From cd690bd2d942b1e8e858fe7d7bf3f287de95eebb Mon Sep 17 00:00:00 2001 From: cheney Date: Fri, 15 May 2026 14:37:35 +0800 Subject: [PATCH] =?UTF-8?q?=E7=BB=88=E7=AB=AF=E7=AE=A1=E7=90=86=E7=B3=BB?= =?UTF-8?q?=E7=BB=9F=E4=B8=BB=E7=A8=8B=E5=BA=8F=E5=AE=8C=E6=95=B4=E6=80=A7?= =?UTF-8?q?=E8=87=AA=E6=A3=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- device-fingerprint-tool/pom.xml | 2 +- .../com/sunyard/cisd/device/tool/Main.java | 16 +-- pom.xml | 2 +- .../service/impl/SelfCheckServiceImpl.java | 115 +++++++++++++++++- 4 files changed, 123 insertions(+), 12 deletions(-) diff --git a/device-fingerprint-tool/pom.xml b/device-fingerprint-tool/pom.xml index 76be577..546f370 100644 --- a/device-fingerprint-tool/pom.xml +++ b/device-fingerprint-tool/pom.xml @@ -6,7 +6,7 @@ com.sunyard.cisd device-fingerprint-tool - 1.0.0 + 1.0.1 device-fingerprint-tool 设备指纹信息获取工具 diff --git a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java index db27117..f22f5d5 100644 --- a/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java +++ b/device-fingerprint-tool/src/main/java/com/sunyard/cisd/device/tool/Main.java @@ -10,24 +10,24 @@ import java.util.Map; public class Main { private static final String DEVICE_DIR = "/home/tms/device"; - private static final String SIGN_FILE = DEVICE_DIR + "/dev.sign"; + public static final String SIGN_FILE = DEVICE_DIR + "/dev.sign"; private static final String SIGN_SM3_FILE = DEVICE_DIR + "/dev.sign.sm3"; private static final String PUBLIC_KEY_FILE = DEVICE_DIR + "/dev.fingerprint.pub"; private static final String PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.fingerprint.pub.sm3"; - private static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data"; + public static final String FINGERPRINT_DATA_FILE = DEVICE_DIR + "/dev.fingerprint.data"; private static final String FINGERPRINT_PRIVATE_KEY_PATH = "/fingerprint_sm2_private_key.pem"; - private static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint_sm2_public_key.pem"; + public static final String FINGERPRINT_PUBLIC_KEY_PATH = "/fingerprint_sm2_public_key.pem"; private static final String MAC_PRIVATE_KEY_PATH = "/mac_sm2_private_key.pem"; - private static final String MAC_PUBLIC_KEY_PATH = "/mac_sm2_public_key.pem"; + public static final String MAC_PUBLIC_KEY_PATH = "/mac_sm2_public_key.pem"; private static final String ROOT_CERT_FILE = "/CFCA_TEST_CS_SM2_CA.cer"; private static final String ROOT_CERT_OUTPUT_FILE = DEVICE_DIR + "/CFCA_TEST_CS_SM2_CA.cer"; private static final String ROOT_CERT_SIGN_FILE = DEVICE_DIR + "/rootcert.sign"; private static final String MAC_PUBLIC_KEY_OUTPUT_FILE = DEVICE_DIR + "/dev.mac.pub"; private static final String MAC_PUBLIC_KEY_SM3_FILE = DEVICE_DIR + "/dev.mac.pub.sm3"; - private static final String MAC_LIST_FILE = "/home/tms/mac.list"; - private static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign"; + public static final String MAC_LIST_FILE = "/home/tms/mac.list"; + public static final String MAC_SIGN_FILE = DEVICE_DIR + "/dev.mac.sign"; - private static final String[] MAC_TARGETS = { + public static final String[] MAC_TARGETS = { "/home/tms/tms-framework.jar", "/home/tms/config", "/home/tms/libs", @@ -111,7 +111,7 @@ public class Main { System.out.println("硬盘序列号: " + fingerprint.getHardDiskSerialNumber()); } - private static String buildPlainText(DeviceFingerprint fingerprint) { + public static String buildPlainText(DeviceFingerprint fingerprint) { return fingerprint.getMotherboardSerialNumber() + fingerprint.getDeviceSerialNumber() + fingerprint.getCpuModel() + diff --git a/pom.xml b/pom.xml index ef7d946..3b7d717 100644 --- a/pom.xml +++ b/pom.xml @@ -119,7 +119,7 @@ com.sunyard.cisd device-fingerprint-tool - 1.0.0 + 1.0.1 diff --git a/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java b/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java index dd38a91..18c70f2 100644 --- a/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java +++ b/src/main/java/com/cisd/tms/modules/system/service/impl/SelfCheckServiceImpl.java @@ -2,12 +2,22 @@ package com.cisd.tms.modules.system.service.impl; import com.cisd.tms.modules.system.dto.SelfCheckResult; import com.cisd.tms.modules.system.service.SelfCheckService; +import com.sunyard.cisd.device.tool.DeviceFingerprint; +import com.sunyard.cisd.device.tool.DeviceFingerprintService; +import com.sunyard.cisd.device.tool.SM2Util; +import com.sunyard.cisd.device.tool.SM3Util; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Service; +import java.io.File; +import java.nio.charset.StandardCharsets; +import java.security.PublicKey; import java.util.ArrayList; import java.util.List; +import java.util.Map; + +import static com.sunyard.cisd.device.tool.Main.*; @Service public class SelfCheckServiceImpl implements SelfCheckService { @@ -129,11 +139,112 @@ public class SelfCheckServiceImpl implements SelfCheckService { } private boolean doVerifyDeviceFingerprint() { - return false; + try { + DeviceFingerprintService service = new DeviceFingerprintService(); + DeviceFingerprint fingerprint = service.getDeviceFingerprint(); + + log.info("=== 当前设备信息 ==="); + log.info("主板序列号: " + fingerprint.getMotherboardSerialNumber()); + log.info("设备序列号: " + fingerprint.getDeviceSerialNumber()); + log.info("CPU型号: " + fingerprint.getCpuModel()); + log.info("CPU序列号: " + fingerprint.getCpuSerialNumber()); + log.info("内存大小: " + fingerprint.getMemorySize()); + log.info("首块网卡MAC地址: " + fingerprint.getFirstNetworkMacAddress()); + log.info("硬盘序列号: " + fingerprint.getHardDiskSerialNumber()); + + String plainText = buildPlainText(fingerprint); + log.info("\n当前拼接原文: " + plainText); + + String savedPlainText = SM3Util.readFile(FINGERPRINT_DATA_FILE).trim(); + log.info("保存的拼接原文: " + savedPlainText); + + byte[] signature = SM3Util.readFileBytes(SIGN_FILE); + PublicKey publicKey = SM2Util.loadPublicKey(FINGERPRINT_PUBLIC_KEY_PATH); + + boolean dataMatch = plainText.equals(savedPlainText); + boolean signatureVerified = SM2Util.verify(savedPlainText.getBytes(StandardCharsets.UTF_8), signature, publicKey); + + log.info("\n=== 验证结果 ==="); + log.info("设备信息匹配: " + dataMatch); + log.info("签名验证: " + signatureVerified); + log.info("总体验证: " + (dataMatch && signatureVerified)); + return (dataMatch && signatureVerified); + } catch (Exception e) { + log.error("[ERROR] {} - {}", CHECK_DEVICE_FINGERPRINT, e.getMessage()); + return false; + } } private boolean doVerifyTmsIntegrity() { - return false; + try { + System.out.println("=== 验证系统文件MAC校验值 ==="); + + PublicKey publicKey = SM2Util.loadPublicKey(MAC_PUBLIC_KEY_PATH); + byte[] savedSignature = SM3Util.readFileBytes(MAC_SIGN_FILE); + String savedMacList = SM3Util.readFile(MAC_LIST_FILE); + + boolean macListSignatureValid = SM2Util.verify(savedMacList.getBytes(StandardCharsets.UTF_8), savedSignature, publicKey); + System.out.println("MAC列表签名验证: " + (macListSignatureValid ? "通过" : "失败")); + + if (!macListSignatureValid) { + System.out.println("错误: mac.list 签名验证失败，可能被篡改！"); + System.out.println("\n=== 验证结果 ==="); + System.out.println("完整性验证: false"); + return false; + } + + Map savedSm3Map = SM3Util.readSM3File(MAC_LIST_FILE); + + Map currentSm3Map = new java.util.LinkedHashMap<>(); + for (String target : MAC_TARGETS) { + File file = new File(target); + if (!file.exists()) { + continue; + } + + if (file.isFile()) { + String sm3Value = SM3Util.sm3FileHex(target); + currentSm3Map.put(target, sm3Value); + } else if (file.isDirectory()) { + Map dirSm3Map = SM3Util.calculateDirectorySM3(target); + for (Map.Entry entry : dirSm3Map.entrySet()) { + String absolutePath = target + "/" + entry.getKey(); + currentSm3Map.put(absolutePath, entry.getValue()); + } + } + } + + boolean allMatch = true; + + for (Map.Entry entry : savedSm3Map.entrySet()) { + String filePath = entry.getKey(); + String savedHash = entry.getValue(); + String currentHash = currentSm3Map.get(filePath); + + if (currentHash == null) { + System.out.println("文件缺失: " + filePath); + allMatch = false; + } else if (!savedHash.equals(currentHash)) { + System.out.println("文件被修改: " + filePath + " (期望: " + savedHash + ", 实际: " + currentHash + ")"); + allMatch = false; + } + } + + for (String filePath : currentSm3Map.keySet()) { + if (!savedSm3Map.containsKey(filePath)) { + System.out.println("新增文件: " + filePath); + allMatch = false; + } + } + + System.out.println(); + System.out.println("=== 验证结果 ==="); + System.out.println("完整性验证: " + allMatch); + return allMatch; + } catch (Exception e) { + log.error("[ERROR] {} - {}", CHECK_TMS_INTEGRITY, e.getMessage()); + return false; + } } private boolean doVerifyStandardTransceiverIntegrity() {