CN117411644B

CN117411644B - Digital signature verification method and device, electronic equipment and storage medium

Info

Publication number: CN117411644B
Application number: CN202311704152.5A
Authority: CN
Inventors: 谭刚; 陈鹏; 王建; 金立江
Original assignee: Suzhou Metabrain Intelligent Technology Co Ltd
Current assignee: Suzhou Metabrain Intelligent Technology Co Ltd
Priority date: 2023-12-12
Filing date: 2023-12-12
Publication date: 2024-03-01
Anticipated expiration: 2043-12-12
Also published as: CN117411644A

Abstract

The application provides a digital signature verification method, a digital signature verification device, electronic equipment and a storage medium. The method comprises the following steps: based on the target secure flash public key and the target bootguard public key, carrying out digital signature on the secure flash public key and the bootguard public key to obtain a BIOS signature file; based on the target secure flash private key, performing two times of digital signature on the target secure flash public key and the secure flash private key to obtain a second BIOS signature file; and based on the target bootguard private key, digitally signing the bootguard private key in the second BIOS signature file, generating a target BIOS signature file, and writing the target BIOS signature file into the BIOS chip for signature verification. The method and the system can improve the system security and prevent illegal modification and malicious invasion of system software.

Description

Digital signature verification method and device, electronic equipment and storage medium

Technical Field

The present disclosure relates to the field of digital signature technologies, and in particular, to a digital signature verification method, a digital signature verification device, an electronic device, and a storage medium.

Background

With the continuous development of computer technology, software security issues are becoming more and more of an issue.

Currently, in a common digital signature verification method, a private key is usually stored in software or an operating system, and is easy to attack and illegally access by malicious software. Signature algorithms are typically public and vulnerable to attack and hacking by malware. Moreover, the signature tampering and the illegal access of the data can be timely found through real-time verification, and the safety and the protection capability of the system are ensured. Whereas conventional digital signature verification methods generally require a lot of computing resources and time for real-time verification, resulting in a decrease in the performance and response speed of the system.

Disclosure of Invention

The embodiment of the application provides a digital signature verification method, a device, electronic equipment and a storage medium, which are used for solving the problems that the existing digital signature verification method is easy to attack and crack by malicious software, and a large amount of computing resources and time are required for real-time verification, so that the performance and response speed of a system are reduced.

In order to solve the above technical problems, embodiments of the present application are implemented as follows:

in a first aspect, an embodiment of the present application provides a digital signature verification method, where the method includes:

acquiring a customized target secure flash public key and a target secure flash private key, and a target bootguard public key and a target bootguard private key;

Based on the target secure flash public key and the target bootguard public key, respectively carrying out digital signature on the secure flash public key and the bootguard public key in the BIOS file in the BIOS chip to obtain a BIOS signature file;

based on the target secure flash private key, performing two times of digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file to obtain a second BIOS signature file;

and based on the target bootguard private key, carrying out digital signature on the bootguard private key in the second BIOS signature file to generate a target BIOS signature file, and writing the target BIOS signature file into a BIOS chip to carry out signature verification.

Optionally, the performing digital signature on the secure public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure public key and the target bootguard public key to obtain a BIOS signature file includes:

replacing the secure flash public key in the BIOS file with the target secure flash public key to complete the digital signature of the secure flash public key, and obtaining an intermediate signature file;

and replacing the bootguard public key in the intermediate signature file with the target bootguard public key to complete digital signature of the bootguard public key, thereby obtaining the BIOS signature file.

Optionally, the target bootguard public key includes: the target bootguard hardware check public key and the target BIOS boot self-test public key,

the replacing the bootguard public key in the intermediate signature file with the target bootguard public key to complete digital signature of the bootguard public key, to obtain the BIOS signature file, includes:

replacing the bootguard hardware verification public key in the intermediate signature file with the target bootguard hardware verification public key;

and replacing the BIOS startup self-checking public key in the intermediate signature file with the target BIOS startup self-checking public key to obtain the BIOS signature file.

Optionally, the performing, based on the target secure flash private key, two times of digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file to obtain a second BIOS signature file includes:

based on the target secure flash private key, digitally signing the secure flash private key in the BIOS signature file to obtain a first BIOS signature file;

and carrying out digital signature on the first BIOS signature file to obtain the second BIOS signature file.

Optionally, the performing digital signature on the secure flash private key in the BIOS signature file based on the target secure flash private key to obtain a first BIOS signature file includes:

Writing the hash value of the target secure flash public key into a designated private key signature file in the BIOS signature file to obtain a first signature file;

processing the extracted secure flash private key signature information in the first signature file to generate a signature certificate coding file;

and re-embedding the signature certificate coding file into the BIOS signature file to obtain the first BIOS signature file.

Optionally, the processing the secure flash private key signature information extracted from the first signature file to generate a signature certificate encoded file includes:

extracting the secure flash private key signature information from the first signature file to obtain a second signature file;

replacing the secure flash private key in the second signature file based on the target secure flash private key to obtain a third signature file;

carrying out hash processing on the third signature file to obtain a first encryptor file;

processing the first encryptor file to obtain a first signature certificate file;

and processing the first signature certificate file based on the distinguishable coding rule to obtain the signature certificate coding file.

Optionally, the digitally signing the first BIOS signature file to obtain the second BIOS signature file includes:

Extracting the file in the area where the signature certificate encoded file is located from the first BIOS signature file to obtain a separated file;

processing the separated file based on the target secure flash private key to obtain a fourth signature file;

and embedding the fourth signature file into a corresponding position of the first BIOS signature file to obtain the second BIOS signature file.

Optionally, the processing the separated file based on the target secure flash private key to obtain a fourth signature file includes:

processing the separated file to obtain a second encryptor file;

processing the second encryptor file based on the distinguishable encoding rules to obtain a second signature certificate file;

and carrying out digital signature on the second signature certificate file based on the target secure flash private key to obtain the fourth signature file.

Optionally, the generating the target BIOS signature file based on the target bootguard private key and digitally signing the bootguard private key in the second BIOS signature file includes:

checking the second BIOS signature file to obtain a checking result;

and under the condition that the verification result indicates that the second BIOS signature file is successfully verified, carrying out digital signature on the bootguard private key in the second BIOS signature file based on the target bootguard private key, and generating the target BIOS signature file.

Optionally, the verifying the second BIOS signature file to obtain a verification result includes:

performing signature trust verification on the second BIOS signature file based on the trust verification data packet;

and after the signature trust verification of the second BIOS signature file is successful, carrying out signature integrity verification on the second BIOS signature file based on the integrity signature verification data to obtain a verification result.

based on the target bootguard private key, replacing the bootguard private key in the second BIOS signature file to obtain an intermediate file;

pairing the target bootguard private key and the target bootguard public key in the intermediate file to obtain a target bootguard public key with successful pairing;

and packaging the hash value of the successfully paired target bootguard public key with the intermediate file to obtain the target BIOS signature file.

Optionally, writing the target BIOS signature file to a BIOS chip for signature verification includes:

Responding to the starting of a server, and performing signature verification on a public key of the target BIOS signature file built in the hardware of the server based on a private key of the target BIOS signature file in the BIOS chip; or alternatively

Responding to the starting of a server, and performing signature verification on a private key of the target BIOS signature file built in the hardware of the server based on a public key of the target BIOS signature file in the BIOS chip;

the BIOS chip is arranged in the server.

In a second aspect, embodiments of the present application provide a digital signature verification apparatus, the apparatus including:

the customized key acquisition module is used for acquiring a customized target secure flash public key, a target secure flash private key, a target bootguard public key and a target bootguard private key;

the public key signature module is used for respectively carrying out digital signature on the secure public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure public key and the target bootguard public key to obtain a BIOS signature file;

the secure flash signature module is used for carrying out two times of digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file based on the target secure flash private key to obtain a second BIOS signature file;

And the signature file generation module is used for carrying out digital signature on the bootguard private key in the second BIOS signature file based on the target bootguard private key to generate a target BIOS signature file, and writing the target BIOS signature file into a BIOS chip to carry out signature verification.

Optionally, the public key signature module includes:

an intermediate file obtaining unit, configured to replace a secure flash public key in the BIOS file with the target secure flash public key, so as to complete digital signature of the secure flash public key, and obtain an intermediate signature file;

and the signature file acquisition unit is used for replacing the bootguard public key in the intermediate signature file with the target bootguard public key so as to complete the digital signature of the bootguard public key and obtain the BIOS signature file.

the signature file acquisition unit includes:

the first public key replacing subunit is used for replacing the bootguard hardware verification public key in the intermediate signature file with the target bootguard hardware verification public key;

and the second public key replacing subunit is used for replacing the BIOS startup self-checking public key in the intermediate signature file with the target BIOS startup self-checking public key to obtain the BIOS signature file.

Optionally, the secureflash signature module includes:

the first BIOS file acquisition unit is used for carrying out digital signature on the secure flash private key in the BIOS signature file based on the target secure flash private key to obtain a first BIOS signature file;

and the second BIOS file acquisition unit is used for carrying out digital signature on the first BIOS signature file to obtain the second BIOS signature file.

Optionally, the first BIOS file obtaining unit includes:

a first signature file obtaining subunit, configured to write a hash value of the target secure flash public key into a specified private key signature file in the BIOS signature file, to obtain a first signature file;

the signature certificate file generation subunit is used for processing the extracted secure flash private key signature information in the first signature file to generate a signature certificate coding file;

and the first BIOS file acquisition subunit is used for re-embedding the signature certificate coding file into the BIOS signature file to obtain the first BIOS signature file.

Optionally, the signature certificate file generation subunit includes:

a second signature file obtaining subunit, configured to extract the secure flash private key signature information from the first signature file, to obtain a second signature file;

A third signature file obtaining subunit, configured to replace the secure flash private key in the second signature file based on the target secure flash private key, to obtain a third signature file;

a first encryptor file obtaining subunit, configured to perform hash processing on the third signature file to obtain a first encryptor file;

the first certificate file acquisition subunit is used for processing the first encryptor file to obtain a first signature certificate file;

and the certificate code file acquisition subunit is used for processing the first signature certificate file based on the distinguishable code rule to obtain the signature certificate code file.

Optionally, the second BIOS file obtaining unit includes:

a separated file obtaining subunit, configured to extract, from the first BIOS signature file, a file in an area where the signature certificate encoded file is located, to obtain a separated file;

a fourth signature file obtaining subunit, configured to process the separated file based on the target secure flash private key to obtain a fourth signature file;

and the second BIOS file acquisition subunit is used for embedding the fourth signature file into the corresponding position of the first BIOS signature file to obtain the second BIOS signature file.

Optionally, the fourth signature file acquisition subunit includes:

a second encryptor file obtaining subunit, configured to process the separated file to obtain a second encryptor file;

a second certificate file obtaining subunit, configured to process the second encryptor file based on a distinguishable encoding rule, to obtain a second signed certificate file;

and the fourth file acquisition subunit is used for carrying out digital signature on the second signature certificate file based on the target secure flash private key to obtain the fourth signature file.

Optionally, the signature file generation module includes:

the verification result acquisition unit is used for verifying the second BIOS signature file to obtain a verification result;

and the signature file generating unit is used for digitally signing the bootguard private key in the second BIOS signature file based on the target bootguard private key under the condition that the verification result indicates that the second BIOS signature file is successfully verified, and generating the target BIOS signature file.

Optionally, the verification result obtaining unit includes:

the trust verification subunit is used for carrying out signature trust verification on the second BIOS signature file based on the trust verification data packet;

And the verification result acquisition subunit is used for carrying out signature integrity verification on the second BIOS signature file based on the integrity signature verification data after the signature trust verification of the second BIOS signature file is successful, so as to obtain the verification result.

Optionally, the signature file generation module includes:

the intermediate file obtaining unit is used for replacing the bootguard private key in the second BIOS signature file based on the target bootguard private key to obtain an intermediate file;

the key pairing unit is used for pairing the target bootguard private key and the target bootguard public key in the intermediate file to obtain a target bootguard public key with successful pairing;

and the target BIOS file acquisition unit is used for packaging the hash value of the successfully paired target bootguard public key with the intermediate file to obtain the target BIOS signature file.

Optionally, the signature file generation module includes:

the first signature verification unit is used for responding to the starting of the server and carrying out signature verification on the public key of the target BIOS signature file built in the hardware of the server based on the private key of the target BIOS signature file in the BIOS chip;

The second signature verification unit is used for responding to the starting of the server and carrying out signature verification on a private key of the target BIOS signature file built in the hardware of the server based on a public key of the target BIOS signature file in the BIOS chip;

the BIOS chip is arranged in the server.

In a third aspect, an embodiment of the present application provides an electronic device, including:

a memory, a processor, and a computer program stored on the memory and executable on the processor, which when executed by the processor, implements the digital signature verification method of any of the above.

In a fourth aspect, embodiments of the present application provide a readable storage medium, which when executed by a processor of an electronic device, enables the electronic device to perform the digital signature verification method of any one of the above.

In the embodiment of the application, the customized target secure flash public key and the target secure flash private key, and the target bootguard public key and the target bootguard private key are obtained. And respectively carrying out digital signature on the secure flash public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure flash public key and the target bootguard public key to obtain a BIOS signature file. And based on the target secure flash private key, performing two-time digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file to obtain a second BIOS signature file. And based on the target bootguard private key, digitally signing the bootguard private key in the second BIOS signature file to generate a target BIOS signature file, and writing the target BIOS signature file into the BIOS chip to perform signature verification. According to the embodiment of the application, the security characteristics of the secure flash and the BootGuard are combined, and the system software can be effectively prevented from being tampered and invaded through two times of digital signature, so that the security of a computer system is improved. Meanwhile, the secure flash has high security, can prevent data from being tampered and leaked, and the BootGuard technology can prevent illegal modification and malicious invasion of system software.

The foregoing description is only an overview of the technical solutions of the present application, and may be implemented according to the content of the specification in order to make the technical means of the present application more clearly understood, and in order to make the above-mentioned and other objects, features and advantages of the present application more clearly understood, the following detailed description of the present application will be given.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the description of the embodiments of the present application will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings may be obtained according to these drawings without inventive effort for a person of ordinary skill in the art.

Fig. 1 is a step flowchart of a digital signature verification method provided in an embodiment of the present application;

FIG. 2 is a schematic diagram of a two-time signature algorithm flow provided in an embodiment of the present application;

FIG. 3 is a schematic diagram of a signature process according to an embodiment of the present application;

fig. 4 is a schematic structural diagram of a digital signature verification device according to an embodiment of the present application;

fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all, of the embodiments of the present application. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments herein without making any inventive effort, are intended to be within the scope of the present application.

Referring to fig. 1, a flowchart illustrating steps of a digital signature verification method according to an embodiment of the present application is shown, and as shown in fig. 1, the digital signature verification method may include: step 101, step 102, step 103 and step 104.

Step 101: and acquiring the customized target secure flash public key and the target secure flash private key, and the target bootguard public key and the target bootguard private key.

The embodiment of the application can be applied to a scene of performing two times of digital signature based on the secure flash and bootguard security policies.

In a specific implementation, a BIOS chip supporting two digital signature modes, namely secure flash and bootguard, may be designed in advance.

The secure flash (secure refresh firmware) is a secure firmware update function, and by using a digital signature and verification mechanism, the secure flash has a security feature at a hardware level, so that the secure flash function can prevent illegal access and tampering, and can select to digitally sign a firmware file to generate a unique signature file. Then, when the device receives the firmware update file, the signature of the firmware file is verified a priori, so that the firmware update file is ensured not to be tampered. If the verification is passed, the device updates the firmware file to protect the device from the threat of firmware attack.

Bootguard is a hardware security function that can be applied to digital signature verification at BIOS startup, which ensures the integrity and authenticity of the startup process by using hardware root keys and digital signatures, protecting the computer from the threat of malware and firmware attacks. The bootguard function, when the computer is booted, verifies the integrity and authenticity of the boot firmware. First, bootguard digitally signs boot firmware using a hardware root key to generate a unique signature. Then, during the boot process, bootguard verifies the signature of the boot firmware, ensuring that it has not been tampered with. If the verification is passed, the computer will continue to boot.

After designing the above BIOS chip, when generating a digital signature based on the secure flash and bootguard, files required for the digital signature, for example, a file romilayout and OEM Key hash required for the signature and a finally generated BIOS file, the romilayout being a data emission structure used to analyze the inside of the BIOS (i.e., determining a storage location of public keys of the secure flash and bootguard, etc.), the OEM Key hash value may be used to verify the BIOS data, and OEM (Key Original Equipment Manufacturer Key, original equipment manufacturer Key) custom-made secure flash and bootguard, i.e., a target secure flash public Key and a target secure flash private Key, and a target bootguard public Key and a target bootguard private Key, may be generated using a tool. The target secure flash public key and the target secure flash private key, and the target bootguard public key and the target bootguard private key may be used to customize the encryption algorithm according to the OEM customer requirements, and then the target secure flash public key and the target secure flash private key, and the target bootguard public key and the target bootguard private key may be used to replace the public key and the private key used by default in the BISO file, so that the BISO file has uniqueness and security.

After the customized target secure flash public key and target secure flash private key, and the target bootguard public key and target bootguard private key are obtained, step 102 is performed.

Step 102: and respectively carrying out digital signature on the secure public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure public key and the target bootguard public key to obtain a BIOS signature file.

After the customized target secure flash public key and target secure flash private key, and the target bootguard public key and target bootguard private key are obtained, digital signatures can be respectively carried out on the secure flash public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure flash public key and the target bootguard public key to obtain the BIOS signature file. The public key signing process may be described in detail in connection with the following specific implementations.

In a specific implementation of the present application, the step 102 may include:

substep A1: and replacing the secure flash public key in the BIOS file with the target secure flash public key to finish the digital signature of the secure flash public key and obtain an intermediate signature file.

In the embodiment of the application, after the customized target secure flash public key is obtained, the secure flash public key in the BIOS file may be replaced by the target secure flash public key, so as to complete digital signature of the secure flash public key, and obtain the intermediate signature file. Specifically, the substitution of the secure flash public key may be performed using a Cryptocon tool (a special tool name of a digital signature algorithm).

Of course, if the execution fails when the secure flash public key in the BIOS file is replaced with the target secure flash public key, the digital signature process is exited. If the execution is successful, the intermediate signature file is obtained, and the sub-step A2 is executed.

Substep A2: and replacing the bootguard public key in the intermediate signature file with the target bootguard public key to complete digital signature of the bootguard public key, thereby obtaining the BIOS signature file.

After the intermediate signature file is obtained, the bootguard public key in the intermediate signature file can be replaced by the target bootguard public key to complete digital signature of the bootguard public key, and the BIOS signature file is obtained. In a specific implementation, replacement of bootguard public keys may be performed using the BpmKmGen tool (the specialized tool name for digital signature algorithms).

In this example, the target bootguard public key may include: the target bootguard hardware check public key and the target BIOS boot self-checking public key. When the bootguard public key is replaced, the bootguard hardware verification public key in the intermediate signature file can be replaced by the target bootguard hardware verification public key, and the BIOS boot self-checking public key in the intermediate signature file is replaced by the target BIOS boot self-checking public key, so that the BIOS signature file is obtained, and the digital signature of the bootguard public key is completed.

Of course, if the bootguard public key in the BIOS file is replaced with the target bootguard public key, the execution fails, and the digital signature process is exited. If the execution is successful, a digital signature file is obtained, and the subsequent flow is executed.

After the digital signature of the bootguard public key and the secure flash public key described above is completed, step 103 is performed.

Step 103: and based on the target secure flash private key, performing two times of digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file to obtain a second BIOS signature file.

After the digital signature of the bootguard public key and the secure flash public key is completed, the target secure flash public key and the secure flash private key in the BIOS signature file can be digitally signed for two times based on the target secure flash private key, so as to obtain a second BIOS signature file. The second BIOS signature file is obtained by twice signing the public key and the private key of the secure flash.

In this example, the secure private key in the BIOS signature file may be digitally signed based on the target secure private key to obtain a first BIOS signature file, and then the first BIOS signature file may be digitally signed to obtain a second BIOS signature file. The implementation may be described in detail in connection with the following specific implementations.

In a specific implementation of the present application, the step 103 may include:

substep B1: and carrying out digital signature on the secure flash private key in the BIOS signature file based on the target secure flash private key to obtain a first BIOS signature file.

In this embodiment of the present application, after obtaining the BIOS signature file, the secure flash private key in the BIOS signature file may be digitally signed based on the target secure flash private key to obtain the first BIOS signature file. The first signing process may be described in detail in connection with the following specific implementations.

In another specific implementation of the present application, the foregoing substep B1 may include:

substep C1: and writing the hash value of the target secure flash public key into a designated private key signature file in the BIOS signature file to obtain a first signature file.

In this embodiment, the hash value of the target secure flash public key may be written into the specified private key signature file in the BIOS signature file to obtain the first signature file. Specifically, the public key hash value of the target secure flash public key may be written to fvdxesign. Inf (i.e., the designated private key signature file) using a Cryptocon tool, and if execution is correct, then continued, if incorrect, then exited.

After obtaining the first signature file, sub-step C2 is performed.

Substep C2: and processing the extracted secure flash private key signature information in the first signature file to generate a signature certificate coding file.

After the first signature file is obtained, the secure flash private key signature information extracted from the first signature file can be processed to generate a signature certificate code file. The implementation may be described in detail in connection with the following specific implementations.

In another specific implementation of the present application, the foregoing substep C2 may include:

substep D1: and extracting the secure flash private key signature information from the first signature file to obtain a second signature file.

In this embodiment, after the first signature file is obtained, the secure flash private key signature information may be extracted from the first signature file to obtain the second signature file. Specifically, the Cryptocon may be used to separate a specific FvDxe signature (i.e., secure flash private key signature information) in the BIOS file (i.e., the first signature file) to prepare for signing, and the output file name is: signed_signed (i.e., second signature file), continues if execution is correct, exits if incorrect.

After extracting the secure flash private key signature information from the first signature file to obtain the second signature file, a sub-step D2 is performed.

Substep D2: and replacing the secure flash private key in the second signature file based on the target secure flash private key to obtain a third signature file.

After the second signature file is obtained by extracting the secure flash private key signature information from the first signature file, the secure flash private key in the second signature file can be replaced based on the target secure flash private key to obtain a third signature file.

After the third signature file is obtained, sub-step D3 is performed.

Substep D3: and carrying out hash processing on the third signature file to obtain a first encryptor file.

After the third signature file is obtained, the third signature file may be processed to obtain the encryptor input file. Specifically, the cryptocon is used to process the separated signed_serialized file (i.e., the third signature file), and the generated encryptor input file is SHA256 (Secure Hash Algorithm-bit, 256 bits of secure hash algorithm) hash file signed_serialized. Hash (i.e., the first encryptor file), and if the execution is correct, the execution is continued, and if the execution is wrong, the execution is exited.

Substep D4: and processing the first encryptor file to obtain a first signature certificate file.

After obtaining the first encryptor file, the first encryptor file may then be processed to obtain a first signed certificate file. Specifically, a separate DER encoded pkcs#1v1.5 signature certificate file may be created by signing "signed_serialized.hash.bin" (i.e. first encryptor file) data hash using an opensl tool (a specialized tool name for digital signature algorithms): "signed_asserted.post1" (i.e., the first signed certificate file), continues if execution is normal, exits if there is an error.

Substep D5: and processing the first signature certificate file based on the distinguishable coding rule to obtain the signature certificate coding file.

Finally, the first signed certificate file may be processed based on the discemable encoding rule (Distinguished Encoding Rules, DER) to obtain a signed certificate encoded file. Specifically, a DER file may be created using Cryptocon: "signed_sequenced.post1. Der" (i.e., signed certificate encoded file), continues if generated normally, exits if made in error.

After obtaining the signed certificate encoded file, sub-step C3 is performed.

Substep C3: and re-embedding the signature certificate coding file into the BIOS signature file to obtain the first BIOS signature file.

After the signature certificate encoded file is obtained, the signature certificate encoded file may be re-embedded into the BIOS signature file to obtain the first BIOS signature file. Specifically, "signed_sequenced 1.Der" (signature certificate encoded file) may be re-embedded back into the BIOS signature file using Cryptocon, generating a file name BIOS1 (i.e., the first BIOS signature file), continuing if execution is correct, exiting if there is an error.

After obtaining the first BIOS signature file, sub-step B2 is performed.

Substep B2: and carrying out digital signature on the first BIOS signature file to obtain the second BIOS signature file.

After the first BIOS signature file is obtained, a second digital signature may be performed on the first BIOS signature file to obtain a second BIOS signature file. The implementation may be described in detail in connection with the following specific implementations.

In another specific implementation of the present application, the foregoing substep B2 may include:

Substep E1: and extracting the file in the area where the signature certificate encoded file is located from the first BIOS signature file to obtain a separated file.

In this embodiment, after the first BIOS signature file is obtained, the file in the area where the signature certificate encoded file is located may be extracted from the BIOS signature file, so as to obtain a separate file. Specifically, the Cryptocon may be used to separate the region where the signature certificate encoded file in the BIOS1 is located to prepare the secondary signature, where the separate file is "signed_second_delayed", and if the execution is correct, the process continues, and if the execution is wrong, the process exits.

After the separate file is obtained, sub-step E2 is performed.

Substep E2: and processing the separated file based on the target secure flash private key to obtain a fourth signature file.

After the separated file is obtained, the separated file can be processed based on the target secure flash private key to obtain a fourth signature file. The implementation may be described in detail in connection with the following specific implementations.

In another specific implementation of the present application, the foregoing substep E2 may include:

substep F1: and processing the separated file to obtain a second encryptor file.

In this embodiment, after obtaining the separated file, the separated file may be processed to obtain the second encryptor file. Specifically, a separation file can be obtained using a Cryptocon: the "signed_second_serialized" is processed to produce an OEM encryptor input file, the SHA256 hash file "signed_second_serialized.hash" (i.e., the second encryptor file), and if execution is correct, then proceed, and exit if there is an error.

After the second encryptor file is obtained, a substep F2 is performed.

Substep F2: and processing the second encryptor file based on the distinguishable coding rules to obtain a second signature certificate file.

After obtaining the second encryptor file, the second encryptor file may then be processed based on the discriminable encoding rule to obtain a second signed certificate file. Specifically, a separate DER encoded PKCS#1v1.5 signature certificate file may be created using opensl by signing a hash of "signed_second_signed.hash.bin" (i.e., the second encryptor file) data: "signed_second_authorized.post_second" (i.e., second signed certificate file), continues if execution is correct, exits if there is an error.

After obtaining the second signed certificate file, sub-step F3 is performed.

Substep F3: and carrying out digital signature on the second signature certificate file based on the target secure flash private key to obtain the fourth signature file.

After the second signature certificate file is obtained, the second signature certificate file can be digitally signed based on the target secure flash private key to obtain a fourth signature file. Specifically, the OEM private key (target secure private key) may be used to digitally sign the second signature certificate file to obtain a fourth signature file: "signed_second_sequenced_second", while converting the fourth signature file into DER format, continue if execution is correct, exit if error occurs.

After the fourth signature file is obtained, a sub-step E3 is performed.

Substep E3: and embedding the fourth signature file into a corresponding position of the first BIOS signature file to obtain the second BIOS signature file.

After the fourth signature file is obtained, the fourth signature file may be embedded in a corresponding location of the first BIOS signature file to obtain the second BIOS signature file. Specifically, "signed_secnd_sequenced.post_second" (i.e., the fourth signature file) may be embedded into BIOS1 using Cryptocon, eventually generating second signed BIOS2 (i.e., the second BIOS signature file), continuing if execution is correct, exiting if error occurs.

According to the embodiment of the application, the secure flash and the BootGuard are used for verifying the digital signature twice, so that tampering and illegal access of malicious software can be effectively prevented.

After the second BIOS signature file is obtained, step 104 is performed.

Step 104: and based on the target bootguard private key, carrying out digital signature on the bootguard private key in the second BIOS signature file to generate a target BIOS signature file, and writing the target BIOS signature file into a BIOS chip to carry out signature verification.

After the second BIOS signature file is obtained, the second BIOS signature file may be checked first, and after the check is successful, the digital signature of the bootguard private key is continued. In this example, the second BIOS signature file may be checked to obtain a check result, and if the check result indicates that the second BIOS signature file is checked successfully, the bootguard private key in the second BIOS signature file is digitally signed based on the target bootguard private key to generate the target BIOS signature file. The verification mode can be described in detail in connection with the following specific implementation modes.

In a specific implementation of the present application, the method for verifying the second BIOS signature file may include the following steps:

Step G1: and carrying out signature trust verification on the second BIOS signature file based on the trust verification data packet.

In this example, the second BIOS signature file may first be signature trust checked based on the trust check packet.

Step G2: and after the signature trust verification of the second BIOS signature file is successful, carrying out signature integrity verification on the second BIOS signature file based on the integrity signature verification data to obtain a verification result.

After the signature trust verification of the second BIOS signature file is successful, the second BIOS signature file may be subjected to signature integrity verification based on the integrity signature verification data, to obtain the verification result. Specifically, the BIOS2 generated by the two signatures may be checked using the Cryptocon to check whether the amitraedfv package (i.e., the trust check data package) and the FW Capsule signature (i.e., the integrity signature check data) are normal, and if the next step is performed normally, the process is exited.

After the verification of the second BIOS signature file is completed, the bootguard private key in the second BIOS signature file may be digitally signed based on the target bootguard private key, to generate a target BIOS signature file, and the target BIOS signature file is written into the BIOS chip to perform signature verification. The implementation may be described in detail in connection with the following specific implementations.

In a specific implementation of the present application, the step 104 may include:

substep H1: and replacing the bootguard private key in the second BIOS signature file based on the target bootguard private key to obtain an intermediate file.

In this embodiment, after successful verification of the second BIOS signature file is completed, the bootguard private key in the second BIOS signature file may be replaced based on the target bootguard private key to obtain the intermediate file.

And after replacing the bootguard private key in the second BIOS signature file based on the target bootguard private key to obtain an intermediate file, executing a sub-step H2.

Substep H2: and matching the target bootguard private key with the target bootguard public key in the intermediate file to obtain the target bootguard public key with successful matching.

After the bootguard private key in the second BIOS signature file is replaced based on the target bootguard private key to obtain an intermediate file, the target bootguard private key and the target bootguard public key in the intermediate file can be paired to obtain a successfully paired target bootguard public key. The existing target bootguard public key in the intermediate file is paired with the replaced target bootguard private key, so that the successfully paired target bootguard public key is obtained.

And after the target bootguard private key and the target bootguard public key in the intermediate file are paired to obtain the target bootguard public key successfully paired, executing the substep H3.

Substep H3: and packaging the hash value of the successfully paired target bootguard public key with the intermediate file to obtain the target BIOS signature file.

After the target bootguard private key and the target bootguard public key in the intermediate file are paired to obtain the target bootguard public key with successful pairing, the hash value of the target bootguard public key with successful pairing can be packaged with the second BIOS signature file to obtain the target BIOS signature file. Specifically, the FITm tool (the special tool name of the digital signature algorithm) may be used to pair the target bootguard private key and the target bootguard public key with the BIOS2 generated by the two signatures, and repackage the hash value of the public key of the bootguard OEM (i.e., the target bootguard public key) successfully paired with the intermediate file to generate the Final bios_final (i.e., the target BIOS signature file).

After the target BIOS signature file is obtained, the target BIOS signature file may be written into the BIOS chip to perform a subsequent signature verification process. The signature verification process may be described in detail in connection with the following detailed implementation.

In another specific implementation of the present application, the step 104 may include:

substep I1: and responding to the starting of the server, and performing signature verification on the public key of the target BIOS signature file built in the hardware of the server based on the private key of the target BIOS signature file in the BIOS chip.

Substep I2: and responding to the starting of the server, and performing signature verification on a private key of the target BIOS signature file built in the hardware of the server based on a public key of the target BIOS signature file in the BIOS chip.

In this embodiment, the server has a built-in BIOS chip that has been written with the target BIOS signature file.

After the server is started, the public key of the target BIOS signature file built in the hardware of the server can be subjected to signature verification based on the private key of the target BIOS signature file in the BIOS chip. Or, based on the public key of the target BIOS signature file in the BIOS chip, carrying out signature verification on the private key of the target BIOS signature file built in the hardware of the server.

Next, the above-described digital signature algorithm verification flow is described below with reference to fig. 3. As shown in fig. 3, the digital signature algorithm verification process may include the steps of:

1. And establishing a BIOS supporting the secure flash digital signature.

2. A BIOS is established that supports bootguard digital signatures.

The designed BIOS can support the secure flash digital signature and the bootguard digital signature through the two steps, so that the BIOS can be prevented from being incapable of identifying information in the digital signature file when the subsequent digital signature file writing is carried out.

3. The generating, storing and verifying algorithm is based on the mode that a Bootguard public key and a secureflash public key are signed firstly, then the secureflash public key and a secureflash private key are signed twice, finally Bootguard private key signature and hash value verification are carried out, so that a target digital signature file is generated, the target digital signature file is written into a BIOS chip, and meanwhile, when a server is started, hardware (such as a CPU (Central Processing Unit, a central processing unit), a chip and the like) can be verified.

4. And the digital signature checking and verifying mechanism ensures the safety of the BIOS, and the BIOS needs to check and verify the digital signature every time the BIOS is started, and the BIOS can be started after verification, or else the BIOS cannot be started.

According to the embodiment of the application, by combining the security characteristics of the secure flash and the BootGuard, the system software can be effectively prevented from being tampered and invaded by two times of digital signature, and the security of the computer system is improved. Meanwhile, the secure flash has high security, can prevent data from being tampered and leaked, and the BootGuard technology can prevent illegal modification and malicious invasion of system software.

The flow of the two-time signature algorithm for secure flash and BootGuard can be described in detail below in conjunction with fig. 2.

As shown in fig. 2, the flow of the two-time signature algorithm may include the following steps:

1. signing the public key of the secure flash, namely replacing the public key of the secure flash in the BIOS to customize the public key for the OEM; if successful, continuing, and if failed, ending.

2. bootguard public key signing, namely replacing the default bootguard public key in the BIOS with the bootguard public key customized by OEM; if successful, continuing, and if failed, ending.

3. The first time of signature of the secure flash, the OEM customized secure flash public key hash value is written into FvDxeSIgn, namely, the appointed private key signature file in the BIOS signature file; if successful, continuing, and if failed, ending.

4. The FvDxeSIgn signature is separated, namely, a specific FvDxe signature in the BIOS is separated to prepare for signature, and the output file name is: signed_delayed; if successful, continuing, and if failed, ending.

5. Generating an encryptor file, namely, a separated signed_serial file, and generating an encryptor input file as an SHA256 hash file signed_serial. If successful, continuing, and if failed, ending.

6. Creating a separate DER code, creating a PKCS#1v1.5 signature certificate file "signed_served.post1" of the separate DER code by signing the data hash of the "signed_served.hash", continuing if execution is normal, and ending if an error occurs.

7. The DER is created, i.e. the corresponding DER file "signed_served. Post1.DER" is created by "signed_served. Post1", and continues if execution is normal, otherwise the flow ends.

8. Generating a first signature BIOS, namely re-embedding 'signed_authorized.post1. Der' back into the BIOS file, generating a file name as BIOS1, if the execution is normal, continuing, otherwise ending the flow.

9. And (3) separating the region in the BIOS1 to prepare a secondary signature by using the secure secondary digital signature, wherein the separated file is 'signed_second_serial', if the execution is normal, continuing, otherwise, ending the flow.

10. An OEM encryptor file is generated, i.e. the separate file is processed, an OEM encryptor input file is generated, the SHA256 hash file "signed_second_signed.

11. Establishing a separate DER code, creating a separate DER code PKCS#1v1.5 signature certificate file by hashing the signature "signed_second_signed.hash.bin" data: "signed_second_signaled_post_second", if execution is correct, continue, if error occurs, exit.

12. Converting to DER, namely converting 'signed_second_signed. Post_second' after OEM private key signing into DER format, continuing if execution is correct, and exiting if error occurs.

13. Signature writeback generates BIOS2, i.e. "signed_secnd_authorized_post_second" is embedded into BIOS1, and finally generates BIOS2 with a second signature, if execution is correct, continuing, if error occurs, exiting.

14. Signature verification, namely, verifying the reliability and the integrity of the BIOS2, wherein the verification is continued, and the flow is ended if the verification fails.

15. The customized bootguard private key is replaced and checked, namely, the customized bootguard private key is written into the BIOS2, pairing is carried out on the bootguard public key and the private key, the hash values of the paired bootguard OEM public keys are repackaged together, a Final BIOS_Final (namely, a target digital signature file) is generated, success is continued, and failure is finished.

16. And generating a mass production BIOS, namely writing the Final BIOS_final into a BIOS chip for mass production. Furthermore, a computer with a mass-produced BIOS can be installed to perform hardware verification by combining the SecureFlash and BootGuard.

According to the digital signature verification method, the customized target secure flash public key and the target secure flash private key, and the target bootguard public key and the target bootguard private key are obtained. And respectively carrying out digital signature on the secure flash public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure flash public key and the target bootguard public key to obtain a BIOS signature file. And based on the target secure flash private key, performing two-time digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file to obtain a second BIOS signature file. And based on the target bootguard private key, digitally signing the bootguard private key in the second BIOS signature file to generate a target BIOS signature file, and writing the target BIOS signature file into the BIOS chip to perform signature verification. According to the embodiment of the application, the security characteristics of the secure flash and the BootGuard are combined, and the system software can be effectively prevented from being tampered and invaded through two times of digital signature, so that the security of a computer system is improved. Meanwhile, the secure flash has high security, can prevent data from being tampered and leaked, and the BootGuard technology can prevent illegal modification and malicious invasion of system software.

Referring to fig. 4, a schematic structural diagram of a digital signature verification device according to an embodiment of the present application is shown. As shown in fig. 4, the digital signature verification apparatus 400 may include the following modules:

a customized key obtaining module 410, configured to obtain a customized target secure flash public key and a target secure flash private key, and a target bootguard public key and a target bootguard private key;

the public key signature module 420 is configured to digitally sign the secure public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure public key and the target bootguard public key, respectively, to obtain a BIOS signature file;

the secure flash signature module 430 is configured to perform two times of digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file based on the target secure flash private key, so as to obtain a second BIOS signature file;

the signature file generating module 440 is configured to digitally sign the bootguard private key in the second BIOS signature file based on the target bootguard private key, generate a target BIOS signature file, and write the target BIOS signature file into a BIOS chip to perform signature verification.

Optionally, the public key signature module includes:

the signature file acquisition unit includes:

Optionally, the secureflash signature module includes:

Optionally, the first BIOS file obtaining unit includes:

Optionally, the signature certificate file generation subunit includes:

Optionally, the second BIOS file obtaining unit includes:

Optionally, the fourth signature file acquisition subunit includes:

Optionally, the signature file generation module includes:

Optionally, the verification result obtaining unit includes:

Optionally, the signature file generation module includes:

The BIOS chip is arranged in the server.

According to the digital signature verification device, the customized target secure flash public key and the target secure flash private key, and the target bootguard public key and the target bootguard private key are obtained. And respectively carrying out digital signature on the secure flash public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure flash public key and the target bootguard public key to obtain a BIOS signature file. And based on the target secure flash private key, performing two-time digital signature on the target secure flash public key and the secure flash private key in the BIOS signature file to obtain a second BIOS signature file. And based on the target bootguard private key, digitally signing the bootguard private key in the second BIOS signature file to generate a target BIOS signature file, and writing the target BIOS signature file into the BIOS chip to perform signature verification. According to the embodiment of the application, the security characteristics of the secure flash and the BootGuard are combined, and the system software can be effectively prevented from being tampered and invaded through two times of digital signature, so that the security of a computer system is improved. Meanwhile, the secure flash has high security, can prevent data from being tampered and leaked, and the BootGuard technology can prevent illegal modification and malicious invasion of system software.

Additionally, the embodiment of the application also provides electronic equipment, which comprises: the digital signature verification system comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the computer program is executed by the processor to realize the digital signature verification method.

Fig. 5 shows a schematic structural diagram of an electronic device 500 according to an embodiment of the invention. As shown in fig. 5, the electronic device 500 includes a Central Processing Unit (CPU) 501 that can perform various suitable actions and processes in accordance with computer program instructions stored in a Read Only Memory (ROM) 502 or loaded from a storage unit 508 into a Random Access Memory (RAM) 503. In the RAM503, various programs and data required for the operation of the electronic device 500 may also be stored. The CPU501, ROM 502, and RAM503 are connected to each other through a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.

A number of components in electronic device 500 are connected to I/O interface 505, including: an input unit 506 such as a keyboard, mouse, microphone, etc.; an output unit 507 such as various types of displays, speakers, and the like; a storage unit 508 such as a magnetic disk, an optical disk, or the like; and a communication unit 509 such as a network card, modem, wireless communication transceiver, etc. The communication unit 509 allows the electronic device 500 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

The various processes and treatments described above may be performed by the processing unit 501. For example, the methods of any of the embodiments described above may be implemented as a computer software program tangibly embodied on a computer-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 500 via the ROM502 and/or the communication unit 509. When the computer program is loaded into RAM503 and executed by CPU501, one or more actions of the methods described above may be performed.

The embodiment of the application also provides a computer readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the processes of the digital signature verification method embodiment are implemented, and the same technical effects can be achieved, so that repetition is avoided, and no further description is provided here. Wherein the computer readable storage medium is selected from Read-Only Memory (ROM), random access Memory (Random Access Memory, RAM), magnetic disk or optical disk.

The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A digital signature verification method, the method comprising:

based on the target bootguard private key, digitally signing the bootguard private key in the second BIOS signature file to generate a target BIOS signature file, and writing the target BIOS signature file into a BIOS chip to perform signature verification;

the digital signature is respectively performed on the secure public key and the bootguard public key in the BIOS file in the BIOS chip based on the target secure public key and the target bootguard public key, to obtain a BIOS signature file, including:

Replacing the bootguard public key in the intermediate signature file with the target bootguard public key to complete digital signature of the bootguard public key, and obtaining the BIOS signature file;

the generating the target BIOS signature file based on the target bootguard private key and digitally signing the bootguard private key in the second BIOS signature file includes:

packaging the hash value of the successfully paired target bootguard public key with the intermediate file to obtain the target BIOS signature file;

writing the target BIOS signature file into a BIOS chip for signature verification, wherein the method comprises the following steps:

The BIOS chip is arranged in the server.

2. The method of claim 1, wherein the target bootguard public key comprises: the target bootguard hardware check public key and the target BIOS boot self-test public key,

3. The method according to claim 1, wherein the performing, based on the target secure flash private key, two digital signatures on the target secure flash public key and the secure flash private key in the BIOS signature file to obtain a second BIOS signature file includes:

4. The method of claim 3, wherein digitally signing the secure private key in the BIOS signature file based on the target secure private key to obtain a first BIOS signature file, comprising:

5. The method of claim 4, wherein the processing the secure flash private key signature information extracted from the first signature file to generate a signature certificate encoded file comprises:

6. The method of claim 3, wherein digitally signing the first BIOS signature file to obtain the second BIOS signature file comprises:

7. The method of claim 6, wherein the processing the separate file based on the target secure flash private key to obtain a fourth signature file comprises:

processing the separated file to obtain a second encryptor file;

8. The method of claim 1, wherein the generating the target BIOS signature file by digitally signing the bootguard private key in the second BIOS signature file based on the target bootguard private key comprises:

checking the second BIOS signature file to obtain a checking result;

9. The method of claim 8, wherein verifying the second BIOS signature file to obtain a verification result comprises:

10. A digital signature verification device, the device comprising:

the signature file generation module is used for carrying out digital signature on the bootguard private key in the second BIOS signature file based on the target bootguard private key to generate a target BIOS signature file, and writing the target BIOS signature file into a BIOS chip to carry out signature verification;

the public key signature module includes:

The signature file obtaining unit is used for replacing the bootguard public key in the intermediate signature file with the target bootguard public key so as to complete digital signature of the bootguard public key and obtain the BIOS signature file;

the signature file generation module comprises:

the target BIOS file obtaining unit is used for packaging the hash value of the successfully paired target bootguard public key and the intermediate file to obtain the target BIOS signature file;

the signature file generation module comprises:

The BIOS chip is arranged in the server.

11. An electronic device, comprising:

memory, a processor and a computer program stored on the memory and executable on the processor, which when executed by the processor implements the digital signature verification method according to any one of claims 1 to 9.

12. A readable storage medium, characterized in that instructions in the storage medium, when executed by a processor of an electronic device, enable the electronic device to perform the digital signature verification method of any one of claims 1 to 9.