CN106570402A - Encryption module and process trusted measurement method - Google Patents
Encryption module and process trusted measurement method Download PDFInfo
- Publication number
- CN106570402A CN106570402A CN201510660372.1A CN201510660372A CN106570402A CN 106570402 A CN106570402 A CN 106570402A CN 201510660372 A CN201510660372 A CN 201510660372A CN 106570402 A CN106570402 A CN 106570402A
- Authority
- CN
- China
- Prior art keywords
- module
- correction verification
- verification module
- host
- agreement
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/575—Secure boot
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
The invention relates to a trusted computing technology, in particular to an encryption module and a process trusted measurement method. The encryption module includes interfaces, an algorithm module, a protocol verification module, a process verification module, and a storage module. The encryption module is mainly arranged on a terminal main board of a host machine such as a PC terminal or a mobile terminal, and is used for performing trusted measurement on an application process of a host system, and monitoring the integrity of the application process by verification and comparison of the a process user measurement value, a process image measurement value, and a process feature measurement value. The host machine uses the verification and comparison result of the process measurement value as a basis so as to determine whether a process is loaded or operated, virus processes and virus infection processes cannot pass trusted measurement and will not be loaded, processes which are infected by a virus will be stopped, and virus spread and attacks can be avoided.
Description
Technical field
Patent of the present invention is related to a kind of trust computing field, specifically, the present invention relates to a kind of encrypting module and the credible measure of process.
Background technology
The method that Trusted Computing Group TCG proposes the process and creditability measurement of the credible startup of computer, its basic thought is：A root of trust being built first, a trust chain is resettled, being started to hardware platform from root of trust, to operating system, then to application, one-level certification one-level, one-level trusts one-level, so as to this trust is expanded to whole computer system.
The actual foundation of trust chain with propagate, trusted root measures first the integrity that hardware guides system bios, preserves measurement results, then again control passed to BIOS；BIOS performs initialization operation, measures the integrity of Master Boot Record, preserves measurement results, loads MBR, and control is being passed to MBR；The integrity of MBR metric operations system loading device LOADER, preserves measurement results, loads LOADER, then control is passed to LOADER；The integrity of LOADER metric operations systems, preserves measurement results, loading of operating system, then control is passed to operating system；Operating system measures the integrity of application software, preserves measurement results, loads application software, then control is passed to application software；Finally, application software enters operation.Integrity measurement result during this can be preserved by hardware trusted root.
Trust computing early stage originates from hardware mechanisms to protect software; at present with hardware that trusted root is mark mainly by TPM and TCM; TPM standards are formulated by the Trusted Computing Group that external IT companies constitute; and TCM is the trust computing standardized product according to China's cryptographic algorithm independent development, referred to as credible password module.No matter TCM or TPM, is to ensure credible reliability by the encryption to identity and decryption, is inherently seen, both encrypting module.
For BIOS, MBR, system loading device, operating system credible tolerance, due to this several parts change it is little, it is general using computing module digest value and to compare the difference of digest value, you can to reach the effect of integrity measurement protection.
But for one of difficult point that the credible tolerance of application process is trusted end-user tolerance.In modern operating system, the features such as process has dynamic, concurrency, independence and asynchronism, especially numerous network service demands have long-term stability and reliability, and used as the backstage of service, the credible execution of process is to ensure the believable key link of computing environment.It is filled with uncertainty once by system loads, and how the running orbit and process of accurate description process becomes a difficult problem in trust computing.
Traditional trust metrics and the method for extension are：One computing environment starts from a unique root of trust, credible tolerance is carried out successively from BIOS, MBR, system loading device, operating system, until the parent process of all processes of system creation, then parent process loads each sub-processes according to specific system configuration, all processes are before loading by way of parent process carries out trust metrics to subprocess, trust chain is extended in the range of computing environment, until system enters normal running status, the instruction of each process is executed concurrently.
The maintenance mode of this trust computing has 3：
First, with the prolongation and the complication of trusting relationship of trust chain, traditional trust metrics and the method for extension can cause the maintenance work of trust chain to become increasingly complex.
With cloud computing and virtually turning to the modern computing environments of representative is becoming more and more huger and complexity, in such as e-commerce system, electronic government affairs system, extensive, high reliability the computing environment of online query system, one server can simultaneously have thousands of modules concurrently to perform, in addition, in order to repair leak and increase function, program can frequently be changed, upgraded and updated.
In order to ensure the credible of program, system can frequently update root of trust and trust chain to system, not only have impact on the treatment effeciency of system, and also increase the uncertainty trusted in expansion process.
Secondth, metrics process takes very much, becomes the wide variety of technical bottleneck of trust computing.
Credible tolerance is undertaken by host system, can take substantial amounts of CPU time, this will user wait, cause user experience very bad.
If giving traditional trusted module the credible tolerance of process, because trusted module such as TPM is connected with main frame by serial ports, the communication speed and throughput of serial ports are a bottlenecks.Such as：Calculated with the process of a 10MB, being transmitted using the UART of 1Mbps probably needs 40 minutes, from terms of using angle, such mode is difficult to what is received.
3rd, merely staticametric is carried out to software document, it is impossible to solve the trust chain destruction that software upgrading is brought.
Whether software is credible, depending on the comparison of the staticametric value of software.But, software is inevitably upgraded and is updated, and this certainly will cause the trust chain of software to be destroyed, and can only provide guarantee during loading, it is impossible to ensured when providing operation.
The content of the invention
The purpose of the embodiment of the present invention is to provide a kind of encrypting module device for realizing carrying out credible tolerance for the application process of host.
What the embodiment of the present invention was realized in, a kind of encrypting module device, described device includes the low-speed interface module for carrying out protocol communication with host, the agreement correction verification module being connected with the low-speed interface module, the algoritic module being connected with the agreement correction verification module, the memory module being connected with the algoritic module, the process correction verification module being connected with the memory module, the High-speed Interface Card being connected with the process correction verification module.
The agreement correction verification module, is mainly used in the operating system of host（Hereinafter referred to as host system）Communication, and assist process correction verification module to shake hands when measure to process, and the communication of host is two-way, in addition, the verification that be also responsible for metric is compared and storage.
The algoritic module, main cooperation agreement correction verification module and process correction verification module are specifically encrypted, decrypted, hash computing.
The memory module, for depositing user metric value, process mirror image metric, process characteristic measure value.
The process correction verification module, it is mainly used in the credible tolerance of the application process of host, the communication of the module and host is unidirectional, only receive the data come as host, not returned data, data are not sent, the data operation for receiving mainly is drawn the module characteristic measure value of user metric value, the mirror image metric of process and process yet.
The High-speed Interface Card, for receiving the data of host system transmission.
The another object of the embodiment of the present invention is to provide a kind of credible tolerance of process and monitoring method based on above-mentioned encrypting module device, be the method comprising the steps of.
The agreement correction verification module obtains username and password by low-speed interface from host system, and call algoritic module to carry out hash computing, user metric value is obtained, the metric and the user metric value for being saved in user storage area are compared, and comparative result is sent to host system.
The process correction verification module obtains process mirror image by high-speed interface from host system, and whole process mirror image is carried out hash computing, draw mirror image metric, and it is sent to agreement correction verification module, request the latter is by the metric and has been saved in the mirror image metric of memory module and compares, and comparative result is sent to host system.
The process correction verification module is after to process mirror image hash, start the eigenvalue of extraction process, the eigenvalue for extracting is put in an order block, hash computing is carried out to this feature value block, draw characteristic measure value, and characteristic measure value is sent to agreement correction verification module, the latter is asked by the metric and be saved in the characteristic measure value of memory module and compare, and comparative result is sent to host system.
After comparative result is sent to host system, host system can be to start also be off the process according to the result judgement to the agreement correction verification module.The verification of process is real-time, i.e. whenever host system loading, startup, polling procedure, this device can be all asked to carry out credible tolerance to process, measurement results are sent to host system by low-speed interface, if unqualified, host system will immediately stop the process.
Therefore, by the use of apparatus of the present invention, the process of with no authorized will not be run, and viral progression will not run, and the process being infected will not be run, so integrity when the credible tolerance of process ensure that running software.
Before running software, it after running software, is existed with the form of process in the form of executable file to be.The integrity check carried out before running software, can only ensure the integrity before running software.After software brings into operation from original state, the main behavioral structure to process is monitored, if the behavioral structure of process there occurs change, in the case of with no authorized, it is considered that software or process receive the destruction of virus, process will be terminated, therefore integrity of the credible tolerance of process when ensure that running software.
Description of the drawings
Below in conjunction with the accompanying drawings the present invention will be further described in detail with specific embodiment.
Fig. 1 is the structure chart of encrypting module provided in an embodiment of the present invention.
Fig. 2 is the topological diagram of encrypting module application provided in an embodiment of the present invention.
Fig. 3 is the flow chart of the credible measure of process provided in an embodiment of the present invention.
Fig. 4 is the storage organization figure of the credible measure of process provided in an embodiment of the present invention.
Specific embodiment
In order that the objects, technical solutions and advantages of the present invention become more apparent, below in conjunction with drawings and Examples, the present invention will be described in further detail.It should be appreciated that specific embodiment described herein is not intended to limit the present invention only to explain the present invention.
Fig. 1 shows the structure chart of encrypting module provided in an embodiment of the present invention.
Wherein in an example, module is mostly installed on the terminal mainboard of host, such as PC ends or mobile terminal, and main application processes carry out credible tolerance, compared by the verification of the user metric value to process, process mirror image metric, process characteristic measure value, monitor the integrity of application process.Can be loaded and run by the process of credible tolerance, due to can not being loaded by credible tolerance, infected process also can be stopped in operation for viral progression and the process being infected, so as to avoid the propagation and outbreak of virus.
Wherein in an example, low-speed interface may employ I2C, SPI, UART.
Wherein in an example, high-speed interface may be employed：USB、PCIE.
Wherein in an example, algoritic module has used SM1, SM2, SM3, SM4 and true random number transmitter etc., and wherein SM1, SM2, SM3, SM4 algorithm is according to national cryptographic algorithm standard implementation.
Fig. 2 shows the topological diagram of encrypting module application provided in an embodiment of the present invention.
Wherein in an example, this device connects to play the function of this device as independent external equipment by the reserved Peripheral Interface with host.
Wherein in an example, host system is Linux systems, and linux system creates first the parent process of all processes, and then parent process loads each sub-processes according to specific system configuration, all processes carried out credible tolerance by parent process before loading to subprocess.
This parent process plays a part of host system and this device interactive communication.
Linux processes mainly occupy following components in internal memory, are respectively the parameters such as code segment, data segment, BSS sections.Wherein, code segment, data segment, the content of BSS sections are corresponding contents in executable file, and loading procedure is not that their content is filled in internal memory from executable program, but by their information（Base address, length etc.）In updating process control block (PCB), then by page faults, ask operating system again by actual content from executable file reproducting content in physical memory.
In specific implementation process, user program when mounted, will carry out the initialization of the credible tolerance of process.The title of user and password can be sent to agreement correction verification module by system, and the latter obtains user metric value to its computing.Agreement correction verification module in one user's memory block of zone-setting, for storing user metric value, mirror image metric, characteristic measure value and some other and user-dependent parameter.The mirror image of installation procedure can be also sent to process correction verification module by system, and the latter obtains mirror image metric, characteristic measure value to its computing, and request protocol correction verification module is deposited in user's memory block for above having set up.
Wherein in an example, the eigenvalue of process employ system call, the binary features such as function call.
In specific implementation process, if software is upgraded, host system can eject cryptographic session frame, require user input password, and user name and the password of user input, it is encrypted first, username and password after encryption is sent to agreement correction verification module by control passage, the latter is decrypted the user and password by algoritic module, decrypted username and password out carries out hash computing again, and the Hash Value of memory block is stored in more, and comparative result is sent to host system.Host system is in the case where comparative result passes through, upgrading process initial address and end address agreement correction verification module is sent to by control passage, the process mirror image of upgrading is issued process correction verification module by data channel, process correction verification module re-starts process mirror image hash computing and characteristics extraction, and committing protocol correction verification module is stored again, and the process block before covering.
Fig. 3 shows the flow chart of the credible measure of process provided in an embodiment of the present invention.
Host system loads respectively consumer process according to the order of user, and process is loaded into after internal memory, is not started.
After host system starts, the username and password of user is encrypted first, then agreement correction verification module is sent to by control passage.
In step S301, the agreement correction verification module obtains username and password by low-speed interface from host system, and calls algoritic module to carry out hash computing, obtains user metric value.
The metric and the user metric value for being saved in user storage area are compared, and comparative result is sent to host system.
After comparative result is sent to host system, host system can be to start also be off the process according to the result judgement to the agreement correction verification module.
After the completion of process content is replicated, not launching process immediately, but the initial address and end address process is sent to agreement correction verification module to host system by control passage；Mirror image process from initial address to end address, by data channel process correction verification module is sent to.
In step s 302, the process correction verification module obtains process mirror image by high-speed interface from host system, and whole process mirror image is carried out hash computing, draws mirror image metric, and is sent to agreement correction verification module；
The agreement correction verification module is by the metric and has been saved in the mirror image metric of memory module and compares, and comparative result is sent to host system.
After comparative result is sent to host system, host system can be to start also be off the process according to the result judgement to the agreement correction verification module.
In step S303, the process correction verification module starts the eigenvalue of extraction process after to process mirror image hash, the eigenvalue for extracting is put in an order block, hash computing is carried out to this feature value block, characteristic measure value is drawn, and characteristic measure value is sent to agreement correction verification module.
The agreement correction verification module is by the metric and has been saved in the characteristic measure value of memory module and compares, and comparative result is sent to host system.
After comparative result is sent to host system, host system can be to start also be off the process according to the result judgement to the agreement correction verification module.
The eigenvalue of process is called including system, function call etc., and process eigenvalue has a lot, and the quantity of the eigenvalue of different processes is different, and specific eigenvalue is also differed.These different process eigenvalues are arranged in order in one block, hash computing is carried out to it, draw the characteristic measure value of process.
Presently preferred embodiments of the present invention is the foregoing is only, not to limit the present invention, all any modification, equivalent and improvement made within the spirit and principles in the present invention etc., be should be included within the scope of the present invention.
Claims (9)
1. a kind of encrypting module device, it is characterized in that, described device includes the low-speed interface module for carrying out protocol communication with host, the agreement correction verification module being connected with the low-speed interface, the algoritic module being connected with the agreement correction verification module, the memory module being connected with the algoritic module, the process correction verification module being connected with the memory module, the High-speed Interface Card being connected with the process correction verification module.
2. encrypting module device according to claim 1, it is characterised in that the agreement correction verification module, is mainly used in the communication of host system, and assists process correction verification module to shake hands when measure to process, and it is two-way with the communication of host.
3. encrypting module device according to claim 1, it is characterised in that the agreement correction verification module, will also be responsible for Inspection and the storage of metric.
4. encrypting module device according to claim 1, it is characterised in that the algoritic module, it is main coordinate agreement correction verification module and process correction verification module are specifically encrypted, are decrypted, hash computing.
5. encrypting module device according to claim 1, it is characterised in that the memory module, for depositing user metric value, process mirror image metric, process characteristic measure value.
6. encrypting module device according to claim 1, it is characterized in that, the process correction verification module, it is mainly used in the credible tolerance of the application process of host, the communication of module and host is unidirectional, only receives the data come as host, not returned data, data are not sent, the process data computing for receiving mainly is drawn the module characteristic measure value of user metric value, the mirror image metric of process and process yet.
7. encrypting module device according to claim 1, it is characterised in that the High-speed Interface Card, for receiving the data of host system transmission.
8. encrypting module device according to claim 1, it is characterised in that be the device and method that credible tolerance is carried out using the dual pathways, process tolerance is completed without the need for host, reduces the process load of host.
9. a kind of credible measure of process of the encrypting module device based on described in any one of claim 1 to 7, it is characterized in that, in step S301, the agreement correction verification module obtains that user is bright and password by low-speed interface from host system, and call algoritic module to carry out hash computing, obtain user metric value；In step s 302, the process correction verification module obtains process mirror image by high-speed interface from host system, and whole process mirror image is carried out hash computing, draws mirror image metric, and is sent to agreement correction verification module；In step S303, the process correction verification module starts the eigenvalue of extraction process after to process mirror image hash, the eigenvalue for extracting is put in an order block, hash computing is carried out to this feature value block, characteristic measure value is drawn, and characteristic measure value is sent to agreement correction verification module.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510660372.1A CN106570402A (en) | 2015-10-13 | 2015-10-13 | Encryption module and process trusted measurement method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510660372.1A CN106570402A (en) | 2015-10-13 | 2015-10-13 | Encryption module and process trusted measurement method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106570402A true CN106570402A (en) | 2017-04-19 |
Family
ID=58508799
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510660372.1A Pending CN106570402A (en) | 2015-10-13 | 2015-10-13 | Encryption module and process trusted measurement method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106570402A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107483187A (en) * | 2017-08-02 | 2017-12-15 | 浪潮(北京)电子信息产业有限公司 | A kind of data guard method and device based on credible password module |
| CN108399338A (en) * | 2018-02-06 | 2018-08-14 | 南京航空航天大学 | Platform integrity status measure information method based on process behavior |
| CN112214795A (en) * | 2020-10-13 | 2021-01-12 | 天津津航计算技术研究所 | Encryption module suitable for various data bandwidths |
| CN114095227A (en) * | 2021-11-15 | 2022-02-25 | 许昌许继软件技术有限公司 | Credible authentication method and system for data communication gateway and electronic equipment |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101122937A (en) * | 2007-09-21 | 2008-02-13 | 武汉大学 | Embedded type platform safety guiding mechanism supported by star-shape trust chain |
| CN101344904A (en) * | 2008-09-02 | 2009-01-14 | 中国科学院软件研究所 | Dynamic measurement method |
| CN103747036A (en) * | 2013-12-23 | 2014-04-23 | 中国航天科工集团第二研究院七〇六所 | Trusted security enhancement method in desktop virtualization environment |
| CN104573516A (en) * | 2014-12-25 | 2015-04-29 | 中国科学院软件研究所 | Industrial control system trusted environment control method and platform based on safety chip |
-
2015
- 2015-10-13 CN CN201510660372.1A patent/CN106570402A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101122937A (en) * | 2007-09-21 | 2008-02-13 | 武汉大学 | Embedded type platform safety guiding mechanism supported by star-shape trust chain |
| CN101344904A (en) * | 2008-09-02 | 2009-01-14 | 中国科学院软件研究所 | Dynamic measurement method |
| CN103747036A (en) * | 2013-12-23 | 2014-04-23 | 中国航天科工集团第二研究院七〇六所 | Trusted security enhancement method in desktop virtualization environment |
| CN104573516A (en) * | 2014-12-25 | 2015-04-29 | 中国科学院软件研究所 | Industrial control system trusted environment control method and platform based on safety chip |
Non-Patent Citations (3)
| Title |
|---|
| 朱小波 等: "基于TCM的国产可信计算机的设计", 《信息技术》 * |
| 肖思莹 等: "基于国产平台的可信系统研究", 《微型机与应用》 * |
| 鲁青远 等: "基于扩展ROM的信任根设备设计与实现", 《计算机工程与设计》 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107483187A (en) * | 2017-08-02 | 2017-12-15 | 浪潮(北京)电子信息产业有限公司 | A kind of data guard method and device based on credible password module |
| CN108399338A (en) * | 2018-02-06 | 2018-08-14 | 南京航空航天大学 | Platform integrity status measure information method based on process behavior |
| CN112214795A (en) * | 2020-10-13 | 2021-01-12 | 天津津航计算技术研究所 | Encryption module suitable for various data bandwidths |
| CN112214795B (en) * | 2020-10-13 | 2022-08-16 | 天津津航计算技术研究所 | Encryption module suitable for various data bandwidths |
| CN114095227A (en) * | 2021-11-15 | 2022-02-25 | 许昌许继软件技术有限公司 | Credible authentication method and system for data communication gateway and electronic equipment |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11295004B2 (en) | Unlock and recovery for encrypted devices | |
| US10262140B2 (en) | Methods and apparatus to facilitate blockchain-based boot tracking | |
| US9436827B2 (en) | Attesting a component of a system during a boot process | |
| US8341393B2 (en) | Security to extend trust | |
| US11206141B2 (en) | Merging multiple compute nodes with trusted platform modules utilizing provisioned node certificates | |
| CN111159691B (en) | Dynamic credibility verification method and system for application program | |
| WO2009051471A2 (en) | Trusted computer platform method and system without trust credential | |
| CN113468535B (en) | Trusted measurement method and related device | |
| CN106570402A (en) | Encryption module and process trusted measurement method | |
| CN113569285A (en) | Identity authentication and authorization method, device, system, equipment and storage medium | |
| US20190166123A1 (en) | User terminal using cloud service, integrated security management server for user terminal, and integrated security management method for user terminal | |
| CN106951785B (en) | JAVA virtual machine and trust chain extension method thereof | |
| US10289510B1 (en) | Intelligent platform management interface functional fuzzer | |
| US12067121B2 (en) | Trusted boot method and apparatus, electronic device, and readable storage medium | |
| WO2018233638A1 (en) | Method and apparatus for determining security state of ai software system | |
| WO2021135978A1 (en) | Method for proving trusted state and related device | |
| CN115859225A (en) | Reinforcement method, registration method, operation method, electronic device, and storage medium | |
| CN113157386A (en) | Trust chain construction method and system from physical machine to virtual machine | |
| US20160246637A1 (en) | Determining Trustworthiness of a Virtual Machine Operating System Prior To Boot UP | |
| Dongliang et al. | TrustVP: construction and evolution of trusted chain on virtualization computing platform | |
| CN117851988A (en) | Application security reinforcement method, device, equipment and medium | |
| CN117648684A (en) | Terminal verification method, device, equipment and storage medium | |
| CN115794165A (en) | Application upgrading method and device, EPS and medium | |
| CN118612277A (en) | Cloud password service calling method and device, medium and electronic equipment | |
| CN116938465A (en) | Gateway equipment starting method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20170419 |
|
| WD01 | Invention patent application deemed withdrawn after publication |