CN106169054A - Access control method based on trusted state - Google Patents
Access control method based on trusted state Download PDFInfo
- Publication number
- CN106169054A CN106169054A CN201610548788.9A CN201610548788A CN106169054A CN 106169054 A CN106169054 A CN 106169054A CN 201610548788 A CN201610548788 A CN 201610548788A CN 106169054 A CN106169054 A CN 106169054A
- Authority
- CN
- China
- Prior art keywords
- access
- main frame
- access control
- resource
- method based
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 29
- 238000012797 qualification Methods 0.000 claims abstract description 7
- 238000012795 verification Methods 0.000 abstract description 5
- 238000005259 measurement Methods 0.000 abstract 1
- 230000002155 anti-virotic effect Effects 0.000 description 2
- 230000007123 defense Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses an access control method based on a trusted state, which collects the measurement information of the code or configuration information of a key program in the starting process of a host as the verification condition of access resources by utilizing the hardware of a TPM chip. The invention adds the verification of the credible state of the host in the traditional access control technology, refuses to access the key resources in the intranet once the credible state of the host is damaged, and ensures that only the credible host has the qualification of accessing the key resources under the intranet environment by using the hardware characteristic of the TPM chip as the verification condition of accessing the resources.
Description
Technical field
The present invention relates to field of information security technology, be specifically related to a kind of access control method based on trusted status, especially
It is the protection of core resource under corporate intranet environment.
Background technology
Along with the development of hacking technique, target of attack by traditional operating system, application turned to BIOS,
The aspects such as BootLoader.Now, the mean of defense such as antivirus software, fire wall is the most not actuated, as RootKit, BootKit attack
Hitting, attack and once go smoothly, rogue program, by obtaining the priority identical with system, therefore can hide the killing of antivirus software.
Privacy information on main frame can be caused threat greatly, meanwhile, if corporate intranet linked by this main frame, maliciously journey by this attack
Sequence once obtains core resource or the data of enterprise, and enterprise will face massive losses.
Summary of the invention
The technical problem to be solved in the present invention is: the present invention is directed to problem above, it is provided that a kind of visit based on trusted status
Ask control method, traditional access control technology adds the checking of main frame trusted status, once finds the trusted status of main frame
Destroyed, i.e. refuse it and access the keystone resources in Intranet.
The technical solution adopted in the present invention is:
A kind of access control method based on trusted status, described method, by utilizing the hardware of TPM chip, collects host-initiated
During the code of key procedure or the metric of configuration information, as accessing the verification condition of resource, lower of Intranet environment
Trusted host is had to have the qualification of access critical resource；
Described main frame in start-up course by the metric (i.e. critical component code or the cryptographic Hash of configuration file) of critical component
Extend to the PCR(Platform Configuration Register in TPM chip, platform configuration register) in, access enterprise
During industry keystone resources, accessing control node and issue reliable information request extremely calculating master agent program, Agent obtains and deposits
Reliable information in PCR sends to accessing control node, accesses and controls node by itself and the credible shape left in white list
State comparison, it is judged that whether the critical component (such as BIOS, BootLoader, OS Kernel etc.) in this start-up course suffers
Distort, as check results is consistent, then access control node and allow this main frame access critical resource, otherwise denied access request.
Described trusted host is the computer installing TPM2.0 chip, itself BIOS and BootLoader(Boot loader)
TCG(Trusted Computing Group, Trusted Computing Group need to be met) specification, according to TCG specification, computer is opening
During Dong, every one-level needs to calculate the metric of next stage before giving next stage by control, and this value extends to correspondence
In PCR, such as, BootLoader needs to calculate the metric of kernel before giving system kernel by control, and is extended to
In PCR14.
Described calculating master agent program is the program being arranged on trust computing node, when computer accesses core resource
Time can collect in this main frame the data of PCR in TPM chip and be uploaded to access and control node, access control main frame can by its with
Confidence values comparison is to determine whether this main frame access critical resource.
Described access controls the main frame that node is the access of control core resource, and its logic is positioned at trusted host and core resource
Between, give its qualification accessing resource according to the trusted status of main frame.
Described method operating process is as follows:
Trusted host initiates to access the request of core resource, accesses control node and intercepts and captures this request, and obtains main from this request
Machine information, it is judged that this main frame is the most registered；
As this main frame is not accessing control node, then access control node and issue registration request, the Agent of respective hosts
Upload reliable information；
Access and control to be stored in white list after node receives this information；
If this main frame is registered, then accesses control node and issue acquisition reliable information request to respective hosts, receive corresponding
After information, the content comparison corresponding with white list by it, if this reliable information is consistent with the corresponding content in white list,
Then allow this main frame to access core resource, otherwise refuse this and access.
The invention have the benefit that
The present invention adds the checking of main frame trusted status in traditional access control technology, once finds that the trusted status of main frame meets with
To destroying, i.e. refuse it and access the keystone resources in Intranet, utilize the ardware feature of TPM chip as the checking bar accessing resource
Part, it is ensured that under Intranet environment, only trusted host has the qualification of access critical resource.
Accompanying drawing explanation
Fig. 1 is the inventive method system architecture schematic diagram；
Fig. 2 is the inventive method flow chart.
Detailed description of the invention
Below in conjunction with Figure of description, according to detailed description of the invention, the present invention is further described:
Embodiment 1:
A kind of access control method based on trusted status, described method, by utilizing the hardware of TPM chip, collects host-initiated
During the code of key procedure or the metric of configuration information, as accessing the verification condition of resource, lower of Intranet environment
Trusted host is had to have the qualification of access critical resource.
Embodiment 2
As it is shown in figure 1, on the basis of embodiment 1, main frame described in the present embodiment in start-up course by the tolerance of critical component
Value (i.e. critical component code or the cryptographic Hash of configuration file) extends to the PCR(Platform in TPM chip
Configuration Register, platform configuration register) in, when accessing enterprise's keystone resources, access control node and issue
Reliable information request is to calculating master agent program, and Agent obtains the reliable information leaving in PCR and sends to accessing control
Node processed, accesses and controls node by itself and the trusted status comparison left in white list, it is judged that in this start-up course
Whether critical component (such as BIOS, BootLoader, OS Kernel etc.) is distorted, and as check results is consistent, then accesses control
Node allows this main frame access critical resource, otherwise denied access request.
Embodiment 3
On the basis of embodiment 2, trusted host described in the present embodiment be install TPM2.0 chip computer, its BIOS and
BootLoader(Boot loader) TCG(Trusted Computing Group, Trusted Computing Group need to be met) rule
Model, according to TCG specification, computer is in start-up course, and every one-level needs to calculate the degree of next stage before giving next stage by control
Value, and this value is extended in the PCR of correspondence, such as, in BootLoader needs before giving system kernel by control to calculate
The metric of core, and extended in PCR14.
Embodiment 4
On the basis of embodiment 2, calculating master agent program described in the present embodiment is the journey being arranged on trust computing node
Sequence, can collect in this main frame the data of PCR in TPM chip and be uploaded to access and control joint when computer accesses core resource
Point, access control main frame can by its with confidence values comparison to determine whether this main frame access critical resource.
Embodiment 5
On the basis of embodiment 4, access described in the present embodiment and control the main frame that node is the access of control core resource, its logic
Between trusted host and core resource, give its qualification accessing resource according to the trusted status of main frame.
Embodiment 6
As in figure 2 it is shown, on the basis of embodiment 5, described in the present embodiment, method operating process is as follows:
Trusted host initiates to access the request of core resource, accesses control node and intercepts and captures this request, and obtains main from this request
Machine information, it is judged that this main frame is the most registered；
As this main frame is not accessing control node, then access control node and issue registration request, the Agent of respective hosts
Upload reliable information；
Access and control to be stored in white list after node receives this information；
If this main frame is registered, then accesses control node and issue acquisition reliable information request to respective hosts, receive corresponding
After information, the content comparison corresponding with white list by it, if this reliable information is consistent with the corresponding content in white list,
Then allow this main frame to access core resource, otherwise refuse this and access.
Embodiment is merely to illustrate the present invention, and not limitation of the present invention, about the ordinary skill of technical field
Personnel, without departing from the spirit and scope of the present invention, it is also possible to make a variety of changes and modification, the most all equivalents
Technical scheme fall within scope of the invention, the scope of patent protection of the present invention should be defined by the claims.
Claims (6)
1. an access control method based on trusted status, it is characterised in that: described method is by utilizing the hard of TPM chip
Part, collects code or the metric of configuration information of key procedure during host-initiated, as the checking bar accessing resource
Part.
A kind of access control method based on trusted status the most according to claim 1, it is characterised in that described main frame exists
The metric of critical component is extended in the PCR in TPM chip by start-up course, when accessing enterprise's keystone resources, accesses control
Node processed issues reliable information request and obtains the reliable information left in PCR send out to calculating master agent program, Agent
Deliver to access and control node, access and control node by itself and the trusted status comparison left in white list, it is judged that opening of this
Whether the critical component during Dong is distorted, and as check results is consistent, then accesses control node and allows this main frame to access pass
Key resource, otherwise denied access request.
A kind of access control method based on trusted status the most according to claim 2, it is characterised in that described credible master
Machine is the computer installing TPM2.0 chip, and its BIOS and Boot loader meet TCG specification.
A kind of access control method based on trusted status the most according to claim 3, it is characterised in that described calculating master
Machine Agent is the program being arranged on trust computing node, can collect in this main frame when computer accesses core resource
In TPM chip, the data of PCR are uploaded to access and are controlled node, access control main frame can by its with confidence values comparison to judge
Whether allow this main frame access critical resource.
A kind of access control method based on trusted status the most according to claim 4, it is characterised in that described access control
Node processed be control core resource access main frame, its logic between trusted host and core resource, according to main frame can
Letter state gives its qualification accessing resource.
A kind of access control method based on trusted status the most according to claim 5, it is characterised in that described method is grasped
Make flow process as follows:
Trusted host initiates to access the request of core resource, accesses control node and intercepts and captures this request, and obtains main from this request
Machine information, it is judged that this main frame is the most registered；
As this main frame is not accessing control node, then access control node and issue registration request, the Agent of respective hosts
Upload reliable information；
Access and control to be stored in white list after node receives this information；
If this main frame is registered, then accesses control node and issue acquisition reliable information request to respective hosts, receive corresponding
After information, the content comparison corresponding with white list by it, if this reliable information is consistent with the corresponding content in white list,
Then allow this main frame to access core resource, otherwise refuse this and access.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610548788.9A CN106169054A (en) | 2016-07-13 | 2016-07-13 | Access control method based on trusted state |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610548788.9A CN106169054A (en) | 2016-07-13 | 2016-07-13 | Access control method based on trusted state |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106169054A true CN106169054A (en) | 2016-11-30 |
Family
ID=58064455
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610548788.9A Pending CN106169054A (en) | 2016-07-13 | 2016-07-13 | Access control method based on trusted state |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106169054A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107145788A (en) * | 2017-05-10 | 2017-09-08 | 郑州云海信息技术有限公司 | A kind of BMC trusted configuration methods with access control function |
| CN112199682A (en) * | 2020-11-03 | 2021-01-08 | 上海思赞博微信息科技有限公司 | Trusted computing based white list library file protection method |
| CN114978544A (en) * | 2022-05-23 | 2022-08-30 | 中国电信股份有限公司 | Access authentication method, device, system, electronic equipment and medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102202046A (en) * | 2011-03-15 | 2011-09-28 | 北京邮电大学 | Network-operating-system-oriented trusted virtual operating platform |
| CN103236928A (en) * | 2013-04-22 | 2013-08-07 | 广东电网公司电力科学研究院 | Method and system for safely controlling network resource |
| CN103647772A (en) * | 2013-12-12 | 2014-03-19 | 浪潮电子信息产业股份有限公司 | Method for carrying out trusted access controlling on network data package |
| CN104735069A (en) * | 2015-03-26 | 2015-06-24 | 浪潮集团有限公司 | High-availability computer cluster based on safety and credibility |
| CN105516207A (en) * | 2016-01-28 | 2016-04-20 | 浪潮电子信息产业股份有限公司 | Certificate management method in remote authentication |
-
2016
- 2016-07-13 CN CN201610548788.9A patent/CN106169054A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102202046A (en) * | 2011-03-15 | 2011-09-28 | 北京邮电大学 | Network-operating-system-oriented trusted virtual operating platform |
| CN103236928A (en) * | 2013-04-22 | 2013-08-07 | 广东电网公司电力科学研究院 | Method and system for safely controlling network resource |
| CN103647772A (en) * | 2013-12-12 | 2014-03-19 | 浪潮电子信息产业股份有限公司 | Method for carrying out trusted access controlling on network data package |
| CN104735069A (en) * | 2015-03-26 | 2015-06-24 | 浪潮集团有限公司 | High-availability computer cluster based on safety and credibility |
| CN105516207A (en) * | 2016-01-28 | 2016-04-20 | 浪潮电子信息产业股份有限公司 | Certificate management method in remote authentication |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107145788A (en) * | 2017-05-10 | 2017-09-08 | 郑州云海信息技术有限公司 | A kind of BMC trusted configuration methods with access control function |
| CN112199682A (en) * | 2020-11-03 | 2021-01-08 | 上海思赞博微信息科技有限公司 | Trusted computing based white list library file protection method |
| CN112199682B (en) * | 2020-11-03 | 2022-08-02 | 上海思赞博微信息科技有限公司 | Trusted computing based white list library file protection method |
| CN114978544A (en) * | 2022-05-23 | 2022-08-30 | 中国电信股份有限公司 | Access authentication method, device, system, electronic equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10318724B2 (en) | User trusted device for detecting a virtualized environment | |
| JP6282305B2 (en) | System and method for safe execution of code in hypervisor mode | |
| US9081600B2 (en) | Virtual machine validation | |
| US9087199B2 (en) | System and method for providing a secured operating system execution environment | |
| US9202062B2 (en) | Virtual machine validation | |
| US8966624B2 (en) | System and method for securing an input/output path of an application against malware with a below-operating system security agent | |
| US9317690B2 (en) | System and method for firmware based anti-malware security | |
| US11184373B2 (en) | Cryptojacking detection | |
| US8701187B2 (en) | Runtime integrity chain verification | |
| US20130312099A1 (en) | Realtime Kernel Object Table and Type Protection | |
| US20170090929A1 (en) | Hardware-assisted software verification and secure execution | |
| US9270467B1 (en) | Systems and methods for trust propagation of signed files across devices | |
| CN105718806A (en) | Method for realizing credible active measurement based on domestic BMC and TPM2.0 | |
| US20070230504A1 (en) | Generating a chain of trust for a virtual endpoint | |
| CN104239802A (en) | Trusted server design method based on cloud data center | |
| CN105760787A (en) | System and method used for detecting malicious code of random access memory | |
| US11645390B2 (en) | Cloud-based method to increase integrity of a next generation antivirus (NGAV) security solution in a virtualized computing environment | |
| EP3217310B1 (en) | Hypervisor-based attestation of virtual environments | |
| CN106326737A (en) | System and method for detecting harmful files executable on a virtual stack machine | |
| EP3127036B1 (en) | Systems and methods for identifying a source of a suspect event | |
| CN103347027A (en) | Trusted network connecting method and system | |
| CN106169054A (en) | Access control method based on trusted state | |
| CN106936768B (en) | White list network control system and method based on trusted chip | |
| Yao et al. | Building secure firmware | |
| US11822951B2 (en) | Hypercall authentication in a guest-assisted virtual machine introspection (VMI) implementation |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20161130 |