WO2016173267A1 - 一种完整性校验方法和装置 - Google Patents

一种完整性校验方法和装置 Download PDF

Info

Publication number
WO2016173267A1
WO2016173267A1 PCT/CN2015/097501 CN2015097501W WO2016173267A1 WO 2016173267 A1 WO2016173267 A1 WO 2016173267A1 CN 2015097501 W CN2015097501 W CN 2015097501W WO 2016173267 A1 WO2016173267 A1 WO 2016173267A1
Authority
WO
WIPO (PCT)
Prior art keywords
baseline
code segment
network device
self
data
Prior art date
Application number
PCT/CN2015/097501
Other languages
English (en)
French (fr)
Inventor
周冲
付天福
朱良
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2016173267A1 publication Critical patent/WO2016173267A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • the present invention relates to the field of data processing, and in particular, to an integrity verification method and apparatus.
  • the network device can determine whether the hardware code or the software code in the network device is maliciously falsified by checking the integrity check of the own code, thereby effectively preventing the leakage of the private information in the network device. It is one of the common means for network devices to improve their security.
  • the integrity check is commonly used in network devices with embedded systems.
  • Network devices with embedded systems are more common, including single-chip microcomputers, smart refrigerators with networking functions, and the like.
  • the network device performs a hash calculation on each code segment in the embedded system in advance, and obtains a baseline corresponding to the code segment and saves it.
  • the saved baseline can be used as a standard for subsequent integrity checks.
  • the integrity of the stored code segment is periodically verified.
  • the integrity check can be understood as performing the same hash calculation on the code segment to obtain a calculation result, which is compared with the same code segment. Calculate the results and the corresponding baseline. If the alignment result for a code segment is the same, the network device can determine that the code segment is complete and has not been tampered with.
  • the baseline for comparison is stored in the CPU, and the write operation is not allowed, so the security level is high, and it is basically impossible for the baseline to be tampered with.
  • the characteristic of the embedded system is that the number of code segments in the system is small and relatively fixed, so the number of baselines corresponding to the code segment is also small and fixed.
  • the low number of baselines and fixed features allow networked devices with embedded systems to keep baselines in CPUs with limited storage space, giving the baseline a high level of storage security.
  • the general system is characterized by a large number of code segments in the system, and is not fixed.
  • various types of software can be installed or reverse-loaded at any time, so that a general-purpose system is available.
  • a network device needs to have the ability to store a large number of baselines, while a general-purpose system's limited CPU storage space does not have the ability to store a large number of baselines. Therefore, network devices with general-purpose systems can only store baselines in storage media with lower security levels.
  • the baseline cannot be guaranteed to be tampered with, and even if the baseline is tampered with, the network device cannot find it, thereby reducing the accuracy of the integrity check.
  • the hacker tampers with the code segment and tampers with the baseline used to verify the code segment, it may cause the network device to use the falsified baseline to verify that the falsified code segment also passes the integrity check.
  • the network device cannot find that the baseline has been tampered with, which will pose a huge hidden danger to user security.
  • an embodiment of the present invention provides an integrity verification method and apparatus, which stores corresponding self-check data for a baseline, so that the network device can pass the self-calibration before performing integrity verification on the code segment.
  • the data is judged to determine whether the baseline has been tampered with.
  • an embodiment of the present invention provides an integrity verification method, which is applied to a network device, where the method includes:
  • the network device When the code segment of the system process is loaded into the memory of the network device, the network device performs a hash calculation on the code segment, and obtains a baseline corresponding to the code segment according to the result of the hash calculation, and establishes a first correspondence between the baseline and the code segment;
  • the network device obtains self-check data by performing preset processing on the baseline, and establishes a second correspondence between the baseline and the self-check data, where the self-check data is used as a checksum a condition for determining whether the baseline has been modified;
  • the network device finds the baseline according to the code segment and the first correspondence relationship before performing the integrity check on the code segment;
  • the network device searches for the self-check data according to the baseline and the second correspondence relationship
  • the network device performs verification on the baseline by using the self-checking data, where the verifying includes: performing, by the network device, performing the preset processing on the baseline to obtain first to-be-matched data, and comparing And the self-checking data and the first to-be-matched data, or the network device performing the pre-processing on the self-checking data to restore the second to-be-matched data, and comparing the self-checking data Whether the verification data and the second to-be-matched data are the same;
  • the network device determines that the baseline has not been modified, and performs the integrity check on the code segment using the baseline.
  • the network device obtains self-check data by processing the baseline, and specifically includes:
  • the network device digitally signs the baseline by its own private key, and uses the digital signature result as the self-check data of the baseline.
  • the network device encrypts the baseline to obtain the encrypted baseline
  • the finding, by the network device, the baseline according to the code segment and the first correspondence includes:
  • the network device searches for the encrypted baseline according to the code segment and the first correspondence, and performs reverse decryption on the encrypted baseline to obtain the baseline.
  • the network device acquires a logical address of the code segment, where the logical address includes a first and last address of the code segment;
  • the network device acquires the code segment by the logical address before performing the integrity check on the code segment.
  • the method further includes:
  • the method further includes:
  • the network device saves the baseline and the corresponding self-check data in the process control block PCB to improve the search speed of the network device to search through the first correspondence relationship and the second correspondence relationship.
  • an embodiment of the present invention provides an integrity verification apparatus, which is applied to a network device, and includes:
  • a calculating unit configured to perform a hash calculation on the code segment when the code segment of the system process is loaded into the memory of the network device, and obtain a baseline corresponding to the code segment according to the result of the hash calculation, and Establishing a first correspondence between the baseline and the code segment;
  • a processing unit configured to obtain self-check data by performing preset processing on the baseline, and establish a second correspondence between the baseline and the self-check data, where the self-check data is used as a checkout a condition for determining whether the baseline has been modified;
  • a searching unit configured to find the baseline according to the code segment and the first correspondence relationship before performing the integrity check on the code segment while the code segment resides in the memory ;
  • the searching unit is further configured to find the self-check data according to the baseline and the second correspondence;
  • a verification unit configured to perform verification on the baseline by using the self-checking data, where the verifying includes: performing, by the network device, the preset processing on the baseline to obtain first to-be-matched data, Comparing the self-checking data and the first to-be-matched data, or the network device performing the pre-processing on the self-checking data to restore the second to-be-matched data, comparing the Whether the self-checking data and the second to-be-matched data are the same;
  • the determining unit is configured to determine that the baseline is not modified when the verification result is the same, and perform the integrity check on the code segment by using the baseline.
  • the processing unit is specifically configured to digitally sign the baseline by using a private key corresponding thereto, and use the digital signature result as self-check data of the baseline.
  • the method further includes:
  • An encryption unit configured to encrypt the baseline after the processing unit is triggered to obtain the encrypted baseline
  • the searching unit is specifically configured to find the encrypted baseline according to the code segment and the first correspondence, and perform reverse decryption on the encrypted baseline to obtain the baseline.
  • the method further includes:
  • a first acquiring unit configured to acquire a logical address of the code segment when the computing unit is triggered, where the logical address includes a first and last address of the code segment;
  • a second acquiring unit configured to acquire the code segment by using the logical address before triggering the determining unit.
  • the method further includes:
  • a removing unit configured to find and delete the baseline and the self-checking data according to the first correspondence relationship and the second correspondence relationship when the code segment is removed from the memory.
  • the method further includes:
  • a saving unit configured to save the baseline and the corresponding self-checking data in the process control block PCB, so as to improve a searching speed of the network device searching by using the first correspondence relationship and the second correspondence relationship.
  • the network device obtains corresponding self-check data by processing the baseline, and the self-check data can verify the integrity of the corresponding baseline, so that the network device has the identifier.
  • the network device uses an integrity check to verify the integrity of the code segment using a baseline that has not been tampered with, improving verification accuracy.
  • FIG. 1 is a flowchart of a method for an integrity verification method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for an integrity verification method according to an embodiment of the present invention
  • FIG. 3 is a structural diagram of an apparatus for an integrity verification apparatus according to an embodiment of the present invention.
  • FIG. 4 is a structural diagram of an apparatus for an integrity verification apparatus according to an embodiment of the present invention.
  • the integrity check of the code segments in the system is mainly applied to network devices with embedded systems, such as a single chip microcomputer or a smart refrigerator. Since the number of code segments in the embedded system is limited, and the code segments change less and are relatively fixed, the number and content of the baseline corresponding to the code segments are generally unchanged, and the storage capacity is small and the change is small. Thus, it can be pre-configured to be stored in a CPU core that does not allow write operations and has limited storage space.
  • the general-purpose system contains a relatively large number of code segments, and the content has a possibility of frequent changes.
  • a smart phone is a typical network device with a general-purpose system.
  • various software applications can be installed without restrictions.
  • the number of baselines for these software application code segments will be many, and it will no longer be possible.
  • CPUs with limited storage space are used to store baselines, and only baselines can be stored in storage media with relatively low security levels, and there is no possibility that the baseline will not be tampered with.
  • the verification result of the integrity check of the code segment is not highly reliable. If the code segment passes the integrity check, it cannot be determined that the code segment is not tamper. Or if the code segment does not pass the integrity check, it cannot be determined whether the code segment has been tampered with or the baseline has been tampered with.
  • an embodiment of the present invention provides an integrity check method and apparatus.
  • the network device obtains corresponding self-check data by processing the baseline, and the self-check data can verify the integrity of the corresponding baseline.
  • the network device has the ability to identify whether the baseline has been tampered with, and the network device performs integrity check on the code segment using a baseline that is not falsified, improving verification accuracy.
  • the embodiment of the present invention further provides a method for encrypting the baseline, which is further improved by self-checking and double protection against baseline encryption.
  • the security of the baseline allows the network device to effectively determine if the baseline has been tampered with.
  • FIG. 1 is a flowchart of a method for an integrity check method according to an embodiment of the present disclosure, which is applied to a network device, where the method includes:
  • the network device when a code segment is loaded into the memory of the network device, the network device can be learned through a processing control block (PCB) in the memory, and can also acquire the relevant process segment. Information, such as the first and last addresses of the process segment.
  • the network device may perform a first trusted metric on the code segment before the code segment is first executed, and obtain a baseline corresponding to the code segment by using a hash calculation.
  • the process of calculating the baseline can participate in the following ways:
  • App Code Segment[i] Code Segment(start-address[i], end-address[i]);
  • App Code Segment[i] is the code segment, and i is an identifier or number corresponding to the code segment.
  • Start-address[i] is the first address and the last address of the code segment.
  • the calculation formula for the hash calculation can be as follows:
  • Hash[i] SHA256(App Code Segment[i]);
  • SHA256 is a specific number of bits of the Secure Hash Algorithm (SHA).
  • the present invention does not limit the use of SHA256 for hash calculation, and may also be other hash algorithms.
  • the result of the hash calculation is taken as a baseline of the code segment, and the code segment and the baseline are bound, that is, the first correspondence relationship between the code segment and the baseline is established.
  • the network device to which the embodiment of the present invention is applied is mainly a network device having a general-purpose system, or a network device having an embedded system.
  • the network device obtains self-check data by performing preset processing on the baseline, and establishes a second correspondence between the baseline and the self-check data, where the self-check data is used as a checksum. A judgment condition as to whether the baseline is modified.
  • the manner of obtaining the self-checking data by performing the preset processing may be obtaining a summary of the baseline content by an algorithm, using the abstract as self-checking data, or by digital signature (Digital Signature or The present invention does not limit this.
  • the embodiment of the present invention provides a method for performing self-checking data by performing preset processing on the baseline, and specifically includes:
  • the network device digitally signs the baseline by its own private key, and uses the digital signature result as the self-check data of the baseline.
  • the private key can be understood as a private key in an asymmetric key, and has a corresponding relationship with the network device.
  • the private key may be stored in a Security Operations Center (SOC) of the network device.
  • SOC Security Operations Center
  • the digital signature result obtained by digital signature can be decrypted by the public key of the corresponding private key in the asymmetric key to complete the integrity check on the baseline.
  • S103 The network device finds the according to the code segment and the first correspondence relationship before performing the integrity check on the code segment while the code segment resides in the memory Baseline.
  • S104 The network device searches for the self-check data according to the baseline and the second correspondence.
  • the network device performs verification on the baseline by using the self-checking data, where the verifying includes: performing, by the network device, performing the preset processing on the baseline to obtain first to-be-matched data, Comparing the self-checking data and the first to-be-matched data, or the network device performing the pre-processing on the self-checking data to restore the second to-be-matched data, comparing the Whether the self-check data and the second waiting data are the same.
  • the baseline is checked for integrity using the self-check data prior to verifying the integrity of the code segment. Since the self-check data is generated by the complete baseline processing that has not been tampered with, if the baseline is tampered with, it is inevitable to be found in the process of verifying using the self-checking data. And verifying the integrity of the code segment using the baseline if the baseline is not falsified by the verification, and when the integrity check is successful, the code segment may be explicitly confirmed When the integrity check is unsuccessful, it can be clearly confirmed that the code segment is incomplete.
  • the integrity check of the code segment by the network device may be performed periodically.
  • the process of verifying the baseline by the self-check data may be related to the type of the self-check data, such as when the self-check data is calculated according to the baseline by a specific algorithm. Summary, then in the verification process of the baseline, the summary may be calculated for the baseline by the same specific algorithm, and then compared with the self-check data. If the self-check data is obtained by digital signature of a private key, the pre-processing may be performed in reverse on the self-check data during the verification of the baseline, that is, using the The public key corresponding to the private key decrypts the digital signature result, and compares the decrypted content with the baseline.
  • the embodiment of the present invention performs other possible verification of the baseline by using the self-checking data. Cheng is no longer exhaustive.
  • the baseline is determined to be unmodified, the code segment may be integrity checked using the baseline, and the integrity check process may be used on the code segment
  • the same hash algorithm as the hash algorithm used to obtain the baseline in step S101 for example
  • PCR[i] SHA256(App Code Segment[i])
  • PCR[i] is a Platform Configuration Register (PCR) corresponding to the code segment.
  • the network device obtains corresponding self-check data by processing the baseline, and the integrity of the corresponding baseline can be verified by the self-check data, so that the network device has the capability of identifying whether the baseline is tampered with.
  • the network device performs integrity check on the code segment using a baseline that is not falsified, improving the verification accuracy.
  • FIG. 2 is a flowchart of a method for an integrity verification method according to an embodiment of the present invention, where the method includes:
  • the network device may acquire the first and last addresses of the code segment through a PCB, where the first and last addresses may be physical addresses occupied by the code segment in memory, and It can be the logical address of the code segment.
  • the network device may acquire a logical address of the code segment, where the logical address includes a first and last address of the code segment, and performing a hash calculation using the logical address of the code segment, so that a relatively accurate baseline may be obtained.
  • the network device acquires the code segment by the logical address after performing an integrity check on the code segment periodically, and the logical address of the code segment can be used to accurately and quickly search from the memory. Go to the code snippet.
  • the network device obtains self-check data by performing preset processing on the baseline, and establishes the a second correspondence between the baseline and the self-checking data, the self-checking data being used as a determining condition for verifying whether the baseline is modified.
  • the baseline and the self-check data have a corresponding relationship due to the code segment and the baseline, so when the storage location of the baseline and the self-check data is selected, the baseline and The self-check data is stored in the same storage medium as the code segment to store to improve subsequent lookup efficiency.
  • the network device saves the baseline and the corresponding self-check data in the PCB, so as to improve the search speed of the network device by using the first correspondence relationship and the second correspondence relationship.
  • the network device may add a field in the PCB for specifically storing the baseline and the self-check data.
  • the code segments in memory can be removed, if the code segments are removed, if the baseline and self-check data corresponding to the code segments are still saved. , may cause a waste of system resources.
  • the embodiment of the present invention further provides that, when the code segment is removed from the memory, the network device searches for the first correspondence and the second correspondence. The baseline and the self-checking data are deleted. By removing invalid baselines and self-checking data, you can reduce the storage pressure on your network devices.
  • S203 The network device encrypts the baseline to obtain the encrypted baseline.
  • the self-check data corresponding to the baseline may be encrypted to further improve security.
  • the encryption may be performed by using a private key in an asymmetric key corresponding to the network device. In the process of reverse decryption, the corresponding public key is used for decryption. Different from the common public key encryption method, the private key is only used when the encryption is started, and then the public key is used for reverse decryption. The lesser use of the private key can reduce the private key. The probability of a key compromise ensures the security of the private key.
  • the network device Before the code segment resides in the memory, before performing the integrity check on the code segment, the network device searches for the encrypted according to the code segment and the first correspondence relationship.
  • the baseline is obtained by performing reverse decryption on the encrypted baseline to obtain the baseline.
  • S205 The network device searches for the self-check data according to the baseline and the second correspondence.
  • the network device performs verification on the baseline by using the self-checking data, where the verifying includes: performing, by the network device, performing the preset processing on the baseline to obtain first to-be-matched data. Comparing the self-checking data and the first to-be-matched data, or the network device performing the pre-processing on the self-checking data to restore the second to-be-matched data, comparing the Whether the self-check data and the second waiting data are the same.
  • the embodiment of the present invention further provides a double protection for the baseline encryption by self-checking by encrypting the baseline. It further improves the security of the baseline and enables the network device to effectively determine whether the baseline has been tampered with.
  • FIG. 3 is a structural diagram of an apparatus for an integrity check apparatus according to an embodiment of the present invention, which is applied to a network device, where the integrity check apparatus 300 includes:
  • the calculating unit 301 is configured to perform a hash calculation on the code segment when the code segment of the system process is loaded into the memory of the network device, and obtain a baseline corresponding to the code segment according to the result of the hash calculation. And establishing a first correspondence between the baseline and the code segment.
  • the network device can learn through the PCB in the memory, and can also obtain information about the process segment, such as the first and last addresses of the process segment. .
  • the calculating unit 301 may perform the first trusted metric on the code segment before the code segment is first executed, and obtain a baseline corresponding to the code segment by using a hash calculation.
  • the process of calculating the baseline can participate in the following ways:
  • App Code Segment[i] Code Segment(start-address[i], end-address[i]);
  • the calculation formula for the hash calculation can be as follows:
  • Hash[i] SHA256(App Code Segment[i]);
  • the result of the hash calculation is taken as a baseline of the code segment, and the code segment and the baseline are bound, that is, the first correspondence relationship between the code segment and the baseline is established.
  • the network device to which the embodiment of the present invention is applied is mainly a network device having a general-purpose system, or a network device having an embedded system.
  • the processing unit 302 is configured to obtain self-check data by performing preset processing on the baseline, and establish a second correspondence between the baseline and the self-check data, where the self-check data is used as a checksum A judgment condition as to whether the baseline is modified.
  • the manner in which the processing unit 302 obtains self-check data by performing preset processing may be obtaining an abstract of the baseline content by an algorithm, using the digest as a self-checking data, or by digital signature (Digital Signature or Signature). In other ways, the present invention does not limit this.
  • the processing unit 302 is specifically configured to digitally sign the baseline by using a private key corresponding thereto, and use the digital signature result as the baseline. Self-checking data.
  • the private key can be understood as a private key in an asymmetric key, and has a corresponding relationship with the network device.
  • the private key may be stored in the SOC of the network device.
  • the digital signature result obtained by digital signature can be decrypted by the public key of the corresponding private key in the asymmetric key to complete the integrity check on the baseline.
  • a searching unit 303 configured to find, according to the code segment and the first correspondence, before performing the integrity check on the code segment while the code segment resides in the memory Baseline.
  • the searching unit 303 is further configured to find the self-check data according to the baseline and the second correspondence.
  • the checking unit 304 is configured to check the baseline by using the self-checking data, where the verifying includes: performing, by the network device, performing the preset processing on the baseline to obtain first to-be-matched data. Comparing the self-checking data and the first to-be-matched data, or the network device performing the pre-processing on the self-checking data to restore the second to-be-matched data, and comparing Whether the self-check data and the second waiting data are the same.
  • the determining unit 305 is configured to determine that the baseline is not modified when the verification result is the same, and perform the integrity check on the code segment by using the baseline.
  • the check unit 304 will use the self-check data to integrity the baseline before verifying the integrity of the code segment. check. Since the self-check data is generated by the complete baseline processing that has not been tampered with, if the baseline is tampered with, it is inevitable to be found in the process of verifying using the self-checking data.
  • the determining unit 305 checks the integrity of the code segment using the baseline in the case that the baseline is not falsified by the check, and when the integrity check is successful, the determining unit 305 can explicitly confirm that the code segment is complete, and when the integrity check is unsuccessful, the determining unit 305 can explicitly confirm that the code segment is incomplete.
  • the integrity check of the code segment can be performed periodically.
  • the process of verifying the baseline by the verification unit 304 by the self-check data may be related to the type of the self-check data, for example, when the self-check data is determined by a specific algorithm.
  • the summary calculated by the baseline, then in the verification process of the baseline, the summary may be calculated by using the same specific algorithm for the baseline, and then compared with the self-checking data.
  • the pre-processing may be performed in reverse on the self-check data during the verification of the baseline, that is, using the The public key corresponding to the private key decrypts the digital signature result, and compares the decrypted content with the baseline.
  • the process of verifying the baseline by the self-checking data is not exhaustive in the embodiment of the present invention.
  • the baseline is determined to be unmodified, the code segment may be integrity checked using the baseline, and the integrity check process may be used on the code segment
  • the same hash algorithm as the hash algorithm used in the calculation unit 301 to obtain the baseline for example
  • PCR[i] SHA256(App Code Segment[i])
  • the network device obtains corresponding self-check data by processing the baseline, and the integrity of the corresponding baseline can be verified by the self-check data, so that the network device has the capability of identifying whether the baseline is tampered with.
  • the network device performs integrity check on the code segment using a baseline that is not falsified, improving the verification accuracy.
  • FIG. 4 is a structural diagram of an apparatus for an integrity verification apparatus according to an embodiment of the present invention.
  • the computing unit 301 when the code segment is loaded into the memory, the computing unit 301 may obtain the first and last addresses of the code segment through a PCB, where the first and last addresses may be occupied by the code segment.
  • the physical address can also be the logical address of the code segment. It should be noted that when the network device is deployed with a general-purpose system, due to the flexibility of the general-purpose system, the physical address of the code segment in the memory may be changed after the execution of the code segment, but The logical address of the code segment is generally relatively fixed.
  • the integrity verification apparatus 300 further includes:
  • the first obtaining unit 401 is configured to acquire a logical address of the code segment when the computing unit 301 is triggered, where the logical address includes a first and last addresses of the code segment.
  • the calculation unit 301 performs hash calculation using the logical address of the code segment, and a relatively accurate baseline can be obtained.
  • the second obtaining unit 402 acquires the code segment by using the logical address, and the logical address of the code segment can be accurately and quickly obtained from the memory. Find the code snippet.
  • the baseline and the self-check data may be stored in the same storage medium as the code segment to store to improve subsequent lookup efficiency.
  • the integrity verification apparatus 300 further includes a saving unit 403, configured to save the baseline and corresponding self-check data in the PCB, to improve the network device by using the first correspondence.
  • the search speed of the search is performed with the second correspondence. Fields may be added to the PCB for specifically storing the baseline and the self-check data.
  • the code segments in memory can be removed, if the code segments are removed, if the baseline and self-check data corresponding to the code segments are still saved. , may cause a waste of system resources.
  • the removing unit 404 is further configured to: when the code segment is removed from the memory, the network device finds according to the first correspondence relationship and the second correspondence relationship And deleting the baseline and the self-checking data. By removing invalid baselines and self-checking data, you can reduce the storage pressure on your network devices.
  • the encryption unit 405 is configured to encrypt the baseline after triggering the processing unit 302 to obtain the encrypted baseline.
  • the self-check data corresponding to the baseline may be encrypted to further improve security.
  • the encryption may be performed by using a private key in an asymmetric key corresponding to the network device. In the process of reverse decryption, the corresponding public key is used for decryption. Different from the common public key encryption method, the private key is only used when the encryption is started, and then the public key is used for reverse decryption. The lesser use of the private key can reduce the private key. The probability of a key compromise ensures the security of the private key.
  • the searching unit 303 is specifically configured to find the encrypted baseline according to the code segment and the first correspondence, and perform reverse decryption on the encrypted baseline to obtain the baseline.
  • the embodiment of the present invention further provides a double protection for the baseline encryption by self-checking by encrypting the baseline. It further improves the security of the baseline and enables the network device to effectively determine whether the baseline has been tampered with.

Abstract

一种完整性校验方法和装置，应用于网络设备，当系统进程的代码段加载到所述网络设备的内存中时，所述网络设备得到对应所述代码段的基线，通过对所述基线执行预置处理得到自校验数据，并建立所述基线与所述自校验数据的第二对应关系，在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，根据所述代码段、第一对应关系和所述第二对应关系查找到所述自校验数据，通过所述自校验数据对所述基线进行校验，当校验结果为相同时判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验，通过自校验数据使得所述网络设备具有识别所述基线是否被篡改的能力，提高了对代码段进行完整性校验的准确度。

Description

一种完整性校验方法和装置
本申请要求于2015年4月29日提交中国专利局、申请号为201510212803.8、发明名称为“一种完整性校验方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及数据处理领域，特别是涉及一种完整性校验方法和装置。
背景技术
网络设备通过对自身代码的完整性校验，能够校验结果判断出所述网络设备中的硬件代码或者软件代码是否出现被恶意篡改，由此可以有效防止所述网络设备中的隐私信息泄露，是一种网络设备提高自身安全性的常用手段之一。
所述完整性校验常用于具有嵌入式系统的网络设备中，具有嵌入式系统的网络设备较为常见的包括单片机、具有联网功能的智能冰箱等。该网络设备对预先获取嵌入式系统内各个代码段进行哈希(Hash)计算，得到与代码段一一对应的基线(Benchmark)并保存。保存的基线可以作为后续完整性校验的标准。该网络设备在运行过程中，会周期性对存储的代码段进行完整性校验，所述完整性校验可以理解为对代码段进行相同的哈希计算得到计算结果，比对同一代码段的计算结果和对应的基线。如果针对一个代码段的比对结果为相同，则该网络设备可以确定该代码段是完整的，没有被篡改。为了保证校验的准确性，用于比对的基线被保存在CPU内，不允许写入操作，所以安全级别很高，基本上不可能出现基线被篡改的情况。
嵌入式系统的特点是系统内的代码段数量较少且较为固定，所以代码段所对应的基线数量也较少也较为固定。基线的数量少且固定的特点使得具有嵌入式系统的网络设备可以将基线保存在存储空间有限的CPU中，从而给予基线较高的存储安全级别。但是对于具有通用系统的网络设备来说，通用系统的特点是系统内代码段的数量可以非常多，且不固定，例如在通用系统中可以随时安装各类软件或反向卸载，使得具有通用系统的网络设备需要具有保存大量基线的能力，而通用系统的CPU有限的存储空间不具有存储大量基线的能力。故具有通用系统的网络设备目前只能将基线存储在安全级别较低的存储介质中。
在安全级别低的存储介质中，由于不限制读写操作，所以无法保证基线不被篡改，而且即使基线被篡改，网络设备也没有能力发现，从而降低了完整性校验的准确性。例 如黑客篡改了代码段并对应篡改了用于校验该代码段的基线，可能会导致网络设备使用篡改后的基线验证篡改后的代码段也能通过完整性校验。该网络设备无法发现基线被篡改将为用户安全带来巨大隐患。
发明内容
为了解决上述技术问题，本发明实施例提供了一种完整性校验方法和装置，为基线保存对应的自校验数据，使得网络设备在对代码段进行完整性校验前，可以通过自校验数据判断基线是否被篡改。
第一方面，本发明实施例提供了一种完整性校验方法，应用于网络设备，所述方法包括：
当系统进程的代码段加载到所述网络设备的内存中时，所述网络设备对所述代码段进行哈希计算，根据所述哈希计算的结果得到对应所述代码段的基线，并建立所述基线与所述代码段之间的第一对应关系；
所述网络设备通过对所述基线执行预置处理得到自校验数据，并建立所述基线与所述自校验数据的第二对应关系，所述自校验数据用于作为校验所述基线是否被修改的判断条件；
在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，所述网络设备根据所述代码段和所述第一对应关系查找到所述基线；
所述网络设备根据所述基线和所述第二对应关系查找到所述自校验数据；
所述网络设备通过所述自校验数据对所述基线进行校验，所述校验具体包括：所述网络设备对所述基线执行所述预置处理得到第一待比对数据，比对所述自校验数据和所述第一待比对数据，或者，所述网络设备对所述自校验数据反向执行所述预处理还原出第二待比对数据，比对所述自校验数据和所述第二待比对数据是否相同；
当校验结果为相同时，所述网络设备判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验。
在第一方面的第一种可能的实现方式中，所述网络设备通过对所述基线处理得到自校验数据，具体包括：
所述网络设备通过自身对应的私钥对所述基线进行数字签名，将数字签名结果作为所述基线的自校验数据。
结合第一方面或者第一方面的第一种可能的实现方式，在第二种可能的实现方式中，在所述网络设备通过对所述基线执行预置处理得到自校验数据之后，还包括：
所述网络设备对所述基线进行加密，得到加密后的所述基线；
所述网络设备根据所述代码段和所述第一对应关系查找到所述基线具体包括：
所述网络设备根据所述代码段和所述第一对应关系查找到加密后的所述基线，对加密后的所述基线进行反向解密得到所述基线。
结合第一方面或者第一方面的第一种或第二种可能的实现方式，在第三种可能的实现方式中，当所述系统进程的代码段加载到所述网络设备的内存中时，还包括：
所述网络设备获取所述代码段的逻辑地址，所述逻辑地址包括所述代码段的首尾地址；
在对所述代码段进行所述完整性校验之前，所述网络设备通过所述逻辑地址获取所述代码段。
在第一方面的第四种可能的实现方式中，还包括：
当所述代码段从所述内存中移除时，根据所述第一对应关系和所述第二对应关系查找到并删除所述基线和所述自校验数据。
结合第一方面或者第一方面的第一种或第二种或第三种或第四种可能的实现方式，在第五种可能的实现方式中，还包括：
所述网络设备将所述基线以及对应的自校验数据保存在进程控制块PCB中，以提高所述网络设备通过所述第一对应关系和所述第二对应关系进行查找的查找速度。
第二方面，本发明实施例提供了一种完整性校验装置，应用于网络设备，包括：
计算单元，用于当系统进程的代码段加载到所述网络设备的内存中时，对所述代码段进行哈希计算，根据所述哈希计算的结果得到对应所述代码段的基线，并建立所述基线与所述代码段之间的第一对应关系；
处理单元，用于通过对所述基线执行预置处理得到自校验数据，并建立所述基线与所述自校验数据的第二对应关系，所述自校验数据用于作为校验所述基线是否被修改的判断条件；
查找单元，用于在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，根据所述代码段和所述第一对应关系查找到所述基线；
所述查找单元还用于根据所述基线和所述第二对应关系查找到所述自校验数据；
校验单元，用于通过所述自校验数据对所述基线进行校验，所述校验具体包括：所述网络设备对所述基线执行所述预置处理得到第一待比对数据，比对所述自校验数据和所述第一待比对数据，或者，所述网络设备对所述自校验数据反向执行所述预处理还原出第二待比对数据，比对所述自校验数据和所述第二待比对数据是否相同；
判断单元，用于当校验结果为相同时，判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验。
在第二方面的第一种可能的实现方式中，
所述处理单元具体用于通过自身对应的私钥对所述基线进行数字签名，将数字签名结果作为所述基线的自校验数据。
结合第二方面或者第二方面的第一种可能的实现方式，在第二种可能的实现方式中，还包括：
加密单元，用于在触发所述处理单元之后，对所述基线进行加密，得到加密后的所述基线；
所述查找单元具体用于根据所述代码段和所述第一对应关系查找到加密后的所述基线，对加密后的所述基线进行反向解密得到所述基线。
结合第二方面或者第二方面的第一种或第二种可能的实现方式，在第三种可能的实现方式中，还包括：
第一获取单元，用于在触发所述计算单元时，获取所述代码段的逻辑地址，所述逻辑地址包括所述代码段的首尾地址；
第二获取单元，用于在触发判断单元之前，通过所述逻辑地址获取所述代码段。
在第二方面的第四种可能的实现方式中，还包括：
移除单元，用于当所述代码段从所述内存中移除时，根据所述第一对应关系和所述第二对应关系查找到并删除所述基线和所述自校验数据。
结合第二方面或者第二方面的第一种或第二种或第三种或第四种可能的实现方式，在第五种可能的实现方式中，还包括：
保存单元，用于将所述基线以及对应的自校验数据保存在进程控制块PCB中，以提高所述网络设备通过所述第一对应关系和所述第二对应关系进行查找的查找速度。
由上述技术方案可以看出，所述网络设备通过对所述基线处理得到对应的自校验数据，通过所述自校验数据可以验证对应基线的完整性，使得所述网络设备具有识别所述基线是否被篡改的能力，所述网络设备使用确认没有被篡改的基线对代码段进行完整性校验，提高了校验准确度。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是 本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种完整性校验方法的方法流程图；
图2为本发明实施例提供的一种完整性校验方法的方法流程图；
图3为本发明实施例提供的一种完整性校验装置的装置结构图；
图4为本发明实施例提供的一种完整性校验装置的装置结构图。
具体实施方式
现有技术中，对系统中代码段的完整性校验主要应用于具有嵌入式系统的网络设备中，例如单片机或者智能冰箱等。由于嵌入式系统中的代码段数量有限，且代码段变化较少、相对固定，故对应这些代码段的基线的数量和内容一般基本不变，具有存储容量小，改变少的特点。由此可以预先配置存储在不允许写操作、且存储空间有限的CPU内核中。
但是，在使用范围更广的、具有通用系统的网络设备中，通用系统所包含的代码段数量相对更多，内容也具有变化频繁的可能。例如智能手机就是一种典型的具有通用系统的网络设备，智能手机系统中基本上可以不受限制的安装各类软件应用，那么针对这些软件应用代码段的基线的数量将会很多，将无法再和嵌入式系统一样使用存储空间有限的CPU来存储基线，而只能将基线存储在安全级别相对较低的存储介质中，无法保证基线不被篡改的可能性。由于目前网络设备没有判断基线是否被篡改的能力，将导致对代码段的完整性校验的校验结果可信度不高，若代码段通过完整性校验，也不能判定该代码段没有被篡改。或者若代码段没有通过完整性校验，也无法判定到底是由于代码段被篡改还是基线被篡改导致的。
为此，本发明实施例提供了一种完整性校验方法和装置，所述网络设备通过对所述基线处理得到对应的自校验数据，通过所述自校验数据可以验证对应基线的完整性，使得所述网络设备具有识别所述基线是否被篡改的能力，所述网络设备使用确认没有被篡改的基线对代码段进行完整性校验，提高了校验准确度。
在为基线建立用于校验基线完整性的自校验数据的基础上，本发明实施例还提供了通过对基线加密的方法，通过自校验加上对基线加密的双重保护，进一步提高了基线的安全性，能够让网络设备可以有效的判断出基线是否被篡改。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整的描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。 基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例一
图1为本发明实施例提供的一种完整性校验方法的方法流程图，应用于网络设备，所述方法包括：
S101：当系统进程的代码段加载到所述网络设备的内存中时，所述网络设备对所述代码段进行哈希计算，根据所述哈希计算的结果得到对应所述代码段的基线，并建立所述基线与所述代码段之间的第一对应关系。
举例说明，当有代码段(Code Segment)加载到所述网络设备的内存中时，网络设备可以通过内存中的进程控制块(Processing Control Block，PCB)获知，并还可以获取该进程段的相关信息，例如进程段的首尾地址等。所述网络设备可以在所述代码段被首次执行之前，对所述代码段进行第一次可信度量，通过哈希(Hash)计算得到对应所述代码段的基线。计算基线的过程可以参加如下方式：
App Code Segment[i]＝Code Segment(start-address[i],end-address[i])；
其中，
App Code Segment[i]为所述代码段，i为对应所述代码段的标识或编号等。
start-address[i],end-address[i]为所述代码段的首地址和尾地址。
哈希计算的计算公式可以如下所示：
Hash[i]＝SHA256(App Code Segment[i])；
其中，
SHA256为安全哈希算法(Secure Hash Algorithm，SHA)的一种具体位数的算法，本发明并不限定一定使用SHA256来进行哈希计算，也可以是其他哈希算法。
将所述哈希计算得出的结果作为所述代码段的基线，并绑定所述代码段和基线，也就是建立所述代码段与基线的第一对应关系。
需要注意，本发明实施例所应用的所述网络设备主要为具有通用系统的网络设备，也可以是具有嵌入式系统的网络设备。
S102：所述网络设备通过对所述基线执行预置处理得到自校验数据，并建立所述基线与所述自校验数据的第二对应关系，所述自校验数据用于作为校验所述基线是否被修改的判断条件。
举例说明，通过执行预置处理得到自校验数据的方式可以为通过算法获取所述基线内容的摘要，以摘要作为自校验数据，或者通过数字签名(Digital Signature或者 Signature)等方式，本发明对此不做限定。可选的，本发明实施例提供了一种通过对所述基线执行预置处理得到自校验数据的方式，具体包括：
所述网络设备通过自身对应的私钥对所述基线进行数字签名，将数字签名结果作为所述基线的自校验数据。
举例说明，所述私钥可以理解为非对称密钥中的私钥，与所述网络设备具有对应关系。所述私钥可以存储在所述网络设备的安全运行中心(Security Operations Center，SOC)中。通过数字签名后的得到的所述数字签名结果可以通过非对称密钥中对应私钥的公钥进行解密，完成对所述基线的完整性校验。
S103：在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，所述网络设备根据所述代码段和所述第一对应关系查找到所述基线。
S104：所述网络设备根据所述基线和所述第二对应关系查找到所述自校验数据。
S105：所述网络设备通过所述自校验数据对所述基线进行校验，所述校验具体包括：所述网络设备对所述基线执行所述预置处理得到第一待比对数据，比对所述自校验数据和所述第一待比对数据，或者，所述网络设备对所述自校验数据反向执行所述预处理还原出第二待比对数据，比对所述自校验数据和所述第二待比对数据是否相同。
S106：当校验结果为相同时，所述网络设备判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验。
举例说明，为了保证校验所述代码段的基线没有被篡改，将在校验所述代码段的完整性之前，使用所述自校验数据对所述基线进行完整性校验。由于所述自校验数据是通过完整的、未被篡改的所述基线处理生成，若所述基线被篡改，则在使用所述自校验数据进行校验的过程中必然可以发现。并在通过所述校验确定所述基线没有被篡改的情况下，使用所述基线校验所述代码段的完整性，当所述完整性校验成功时，可以明确确认所述代码段完整，当所述完整性校验不成功时，可以明确确认所述代码段不完整。
需要注意，所述网络设备对所述代码段的完整性校验可以周期性进行。
还需要注意，通过所述自校验数据对所述基线进行校验的过程可以与所述自校验数据的类型相关，例如当所述自校验数据通过特定算法根据所述基线计算得到的摘要，那么在对所述基线进行所述校验过程中，可以对所述基线通过相同所述特定算法计算出摘要，再和所述自校验数据进行比对。若所述自校验数据为通过私钥数字签名得到，那么在对所述基线进行所述校验过程中，可以对所述自校验数据反向执行所述预处理，也就是使用所述私钥对应的公钥对所述数字签名结果进行解密，将解密出的内容与所述基线进行比对。本发明实施例对其他可能的通过所述自校验数据对所述基线进行校验的过 程在此不再一一穷举。
当比对结果为相同时，所述基线被确定为未被修改，则可以使用所述基线对所述代码段进行完整性校验，所述完整性校验的过程可以对所述代码段使用与步骤S101中获得所述基线的所使用哈希算法相同的哈希算法，例如为
PCR[i]＝SHA256(App Code Segment[i])
其中，PCR[i]为对应所述代码段的平台配置寄存器(Platform Configuration Register，PCR)。
当PCR[i]＝Hash[i]时，可以确定所述代码段通过所述完整性校验，所述代码段未被修改。
可见，所述网络设备通过对所述基线处理得到对应的自校验数据，通过所述自校验数据可以验证对应基线的完整性，使得所述网络设备具有识别所述基线是否被篡改的能力，所述网络设备使用确认没有被篡改的基线对代码段进行完整性校验，提高了校验准确度。
实施例二
除了对所述基线进行处理得到自校验数据外，本发明实施例还可以在此基础上，进一步提高对所述基线的安全保护。在图1所对应的实施例基础上，图2为本发明实施例提供的一种完整性校验方法的方法流程图，所述方法包括：
S201：当系统进程的代码段加载到所述网络设备的内存中时，所述网络设备对所述代码段进行哈希计算，根据所述哈希计算的结果得到对应所述代码段的基线，并建立所述基线与所述代码段之间的第一对应关系。
举例说明，当所述代码段加载到所述内存中时，所述网络设备可以通过PCB获取所述代码段的首尾地址，所述首尾地址可以是所述代码段占用内存中的物理地址，也可以是所述代码段的逻辑地址。需要注意是的，当所述网络设备部署有通用系统时，由于通用系统的灵活性特点，可能会导致在执行所述代码段之后，所述代码段在内存中的物理地址发生改变，但所述代码段的逻辑地址一般相对固定。所述网络设备可以获取所述代码段的逻辑地址，所述逻辑地址包括所述代码段的首尾地址，使用所述代码段的逻辑地址进行哈希计算，可以得到较为准确的基线。在之后周期性的对所述代码段执行完整性校验之前，所述网络设备通过所述逻辑地址获取所述代码段，使用所述代码段的逻辑地址可以从所述内存中准确快速的查找到所述代码段。
S202：所述网络设备通过对所述基线执行预置处理得到自校验数据，并建立所述 基线与所述自校验数据的第二对应关系，所述自校验数据用于作为校验所述基线是否被修改的判断条件。
由于所述代码段与所述基线，所述基线与所述自校验数据均具有对应关系，故在选择存储所述基线和所述自校验数据的存储位置时，可以将所述基线和所述自校验数据存储到与所述代码段存储的同一存储介质中，以提高之后的查找效率。故可选的，所述网络设备将所述基线以及对应的自校验数据保存在PCB中，以提高所述网络设备通过所述第一对应关系和所述第二对应关系进行查找的查找速度。所述网络设备可以在所述PCB中新增字段用于专门存储所述基线和所述自校验数据。
还需要注意，在具有通用系统的移动终端中，内存中的代码段可以被移除，若所述代码段被移除，如果还继续保存对应所述代码段的所述基线和自校验数据，可能会造成系统资源的浪费。为此，可选的，本发明实施例还提供了，当所述代码段从所述内存中移除时，所述网络设备根据所述第一对应关系和所述第二对应关系查找到并删除所述基线和所述自校验数据。通过删除无效的基线和自校验数据，可以减少网络设备的存储压力。
S203：所述网络设备对所述基线进行加密，得到加密后的所述基线。
举例说明，通过对所述基线进行加密，可以使得即使他人获取到加密后的基线，也不知道该加密后的基线是否与所述基线有关；即使知道这个就是加密后的基线，也无法通过所述加密后的基线得知未加密的基线是什么，由此提高了安全性。而且，除了可以对所述基线进行加密，还可以对所述基线对应的所述自校验数据进行加密，进一步提高安全性。加密的方式可以是通过使用所述网络设备对应的非对称密钥中的私钥加密。在反向解密的过程中，使用相应的公钥解密。不同于常用的公钥加密的方式，通过私钥加密的方式，私钥只会在刚开始加密的时候使用到，之后都是使用公钥反向解密，较少次数的使用私钥可以降低私钥泄露的几率，保证私钥的安全性。
S204：在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，所述网络设备根据所述代码段和所述第一对应关系查找到加密后的所述基线，对加密后的所述基线进行反向解密得到所述基线。
S205：所述网络设备根据所述基线和所述第二对应关系查找到所述自校验数据。
S206：所述网络设备通过所述自校验数据对所述基线进行校验，所述校验具体包括：所述网络设备对所述基线执行所述预置处理得到第一待比对数据，比对所述自校验数据和所述第一待比对数据，或者，所述网络设备对所述自校验数据反向执行所述预处理还原出第二待比对数据，比对所述自校验数据和所述第二待比对数据是否相同。
S207：当校验结果为相同时，所述网络设备判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验。
由此可见，在为基线建立用于校验基线完整性的自校验数据的基础上，本发明实施例还提供了通过对基线加密的方法，通过自校验加上对基线加密的双重保护，进一步提高了基线的安全性，能够让网络设备可以有效的判断出基线是否被篡改。
实施例三
图3为本发明实施例提供的一种完整性校验装置的装置结构图，应用于网络设备，所述完整性校验装置300包括：
计算单元301，用于当系统进程的代码段加载到所述网络设备的内存中时，对所述代码段进行哈希计算，根据所述哈希计算的结果得到对应所述代码段的基线，并建立所述基线与所述代码段之间的第一对应关系。
举例说明，当有代码段(Code Segment)加载到所述网络设备的内存中时，网络设备可以通过内存中的PCB获知，并还可以获取该进程段的相关信息，例如进程段的首尾地址等。所述计算单元301可以在所述代码段被首次执行之前，对所述代码段进行第一次可信度量，通过哈希(Hash)计算得到对应所述代码段的基线。计算基线的过程可以参加如下方式：
App Code Segment[i]＝Code Segment(start-address[i],end-address[i])；
哈希计算的计算公式可以如下所示：
Hash[i]＝SHA256(App Code Segment[i])；
将所述哈希计算得出的结果作为所述代码段的基线，并绑定所述代码段和基线，也就是建立所述代码段与基线的第一对应关系。
需要注意，本发明实施例所应用的所述网络设备主要为具有通用系统的网络设备，也可以是具有嵌入式系统的网络设备。
处理单元302，用于通过对所述基线执行预置处理得到自校验数据，并建立所述基线与所述自校验数据的第二对应关系，所述自校验数据用于作为校验所述基线是否被修改的判断条件。
举例说明，所述处理单元302通过执行预置处理得到自校验数据的方式可以为通过算法获取所述基线内容的摘要，以摘要作为自校验数据，或者通过数字签名(Digital Signature或者Signature)等方式，本发明对此不做限定。可选的，所述处理单元302具体用于通过自身对应的私钥对所述基线进行数字签名，将数字签名结果作为所述基线的 自校验数据。
举例说明，所述私钥可以理解为非对称密钥中的私钥，与所述网络设备具有对应关系。所述私钥可以存储在所述网络设备的SOC中。通过数字签名后的得到的所述数字签名结果可以通过非对称密钥中对应私钥的公钥进行解密，完成对所述基线的完整性校验。
查找单元303，用于在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，根据所述代码段和所述第一对应关系查找到所述基线。
所述查找单元303还用于根据所述基线和所述第二对应关系查找到所述自校验数据。
校验单元304，用于通过所述自校验数据对所述基线进行校验，所述校验具体包括：所述网络设备对所述基线执行所述预置处理得到第一待比对数据，比对所述自校验数据和所述第一待比对数据，或者，所述网络设备对所述自校验数据反向执行所述预处理还原出第二待比对数据，比对所述自校验数据和所述第二待比对数据是否相同。
判断单元305，用于当校验结果为相同时，判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验。
举例说明，为了保证校验所述代码段的基线没有被篡改，所述校验单元304将在校验所述代码段的完整性之前，使用所述自校验数据对所述基线进行完整性校验。由于所述自校验数据是通过完整的、未被篡改的所述基线处理生成，若所述基线被篡改，则在使用所述自校验数据进行校验的过程中必然可以发现。所述判断单元305在通过所述校验确定所述基线没有被篡改的情况下，使用所述基线校验所述代码段的完整性，当所述完整性校验成功时，所述判断单元305可以明确确认所述代码段完整，当所述完整性校验不成功时，所述判断单元305可以明确确认所述代码段不完整。
需要注意，对所述代码段的完整性校验可以周期性进行。
还需要注意，所述校验单元304通过所述自校验数据对所述基线进行校验的过程可以与所述自校验数据的类型相关，例如当所述自校验数据通过特定算法根据所述基线计算得到的摘要，那么在对所述基线进行所述校验过程中，可以对所述基线通过相同所述特定算法计算出摘要，再和所述自校验数据进行比对。若所述自校验数据为通过私钥数字签名得到，那么在对所述基线进行所述校验过程中，可以对所述自校验数据反向执行所述预处理，也就是使用所述私钥对应的公钥对所述数字签名结果进行解密，将解密出的内容与所述基线进行比对。本发明实施例对其他可能的通过所述自校验数据对所述基线进行校验的过程在此不再一一穷举。
当比对结果为相同时，所述基线被确定为未被修改，则可以使用所述基线对所述代码段进行完整性校验，所述完整性校验的过程可以对所述代码段使用与所述计算单元301中获得所述基线的所使用哈希算法相同的哈希算法，例如为
PCR[i]＝SHA256(App Code Segment[i])
当PCR[i]＝Hash[i]时，可以确定所述代码段通过所述完整性校验，所述代码段未被修改。
可见，所述网络设备通过对所述基线处理得到对应的自校验数据，通过所述自校验数据可以验证对应基线的完整性，使得所述网络设备具有识别所述基线是否被篡改的能力，所述网络设备使用确认没有被篡改的基线对代码段进行完整性校验，提高了校验准确度。
实施例四
除了对所述基线进行处理得到自校验数据外，本发明实施例还可以在此基础上，进一步提高对所述基线的安全保护。在图3所对应的实施例基础上，图4为本发明实施例提供的一种完整性校验装置的装置结构图，
对于所述计算单元301，当所述代码段加载到所述内存中时，所述计算单元301可以通过PCB获取所述代码段的首尾地址，所述首尾地址可以是所述代码段占用内存中的物理地址，也可以是所述代码段的逻辑地址。需要注意是的，当所述网络设备部署有通用系统时，由于通用系统的灵活性特点，可能会导致在执行所述代码段之后，所述代码段在内存中的物理地址发生改变，但所述代码段的逻辑地址一般相对固定。
故所述完整性校验装置300还包括：
第一获取单元401，用于在触发所述计算单元301时，获取所述代码段的逻辑地址，所述逻辑地址包括所述代码段的首尾地址。
所述计算单元301使用所述代码段的逻辑地址进行哈希计算，可以得到较为准确的基线。在之后周期性的对所述代码段执行完整性校验之前，第二获取单元402通过所述逻辑地址获取所述代码段，使用所述代码段的逻辑地址可以从所述内存中准确快速的查找到所述代码段。
对于所述处理单元302，由于所述代码段与所述基线，所述基线与所述自校验数据均具有对应关系，故在选择存储所述基线和所述自校验数据的存储位置时，可以将所述基线和所述自校验数据存储到与所述代码段存储的同一存储介质中，以提高之后的查找效率。
故可选的，所述完整性校验装置300还包括保存单元403，用于将所述基线以及对应的自校验数据保存在PCB中，以提高所述网络设备通过所述第一对应关系和所述第二对应关系进行查找的查找速度。可以在所述PCB中新增字段用于专门存储所述基线和所述自校验数据。
还需要注意，在具有通用系统的移动终端中，内存中的代码段可以被移除，若所述代码段被移除，如果还继续保存对应所述代码段的所述基线和自校验数据，可能会造成系统资源的浪费。为此，可选的，还包括移除单元404，用于当所述代码段从所述内存中移除时，所述网络设备根据所述第一对应关系和所述第二对应关系查找到并删除所述基线和所述自校验数据。通过删除无效的基线和自校验数据，可以减少网络设备的存储压力。
加密单元405用于在触发所述处理单元302之后，对所述基线进行加密，得到加密后的所述基线。
举例说明，通过对所述基线进行加密，可以使得即使他人获取到加密后的基线，也不知道该加密后的基线是否与所述基线有关；即使知道这个就是加密后的基线，也无法通过所述加密后的基线得知未加密的基线是什么，由此提高了安全性。而且，除了可以对所述基线进行加密，还可以对所述基线对应的所述自校验数据进行加密，进一步提高安全性。加密的方式可以是通过使用所述网络设备对应的非对称密钥中的私钥加密。在反向解密的过程中，使用相应的公钥解密。不同于常用的公钥加密的方式，通过私钥加密的方式，私钥只会在刚开始加密的时候使用到，之后都是使用公钥反向解密，较少次数的使用私钥可以降低私钥泄露的几率，保证私钥的安全性。
所述查找单元303具体用于根据所述代码段和所述第一对应关系查找到加密后的所述基线，对加密后的所述基线进行反向解密得到所述基线。
由此可见，在为基线建立用于校验基线完整性的自校验数据的基础上，本发明实施例还提供了通过对基线加密的方法，通过自校验加上对基线加密的双重保护，进一步提高了基线的安全性，能够让网络设备可以有效的判断出基线是否被篡改。
本发明实施例中提到的第一对应关系和所述第一待比对数据的“第一”只是用来做名字标识，并不代表顺序上的第一。该规则同样适用于“第二”。
本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质可以是下述介质中的至少一种：只读存储器(Read-Only Memory，ROM)、RAM、磁碟或者光盘等各种可以存 储程序代码的介质。
需要说明的是，本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于设备及系统实施例而言，由于其基本相似于方法实施例，所以描述得比较简单，相关之处参见方法实施例的部分说明即可。以上所描述的设备及系统实施例仅仅是示意性的，其中作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述仅是本发明的优选实施方式，并非用于限定本发明的保护范围。应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (12)

  1. 一种完整性校验方法，其特征在于，应用于网络设备，所述方法包括：
    当系统进程的代码段加载到所述网络设备的内存中时，所述网络设备对所述代码段进行哈希计算，根据所述哈希计算的结果得到对应所述代码段的基线，并建立所述基线与所述代码段之间的第一对应关系；
    所述网络设备通过对所述基线执行预置处理得到自校验数据，并建立所述基线与所述自校验数据的第二对应关系，所述自校验数据用于作为校验所述基线是否被修改的判断条件；
    在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，所述网络设备根据所述代码段和所述第一对应关系查找到所述基线；
    所述网络设备根据所述基线和所述第二对应关系查找到所述自校验数据；
    所述网络设备通过所述自校验数据对所述基线进行校验，所述校验具体包括：所述网络设备对所述基线执行所述预置处理得到第一待比对数据，比对所述自校验数据和所述第一待比对数据，或者，所述网络设备对所述自校验数据反向执行所述预处理还原出第二待比对数据，比对所述自校验数据和所述第二待比对数据是否相同；
    当校验结果为相同时，所述网络设备判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验。
  2. 根据权利要求1所述的方法，其特征在于，所述网络设备通过对所述基线处理得到自校验数据，具体包括：
    所述网络设备通过自身对应的私钥对所述基线进行数字签名，将数字签名结果作为所述基线的自校验数据。
  3. 根据权利要求1或2所述的方法，其特征在于，在所述网络设备通过对所述基线执行预置处理得到自校验数据之后，还包括：
    所述网络设备对所述基线进行加密，得到加密后的所述基线；
    所述网络设备根据所述代码段和所述第一对应关系查找到所述基线具体包括：
    所述网络设备根据所述代码段和所述第一对应关系查找到加密后的所述基线，对加密后的所述基线进行反向解密得到所述基线。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，当所述系统进程的代码段加载到所述网络设备的内存中时，还包括：
    所述网络设备获取所述代码段的逻辑地址，所述逻辑地址包括所述代码段的首尾地址；
    在对所述代码段进行所述完整性校验之前，所述网络设备通过所述逻辑地址获取所述代码段。
  5. 根据权利要求1所述的方法，其特征在于，还包括：
    当所述代码段从所述内存中移除时，根据所述第一对应关系和所述第二对应关系查找到并删除所述基线和所述自校验数据。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，还包括：
    所述网络设备将所述基线以及对应的自校验数据保存在进程控制块PCB中，以提高所述网络设备通过所述第一对应关系和所述第二对应关系进行查找的查找速度。
  7. 一种完整性校验装置，其特征在于，应用于网络设备，包括：
    计算单元，用于当系统进程的代码段加载到所述网络设备的内存中时，对所述代码段进行哈希计算，根据所述哈希计算的结果得到对应所述代码段的基线，并建立所述基线与所述代码段之间的第一对应关系；
    处理单元，用于通过对所述基线执行预置处理得到自校验数据，并建立所述基线与所述自校验数据的第二对应关系，所述自校验数据用于作为校验所述基线是否被修改的判断条件；
    查找单元，用于在所述代码段驻留在所述内存期间，在对所述代码段进行所述完整性校验之前，根据所述代码段和所述第一对应关系查找到所述基线；
    所述查找单元还用于根据所述基线和所述第二对应关系查找到所述自校验数据；
    校验单元，用于通过所述自校验数据对所述基线进行校验，所述校验具体包括：所述网络设备对所述基线执行所述预置处理得到第一待比对数据，比对所述自校验数据和所述第一待比对数据，或者，所述网络设备对所述自校验数据反向执行所述预处理还原出第二待比对数据，比对所述自校验数据和所述第二待比对数据是否相同；
    判断单元，用于当校验结果为相同时，判断所述基线没有被修改，使用所述基线对所述代码段执行所述完整性校验。
  8. 根据权利要求7所述的装置，其特征在于，
    所述处理单元具体用于通过自身对应的私钥对所述基线进行数字签名，将数字签名结果作为所述基线的自校验数据。
  9. 根据权利要求6或7所述的装置，其特征在于，还包括：
    加密单元，用于在触发所述处理单元之后，对所述基线进行加密，得到加密后的所述基线；
    所述查找单元具体用于根据所述代码段和所述第一对应关系查找到加密后的所述 基线，对加密后的所述基线进行反向解密得到所述基线。
  10. 根据权利要求7至9任一项所述的装置，其特征在于，还包括：
    第一获取单元，用于在触发所述计算单元时，获取所述代码段的逻辑地址，所述逻辑地址包括所述代码段的首尾地址；
    第二获取单元，用于在触发判断单元之前，通过所述逻辑地址获取所述代码段。
  11. 根据权利要求7所述的装置，其特征在于，还包括：
    移除单元，用于当所述代码段从所述内存中移除时，根据所述第一对应关系和所述第二对应关系查找到并删除所述基线和所述自校验数据。
  12. 根据权利要求7至11任一项所述的装置，其特征在于，还包括：
    保存单元，用于将所述基线以及对应的自校验数据保存在进程控制块PCB中，以提高所述网络设备通过所述第一对应关系和所述第二对应关系进行查找的查找速度。
PCT/CN2015/097501 2015-04-29 2015-12-15 一种完整性校验方法和装置 WO2016173267A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510212803.8A CN106203100A (zh) 2015-04-29 2015-04-29 一种完整性校验方法和装置
CN201510212803.8 2015-04-29

Publications (1)

Publication Number Publication Date
WO2016173267A1 true WO2016173267A1 (zh) 2016-11-03

Family

ID=57198964

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/097501 WO2016173267A1 (zh) 2015-04-29 2015-12-15 一种完整性校验方法和装置

Country Status (2)

Country Link
CN (1) CN106203100A (zh)
WO (1) WO2016173267A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111832012A (zh) * 2020-07-15 2020-10-27 北京经纬恒润科技有限公司 一种ecu及其启动方法
CN114564724A (zh) * 2021-12-30 2022-05-31 海光信息技术股份有限公司 虚拟机内存完整性保护方法、装置、电子设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112528342B (zh) * 2020-12-29 2022-06-28 内蒙古工业大学 一种基于编译中间结果的软件保护方法
CN116737526A (zh) * 2022-03-01 2023-09-12 华为技术有限公司 一种代码段动态度量方法、装置及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006118896A2 (en) * 2005-04-29 2006-11-09 Sony Electronics Inc. Method and apparatus for detecting the falsification of metadata
US20080289038A1 (en) * 2007-05-14 2008-11-20 Samsung Electronics Co., Ltd. Method and apparatus for checking integrity of firmware
CN102509047A (zh) * 2011-11-09 2012-06-20 北京赛科世纪数码科技有限公司 校验机顶盒中程序代码的方法和系统
CN104077522A (zh) * 2014-06-30 2014-10-01 江苏华大天益电力科技有限公司 一种操作系统进程完整性检测方法
CN104408370A (zh) * 2014-12-25 2015-03-11 珠海全志科技股份有限公司 安卓系统安全性验证方法及其验证装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101834860B (zh) * 2010-04-22 2013-01-30 北京交通大学 一种远程动态验证客户端软件完整性的方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006118896A2 (en) * 2005-04-29 2006-11-09 Sony Electronics Inc. Method and apparatus for detecting the falsification of metadata
US20080289038A1 (en) * 2007-05-14 2008-11-20 Samsung Electronics Co., Ltd. Method and apparatus for checking integrity of firmware
CN102509047A (zh) * 2011-11-09 2012-06-20 北京赛科世纪数码科技有限公司 校验机顶盒中程序代码的方法和系统
CN104077522A (zh) * 2014-06-30 2014-10-01 江苏华大天益电力科技有限公司 一种操作系统进程完整性检测方法
CN104408370A (zh) * 2014-12-25 2015-03-11 珠海全志科技股份有限公司 安卓系统安全性验证方法及其验证装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111832012A (zh) * 2020-07-15 2020-10-27 北京经纬恒润科技有限公司 一种ecu及其启动方法
CN111832012B (zh) * 2020-07-15 2024-04-05 北京经纬恒润科技股份有限公司 一种ecu及其启动方法
CN114564724A (zh) * 2021-12-30 2022-05-31 海光信息技术股份有限公司 虚拟机内存完整性保护方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN106203100A (zh) 2016-12-07

Similar Documents

Publication Publication Date Title
CN112637166B (zh) 一种数据传输方法、装置、终端及存储介质
KR101845799B1 (ko) 외부 비휘발성 메모리에 저장된 데이터가 유효한지 여부를 결정하기 위한 집적 회로
US8161285B2 (en) Protocol-Independent remote attestation and sealing
TWI667586B (zh) 用以核對ｕｅｆｉ認證變量變化之系統及方法
US9270467B1 (en) Systems and methods for trust propagation of signed files across devices
US8683213B2 (en) Progressive boot for a wireless device
ES2804771T3 (es) Método y sistema para facilitar identificadores de terminal
CN106295407B (zh) 一种检测文件是否被篡改的方法及装置
US10511605B2 (en) Method for securing electronic data by restricting access and transmission of the data
US11601281B2 (en) Managing user profiles securely in a user environment
US11893118B2 (en) Transfer of ownership of a computing device via a security processor
RU2011114863A (ru) Способ и устройство для обнаружения вредоносного по
WO2016173267A1 (zh) 一种完整性校验方法和装置
EP2803011B1 (en) Detection of invalid escrow keys
CN110008719B (zh) 一种文件处理、文件检测方法及装置
WO2018086276A1 (zh) 用于验证应用安全性的方法和设备
CN110826091B (zh) 一种文件签名方法、装置、电子设备及可读存储介质
KR20210134054A (ko) 보안 전자 제어 유닛 업데이트를 위한 로컬 원장 블록 체인
CN109117643B (zh) 系统处理的方法以及相关设备
CN107924440B (zh) 用于管理容器的方法、系统和计算机可读介质
CN110008758B (zh) 一种id获取方法、装置、电子设备及存储介质
US20210266181A1 (en) Data security processing method and terminal thereof, and server
WO2020233044A1 (zh) 一种插件校验方法、设备、服务器及计算机可读存储介质
CN111639353B (zh) 一种数据管理方法、装置、嵌入式设备及存储介质
WO2010151102A1 (en) Remote destroy mechanism using trusted platform module

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15890642

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15890642

Country of ref document: EP

Kind code of ref document: A1