CN1234078C - Code signature verifying method of ELF file form - Google Patents
Code signature verifying method of ELF file form Download PDFInfo
- Publication number
- CN1234078C CN1234078C CN 02128125 CN02128125A CN1234078C CN 1234078 C CN1234078 C CN 1234078C CN 02128125 CN02128125 CN 02128125 CN 02128125 A CN02128125 A CN 02128125A CN 1234078 C CN1234078 C CN 1234078C
- Authority
- CN
- China
- Prior art keywords
- file
- signature
- rank
- verification
- elf
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Abstract
The present invention discloses a code signature verifying method of ELF file forms, which comprises the following steps: when a user requests the execution of ELF files, a system judges system verifying stages, the file verifying stages of the executed files are determined according to the determined stages, code signatures are not verified if the system verifying stages are the 0 stages, and the incomplete signature values or the complete signature values of the executed files are respectively correspondingly not verified or verified if the system verifying stages are not the 0 stages; in verification, a signer public key is taken from a core space public key chain table, signature data is decrypted to obtain the abstract data of the original data, the corresponding abstract data is calculated by the data of the existing files, the two kinds of data are compared, the verification is successful if the two kinds of data are identical, and the verification is failed if the two kinds of data are different. The present invention has the obvious advantages that the code signature verifying method of ELF file forms can prevent the attack of prevent and can enhance the safety of the operating system, the operating system can obtain the optimum balance of the safety and efficiency, and the code signature verifying method of ELF file forms can also effectively protect the benefit of an open source software developer, an issuer and a software user.
Description
Technical field
The present invention relates to a kind of technical method that prevents to calculate virus and the invasion of other malicious code, definitely say so and relate to a kind of ELF file layout that can effectively prevent and easily utilized by the hacker, carry out virus or other malicious code and attack, guarantee the code signature verifying method of computer security.
Background technology
The ELF file layout is in the Unix environment, can carry out one of binary topmost file layout, this file layout is full disclosure, anyone can both understand its concrete form, thereby be easy to be utilized by the hacker, just can reach the purpose of invasion computing machine by direct modification binary file.Virus under many Unix is arranged in history, realize invading by this method.Traditional Unix system can't carry out integrality and legitimacy and detect to the code of carrying out, thereby allows a lot of Viruses and trojan horse program have an opportunity to take advantage of.In addition, have a lot of softwares to follow the GPL agreement under the Unix, anyone can obtain the source code of software, and therefore distribution once more also is easy to be utilized by the hacker after revising, after revising and pretend to be some publisher to issue.If the user installs and carried out such distributed software, so just invaded probably.
Code signature and checking are a kind of methods that can effectively prevent virus and the invasion of other malicious codes.At present, the code signature technology of ELF file layout had only some scattered researchs, also there is not unified standard, the project that some open source codes are also arranged, but mostly all only in a certain respect or several respects, do not have total solution, and efficient is very low, has had a strong impact on performance of computer systems.
Summary of the invention
The objective of the invention is to: in present most of code signature methods, the serious unbalance situation of security and efficient provides a kind of and can guarantee computer security, makes operating system efficient and security performance obtain optimum balance, effectively prevent that the ELF file is utilized the code signature verifying method that carries out illegal invasion.
The objective of the invention is to realize by the enforcement following technical proposals:
A kind of code signature verifying method of ELF file layout, it is characterized in that: when the user asks to carry out the ELF file, " system verification rank " at first judged by system, again according to " the system verification rank " determined, determine to be performed " the file verification rank " of file, carry out corresponding program according to the content of file verification rank regulation then; The system verification rank is provided with 0,1,2,3 level Four, is defined as 0 grade for the system verification rank, and the Validation Code signature is not directly carried out the ELF file routine; Be defined as 1 grade for the system verification rank, its file verification rank that is performed file is set as 0,1,2 three sub-rank again, and wherein: sub level is not 0 grade a file verification rank, and the Validation Code signature is not directly carried out the ELF file routine; Sub level is not 1 grade a file verification rank, is performed file and carries out the incomplete signature value of checking; Sub level is not 2 grades a file verification rank, is performed the file execution and verifies signature value fully; Be defined as 2 grades for the system verification rank, its file verification rank that is performed file is set as 0/1,2 three sub-rank again, and wherein: sub level is not two file verification ranks of 0/1, is performed file and carries out the incomplete signature value of checking; Sub level is not 2 grades a file verification rank, is performed the file execution and verifies signature value fully; Be defined as 3 grades for the system verification rank, no file verification rank is performed file and directly verifies signature value fully; When verifying, at first from core space PKI chained list, extract corresponding signer PKI, and with these PKI decrypted signature data, obtain the summary data of raw data, system utilizes the existing file data computation to go out corresponding summary data then, system contrasts these two summary datas, if identical then be proved to be successful, can carry out the ELF file; Otherwise authentication failed does not allow to carry out the ELF file.
Describedly to verify the incomplete signature value that is performed file, be that raw data is comprised: the file header of the ELF file of being signed, version identifier, source document size, signer PKI sign ID, signature algorithm identifier, signature time, signer essential information, calculate digital digest by hash operations, and obtain digital digest with the encryption of signer certificate private key.
Employed core space PKI chained list during described checking, be that of disposing in system core space records the PKI chained list that all are trusted, when the signature value of system verification code, can directly from this table, extract corresponding PKI, if do not have corresponding public key in the PKI chained list, then the signer of this code is not trusted, thereby authentication failed.
The invention has the advantages that; 1. can prevent effectively that virus and trojan horse program from utilizing the ELF file layout to carry out malicious code and attacking, thereby the security that has improved operating system.The invasion of resisting malicious code is the main purpose of code signature and checking.After the ELF file is signed, preserved the signing messages and the signature value of signer in this document, these information all are whether believable bases of checking this document.The signature value of each file all is after unique, same file was signed in the different time, and the signature value is also different.Its advantage is: after file that a quilt is signed is modified, even the change of a bit (bit) is arranged, all can't pass through during the signature of checking this document.Like this, just can prevent that other people are by revising the purpose that the ELF file reaches invasion.In addition, be not that short of just be modified of all ELF files of being signed can be by correct verification, but the ELF file that has only believable signer to sign could pass through checking.Like this, just can prevent to attack from incredible software publisher's malicious code.2. different with the unbalance situation of security and efficient in present most of code signature mechanism; the present invention can make operating system obtain the optimum balance of security and verification efficiency: method of the present invention has dual mode to the protection of system; a kind of is real-time guard, and another kind is non-real-time guard.Real-time guard is meant system when executive summary is calculated, and this computation process will consume certain system resource.Therefore, under the real-time guard pattern, if there is heap file to need to carry out, the performance of system will inevitably be affected so.In order to average out between security and efficient, the inventive method provides cover configuration flexibly, can adapt to the demand of different level of securitys.Proposed " signature value fully " and " not exclusively signature value " two notions and document handling methods in the method: " signature value fully " has been meant to all data computation of whole ELF file the resulting signature value in summary back, and " not exclusively signature value " has been meant to a part of data computation of ELF file the resulting signature value in summary back.In addition, " system verification rank " and " the file verification sub level is other " two notions and to the way of file differentiated control have also been proposed." system verification rank " is meant system-level checking rank, and it is applicable to ELF files all in the system." the file verification sub level is other " is meant the checking rank of single ELF file, and it only is applicable to certain ELF file of appointment.By the combination of " system verification rank " and " the file verification sub level is other ", we can obtain adapting to the allocation plan of various level of securitys, as shown in Figure 4.If the software publishing person signs the code of oneself distribution, the software user verifies the signature value of code when installing or moving these codes, so just can effectively stop the invasion of malicious code.For the software user, if he is when losing faith in certain software publishing person, only need certificate with this publisher, from the certificate configuration file of being trusted, delete and get final product.4. since the checking of code signature value finish at operating system kernel, can more effective prevention malicious code, thereby security is higher.
Description of drawings
Fig. 1 is a system verification rank table
Fig. 2 does not show for the file verification sub level
Fig. 3 is system-level signature value verification mode table
Fig. 4 is for adapting to the allocation plan table of various level of securitys
Fig. 5 is system-level signature verification process flow diagram
Fig. 6 is concrete applicating example
Embodiment
Providing a realization based on (SuSE) Linux OS below gives an example.
1, function module design
This mainly comprises following six functional modules for example:
1), signature blocks
2), core layer authentication module
3), application-layer authentication module
4), public key management module
5), system verification rank administration module
6), file verification rank administration module
2, functional module
1), signature blocks
Signature blocks is a relatively independent module, and it provides the module of using to the software publishing person, is mainly used in the ELF file is signed.
This module functions has: to specifying the ELF file signature, to all the ELF file signatures under the assigned catalogue, and generate the signature report.Simultaneously, this module also has basic abnormality processing function, as: whether whether can discern by signature file is the ELF file, can discern by signature file by signature etc.
2), core layer authentication module
The core layer authentication module is meant in the operating system kernel space, the module that the ELF file that request is carried out is verified.This module is at first carried out alternately with system verification rank administration module and file verification rank administration module, obtains system verification rank and corresponding file verification rank, according to authentication policy the signature value of file is verified then.During checking, this module also needs to carry out alternately with the public key management module, obtains signer PKI required when verifying.
3), application-layer authentication module
The application-layer authentication module is meant the module of the ELF file being verified in application layer, and it provides to the software user and is used for the instrument of authenticating documents signature value voluntarily.During checking, this module need be carried out alternately with the public key management module, obtains signer PKI required when verifying.
This module functions has: verify specifying the ELF file, all the ELF files under the assigned catalogue are verified, and generate the checking report.Simultaneously, this module also has basic abnormality processing function, as: whether can discern and be verified file is ELF file etc.
4), public key management module
The public key management module functions is the management signer PKI of being trusted, and keeps a trusted public key chained list at operating system kernel, so that PKI that can very fast extraction signer during the certifying signature value.
This module functions has, configuration file management and analysis, and certain PKI is inquired about, obtains, inserts and deleted to initialization core PKI chained list in core PKI chained list.
5), system verification rank administration module
The mainly responsible control of system verification rank administration module ' the system verification rank ".Major function comprises: initialization system checking rank, the system verification rank is set, and management and maintenance system checking rank are checked the system verification rank.
6), file verification rank administration module
File verification rank administration module mainly is responsible for control " the file verification sub level is other ".Major function comprises: it is other that the file verification sub level is set, and management is provided with by other ELF file of file verification sub level, and the file verification sub level of inquiring about certain file is other, and it is other to obtain and detect the file verification sub level.This module also has the function that the file verification sub level that prevents the ELF file is not modified.
3, applicating example
Be one below this realization be applied to example in the reality, application examples as shown in Figure 6:
This practical application for convenience of description, we suppose that this application satisfied following precondition:
1. software user and software publishing person (or developer) have the certificate issued office of a common trust;
2. the software publishing person has obtained legal code signature certificate from this licence issuing authority;
3. the software publishing person has installed the code signature verifying kit, wherein comprises the code signature instrument at least:
4. the software user has installed the code signature verifying kit, wherein comprises signature value verification tool at least;
5. the software user has installed the core bag of support code signature mechanism.
Owing to satisfied above condition, then the step of this application examples enforcement is as follows:
1), the software publishing person certificate that uses the code signature instrument and obtain from licence issuing authority, to forthcoming code file signature, the software that will sign with certain form is issued to the software user together together with the public key certificate of oneself then;
2), the software user obtains the public key certificate of this software and publisher thereof with certain form;
3), the user utilizes the CA counterfoil certificate of being trusted licence issuing authority, whether the public key certificate of checking publisher trusted:
4) if the certificate of publisher be verified by, and the user trusts this certificate, the user then will be injected in the PKI chained list of own trust by the PKI of configuration with this certificate so;
5), so far, the software user can select configuration mode according to the Fig. 4 in the technical scheme.The software user can be provided with instrument by the system verification rank, and the system verification rank is set, and also can instrument be set by the file verification rank simultaneously, and the checking sub level that file is set is other.
Above-mentioned configuration tool, verification tool and signature instrument etc. all are instruments indispensable in this scheme, and corresponding realization is all arranged in this example.
Claims (3)
1, a kind of code signature verifying method of ELF file layout, it is characterized in that: when the user asks to carry out the ELF file, " system verification rank " at first judged by system, again according to " the system verification rank " determined, determine to be performed " the file verification rank " of file, carry out corresponding program according to the content of file verification rank regulation then; The checking rank of system is provided with 0,1,2,3 level Four, is defined as 0 grade for the system verification rank, and the Validation Code signature is not directly carried out the ELF file routine; Be defined as 1 grade for the system verification rank, its file verification rank that is performed file is set as 0,1,2 three sub-rank, and wherein: sub level is not 0 grade a file verification rank, and the Validation Code signature is not directly carried out the ELF file routine; Sub level is not 1 grade a file verification rank, is performed file and carries out the incomplete signature value of checking; Sub level is not 2 grades a file verification rank, is performed the file execution and verifies signature value fully; Be defined as 2 grades for the system verification rank, its file verification rank that is performed file is set as 0/1,2 three sub-rank, and wherein: sub level is not two file verification ranks of 0/1, is performed file and carries out the incomplete signature value of checking; Sub level is not 2 grades a file verification rank, is performed the file execution and verifies signature value fully; Be defined as 3 grades for the system verification rank, no file verification rank is performed file and directly verifies signature value fully; When verifying, at first from core space PKI chained list, extract corresponding signer PKI, and with these PKI decrypted signature data, obtain the summary data of raw data, system utilizes the existing file data computation to go out corresponding summary data then, system contrasts these two summary datas, if identical then be proved to be successful, can carry out the ELF file; Otherwise authentication failed does not allow to carry out the ELF file.
2, according to the code signature verifying method of the described ELF file layout of claim 1, it is characterized in that: describedly will verify the incomplete signature value that is performed file, be that raw data is comprised: the file header of the ELF file of being signed, version identifier, source document size, signer PKI sign ID, signature algorithm identifier, signature time, signer essential information, calculate digital digest by hash operations, and obtain digital digest with the encryption of signer certificate private key.
3, according to the code signature verifying method of the described ELF file layout of claim 1, it is characterized in that: employed core space PKI chained list during described checking, be that of disposing in system core space records the PKI chained list that all are trusted, when the signature value of system verification code, can directly from this table, extract corresponding public key, if do not have corresponding public key in the PKI chained list, then the signer of this code is not trusted, thereby authentication failed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02128125 CN1234078C (en) | 2002-12-30 | 2002-12-30 | Code signature verifying method of ELF file form |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02128125 CN1234078C (en) | 2002-12-30 | 2002-12-30 | Code signature verifying method of ELF file form |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1512355A CN1512355A (en) | 2004-07-14 |
| CN1234078C true CN1234078C (en) | 2005-12-28 |
Family
ID=34231235
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 02128125 Expired - Fee Related CN1234078C (en) | 2002-12-30 | 2002-12-30 | Code signature verifying method of ELF file form |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN1234078C (en) |
Families Citing this family (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN100459495C (en) * | 2004-08-01 | 2009-02-04 | 常志文 | Password dynamic enciphering inputmethod of public emipering mode |
| KR101073847B1 (en) * | 2009-04-23 | 2011-10-14 | 주식회사 케이엘넷 | Method, Apparatus and Recording Medium for Transforming Electronic Document Form |
| CN102375956B (en) * | 2010-08-19 | 2016-05-25 | 北京市国路安信息技术有限公司 | The method of the mechanism construction Unix credible platform based on Unix redirection of system call |
| CN104283860A (en) * | 2013-07-10 | 2015-01-14 | 全联斯泰克科技有限公司 | ELF file identification method and device based on code signature |
| CN103544411A (en) * | 2013-10-16 | 2014-01-29 | 深圳全智达通信股份有限公司 | Software package certificate protection method and device |
| CN104573490A (en) * | 2013-10-29 | 2015-04-29 | 桂林电子科技大学 | Method for protecting installed software on Android platform |
| CN103995992A (en) * | 2014-05-28 | 2014-08-20 | 全联斯泰克科技有限公司 | Method and device for protecting software |
| CN106330812B (en) * | 2015-06-15 | 2019-07-05 | 腾讯科技（深圳）有限公司 | File security recognition methods and device |
| CN105426749B (en) * | 2015-11-03 | 2018-08-14 | 浪潮电子信息产业股份有限公司 | A method of ELF running papers are controlled based on signature mechanism |
| CN107135074B (en) * | 2016-02-29 | 2021-11-02 | 中兴通讯股份有限公司 | Advanced security method and device |
| CN106375340B (en) * | 2016-10-11 | 2020-03-31 | 北京元心科技有限公司 | Method and system for improving certificate verification security |
| CN109635522A (en) * | 2018-11-13 | 2019-04-16 | 许继集团有限公司 | A kind of tamper resistant method and device of dynamic base |
| WO2020140257A1 (en) * | 2019-01-04 | 2020-07-09 | Baidu.Com Times Technology (Beijing) Co., Ltd. | Method and system for validating kernel objects to be executed by a data processing accelerator of a host system |
| CN111783072A (en) * | 2020-07-15 | 2020-10-16 | 北京同源华安软件科技有限公司 | Security control method and device under Linux system |
| CN113468485A (en) * | 2021-07-05 | 2021-10-01 | 桂林电子科技大学 | Digital signature and certificate verification program protection method based on Linux operating system |
-
2002
- 2002-12-30 CN CN 02128125 patent/CN1234078C/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| CN1512355A (en) | 2004-07-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN1234078C (en) | Code signature verifying method of ELF file form | |
| US7694139B2 (en) | Securing executable content using a trusted computing platform | |
| CN1097772C (en) | Method and apparatus for protecting application data in secure storage areas | |
| US6381698B1 (en) | System and method for providing assurance to a host that a piece of software possesses a particular property | |
| EP1257892B1 (en) | Controlling access to a resource by a program using a digital signature | |
| CN1315017C (en) | Method for software copyright protection | |
| US6148401A (en) | System and method for providing assurance to a host that a piece of software possesses a particular property | |
| US7546587B2 (en) | Run-time call stack verification | |
| US5978484A (en) | System and method for safety distributing executable objects | |
| AU2009233685B2 (en) | Method and apparatus for incremental code signing | |
| US7591014B2 (en) | Program authentication on environment | |
| US20050166041A1 (en) | Authentication in a distributed computing environment | |
| CN104283860A (en) | ELF file identification method and device based on code signature | |
| CA2632590A1 (en) | Method to verify the integrity of components on a trusted platform using integrity database services | |
| US20040243807A1 (en) | Runtime digital signatures | |
| CN113761595A (en) | Code signature verification method based on computer memory forensics technology | |
| CN112817608A (en) | Program package installation method of trusted computing industrial personal computer | |
| CN1215418C (en) | Method for preventing attack on alteration of applied system operating in computer | |
| CN100343775C (en) | Licensing file generating method, software product protection method and system | |
| JP2020119503A (en) | System and method for attack resiliency in verifying digital signatures of files | |
| CN1369809A (en) | Anti-piracy encryption method for register code of computer software | |
| CN112580015A (en) | Processing system including trust anchor computing instrument and corresponding method | |
| EP3674945B1 (en) | System and method for verifying digital signatures of files | |
| RU2706873C1 (en) | System and method of checking file eds | |
| EP3674944B1 (en) | System and method for attack resiliency in verifying digital signatures of files |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20051228 Termination date: 20191230 |