Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

终端管理系统主程序完整性自检

Browse Source
This commit is contained in:
cheney 2026-05-15 14:37:35 +08:00
parent 546bf5f240
commit cd690bd2d9
4 changed files with 123 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
device-fingerprint-tool/pom.xml
View File

@ -6,7 +6,7 @@
<groupId>com.sunyard.cisd</groupId>
<artifactId>device-fingerprint-tool</artifactId>
<version>1.0.0</version>
<version>1.0.1</version>
<name>device-fingerprint-tool</name>
<description>设备指纹信息获取工具</description>

16
device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java
View File

@ -10,24 +10,24 @@ import java.util.Map;
public class Main {
private static final String DEVICE_DIR = "/home/tms/device";
private static final String SIGN_FILE = DEVICE_DIR + "/dev.sign";
public static final String SIGN_FILE = DEVICE_DIR + "/dev.sign";
private static final String SIGN_SM3_FILE = DEVICE_DIR + "/dev.sign.sm3";
private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub";
private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3";
private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data";
public static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data";
private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/fingerprint_sm2_private_key.pem";
private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint_sm2_public_key.pem";
public static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint_sm2_public_key.pem";
private static final String MAC_PRIVATE_KEY_PATH = "/mac_sm2_private_key.pem";
private static final String MAC_PUBLIC_KEY_PATH = "/mac_sm2_public_key.pem";
public static final String MAC_PUBLIC_KEY_PATH = "/mac_sm2_public_key.pem";
private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer";
private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer";
private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign";
private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub";
private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3";
private static final String MAC_LIST_FILE = "/home/tms/mac.list";
private static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign";
public static final String MAC_LIST_FILE = "/home/tms/mac.list";
public static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign";
private static final String[] MAC_TARGETS = {
public static final String[] MAC_TARGETS = {
"/home/tms/tms-framework.jar",
"/home/tms/config",
"/home/tms/libs",
@ -111,7 +111,7 @@ public class Main {
System.out.println("硬盘序列号: " + fingerprint.getHardDiskSerialNumber());
}
private static String buildPlainText(DeviceFingerprint fingerprint) {
public static String buildPlainText(DeviceFingerprint fingerprint) {
return fingerprint.getMotherboardSerialNumber() +
fingerprint.getDeviceSerialNumber() +
fingerprint.getCpuModel() +

2
pom.xml
View File

@ -119,7 +119,7 @@
<dependency>
<groupId>com.sunyard.cisd</groupId>
<artifactId>device-fingerprint-tool</artifactId>
<version>1.0.0</version>
<version>1.0.1</version>
</dependency>
</dependencies>

115
src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java
View File

@ -2,12 +2,22 @@ package com.cisd.tms.modules.system.service.impl;
import com.cisd.tms.modules.system.dto.SelfCheckResult;
import com.cisd.tms.modules.system.service.SelfCheckService;
import com.sunyard.cisd.device.tool.DeviceFingerprint;
import com.sunyard.cisd.device.tool.DeviceFingerprintService;
import com.sunyard.cisd.device.tool.SM2Util;
import com.sunyard.cisd.device.tool.SM3Util;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Service;
import java.io.File;
import java.nio.charset.StandardCharsets;
import java.security.PublicKey;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import static com.sunyard.cisd.device.tool.Main.*;
@Service
public class SelfCheckServiceImpl implements SelfCheckService {
@ -129,11 +139,112 @@ public class SelfCheckServiceImpl implements SelfCheckService {
}
private boolean doVerifyDeviceFingerprint() {
return false;
try {
DeviceFingerprintService service = new DeviceFingerprintService();
DeviceFingerprint fingerprint = service.getDeviceFingerprint();
log.info("=== 当前设备信息 ===");
log.info("主板序列号: " + fingerprint.getMotherboardSerialNumber());
log.info("设备序列号: " + fingerprint.getDeviceSerialNumber());
log.info("CPU型号: " + fingerprint.getCpuModel());
log.info("CPU序列号: " + fingerprint.getCpuSerialNumber());
log.info("内存大小: " + fingerprint.getMemorySize());
log.info("首块网卡MAC地址: " + fingerprint.getFirstNetworkMacAddress());
log.info("硬盘序列号: " + fingerprint.getHardDiskSerialNumber());
String plainText = buildPlainText(fingerprint);
log.info("\n当前拼接原文: " + plainText);
String savedPlainText = SM3Util.readFile(FINGERPRINT_DATA_FILE).trim();
log.info("保存的拼接原文: " + savedPlainText);
byte[] signature = SM3Util.readFileBytes(SIGN_FILE);
PublicKey publicKey = SM2Util.loadPublicKey(FINGERPRINT_PUBLIC_KEY_PATH);
boolean dataMatch = plainText.equals(savedPlainText);
boolean signatureVerified = SM2Util.verify(savedPlainText.getBytes(StandardCharsets.UTF_8), signature, publicKey);
log.info("\n=== 验证结果 ===");
log.info("设备信息匹配: " + dataMatch);
log.info("签名验证: " + signatureVerified);
log.info("总体验证: " + (dataMatch && signatureVerified));
return (dataMatch && signatureVerified);
} catch (Exception e) {
log.error("[ERROR] {} - {}", CHECK_DEVICE_FINGERPRINT, e.getMessage());
return false;
}
}
private boolean doVerifyTmsIntegrity() {
return false;
try {
System.out.println("=== 验证系统文件MAC校验值 ===");
PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH);
byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE);
String savedMacList = SM3Util.readFile(MAC_LIST_FILE);
boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey);
System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败"));
if (!macListSignatureValid) {
System.out.println("错误: mac.list 签名验证失败，可能被篡改！");
System.out.println("\n=== 验证结果 ===");
System.out.println("完整性验证: false");
return false;
}
Map<String, String> savedSm3Map = SM3Util.readSM3File(MAC_LIST_FILE);
Map<String, String> currentSm3Map = new java.util.LinkedHashMap<>();
for (String target : MAC_TARGETS) {
File file = new File(target);
if (!file.exists()) {
continue;
}
if (file.isFile()) {
String sm3Value = SM3Util.sm3FileHex(target);
currentSm3Map.put(target, sm3Value);
} else if (file.isDirectory()) {
Map<String, String> dirSm3Map = SM3Util.calculateDirectorySM3(target);
for (Map.Entry<String, String> entry : dirSm3Map.entrySet()) {
String absolutePath = target + "/" + entry.getKey();
currentSm3Map.put(absolutePath, entry.getValue());
}
}
}
boolean allMatch = true;
for (Map.Entry<String, String> entry : savedSm3Map.entrySet()) {
String filePath = entry.getKey();
String savedHash = entry.getValue();
String currentHash = currentSm3Map.get(filePath);
if (currentHash == null) {
System.out.println("文件缺失: " + filePath);
allMatch = false;
} else if (!savedHash.equals(currentHash)) {
System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")");
allMatch = false;
}
}
for (String filePath : currentSm3Map.keySet()) {
if (!savedSm3Map.containsKey(filePath)) {
System.out.println("新增文件: " + filePath);
allMatch = false;
}
}
System.out.println();
System.out.println("=== 验证结果 ===");
System.out.println("完整性验证: " + allMatch);
return allMatch;
} catch (Exception e) {
log.error("[ERROR] {} - {}", CHECK_TMS_INTEGRITY, e.getMessage());
return false;
}
}
private boolean doVerifyStandardTransceiverIntegrity() {