diff --git a/device-activation-platform/Readme.md b/device-activation-platform/Readme.md index 2f67ba4..2360941 100644 --- a/device-activation-platform/Readme.md +++ b/device-activation-platform/Readme.md @@ -58,13 +58,16 @@ 首块网卡MAC地址 硬盘序列号 } - -设备指纹是设备指纹信息的 SM2 签名（pkcs1 格式）。 ~~设备指纹信息存储于文件 /home/tms/device/dev.info 文件，json 格式。~~ +设备指纹是设备指纹信息的 SM2 签名（pkcs1 格式）。 + 设备指纹存放于签名文件 /home/tms/device/dev.sign, pkcs1 格式。校验值 /home/tms/device/dev.sign.sm3。 设备指纹密钥公钥存储于文件 /home/tms/device/dev.fingerprint.pub, 公钥格式。校验值 /home/tms/device/dev.fingerprint.pub.sm3。 设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。 根证书校验证书 /home/tms/device/rootcert.sign -应用完整性公钥 /home/tms/device/dev.mac.pub, 公钥格式。校验值 /home/tms/device/dev.mac.pub.sm3。 \ No newline at end of file +应用完整性公钥 /home/tms/device/dev.mac.pub, 公钥格式。校验值 /home/tms/device/dev.mac.pub.sm3。 + +应用程序文件完整性校验文件列表 /home/tms/mac.list +应用完整性签名 /home/tms/device/dev.mac.sign \ No newline at end of file diff --git a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java index f2a3166..b5e3fbf 100644 --- a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java +++ b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java @@ -1,5 +1,6 @@ package com.sunyard.cisd.device.tool; +import java.io.File; import java.io.InputStream; import java.nio.charset.StandardCharsets; import java.security.PublicKey; @@ -14,15 +15,26 @@ public class Main { private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub"; private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3"; private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data"; - private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/sm2_fingerprint_private_key.pem"; - private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/sm2_fingerprint_public_key.pem"; - private static final String MAC_PRIVATE_KEY_PATH = "/sm2_mac_private_key.pem"; - private static final String MAC_PUBLIC_KEY_PATH = "/sm2_mac_public_key.pem"; + private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/fingerprint_sm2_private_key.pem"; + private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint_sm2_public_key.pem"; + private static final String MAC_PRIVATE_KEY_PATH = "/mac_sm2_private_key.pem"; + private static final String MAC_PUBLIC_KEY_PATH = "/mac_sm2_public_key.pem"; private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer"; private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer"; private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign"; private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub"; private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3"; + private static final String MAC_LIST_FILE = "/home/tms/mac.list"; + private static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign"; + + private static final String[] MAC_TARGETS = { + "/home/tms/tms-framework.jar", + "/home/tms/config", + "/home/tms/libs", + "/home/tms/web", + "/home/tms/bin", + "/home/tms/scripts/tms.sh" + }; public static void main(String[] args) { if (args.length == 0) { @@ -48,20 +60,10 @@ public class Main { verifyFingerprint(); break; case "mac-gen": - if (args.length < 3) { - System.err.println("错误: mac-gen 需要两个参数 - 文件夹路径 和 输出文件路径"); - System.out.println("用法: mac-gen <文件夹路径> <输出文件路径>"); - } else { - generateMAC(args[1], args[2]); - } + generateMAC(); break; case "mac-vertify": - if (args.length < 3) { - System.err.println("错误: mac-verify 需要两个参数 - 文件夹路径 和 SM3文件路径"); - System.out.println("用法: mac-verify <文件夹路径> "); - } else { - verifyMAC(args[1], args[2]); - } + verifyMAC(); break; case "rootcert-mac-gen": generateRootCertMAC(); @@ -88,8 +90,8 @@ public class Main { System.out.println(" info - 获取并显示设备信息"); System.out.println(" fingerprint-gen - 获取设备信息并生成设备指纹输出到文件"); System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹"); - System.out.println(" mac-gen <文件夹> <输出文件> - 对指定文件夹下所有文件计算SM3并输出到文件"); - System.out.println(" mac-vertify <文件夹> - 验证指定文件夹下所有文件的SM3值"); + System.out.println(" mac-gen - 生成系统文件MAC校验值并签名"); + System.out.println(" mac-vertify - 验证系统文件MAC校验值"); System.out.println(" rootcert-mac-gen - 生成根证书MAC签名"); System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名"); System.out.println(); @@ -193,29 +195,117 @@ public class Main { System.out.println("总体验证: " + (dataMatch && signatureVerified)); } - private static void generateMAC(String directoryPath, String outputFilePath) throws Exception { - System.out.println("正在计算文件夹 SM3: " + directoryPath); - Map sm3Map = SM3Util.calculateDirectorySM3(directoryPath); + private static void generateMAC() throws Exception { + System.out.println("=== 生成系统文件MAC校验值 ==="); + System.out.println("目标路径:"); + for (String target : MAC_TARGETS) { + System.out.println(" " + target); + } + + Map sm3Map = new java.util.LinkedHashMap<>(); - System.out.println("\n发现 " + sm3Map.size() + " 个文件:"); + for (String target : MAC_TARGETS) { + File file = new File(target); + if (!file.exists()) { + System.out.println("警告: 路径不存在 - " + target); + continue; + } + + if (file.isFile()) { + String sm3Value = SM3Util.sm3FileHex(target); + sm3Map.put(target, sm3Value); + System.out.println("文件: " + target + " -> " + sm3Value); + } else if (file.isDirectory()) { + Map dirSm3Map = SM3Util.calculateDirectorySM3(target); + for (Map.Entry entry : dirSm3Map.entrySet()) { + String absolutePath = target + "/" + entry.getKey(); + sm3Map.put(absolutePath, entry.getValue()); + System.out.println("文件: " + absolutePath + " -> " + entry.getValue()); + } + } + } + + StringBuilder macListContent = new StringBuilder(); for (Map.Entry entry : sm3Map.entrySet()) { - System.out.println(" " + entry.getKey() + " : " + entry.getValue()); + macListContent.append(entry.getKey()).append("|").append(entry.getValue()).append("\n"); } - SM3Util.writeSM3File(sm3Map, outputFilePath); - System.out.println("\nSM3 文件已保存: " + outputFilePath); + SM3Util.writeFile(MAC_LIST_FILE, macListContent.toString()); + System.out.println("\nMAC列表文件已保存: " + MAC_LIST_FILE); + + byte[] signature = SM2Util.sign(macListContent.toString().getBytes(StandardCharsets.UTF_8), MAC_PRIVATE_KEY_PATH); + SM3Util.writeFile(MAC_SIGN_FILE, signature); + System.out.println("MAC签名文件已保存: " + MAC_SIGN_FILE); + + PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + boolean verified = SM2Util.verify(macListContent.toString().getBytes(StandardCharsets.UTF_8), signature, publicKey); + System.out.println("\n签名验证结果: " + verified); } - private static void verifyMAC(String directoryPath, String sm3FilePath) throws Exception { - System.out.println("正在验证文件夹 SM3: " + directoryPath); - System.out.println("使用 SM3 文件: " + sm3FilePath); - System.out.println(); + private static void verifyMAC() throws Exception { + System.out.println("=== 验证系统文件MAC校验值 ==="); + + PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE); + String savedMacList = SM3Util.readFile(MAC_LIST_FILE); + + boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey); + System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败")); - boolean verified = SM3Util.verifyDirectorySM3(directoryPath, sm3FilePath); + if (!macListSignatureValid) { + System.out.println("错误: mac.list 签名验证失败，可能被篡改！"); + System.out.println("\n=== 验证结果 ==="); + System.out.println("完整性验证: false"); + return; + } + + Map savedSm3Map = SM3Util.readSM3File(MAC_LIST_FILE); + Map currentSm3Map = new java.util.LinkedHashMap<>(); + for (String target : MAC_TARGETS) { + File file = new File(target); + if (!file.exists()) { + continue; + } + + if (file.isFile()) { + String sm3Value = SM3Util.sm3FileHex(target); + currentSm3Map.put(target, sm3Value); + } else if (file.isDirectory()) { + Map dirSm3Map = SM3Util.calculateDirectorySM3(target); + for (Map.Entry entry : dirSm3Map.entrySet()) { + String absolutePath = target + "/" + entry.getKey(); + currentSm3Map.put(absolutePath, entry.getValue()); + } + } + } + + boolean allMatch = true; + + for (Map.Entry entry : savedSm3Map.entrySet()) { + String filePath = entry.getKey(); + String savedHash = entry.getValue(); + String currentHash = currentSm3Map.get(filePath); + + if (currentHash == null) { + System.out.println("文件缺失: " + filePath); + allMatch = false; + } else if (!savedHash.equals(currentHash)) { + System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")"); + allMatch = false; + } + } + + for (String filePath : currentSm3Map.keySet()) { + if (!savedSm3Map.containsKey(filePath)) { + System.out.println("新增文件: " + filePath); + allMatch = false; + } + } + System.out.println(); System.out.println("=== 验证结果 ==="); - System.out.println("完整性验证: " + verified); + System.out.println("完整性验证: " + allMatch); } private static void generateRootCertMAC() throws Exception {