Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

整理名字

Browse Source
This commit is contained in:
cheney 2026-05-14 17:09:09 +08:00
parent ee8c42dc8e
commit 75150831c3
2 changed files with 127 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
device-activation-platform/Readme.md
View File

@ -58,13 +58,16 @@
首块网卡MAC地址 首块网卡MAC地址
硬盘序列号 硬盘序列号
} }
设备指纹是设备指纹信息的 SM2 签名（pkcs1 格式）。
~~设备指纹信息存储于文件 /home/tms/device/dev.info 文件，json 格式。~~ ~~设备指纹信息存储于文件 /home/tms/device/dev.info 文件，json 格式。~~
设备指纹是设备指纹信息的 SM2 签名（pkcs1 格式）。
设备指纹存放于签名文件 /home/tms/device/dev.sign, pkcs1 格式。校验值 /home/tms/device/dev.sign.sm3。 设备指纹存放于签名文件 /home/tms/device/dev.sign, pkcs1 格式。校验值 /home/tms/device/dev.sign.sm3。
设备指纹密钥公钥存储于文件 /home/tms/device/dev.fingerprint.pub, 公钥格式。校验值 /home/tms/device/dev.fingerprint.pub.sm3。 设备指纹密钥公钥存储于文件 /home/tms/device/dev.fingerprint.pub, 公钥格式。校验值 /home/tms/device/dev.fingerprint.pub.sm3。
设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。 设备激活密钥公钥存储于文件 /home/tms/device/dev.active.pub, 公钥格式。校验值 /home/tms/device/dev.active.pub.sm3。
根证书校验证书 /home/tms/device/rootcert.sign 根证书校验证书 /home/tms/device/rootcert.sign
应用完整性公钥 /home/tms/device/dev.mac.pub, 公钥格式。校验值 /home/tms/device/dev.mac.pub.sm3。 应用完整性公钥 /home/tms/device/dev.mac.pub, 公钥格式。校验值 /home/tms/device/dev.mac.pub.sm3。
应用程序文件完整性校验文件列表 /home/tms/mac.list
应用完整性签名 /home/tms/device/dev.mac.sign

152
device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java
View File

@ -1,5 +1,6 @@
package com.sunyard.cisd.device.tool; package com.sunyard.cisd.device.tool;
import java.io.File;
import java.io.InputStream; import java.io.InputStream;
import java.nio.charset.StandardCharsets; import java.nio.charset.StandardCharsets;
import java.security.PublicKey; import java.security.PublicKey;
@ -14,15 +15,26 @@ public class Main {
private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub"; private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub";
private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3"; private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3";
private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data"; private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data";
private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/sm2_fingerprint_private_key.pem"; private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/fingerprint_sm2_private_key.pem";
private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/sm2_fingerprint_public_key.pem"; private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint_sm2_public_key.pem";
private static final String MAC_PRIVATE_KEY_PATH = "/sm2_mac_private_key.pem"; private static final String MAC_PRIVATE_KEY_PATH = "/mac_sm2_private_key.pem";
private static final String MAC_PUBLIC_KEY_PATH = "/sm2_mac_public_key.pem"; private static final String MAC_PUBLIC_KEY_PATH = "/mac_sm2_public_key.pem";
private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer"; private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer";
private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer"; private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer";
private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign"; private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign";
private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub"; private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub";
private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3"; private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3";
private static final String MAC_LIST_FILE = "/home/tms/mac.list";
private static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign";
private static final String[] MAC_TARGETS = {
"/home/tms/tms-framework.jar",
"/home/tms/config",
"/home/tms/libs",
"/home/tms/web",
"/home/tms/bin",
"/home/tms/scripts/tms.sh"
};
public static void main(String[] args) { public static void main(String[] args) {
if (args.length == 0) { if (args.length == 0) {
@ -48,20 +60,10 @@ public class Main {
verifyFingerprint(); verifyFingerprint();
break; break;
case "mac-gen": case "mac-gen":
if (args.length < 3) { generateMAC();
System.err.println("错误: mac-gen 需要两个参数 - 文件夹路径 和 输出文件路径");
System.out.println("用法: mac-gen <文件夹路径> <输出文件路径>");
} else {
generateMAC(args[1], args[2]);
}
break; break;
case "mac-vertify": case "mac-vertify":
if (args.length < 3) { verifyMAC();
System.err.println("错误: mac-verify 需要两个参数 - 文件夹路径 和 SM3文件路径");
System.out.println("用法: mac-verify <文件夹路径> <SM3文件路径>");
} else {
verifyMAC(args[1], args[2]);
}
break; break;
case "rootcert-mac-gen": case "rootcert-mac-gen":
generateRootCertMAC(); generateRootCertMAC();
@ -88,8 +90,8 @@ public class Main {
System.out.println(" info - 获取并显示设备信息"); System.out.println(" info - 获取并显示设备信息");
System.out.println(" fingerprint-gen - 获取设备信息并生成设备指纹输出到文件"); System.out.println(" fingerprint-gen - 获取设备信息并生成设备指纹输出到文件");
System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹"); System.out.println(" fingerprint-vertify - 获取设备信息并验证设备指纹");
System.out.println(" mac-gen <文件夹> <输出文件> - 对指定文件夹下所有文件计算SM3并输出到文件"); System.out.println(" mac-gen - 生成系统文件MAC校验值并签名");
System.out.println(" mac-vertify <文件夹> <SM3文件> - 验证指定文件夹下所有文件的SM3值"); System.out.println(" mac-vertify - 验证系统文件MAC校验值");
System.out.println(" rootcert-mac-gen - 生成根证书MAC签名"); System.out.println(" rootcert-mac-gen - 生成根证书MAC签名");
System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名"); System.out.println(" rootcert-mac-vertify - 验证根证书MAC签名");
System.out.println(); System.out.println();
@ -193,29 +195,117 @@ public class Main {
System.out.println("总体验证: " + (dataMatch && signatureVerified)); System.out.println("总体验证: " + (dataMatch && signatureVerified));
} }
private static void generateMAC(String directoryPath, String outputFilePath) throws Exception { private static void generateMAC() throws Exception {
System.out.println("正在计算文件夹 SM3: " + directoryPath); System.out.println("=== 生成系统文件MAC校验值 ===");
Map<String, String> sm3Map = SM3Util.calculateDirectorySM3(directoryPath); System.out.println("目标路径:");
for (String target : MAC_TARGETS) {
System.out.println(" " + target);
}
Map<String, String> sm3Map = new java.util.LinkedHashMap<>();
System.out.println("\n发现 " + sm3Map.size() + " 个文件:"); for (String target : MAC_TARGETS) {
File file = new File(target);
if (!file.exists()) {
System.out.println("警告: 路径不存在 - " + target);
continue;
}
if (file.isFile()) {
String sm3Value = SM3Util.sm3FileHex(target);
sm3Map.put(target, sm3Value);
System.out.println("文件: " + target + " -> " + sm3Value);
} else if (file.isDirectory()) {
Map<String, String> dirSm3Map = SM3Util.calculateDirectorySM3(target);
for (Map.Entry<String, String> entry : dirSm3Map.entrySet()) {
String absolutePath = target + "/" + entry.getKey();
sm3Map.put(absolutePath, entry.getValue());
System.out.println("文件: " + absolutePath + " -> " + entry.getValue());
}
}
}
StringBuilder macListContent = new StringBuilder();
for (Map.Entry<String, String> entry : sm3Map.entrySet()) { for (Map.Entry<String, String> entry : sm3Map.entrySet()) {
System.out.println(" " + entry.getKey() + " : " + entry.getValue()); macListContent.append(entry.getKey()).append("|").append(entry.getValue()).append("\n");
} }
SM3Util.writeSM3File(sm3Map, outputFilePath); SM3Util.writeFile(MAC_LIST_FILE, macListContent.toString());
System.out.println("\nSM3 文件已保存: " + outputFilePath); System.out.println("\nMAC列表文件已保存: " + MAC_LIST_FILE);
byte[] signature = SM2Util.sign(macListContent.toString().getBytes(StandardCharsets.UTF_8), MAC_PRIVATE_KEY_PATH);
SM3Util.writeFile(MAC_SIGN_FILE, signature);
System.out.println("MAC签名文件已保存: " + MAC_SIGN_FILE);
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
boolean verified = SM2Util.verify(macListContent.toString().getBytes(StandardCharsets.UTF_8), signature, publicKey);
System.out.println("\n签名验证结果: " + verified);
} }
private static void verifyMAC(String directoryPath, String sm3FilePath) throws Exception { private static void verifyMAC() throws Exception {
System.out.println("正在验证文件夹 SM3: " + directoryPath); System.out.println("=== 验证系统文件MAC校验值 ===");
System.out.println("使用 SM3 文件: " + sm3FilePath);
System.out.println(); PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE);
String savedMacList = SM3Util.readFile(MAC_LIST_FILE);
boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
boolean verified = SM3Util.verifyDirectorySM3(directoryPath, sm3FilePath); if (!macListSignatureValid) {
System.out.println("错误: mac.list 签名验证失败，可能被篡改！");
System.out.println("\n=== 验证结果 ===");
System.out.println("完整性验证: false");
return;
}
Map<String, String> savedSm3Map = SM3Util.readSM3File(MAC_LIST_FILE);
Map<String, String> currentSm3Map = new java.util.LinkedHashMap<>();
for (String target : MAC_TARGETS) {
File file = new File(target);
if (!file.exists()) {
continue;
}
if (file.isFile()) {
String sm3Value = SM3Util.sm3FileHex(target);
currentSm3Map.put(target, sm3Value);
} else if (file.isDirectory()) {
Map<String, String> dirSm3Map = SM3Util.calculateDirectorySM3(target);
for (Map.Entry<String, String> entry : dirSm3Map.entrySet()) {
String absolutePath = target + "/" + entry.getKey();
currentSm3Map.put(absolutePath, entry.getValue());
}
}
}
boolean allMatch = true;
for (Map.Entry<String, String> entry : savedSm3Map.entrySet()) {
String filePath = entry.getKey();
String savedHash = entry.getValue();
String currentHash = currentSm3Map.get(filePath);
if (currentHash == null) {
System.out.println("文件缺失: " + filePath);
allMatch = false;
} else if (!savedHash.equals(currentHash)) {
System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
allMatch = false;
}
}
for (String filePath : currentSm3Map.keySet()) {
if (!savedSm3Map.containsKey(filePath)) {
System.out.println("新增文件: " + filePath);
allMatch = false;
}
}
System.out.println(); System.out.println();
System.out.println("=== 验证结果 ==="); System.out.println("=== 验证结果 ===");
System.out.println("完整性验证: " + verified); System.out.println("完整性验证: " + allMatch);
} }
private static void generateRootCertMAC() throws Exception { private static void generateRootCertMAC() throws Exception {