificate corresponding to the system software.
Optionally, the features include: at least one of a device feature, a lot feature, a version feature, and a release area feature.
Optionally, the certificate is a sub-certificate derived from the root certificate.
Optionally, the determining, according to the characteristics of the system software, the certificate corresponding to the system software includes:
generating a plurality of sub-certificates according to the root certificate;
and distributing at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software to obtain the certificate corresponding to the system software of the feature.
Optionally, the root certificate and the sub-certificate form a tree relationship, and the sub-certificate of the current level in the tree relationship is obtained according to the root certificate or the sub-certificate of the last level.
Optionally, the generating a plurality of sub-certificates according to the root certificate includes:
issuing at least one sub-certificate of a first level by utilizing the root certificate;
issuing the sub-certificate of the (n+1) th level by using the sub-certificate of the N th level; wherein N is a natural number.
Optionally, the certificate includes: the first certificate, the method further comprising:
determining a second certificate corresponding to system software according to a first certificate corresponding to the system software;
and signing the data packet corresponding to the system software by using the second certificate corresponding to the system software.
Optionally, the first certificate is a sub-certificate obtained according to a root certificate; the root certificate and the sub-certificate form a tree relationship; the second certificate is at a higher level in the tree relationship than the first certificate.
Optionally, the second certificate includes: the root certificate.
Optionally, the second certificate is obtained according to a category corresponding to the first certificate, and the first certificates in the same category correspond to the same second certificate; the class corresponding to the first certificate is obtained according to the superior certificate corresponding to the first certificate, and the first certificates with the same class correspond to the same superior certificate.
Optionally, the method further comprises:
judging whether a certificate used for signing the data packet meets preset conditions, if so, checking the signature of the data packet, and if not, checking the signature of the data packet; the preset conditions include: the level of the certificate used by the signature of the data packet in the tree relationship is higher than the level of the first certificate in the tree relationship.
Optionally, the method further comprises:
and publishing the signed system software as a corresponding version of the system software.
On the other hand, the embodiment of the application also discloses a data processing device, which comprises:
the certificate determining module is used for determining a certificate corresponding to the system software according to the characteristics of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; and
and the first signature module is used for signing the system software by utilizing the certificate corresponding to the system software.
Optionally, the features include: at least one of a device feature, a lot feature, a version feature, and a release area feature.
Optionally, the certificate is a sub-certificate derived from the root certificate.
Optionally, the certificate determination module includes:
the sub-certificate generation sub-module is used for generating a plurality of sub-certificates according to the root certificate;
and the sub-certificate assignment sub-module is used for assigning at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software so as to obtain the certificate corresponding to the system software of the feature.
Optionally, the root certificate and the sub-certificate form a tree relationship, and the sub-certificate of the current level in the tree relationship is obtained according to the root certificate or the sub-certificate of the last level.
Optionally, the sub-certificate allocation sub-module includes:
a first issuing unit, configured to issue at least one sub-certificate of a first hierarchy by using a root certificate; and
a second issuing unit, configured to issue a sub-certificate of the (n+1) -th level by using the sub-certificate of the N-th level; wherein N is a natural number.
Optionally, the certificate includes: the first certificate, the apparatus further comprising:
the second certificate determining module is used for determining a second certificate corresponding to the system software according to the first certificate corresponding to the system software;
And the second certificate signing module is used for signing the data packet corresponding to the system software by utilizing the second certificate corresponding to the system software.
Optionally, the first certificate is a sub-certificate obtained according to a root certificate; the root certificate and the sub-certificate form a tree relationship; the second certificate is at a higher level in the tree relationship than the first certificate.
In yet another aspect, an embodiment of the present application further discloses an apparatus, including:
one or more processors; and
one or more machine-readable media having instructions stored thereon, which when executed by the one or more processors, cause the apparatus to perform one or more of the methods described previously.
In yet another aspect, embodiments of the present application disclose one or more machine-readable media having instructions stored thereon that, when executed by one or more processors, cause an apparatus to perform one or more of the methods described previously.
In yet another aspect, an embodiment of the present application further discloses an operating system for a device, including:
the certificate determining unit is used for determining a certificate corresponding to the system software according to the characteristics of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; and
And the first signature unit is used for signing the system software by utilizing the certificate corresponding to the system software.
Compared with the prior art, the embodiment of the application has the following advantages:
according to the method and the device for identifying the mass equipment, different certificates are distinguished through the characteristics of the system software, specifically, at least two different characteristics can correspond to different certificates, and the certificate corresponding to the system software can be used as a basis for signing the system software, so that the diversity and the diversity of the corresponding signature of the system software can be increased through different certificates, and therefore the security risk of the mass equipment caused by signature leakage can be reduced to a certain extent, namely, the number of equipment which is threatened by security during signature leakage can be reduced, and the security protection capability of the equipment can be improved.
Drawings
FIG. 1 is a flow chart of steps of an embodiment of a data processing method of the present application;
FIG. 2 is an illustration of a certificate of tree relationship in accordance with an embodiment of the present application;
FIG. 3 is a process schematic for obtaining a signature according to an embodiment of the present application;
FIG. 4 is a flowchart illustrating steps of another embodiment of a data processing method of the present application;
FIG. 5 is a block diagram of an embodiment of a data processing apparatus of the present application;
FIG. 6 is a block diagram of another embodiment of a data processing apparatus of the present application;
FIG. 7 is a schematic diagram of a hardware structure of an apparatus according to an embodiment of the present application;
FIG. 8 is a schematic diagram of a hardware structure of an apparatus according to another embodiment of the present application;
FIG. 9 is a schematic diagram of an operating system according to an embodiment of the present application.
Detailed Description
In order that the above-recited objects, features and advantages of the present application will become more readily apparent, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings.
The embodiment of the application provides a data processing scheme, which can determine a certificate corresponding to system software according to the characteristics of the system software; the system software with at least two different features can correspond to different certificates, and the certificates corresponding to the system software with at least two different features can be generated based on the same root certificate; and signing the system software by using the certificate corresponding to the system software.
In the embodiment of the present application, the features of the system software may be used to characterize abstract characteristics of the system software, for example, the features may include: at least one of a device feature, a lot feature, a version feature, and a release area feature.
Wherein the device characteristics may be used to characterize the device information applied by the system software, i.e. the device information used to install and run the system software. In practical applications, the above device features may include: information such as a device model number, a device configuration, or a date of manufacture of the device.
The batch characteristics refer to a management mode adopted in the signing process for distinguishing different certificates, and at least two different batch characteristics can correspond to different certificates. In practical applications, the batch characteristics corresponding to the system software may be determined according to the development completion date of the system software, the signature date of the system software, and the like, and it is understood that the embodiment of the present application is not limited to specific batch characteristics and specific determination manners of the batch characteristics.
Version features may be used to characterize version information of the system software for the operating system. Taking a terminal device as an example, along with development of a terminal device technology, the development speed of an existing operating system suitable for the terminal device is faster and faster, and an operator of the terminal device can determine version information of the operating system of the terminal device, wherein the version information can be version information of a native operating system or version information of an improved operating system. Taking an android operating system as an example, version information of a native operating system may include: 4.0, … 7.0, 7.1, etc., and the operator of the terminal device can determine the version information of its modified operating system, such as version information from 1.0.0.0 to 8.7.7.6, etc., according to the actual application requirements. It will be appreciated that embodiments of the present application are not limited to particular version features and particular manners of determining version features. In this embodiment of the present application, the same version features may correspond to the same system software, and further, the same version features may correspond to the same or different certificates.
The release area features can be used for characterizing the actual application area of the system software, namely the release area of the corresponding equipment of the system software. In practical application, the region granularity corresponding to the release region features may be country, province, city, etc., and it can be understood that the embodiment of the application does not limit specific release features and specific determination manners of release features.
According to the method and the device for identifying the mass equipment, different certificates are distinguished through the characteristics of the system software, specifically, at least two different characteristics can correspond to different certificates, and the certificate corresponding to the system software can be used as a basis for signing the system software, so that the diversity and the diversity of the corresponding signature of the system software can be increased through different certificates, and therefore the security risk of the mass equipment caused by signature leakage can be reduced to a certain extent, namely, the number of equipment which is threatened by security during signature leakage can be reduced, and the security protection capability of the equipment can be improved.
It can be appreciated that the above device features, batch features, version features and release area features are only optional embodiments of the features of the embodiments of the present application, and it can be appreciated that, according to actual application requirements, a person skilled in the art may use any desired features, and any feature capable of distinguishing system software is within the protection scope of the features of the embodiments of the present application.
In the embodiment of the application, the certificate can refer to a digital certificate, wherein the digital certificate is an electronic file issued by an organization and containing public key owner information and a public key, and has uniqueness and reliability. Typically, digital certificates employ a public key system, i.e., encryption and decryption using a pair of mutually matching keys. In one embodiment of the present application, the digital certificate may include: information such as the issuer, the use of the certificate, the public key, the encryption algorithm, the HASH algorithm, the expiration time of the certificate, etc.
In the embodiment of the application, the signature may refer to a digital signature. Digital signatures are some of the data attached to a data unit or cryptographic transformations made to a data unit. Such data or transformations allow the recipient of the data unit to confirm the source of the data unit and the integrity of the data unit and to protect the data from forgery by an unauthorized user. The digital signature can be obtained based on both public key cryptosystem and private key cryptosystem, mainly based on the public key cryptosystem. Digital signature is the process of encryption, and digital signature verification is the process of decryption.
In one embodiment of the present application, the process of digital signature may include: and encrypting the abstract information obtained by the digital certificate through a specific HASH function by using a private key corresponding to the digital certificate to obtain a signature. The process of digital signature verification may include: decrypting the signature by adopting a public key corresponding to the digital certificate to obtain encrypted first abstract information, obtaining second abstract information corresponding to the digital signature by adopting a HASH function, comparing the first abstract information with the second abstract information, if the first abstract information and the second abstract information are consistent, indicating that the file is not tampered, checking to pass, and otherwise, checking to fail. Alternatively, the resulting signature may be attached at the end of the digital certificate or the like.
The embodiment of the application can be used for signing the system software of the operating system so as to reduce the safety risk of the equipment corresponding to the system software and improve the safety protection capability of the equipment. The system software is a system for controlling and coordinating a computer and external equipment and supporting development and running of application software, is a set of various programs without user intervention, and has the main functions of scheduling, monitoring and maintaining an operating system; is responsible for managing the various independent hardware in the computer system so that they can work in concert. The system software allows computer users and other software to treat the computer as a whole without regard to how each underlying piece of hardware works.
The operating system may be any operating system, such as an android operating system, an IOS operating system, a Windows operating system, a Linux operating system, etc., which is not limited in the embodiment of the present application. For example, the android operating system of a terminal device is typically composed of a base platform and several system software based on the base platform.
The embodiment of the application can be applied to signature scenes of system software. In practical applications, the system software may include: the system software of the initial version or the system software of the upgrade version can be preloaded into the equipment before the equipment leaves the factory or is sold, and the system software of the upgrade version can be pushed to the equipment after the equipment leaves the factory or is sold. It will be appreciated that embodiments of the present application are not limited to specific system software. Accordingly, the certificate corresponding to the system software may include: a first certificate, a second certificate, etc. The first certificate may be an initial certificate, that is, a certificate corresponding to an installation package of the system software; the second certificate may be an upgrade certificate, that is, a certificate corresponding to an upgrade package of the system software. Of course, embodiments of the present application are not limited to specific credentials.
The devices to which the operating system of the embodiments of the present application is applicable may specifically include, but are not limited to: smart phones, tablet computers, e-book readers, MP3 (dynamic video expert compression standard audio plane 3,Moving Picture Experts Group Audio Layer III) players, MP4 (dynamic video expert compression standard audio plane 4,Moving Picture Experts Group Audio Layer IV) players, laptop portable computers, car computers, desktop computers, set-top boxes, smart televisions, wearable devices, and the like.
Referring to fig. 1, a flowchart illustrating steps of an embodiment of a data processing method of the present application may specifically include the following steps:
step 101, determining a certificate corresponding to system software according to the characteristics of the system software; the system software with at least two different features can correspond to different certificates, and the certificates corresponding to the system software with at least two different features can be generated based on the same root certificate;
and 102, signing the system software by using a certificate corresponding to the system software.
In this embodiment of the present application, the certificate corresponding to the system software may include: a first certificate, a second certificate, etc. The first certificate may be an initial certificate, and the initial certificate may correspond to an initial version of the system software, and may be used to sign the initial version of the system software; the second certificate may be an upgrade certificate, and the upgrade certificate may be a certificate corresponding to the upgrade version, relative to the initial certificate being a certificate corresponding to the initial version.
In an alternative embodiment of the present application, the features may include: at least one of a device feature, a lot feature, a version feature, and a release area feature. It is understood that, according to the actual application requirement, any required characteristics can be adopted by a person skilled in the art, and any characteristics capable of distinguishing the system software are all within the protection scope of the characteristics of the embodiments of the present application.
In another alternative embodiment of the present application, the certificate may be a sub-certificate derived from a root certificate. The root certificate is a certificate issued by the trusted structure to itself, which is the starting point of the trust chain. Optionally, the process of determining the certificate corresponding to the system software according to the characteristics of the system software may include: generating a plurality of sub-certificates according to the root certificate; and distributing at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software to obtain the certificate corresponding to the system software of the feature. In practical applications, different sub-certificates may be assigned for system software of different features. For example, for system software such as feature 1, feature 2, feature 3, feature 4, etc., a primary sub-certificate, a secondary sub-certificate, a tertiary sub-certificate, a quaternary sub-certificate, etc., are respectively assigned.
Optionally, the root certificate and the sub-certificate may form a tree relationship, where the sub-certificate of the current level in the tree relationship is obtained according to the root certificate or the sub-certificate of the previous level.
Optionally, the process of generating the plurality of sub-certificates according to the root certificate may include: issuing at least one sub-certificate of a first level by utilizing the root certificate; issuing a sub-certificate of the (n+1) -th hierarchy by using the sub-certificate of the (N) -th hierarchy (hereinafter referred to as an N-level sub-certificate); wherein N is a natural number.
Referring to fig. 2, a schematic representation of a tree-like relationship certificate according to an embodiment of the present application is shown, which may specifically include: the number of the sub-certificates in fig. 2 is 4, and it is understood that the number of the sub-certificates is not limited in the embodiment of the present application. Wherein, the nth level sub-certificate may include M sub-certificates, N, M is a natural number, and the value of M is not limited in the embodiment of the present application; the sub-certificates of the first hierarchy can be obtained according to the root certificate; when N > 1, the sub-certificate of the N-th hierarchy can be obtained according to the sub-certificate of the (N-1) hierarchy.
Specifically, the process of acquiring the sub-certificate of the nth hierarchy may include: signing the first-level sub-certificate with the root certificate; and/or issuing the sub-certificate of the (n+1) th level by using the sub-certificate of the nth level, so that the certificate of the next level can be obtained by using the certificate of the previous level; that is, the first level of sub-certificates require root certificates to certify, and the (n+1) th level of sub-certificates require the nth level of sub-certificates to certify.
Step 102 may utilize a certificate corresponding to the system software to sign the system software, where different certificates may correspond to different signatures, so that diversity and variability of signatures in the mass device may be realized. It will be appreciated that embodiments of the present application are not limited to the particular process of signing the system software.
In an alternative embodiment of the present application, the source code of the operating system may be compiled, the executable file obtained by compiling is used as a file corresponding to the system software, and then the file corresponding to the system software is input into step 102, so that the file corresponding to the system software is signed by using the first certificate through step 102, where the signed system software may be used as an release version of the system software.
In an alternative embodiment of the present application, different release versions may be obtained according to the source code of the operating system corresponding to the system software, specifically, according to the characteristics of the system software, a corresponding initial certificate may be obtained, and the system software is signed by using the initial certificate, so as to obtain different release versions. It should be noted that different release versions may correspond to the same or different operating system source code. In the case where different release versions correspond to the same operating system source code, the feature of the system software may be at least one of a device feature, a batch feature, and a release region feature. In the case where different release versions correspond to different operating system source code, the characteristics of the system software may be version characteristics.
Referring to fig. 3, a process schematic of obtaining a signature according to an embodiment of the present application is shown, where in a case where a feature of system software is a version feature of system software, the embodiment of the present application may compile operating system source code to obtain an executable file corresponding to a certain version of system software; where different operating system source codes may correspond to different versions, fig. 3 shows version 1, version 2, version 3, and version 4, and it is understood that the number of versions corresponding to the operating system source codes is not limited in the embodiments of the present application. Fig. 3 may obtain a primary sub-certificate using root certificate issuance: such as a primary sub-certificate a, a primary sub-certificate B, a primary sub-certificate C, a primary sub-certificate D, etc., and may also be issued by a primary sub-certificate to obtain a secondary sub-certificate, such as a primary sub-certificate C to obtain a secondary sub-certificate L2C, etc. Further, in fig. 3, at least one sub-certificate may be used to sign a version of executable file, and the system software that completes the signature may be used as an issue version of the system software, for example, the signatures obtained according to the first-level sub-certificate a, the first-level sub-certificate B, the second-level sub-certificate L2C, and the first-level sub-certificate D are respectively: an a signature, a B signature, an L2C signature, and a D signature, different signatures may correspond to different release versions.
In an alternative embodiment of the present application, the method of the embodiment of the present application may further include: issuing the signed system software as a corresponding version of the system software; for example, the signed system software is released as an initial version of the system software, as well as, for example, the signed system software is released as an updated version of the system software, and so on. Those skilled in the art can adopt a specific process of issuing the system software with the completed signature as an initial version of the system software according to actual application requirements. For example, the above-described process of distributing the signed system software as an initial version of the system software may include: the system software of the initial version is preloaded into the device, or the system software of the initial version is released to platforms such as official websites, application stores and the like. It will be appreciated that embodiments of the present application are not limited in the specific process of publishing signed system software as an initial version of the system software.
After the signed system software is installed to the device, the signature verification can be performed on the system software in the starting and running processes of the operating system, so as to judge whether the file corresponding to the system software is tampered or not through the signature verification. Alternatively, the foregoing digital signature verification process may be used to perform signature verification on the system software, and the embodiment of the present application does not limit the specific process of performing signature verification on the system software.
The configuration of system software is a complex process, the security levels of different versions are different, taking fig. 3 as an example, it is assumed that version 1 may contain risk codes because of vulnerability contained in release time or insufficient security audit in release process, and because of mutual independence between different signatures (such as an a signature and a B signature, an a signature and a C signature, etc.), after the signature a is used for signature by the version 1, a problem module of the version 1 cannot be installed on corresponding devices of the version 2, the version 3, etc., so that the embodiment of the application can realize signature isolation of security risks through diversity and diversity of signatures.
In summary, according to the data processing method of the embodiment of the present application, different certificates are distinguished by the features of the system software, specifically, different features may correspond to different certificates, and the certificate corresponding to the system software may be used as a basis for signing the system software, so the embodiment of the present application may increase diversity and diversity of the corresponding signature of the system software through different certificates, so that security risk of mass devices caused by signature leakage may be reduced to a certain extent, that is, the number of devices that are compromised in security when the signature leaks may be reduced, and further security protection capability of the devices may be improved.
To maintain a good user experience, operators of devices often regularly provide upgrade services for system software to the devices to enable an ever-increasing functionality of the devices, as well as an ever-improving operating system. According to the embodiment of the application, the upgrade service of the system software can be realized through the upgrade package. Wherein, the upgrade package may include: and the upgrade files corresponding to the system software are loaded by the operating system so as to realize the upgrade of the system software.
Referring to fig. 4, a flowchart illustrating steps of an embodiment of a data processing method of the present application may specifically include the following steps:
step 401, determining a first certificate corresponding to system software according to the characteristics of the system software; the system software with at least two different features can correspond to different first certificates, and the first certificates corresponding to the system software with at least two different features can be generated based on the same root certificate;
step 402, signing the system software by using a first certificate corresponding to the system software;
with respect to the method embodiment shown in fig. 1, the method of this embodiment may further include:
step 403, determining a second certificate corresponding to the system software according to the first certificate corresponding to the system software;
And 404, signing the data packet corresponding to the system software by using a second certificate corresponding to the system software.
In order to improve the security of the operating system, the embodiment of the application can also sign the upgrade package corresponding to the system software.
In one embodiment of the present application, the second certificate corresponding to the system software may be used to sign the data packet corresponding to the system software. The first certificate is a certificate corresponding to the initial version, and the data packet signed by the first certificate can be an installation packet; the second certificate may be a certificate corresponding to the upgrade version, and the data packet signed by the second certificate may be an upgrade packet.
Optionally, for the system software corresponding to one device, the corresponding second certificate can be the same as the first certificate, so that the diversity and the variability of the corresponding signature of the second certificate can be realized, and the security protection capability of the device is improved. Assuming that the system software corresponding to a certain version feature corresponds to S (S is a natural number) first certificates, the S first certificates can be used as S second certificates, and the upgrade package of the system software corresponding to the version can be signed by using the S second certificates. However, the number of times the upgrade package is signed is consistent with the number of second certificates, so the complexity of signing the upgrade package will increase as the value of S increases.
For the problem that the complexity of signing the upgrade package will increase with increasing value of S, in an alternative embodiment of the present application, the first certificate may be a sub-certificate obtained according to a root certificate; the root certificate and the sub-certificate form a tree relationship; the second certificate is at a higher level in the tree relationship than the first certificate.
The second certificate in the embodiment of the present application may be at an upper level or a higher level of the first certificate in the tree relationship, and because different first certificates may be obtained according to the same root certificate, for the system software corresponding to a certain version feature, the number of the upper level certificates corresponding to the first certificate may be smaller than the number of the first certificates, so the number of times of signing the upgrade package may be reduced, and therefore the complexity of signing the upgrade package may be reduced.
In an application example of the present application, it is assumed that, for system software corresponding to a certain version feature, the corresponding first certificate may include: s is S 1 One-level sub-certificate, S 2 Each secondary sub-certificate … S n N-level sub-certificates, where S 1 +S 2 +…+S n In one embodiment, the upper certificate-root certificate corresponding to the S first certificates may be used as the second certificate, that is, the second certificate may include: the root certificate; thus, the signature of the upgrade package of the system software corresponding to the version characteristic can be completed through 1-time signature, so that the complexity of signing the upgrade package can be reduced.
Of course, the above embodiment in which the root certificates corresponding to the S first certificates are used as the second certificates is just an alternative embodiment, and in fact, those skilled in the art may determine the second certificate in other manners according to actual application requirements. For example, the second certificate may be obtained according to a category corresponding to the first certificate, and the first certificate of the same category may correspond to the same second certificate; the class corresponding to the first certificate may be obtained according to an upper-level certificate corresponding to the first certificate, and the first certificates of the same class may correspond to the same upper-level certificate. The first certificate may be classified according to an upper certificate corresponding to the first certificate, so as to obtain a category corresponding to the first certificate, and the same second certificate is multiplexed for one category.
The superior certificate of the embodiment of the application may include: a previous-level certificate, or a previous-level certificate.
Alternatively, the S first certificates may be classified, and the first certificates having the same upper level certificate may be classified into one first class, so that the corresponding upper level certificate may be regarded as the second certificate for one first class. Taking fig. 2 as an example, the four-level sub-certificate a111 and the four-level sub-certificate a112 may be classified into a first class C1, the four-level sub-certificate a121 and the four-level sub-certificate a122 may be classified into a first class C2, the three-level sub-certificate a11 and the three-level sub-certificate a12 may be classified into a first class C3, and so on.
Further, the plurality of first classes may be classified, the first class in which the previous-stage certificate is identical may be classified into one second class, or the like, so that the previous-stage certificate may be regarded as the second certificate for one second class. Taking fig. 2 as an example, since the previous-stage certificate (the third-stage sub-certificate a 11) corresponding to the first class C1 and the previous-stage certificate (the third-stage sub-certificate a 12) corresponding to the first class C2 are the same, the first class C1 and the first class C2 may be classified into one second class, and the second certificate corresponding to the second class may be the second-stage sub-certificate A1.
In an alternative embodiment of the present application, the method of the embodiment of the present application may further include: the signed data packet is published as a corresponding version of the system software, for example, the signed upgrade packet may be published as an upgrade version of the system software. The process of issuing the signed upgrade package as an upgrade version of the system software may include: the upgrade version of the system software is pushed to the device, or the upgrade version of the system software is released to a platform such as an official website, an application store, etc., and it is understood that the specific process of releasing the upgrade package with the signature as the upgrade version of the system software is not limited in the embodiments of the present application.
In an optional embodiment of the present application, the second certificate may be further used to perform signature verification on the data packet to prevent the data packet from being tampered, and accordingly, the method of the embodiment of the present application may further include: judging whether a certificate used for signing the data packet meets preset conditions, if so, checking the signature of the data packet, and if not, checking the signature of the data packet; the preset conditions include: the level of the certificate used by the signature of the data packet in the tree relationship is higher than the level of the first certificate in the tree relationship. In practical applications, the device side may perform signature verification on the data packet (e.g., upgrade packet) after downloading the data packet (e.g., upgrade packet) and before installing the data packet (e.g., upgrade packet).
In summary, according to the data processing method disclosed by the embodiment of the application, the upgrade service of the system software can be realized through the data packet obtained based on the second certificate signature, so that good user experience is maintained. In addition, the hierarchy of the second certificate in the tree relationship is higher than that of the first certificate in the tree relationship, so that the second certificate is an upper-level certificate corresponding to the first certificate, and as different first certificates can be obtained according to the same root certificate, the number of upper-level certificates corresponding to the first certificate can be smaller than that of the first certificates for system software corresponding to a certain version characteristic, the number of times of signing the data packet can be reduced, and therefore the complexity of signing the data packet can be reduced.
It should be noted that, for simplicity of description, the method embodiments are shown as a series of acts, but it should be understood by those skilled in the art that the embodiments are not limited by the order of acts described, as some steps may occur in other orders or concurrently in accordance with the embodiments. Further, those skilled in the art will appreciate that the embodiments described in the specification are all preferred embodiments and that the acts referred to are not necessarily required by the embodiments of the present application.
The embodiment of the application also provides a data processing device.
With reference to fig. 5, a block diagram of an embodiment of a data processing apparatus of the present application is shown, which may specifically include the following modules:
a certificate determining module 501, configured to determine a certificate corresponding to system software according to a feature of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; and
and the first signing module 502 is configured to sign the system software by using a certificate corresponding to the system software.
Optionally, the features may include: at least one of a device feature, a lot feature, a version feature, and a release area feature.
Optionally, the certificate is a sub-certificate derived from the root certificate.
Optionally, the certificate determination module may include:
the sub-certificate generation sub-module is used for generating a plurality of sub-certificates according to the root certificate;
and the sub-certificate assignment sub-module is used for assigning at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software so as to obtain the certificate corresponding to the system software of the feature.
Optionally, the root certificate and the sub-certificate form a tree relationship, and the sub-certificate of the current level in the tree relationship is obtained according to the root certificate or the sub-certificate of the last level.
Optionally, the sub-certificate assignment sub-module may include:
a first issuing unit, configured to issue at least one sub-certificate of a first hierarchy by using a root certificate; and
a second issuing unit, configured to issue a sub-certificate of the (n+1) -th level by using the sub-certificate of the N-th level; wherein N is a natural number.
Optionally, the apparatus may further include:
and the release module is used for releasing the signed system software as a corresponding version of the system software.
With reference to fig. 6, a block diagram illustrating another embodiment of a data processing apparatus of the present application may specifically include the following modules:
the first certificate determining module 601 is configured to determine a certificate corresponding to system software according to a feature of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; and
a first signing module 602, configured to sign the system software by using a certificate corresponding to the system software;
with respect to the embodiment shown in fig. 5, the certificate of this embodiment may include: the first certificate, the apparatus may further include:
a second certificate determining module 603, configured to determine a second certificate corresponding to the system software according to the first certificate corresponding to the system software;
and the second certificate signing module 604 is configured to sign a data packet corresponding to the system software by using a second certificate corresponding to the system software.
Optionally, the first certificate is a sub-certificate obtained according to a root certificate; the root certificate and the sub-certificate form a tree relationship; the second certificate is at a higher level in the tree relationship than the first certificate.
Optionally, the second certificate may include: the root certificate.
Optionally, the second certificate is obtained according to a category corresponding to the first certificate, and the first certificates in the same category correspond to the same second certificate; the class corresponding to the first certificate is obtained according to the superior certificate corresponding to the first certificate, and the first certificates with the same class correspond to the same superior certificate.
Optionally, the apparatus may further include:
the judging module is used for judging whether the certificate used by the signature of the data packet accords with preset conditions, if so, the signature verification of the data packet passes, and if not, the signature verification of the data packet does not pass; the preset conditions may include: the level of the certificate used by the signature of the data packet in the tree relationship is higher than the level of the first certificate in the tree relationship.
Optionally, the apparatus may further include:
and the release module is used for releasing the signed system software as a corresponding version of the system software.
For the device embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference is made to the description of the method embodiments for relevant points.
In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described by differences from other embodiments, and identical and similar parts between the embodiments are all enough to be referred to each other.
The specific manner in which the various modules perform the operations in the apparatus of the above embodiments have been described in detail in connection with the embodiments of the method, and will not be described in detail herein.
The embodiment of the application also provides a device, which may include: one or more processors; and one or more machine readable media having instructions stored thereon, which when executed by the one or more processors, cause the apparatus to perform the method of one or more of fig. 1-4.
The embodiment of the application also provides a non-volatile readable storage medium, where one or more modules (programs) are stored, where the one or more modules are applied to a device, and the device may be caused to execute instructions (instractions) of each method step in the embodiment of the application.
In an alternative embodiment, the method comprises: one or more machine-readable media having instructions stored thereon that, when executed by one or more processors, cause a device to perform one or more of the methods described as server-side.
In another alternative embodiment, the method includes: one or more machine-readable media having instructions stored thereon that, when executed by one or more processors, cause a device to perform one or more of the methods as described at the terminal device side.
Fig. 7 is a schematic hardware structure of an apparatus according to an embodiment of the present application. The device may include various devices such as a server, a terminal device, and the like. As shown in fig. 7, the terminal device may include an input device 140, a processor 141, an output device 142, a memory 143, and at least one communication bus 144. The communication bus 144 is used to enable communication connections between the elements. The memory 143 may comprise a high-speed RAM memory or may further comprise a non-volatile memory NVM, such as at least one magnetic disk memory, in which various programs may be stored in the memory 143 for performing various processing functions and implementing the method steps of the present embodiment.
Alternatively, the processor 141 may be implemented as, for example, a central processing unit (Central Processing Unit, abbreviated as CPU), an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a controller, a microcontroller, a microprocessor, or other electronic components, and the processor 141 is coupled to the input device 140 and the output device 142 through wired or wireless connections.
Alternatively, the input device 140 may include a variety of input devices, for example, may include at least one of a user-oriented user interface, a device-oriented device interface, a programmable interface of software, a camera, and a sensor. Optionally, the device interface facing the device may be a wired interface for data transmission between devices, or may be a hardware insertion interface (such as a USB interface, a serial port, etc.) for data transmission between devices; alternatively, the user-oriented user interface may be, for example, a user-oriented control key, a voice input device for receiving voice input, and a touch-sensitive device (e.g., a touch screen, a touch pad, etc. having touch-sensitive functionality) for receiving user touch input by a user; optionally, the programmable interface of the software may be, for example, an entry for a user to edit or modify a program, for example, an input pin interface or an input interface of a chip, etc.; optionally, the transceiver may be a radio frequency transceiver chip, a baseband processing chip, a transceiver antenna, etc. with a communication function. An audio input device such as a microphone may receive voice data. The output device 142 may include a display, audio, etc.
In this embodiment, the processor of the terminal device may include functions for executing each module of the data processing apparatus in each device, and specific functions and technical effects may be referred to the above embodiments and are not described herein again.
Fig. 8 is a schematic hardware structure of an apparatus according to another embodiment of the present application. Fig. 8 is a diagram of one particular embodiment of the implementation of fig. 7. As shown in fig. 8, the apparatus of the present embodiment may include a processor 151 and a memory 152.
The processor 151 executes computer program codes stored in the memory 152 to implement the data processing methods of fig. 1 to 4 in the above-described embodiments.
The memory 152 is configured to store various types of data to support operations at the terminal device. Examples of such data include instructions for any application or method operating on the terminal device, such as messages, pictures, video, etc. The memory 152 may include a random access memory (random access memory, simply referred to as RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one magnetic disk memory.
Optionally, a processor 151 is provided in the processing assembly 150. The terminal device may further include: a communication component 153, a power supply component 154, a multimedia component 155, an audio component 156, an input/output interface 157 and/or a sensor component 158. The components and the like specifically included in the terminal device are set according to actual requirements, which are not limited in this embodiment.
The processing component 150 generally controls the overall operation of the terminal device. The processing component 150 may include one or more processors 151 to execute instructions to perform all or part of the steps of the methods illustrated in fig. 1-7 described above. Further, the processing component 150 can include one or more modules that facilitate interactions between the processing component 150 and other components. For example, the processing component 150 may include a multimedia module to facilitate interaction between the multimedia component 155 and the processing component 150.
The power supply assembly 154 provides power to the various components of the terminal device. The power components 154 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the terminal devices.
The multimedia component 155 includes a display screen between the terminal device and the user that provides an output interface. In some embodiments, the display screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the display screen includes a touch panel, the display screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may sense not only the boundary of a touch or slide action, but also the duration and pressure associated with the touch or slide operation.
Audio component 156 is configured to output and/or input audio signals. For example, the audio component 156 includes a Microphone (MIC) configured to receive external audio signals when the terminal device is in an operational mode, such as a speech recognition mode. The received audio signals may be further stored in the memory 152 or transmitted via the communication component 153. In some embodiments, audio component 156 also includes a speaker for outputting audio signals.
The input/output interface 157 provides an interface between the processing assembly 150 and peripheral interface modules, which may be click wheels, buttons, and the like. These buttons may include, but are not limited to: volume button, start button and lock button.
The sensor assembly 158 includes one or more sensors for providing status assessment of various aspects for the terminal device. For example, the sensor assembly 158 may detect the open/closed state of the terminal device, the relative positioning of the assembly, and the presence or absence of user contact with the terminal device. The sensor assembly 158 may include a proximity sensor configured to detect the presence of nearby objects in the absence of any physical contact, including detecting the distance between the user and the terminal device. In some embodiments, the sensor assembly 158 may also include a camera or the like.
The communication component 153 is configured to facilitate communication between the terminal device and other devices in a wired or wireless manner. The terminal device may access a wireless network based on a communication standard, such as WiFi,2G or 3G, or a combination thereof. In one embodiment, the terminal device may include a SIM card slot therein for inserting a SIM card, so that the terminal device may log into a GPRS network and establish communication with a server via the internet.
From the above, the communication component 153, the audio component 156, the input/output interface 157, and the sensor component 158 in the embodiment of fig. 8 can be implemented as the input device in the embodiment of fig. 7.
The embodiment of the application also provides an operating system for a device, as shown in fig. 9, where the operating system of the device may include: a certificate determination unit 901 and a first signature unit 902.
The certificate determining unit 901 is configured to determine a certificate corresponding to system software according to a feature of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; and
And the first signing unit 902 is configured to sign the system software by using a certificate corresponding to the system software.
Optionally, the features may include: at least one of a device feature, a lot feature, a version feature, and a release area feature.
Optionally, the certificate is a sub-certificate derived from the root certificate.
Alternatively, the certificate determination unit may include:
a sub-certificate generation sub-unit for generating a plurality of sub-certificates from the root certificate;
and the sub-certificate assignment sub-unit is used for assigning at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software so as to obtain the certificate corresponding to the system software of the feature.
Optionally, the root certificate and the sub-certificate form a tree relationship, and the sub-certificate of the current level in the tree relationship is obtained according to the root certificate or the sub-certificate of the last level.
Optionally, the sub-certificate allocation subunit may include:
a first issuing unit, configured to issue at least one sub-certificate of a first hierarchy by using a root certificate; and
a second issuing unit, configured to issue a sub-certificate of the (n+1) -th level by using the sub-certificate of the N-th level; wherein N is a natural number.
Optionally, the certificate includes: the first certificate, the operating system further comprising:
the second certificate determining unit is used for determining a second certificate corresponding to the system software according to the first certificate corresponding to the system software;
and the second certificate signing unit is used for signing the data packet corresponding to the system software by utilizing the second certificate corresponding to the system software.
Optionally, the first certificate is a sub-certificate obtained according to a root certificate; the root certificate and the sub-certificate form a tree relationship; the second certificate is at a higher level in the tree relationship than the first certificate.
Optionally, the operating system may further include:
and the issuing unit is used for issuing the signed system software as a corresponding version of the system software.
For the device embodiment, the apparatus embodiment and the operating system embodiment for the apparatus, the description is relatively simple, since it is substantially similar to the method embodiment, as relevant to see the partial description of the method embodiment.
In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described by differences from other embodiments, and identical and similar parts between the embodiments are all enough to be referred to each other.
Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present embodiments have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the embodiments of the present application.
Finally, it is further noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or terminal. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or terminal device comprising the element.
The foregoing has outlined a data processing method, a data processing apparatus, a device, a machine readable medium, a device-based operating system, and detailed description of the invention are provided, wherein specific examples are provided herein to illustrate the principles and embodiments of the invention, and the above examples are only for the purpose of aiding in the understanding of the method and core concept of the invention; meanwhile, as those skilled in the art will have modifications in the specific embodiments and application scope in accordance with the ideas of the present application, the present description should not be construed as limiting the present application in view of the above.

Claims (21)

1. A method of data processing, comprising:
determining a certificate corresponding to system software according to the characteristics of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; the certificate includes: certificate corresponding to installation package of system software, or certificate corresponding to upgrade package of system software;
signing the system software by using a certificate corresponding to the system software;
Wherein, according to the characteristics of the system software, determining the certificate corresponding to the system software comprises: generating a plurality of sub-certificates according to the root certificate; and distributing at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software to obtain the certificate corresponding to the system software of the feature.
2. The method of claim 1, wherein the features comprise: at least one of a device feature, a lot feature, a version feature, and a release area feature.
3. A method according to claim 1 or 2, characterized in that the certificate is a sub-certificate derived from a root certificate.
4. A method according to claim 3, wherein the root certificate and the sub-certificate form a tree-like relationship, and the sub-certificate of the current level in the tree-like relationship is obtained from the root certificate or the sub-certificate of the previous level.
5. The method of claim 1, wherein the generating a plurality of sub-certificates from the root certificate comprises:
issuing at least one sub-certificate of a first level by utilizing the root certificate;
issuing the sub-certificate of the (n+1) th level by using the sub-certificate of the (N) th level; wherein N is a natural number.
6. The method according to claim 1 or 2, wherein the certificate comprises: the first certificate, the method further comprising:
determining a second certificate corresponding to system software according to a first certificate corresponding to the system software;
and signing the data packet corresponding to the system software by using the second certificate corresponding to the system software.
7. The method of claim 6, wherein the first certificate is a sub-certificate derived from a root certificate; the root certificate and the sub-certificate form a tree relationship; the second certificate is at a higher level in the tree relationship than the first certificate.
8. The method of claim 7, wherein the second certificate comprises: the root certificate.
9. The method of claim 7, wherein the second certificate is obtained according to a category to which the first certificate corresponds, and a first certificate of a same category corresponds to a same second certificate; the class corresponding to the first certificate is obtained according to the superior certificate corresponding to the first certificate, and the first certificates with the same class correspond to the same superior certificate.
10. The method of claim 7, wherein the method further comprises:
judging whether a certificate used for signing the data packet meets preset conditions, if so, checking the signature of the data packet, and if not, checking the signature of the data packet; the preset conditions include: the level of the certificate used by the signature of the data packet in the tree relationship is higher than the level of the first certificate in the tree relationship.
11. The method according to claim 1 or 2, characterized in that the method further comprises:
and publishing the signed system software as a corresponding version of the system software.
12. A data processing apparatus, comprising:
the certificate determining module is used for determining a certificate corresponding to the system software according to the characteristics of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; the certificate includes: certificate corresponding to installation package of system software, or certificate corresponding to upgrade package of system software; and
The first signature module is used for signing the system software by utilizing a certificate corresponding to the system software;
wherein the certificate determination module comprises:
the sub-certificate generation sub-module is used for generating a plurality of sub-certificates according to the root certificate;
and the sub-certificate assignment sub-module is used for assigning at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software so as to obtain the certificate corresponding to the system software of the feature.
13. The apparatus of claim 12, wherein the features comprise: at least one of a device feature, a lot feature, a version feature, and a release area feature.
14. The apparatus according to claim 12 or 13, wherein the certificate is a sub-certificate derived from a root certificate.
15. The apparatus of claim 14, wherein the root certificate and the sub-certificate form a tree relationship, and wherein a sub-certificate of a current level in the tree relationship is derived from a root certificate or a sub-certificate of a previous level.
16. The apparatus of claim 15, wherein the sub-certificate assignment sub-module comprises:
a first issuing unit, configured to issue at least one sub-certificate of a first hierarchy by using a root certificate; and
The second issuing unit is used for issuing the sub-certificate of the (n+1) th level by utilizing the sub-certificate of the (N) th level; wherein N is a natural number.
17. The apparatus according to claim 12 or 13, wherein the certificate comprises: the first certificate, the apparatus further comprising:
the second certificate determining module is used for determining a second certificate corresponding to the system software according to the first certificate corresponding to the system software;
and the second certificate signing module is used for signing the data packet corresponding to the system software by utilizing the second certificate corresponding to the system software.
18. The apparatus of claim 17, wherein the first certificate is a sub-certificate derived from a root certificate; the root certificate and the sub-certificate form a tree relationship; the second certificate is at a higher level in the tree relationship than the first certificate.
19. A computer device, comprising:
one or more processors; and
one or more machine-readable media having instructions stored thereon, which when executed by the one or more processors, cause the computer device to perform the method of one or more of claims 1-11.
20. One or more machine-readable media having instructions stored thereon that, when executed by one or more processors, cause a computer device to perform the method of one or more of claims 1-11.
21. An operating system for a computer device, comprising:
the certificate determining unit is used for determining a certificate corresponding to the system software according to the characteristics of the system software; wherein, at least two different characteristic system software correspond to different certificates, the certificate corresponding to the at least two different characteristic system software is generated based on the same root certificate; the certificate includes: certificate corresponding to installation package of system software, or certificate corresponding to upgrade package of system software; and
the first signing unit is used for signing the system software by utilizing a certificate corresponding to the system software;
wherein the certificate determination unit includes:
a sub-certificate generation sub-unit for generating a plurality of sub-certificates from the root certificate;
and the sub-certificate assignment sub-unit is used for assigning at least one of the plurality of sub-certificates to the system software of the feature according to the feature of the system software so as to obtain the certificate corresponding to the system software of the feature.
CN201810035991.5A 2018-01-15 2018-01-15 Data processing method, device, equipment and machine-readable medium Active CN110046493B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201810035991.5A CN110046493B (en) 2018-01-15 2018-01-15 Data processing method, device, equipment and machine-readable medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201810035991.5A CN110046493B (en) 2018-01-15 2018-01-15 Data processing method, device, equipment and machine-readable medium

Publications (2)

Publication Number Publication Date
CN110046493A CN110046493A (en) 2019-07-23
CN110046493B true CN110046493B (en) 2023-08-01

Family

ID=67272742

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201810035991.5A Active CN110046493B (en) 2018-01-15 2018-01-15 Data processing method, device, equipment and machine-readable medium

Country Status (1)

Country Link
CN (1) CN110046493B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112800004B (en) * 2019-10-28 2023-06-16 浙江宇视科技有限公司 License plate algorithm library control method, device, equipment and medium

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103718183A (en) * 2011-07-25 2014-04-09 阿尔卡特朗讯 Software run-time provenance
CN106612183A (en) * 2016-12-27 2017-05-03 哈尔滨安天科技股份有限公司 Cross digital signing method and cross digital signing system for application software under domestic operating system

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103718183A (en) * 2011-07-25 2014-04-09 阿尔卡特朗讯 Software run-time provenance
CN106612183A (en) * 2016-12-27 2017-05-03 哈尔滨安天科技股份有限公司 Cross digital signing method and cross digital signing system for application software under domestic operating system

Also Published As

Publication number Publication date
CN110046493A (en) 2019-07-23

Similar Documents

Publication Publication Date Title
CN109460373B (en) Data sharing method, terminal equipment and storage medium
KR101190479B1 (en) Ticket authorized secure installation and boot
US20130031371A1 (en) Software Run-Time Provenance
CN104462965A (en) Method for verifying integrity of application program and network device
CN104915591A (en) Data processing method and electronic equipment
KR20100126476A (en) Managing code entitlements for software developers in secure operating environments
CN105446713A (en) Safe storage method and equipment
CN107528830B (en) Account login method, system and storage medium
CN102883324A (en) Security verification method, security verification device and mobile terminal for plugin call in mobile terminal
CN105718807A (en) Android system based on software TCM and trusted software stack and trusted authentication system and method thereof
KR20100126471A (en) System and method of authorizing execution of software code based on at least one installed profile
KR20200116009A (en) Encryption key management based on identity information
KR102013983B1 (en) Method and server for authenticating an application integrity
CN108460273B (en) Application management method of terminal, application server and terminal
CN108335105B (en) Data processing method and related equipment
CN108229144B (en) Verification method of application program, terminal equipment and storage medium
CN104680061A (en) Method and system for verifying code signing during startup of application in Android environment
CN112558946A (en) Method, device and equipment for generating code and computer readable storage medium
WO2017008728A1 (en) Method and system for classifying development mode and product mode for terminal
CN106156607B (en) SElinux secure access method and POS terminal
US20190166123A1 (en) User terminal using cloud service, integrated security management server for user terminal, and integrated security management method for user terminal
US20160218882A1 (en) Methods and systems for installing software
CN109522683B (en) Software tracing method, system, computer equipment and storage medium
CN110046493B (en) Data processing method, device, equipment and machine-readable medium
KR101324693B1 (en) Security system and method for applications

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 40010961

Country of ref document: HK

TA01 Transfer of patent application right
TA01 Transfer of patent application right

Effective date of registration: 20201223

Address after: Room 603, 6 / F, Roche Plaza, 788 Cheung Sha Wan Road, Kowloon, China

Applicant after: Zebra smart travel network (Hong Kong) Ltd.

Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands

Applicant before: Alibaba Group Holding Ltd.

GR01 Patent grant
GR01 Patent grant