物联网固件签名与版本门禁（哈希/ES256/窗口）最佳实践

背景与价值固件是设备可信根。统一签名与版本门禁可防止篡改与回滚，并确保升级过程平滑。统一规范哈希与签名：统一 `SHA-256` 哈希与 `ES256` 签名校验。版本门禁：仅允许高于当前版本且在窗口内的版本。升级窗口：在窗口期允许回滚一次用于容错，超出拒绝。核心实现哈希与签名校验function b64(b: ArrayBuffer): string { const u = new Uint8Array(b); let s=''; for (let i=0;i<u.length;i++) s+=String.fromCharCode(u[i]); return btoa(s).replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,'') } async function sha256(buf: ArrayBuffer): Promise<string> { const d = await crypto.subtle.digest('SHA-256', buf); return b64(d) } async function importPublicKey(spki: ArrayBuffer): Promise<CryptoKey> { return crypto.subtle.importKey('spki', spki, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']) } async function verifySig(key: CryptoKey, payload: string, sigB64: string): Promise<boolean> { const sig = Uint8Array.from(atob(sigB64.replace(/-/g,'+').replace(/_/g,'/')), c => c.charCodeAt(0)).buffer; return crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, sig, new TextEncoder().encode(payload)) } 版本门禁与窗口type Meta = { version: string; hash: string; sig: string } function cmp(a: string, b: string): number { const pa = a.split('.').map(Number); const pb = b.split('.').map(Number); for (let i=0;i<Math.max(pa.length,pb.length);i++) { const x = pa[i]||0; const y = pb[i]||0; if (x!==y) return x-y } return 0 } type Device = { current: string; windowUntil: number; rollbackUsed?: boolean } function withinWindow(d: Device): boolean { return Date.now() <= d.windowUntil } function allowedVersion(d: Device, next: string): boolean { const c = cmp(next, d.current); if (c > 0) return true; if (c < 0 && withinWindow(d) && !d.rollbackUsed) return true; return false } 升级校验async function canUpgrade(dev: Device, meta: Meta, fwBuf: ArrayBuffer, pub: CryptoKey): Promise<boolean> { const h = await sha256(fwBuf) if (h !== meta.hash) return false const ok = await verifySig(pub, meta.hash + '|' + meta.version, meta.sig) if (!ok) return false return allowedVersion(dev, meta.version) } 落地建议固件发布统一生成哈希与签名，设备端严格校验与版本门禁。设置升级窗口以允许一次性容错回滚，超出窗口拒绝回滚。验证清单固件哈希与签名是否匹配；版本是否符合门禁与窗口策略。