CN110109710B

CN110109710B - Method and system for establishing OS (operating system) trust chain without physical root of trust

Info

Publication number: CN110109710B
Application number: CN201910402833.3A
Authority: CN
Inventors: 吴保锡
Original assignee: Suzhou Inspur Intelligent Technology Co Ltd
Current assignee: Suzhou Inspur Intelligent Technology Co Ltd
Priority date: 2019-05-15
Filing date: 2019-05-15
Publication date: 2020-05-08
Anticipated expiration: 2039-05-15
Also published as: CN110109710A

Abstract

The invention provides a method and a system for establishing an OS trust chain without a physical root, which are used for establishing the trust chain of an OS guide and starting process from the moment when an OS guide program obtains a CPU trust chain in a software mode without depending on the physical root, thereby ensuring the safety of program data before the starting of an OS safety mechanism. The safety of the bootstrap program for booting and loading the OS kernel is ensured by detecting the bootstrap program based on a safety mechanism of a mainboard of the computing equipment; opening up an application invisible space of an OS (operating system) in a hard disk in a software mode for storing a credible verification strategy; and providing a trusted root service for the service node through the virtual trusted root simulated by the software. The method solves the problems of huge cost and high risk caused by the fact that the data center needs to update the computing equipment for realizing the trusted computing in the prior art, can construct a trust chain without depending on a physical trusted root, realizes the trusted computing in a software mode, and reduces the cost and the risk.

Description

Method and system for establishing OS (operating system) trust chain without physical root of trust

Technical Field

The invention relates to the technical field of information security, in particular to a method and a system for constructing an OS trust chain without a physical trusted root.

Background

Currently, trusted computing is being applied to enterprise data centers and cloud data centers as a key technology for systematically improving the security of the data centers, but a great problem is encountered in the process of application and popularization of the trusted computing technology, namely the problem of the cost of technology application, and the problem becomes an important obstacle for hindering the application of the trusted computing technology.

The application of the trusted computing technology needs to start from a physical device, and the physical device is required to support a physical root of trust and support a physical layer trust chain construction. The computing device completely protected according to the trusted computing technology is used for building a trust chain based on the physical trusted root to monitor the trusted state of the physical layer, then the OS boot continues to build the trust chain from the OS boot to the OS operation based on the physical trusted root, and all modules (including hardware, programs, files and the like) which provide computing services and participate in the computation are guaranteed to be trusted before the OS security mechanism takes effect, so that the OS security mechanism can be enabled to operate safely and effectively and provide security protection services for the OS.

The above needs require an enterprise to update a computing device or to provide a physical root of trust for the OS by using certain technical means. In an enterprise with few PCs and computing devices, the problem can be solved by PCI board cards, USB devices, and the like, but for cloud computing data centers or financial service data centers with hundreds of computing devices or even tens of thousands of computing devices, these schemes are not feasible:

by adopting a PCI board card mode, mainboard adaptation is needed, hardware equipment is possibly unstable, and replacement risk is high;

by adopting the mode of the USB equipment, for the data center, the operation and maintenance cost can be increased by inserting one USB equipment into each equipment in the machine room, and meanwhile, the risk of malicious replacement by malicious management exists because the USB equipment is pluggable.

Disclosure of Invention

The invention aims to provide a method and a system for establishing an OS trust chain without a physical trusted root, and aims to solve the problems of huge cost and high risk caused by the fact that computing equipment needs to be updated when a data center realizes trusted computing in the prior art, the trust chain can be established without depending on the physical trusted root, trusted computing is realized in a software mode, and the cost and the risk are reduced.

In order to achieve the technical purpose, the invention provides a method for constructing an OS trust chain without a physical root of trust, which comprises the following steps:

s1, acquiring the control right of the CPU from UEFI by the MBR, loading boot.img, and transferring the control right to boot.img;

s2, measuring and detecting the integrity of the MBR, continuously loading and measuring the core.img and the core module after confirming that the MBR is credible, verifying the integrity, storing the measurement result in a safe storage area of a disk, and transferring the control right of the CPU to the core.img after confirming that the core.img is credible;

s3, core.img continuously measuring and loading other grub2 modules according to the configuration file requirement, and verifying the integrity;

s4, loading the OS kernel root file system, measuring the integrity of the OS kernel root file system, storing the measurement result in a disk safe storage area, verifying the integrity of the OS kernel root file system, executing a boot instruction after ensuring the credibility of the OS kernel root file system, and transferring the CPU control right to the OS kernel;

s5, after the OS kernel obtains the CPU control right, measuring the loaded program file and recording a measurement log to a physical memory to ensure the safe starting of the OS safety program;

and S6, starting the TPM simulator and the trusted basic software after the OS security program is started.

Preferably, the verification process of the integrity of the MBR is as follows:

on the OS level, deploying a trusted verification policy to a disk secure storage area through a trusted verification policy management program;

after a server is started, after a firmware transfers the control right of a CPU to an MBR, the MBR loads boot.img of a bootstrap program to a memory;

obtaining a trusted verification strategy from a disk security storage area by boot.img, and verifying the integrity of MBR according to a verification strategy measurement result;

and when detecting that the integrity of the MBR is damaged, alarming or forbidding starting according to a verification strategy by boot.

Preferably, the trusted authentication policy includes a measurement policy, a verification policy, and a control policy.

Preferably, the measurement policy includes a name of a required measurement object and an extended PCR, wherein MBR, boot.

Preferably, the verification policy includes a metric object name, a metric object reference value, and a reference value update time.

Preferably, the control strategy comprises alarm starting, alarm authorization starting and alarm forbidding starting.

Preferably, the TPM simulator runs on a system, exports TPM devices to the outside through a kernel module, and provides security services.

Preferably, the security service includes a remote authentication service, a key engine service, a security control, and the like, and specifically includes the following steps:

the integrity of the platform is proved to an external entity through a measurement log generated in the boot and start processes based on a remote attestation service provided by a TPM simulator;

based on the key engine service of the TPM simulator, the strategy management program realizes the signature of the strategy data in a safe way, and the integrity of the strategy data is ensured;

based on the secure space provided by the TPM, signature keys and private data may be stored.

The invention also provides an OS trust chain construction system without a physical trusted root, which comprises:

the trusted boot program module is used for carrying out CPU control right and booting an OS kernel after BIOS/UEFI, starting the OS, and performing trusted verification on core files such as the boot program and the OS kernel according to a trusted verification strategy in the boot process;

the trusted verification policy management program module is used for deploying a trusted verification policy to the service node according to the requirement of an OS (operating system) administrator;

the trusted verification policy storage module is used for storing the trusted verification policy and only allowing the access of the trusted verification policy management program and the trusted boot program;

the BIOS safety starting program module is used for detecting the legality of the MBR/GPT;

and the trusted root simulator module is used for providing trusted root service for the OS application.

The effect provided in the summary of the invention is only the effect of the embodiment, not all the effects of the invention, and one of the above technical solutions has the following advantages or beneficial effects:

compared with the prior art, the method and the device have the advantages that the trust chain of the OS booting and starting process is built in a software mode from the moment when the OS booting program obtains the CPU trust chain, and the physical trust root is not relied on, so that the safety of program data before the OS safety mechanism is started is ensured. The safety of the bootstrap program for booting and loading the OS kernel is ensured by detecting the bootstrap program based on a safety mechanism of a mainboard of the computing equipment; an application invisible space of an OS (operating system) is opened up in a hard disk in a software mode and used for storing a credibility verification strategy and providing a basis for measuring and verifying the credibility state of an OS kernel by a bootstrap program; the virtual trusted root simulated by software provides trusted root service for the service node, provides remote certification for the outside, provides services such as key management for the top and the like. The method solves the problems of huge cost and high risk caused by the fact that the data center needs to update the computing equipment for realizing the trusted computing in the prior art, can construct a trust chain without depending on a physical trusted root, realizes the trusted computing in a software mode, and reduces the cost and the risk.

Drawings

Fig. 1 is a flowchart of a method for establishing an OS trust chain without a physical root of trust according to an embodiment of the present invention;

fig. 2 is a schematic diagram of a trust chain building process of a root OS booting process without trust provided in an embodiment of the present invention;

FIG. 3 is a schematic diagram illustrating MBR integrity verification according to an embodiment of the present invention;

FIG. 4 is a diagram of a trusted authentication policy manager provided in an embodiment of the present invention;

FIG. 5 is a diagram illustrating a root of trust simulator provided in an embodiment of the present invention;

fig. 6 is a block diagram of a system for constructing a trust chain of an OS without a physical root of trust according to an embodiment of the present invention.

Detailed Description

In order to clearly explain the technical features of the present invention, the following detailed description of the present invention is provided with reference to the accompanying drawings. The following disclosure provides many different embodiments, or examples, for implementing different features of the invention. To simplify the disclosure of the present invention, the components and arrangements of specific examples are described below. Furthermore, the present invention may repeat reference numerals and/or letters in the various examples. This repetition is for the purpose of simplicity and clarity and does not in itself dictate a relationship between the various embodiments and/or configurations discussed. It should be noted that the components illustrated in the figures are not necessarily drawn to scale. Descriptions of well-known components and processing techniques and procedures are omitted so as to not unnecessarily limit the invention.

The following describes a method and a system for constructing an OS trust chain without a physical root according to an embodiment of the present invention in detail with reference to the accompanying drawings.

As shown in fig. 1, an embodiment of the present invention discloses a method for constructing an OS trust chain without a physical root of trust, where the method includes the following steps:

s4, loading the OS kernel root file system, measuring the integrity of the OS kernel root file system, storing the measurement result in a physical disk safe storage area, verifying the integrity of the OS kernel root file system, executing a boot instruction after ensuring the credibility of the OS kernel root file system, and transferring the CPU control right to the OS kernel;

The embodiment of the invention has the following remarkable characteristics:

detecting a bootstrap program based on a security mechanism of a mainboard of the computing device, and ensuring that the bootstrap program for booting and loading an OS kernel is safe;

an OS system application invisible space is opened up in a hard disk in a software mode, a credibility verification strategy is stored, and a foundation is provided for measuring and verifying the credibility state of an OS kernel by a bootstrap program;

the virtual trusted root of the software simulation provides a trusted root service for the service node OS, and provides services such as remote certification and key management for the service node OS.

As shown in fig. 2, the untrusted root OS trust chain is constructed as follows:

the MBR acquires the control power of the CPU from the UEFI, loads boot.img, and transfers the control power to the boot.img;

measuring and detecting the integrity of the MBR, continuously loading and measuring the core.img and the core module after confirming that the MBR is credible, verifying the integrity, storing a measurement result into a safe storage area of a disk, and transferring the control right of the CPU to the core.img after confirming that the core.img is credible;

img continues to measure and load other grub2 modules according to the configuration file requirement, and verifies the integrity;

after confirming that each module of the bootstrap program is trusted, starting to load an OS kernel root file system, measuring the integrity of the OS kernel root file system, storing a measurement result to a physical disk safe storage area, verifying the integrity of the OS kernel root file system, executing a boot instruction after ensuring that the OS kernel root file system is trusted, and transferring the CPU control right to an OS kernel;

after the OS kernel obtains the CPU control right, the OS kernel continues to measure the loaded program file based on a system self-contained integrity measurement mechanism and records a measurement log to a physical memory, so that the safe starting of the OS safety program is ensured;

and after the OS safety program is started, starting the TPM simulator and the trusted basic software.

As shown in fig. 3, the MBR integrity verification process is as follows:

and when detecting that the integrity of the MBR is damaged, alarming or prohibiting starting according to a verification strategy until manual intervention.

As shown in fig. 4, the trusted authentication policy includes a measurement policy, a verification policy, and a control policy.

The measurement policy comprises the name of a required measurement object and an extended PCR, wherein MBR, boot. The management of the metric policy is as follows:

deploying the strategy, wherein the deployment measurement strategy needs ROOT authority, and detecting whether the measurement object exists, whether a reference value source is legal and whether the measurement object exists in the measurement strategy in the deployment process through the deployment of the strategy management program; the deployment value is stored in a physical disk secure area, which is not visible to the OS, and the operation process is recorded to an operation log.

The use of policies is used when the TGrub2 boot phase loads the metric object.

Updating the strategy, wherein the updating strategy needs ROOT authority, the strategy management program is used for updating, if a newly added measurement object needs to detect whether the measurement object exists in the updating process, the verification strategy and the control strategy need to be further updated after the measurement strategy is updated, and the operation process is recorded in an operation log.

And deleting the strategy, wherein ROOT authority is needed for deleting the measurement strategy, the strategy is deleted through a strategy deleting program, whether the strategy exists needs to be detected in the deleting process, and the deleting operation needs to be recorded in an operation log.

The verification strategy comprises a measurement object name, a measurement object reference value and reference value updating time. The check policy is managed as follows:

deploying the strategy, wherein the deployment verification strategy needs ROOT authority, and the deployment is performed through a strategy management program, so that whether the measurement object exists, whether a reference value source is legal and whether the measurement object exists in the measurement strategy are detected in the deployment process; the deployment value is stored in a physical disk secure area, which is not visible to the OS, and the operation process is recorded to an operation log.

The strategy is used in the TGrub boot stage, and other programs are not allowed to use the strategy.

Updating the strategy, wherein ROOT authority is needed for updating the verification strategy, and the original reference value of the measurement object and the updating reason need to be provided in the updating process through updating the strategy management program; after the verification strategy is updated, the control strategy needs to be further updated, and the operation process is recorded in an operation log.

And deleting the strategy, wherein ROOT authority is required for deleting the verification strategy, the strategy is deleted through a strategy deleting program, whether the strategy exists or not needs to be detected in the deleting process, and the deleting operation needs to be recorded into an operation log.

The control strategy comprises alarm starting, alarm authorization starting and alarm forbidding starting. The control strategy is managed in the following way:

deploying a policy, wherein the deployment of the control policy requires ROOT authority, deploying through a policy management program, detecting whether a control stage exists in the deployment process, and if the policy is authorized starting, inputting an authorized starting control code; and deploying the operation log to a physical disk safety area, wherein the area OS is invisible, and recording the operation process to the operation log.

Updating the strategy, wherein the strategy updating needs ROOT authority, updating needs to be carried out through a strategy management program, an updating reason needs to be provided in the updating process, if the updating relates to starting the control strategy, a starting control strategy authorization code needs to be provided, and the operation process is recorded in an operation log.

And deleting the strategy, wherein the ROOT authority is required for deleting the control strategy, the strategy is deleted through a strategy deleting program, whether the strategy exists or not needs to be detected in the deleting process, and the deleting operation is recorded into an operation log.

As shown in fig. 5, the TPM simulator runs on a system, exports TPM devices through a kernel module, and provides security services, where the security services include a remote authentication service, a key engine service, a security control, and the like, and the specific services are as follows:

The embodiment of the invention constructs the trust chain of the OS booting and starting process from the moment when the OS booting program obtains the CPU trust chain in a software mode, and does not depend on a physical trusted root, thereby ensuring the safety of program data before the OS safety mechanism is started. The safety of the bootstrap program for booting and loading the OS kernel is ensured by detecting the bootstrap program based on a safety mechanism of a mainboard of the computing equipment; an application invisible space of an OS (operating system) is opened up in a hard disk in a software mode and used for storing a credibility verification strategy and providing a basis for measuring and verifying the credibility state of an OS kernel by a bootstrap program; the virtual trusted root simulated by software provides trusted root service for the service node, provides remote certification for the outside, provides services such as key management for the top and the like. The method solves the problems of huge cost and high risk caused by the fact that the data center needs to update the computing equipment for realizing the trusted computing in the prior art, can construct a trust chain without depending on a physical trusted root, realizes the trusted computing in a software mode, and reduces the cost and the risk.

As shown in fig. 6, an embodiment of the present invention further discloses an OS trust chain building system without a physical root of trust, where the system includes:

the trusted verification policy management program module is used for deploying a trusted verification policy to the service node according to the requirement of an OS administrator, operating on the service node OS and protected by an OS security mechanism;

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents and improvements made within the spirit and principle of the present invention are intended to be included within the scope of the present invention.

Claims

1. A method for constructing an OS trust chain without a physical root of trust is characterized by comprising the following steps:

s2, measuring and detecting the integrity of the MBR, continuously loading and measuring the core.img and the core module after confirming that the MBR is credible, verifying the integrity, storing the measurement result in a safe storage area of a disk, and transferring the control right of the CPU to the core.img after confirming that the core.img is credible; the verification process of the integrity of the MBR comprises the following steps: on the OS level, deploying a trusted verification policy to a disk secure storage area through a trusted verification policy management program; after a server is started, after a firmware transfers the control right of a CPU to an MBR, the MBR loads boot.img of a bootstrap program to a memory; obtaining a trusted verification strategy from a disk security storage area by boot.img, and verifying the integrity of MBR according to a verification strategy measurement result; when detecting that the integrity of the MBR is damaged, the boot.img alarms or prohibits starting according to a verification strategy;

and S6, after the OS security program is started, starting the TPM simulator and the trusted basic software, wherein the TPM simulator runs on the system, exports the TPM simulator through the kernel module, and provides security services, and the security services comprise remote authentication services, key engine services and security controls.

2. The method of claim 1, wherein the trust verification policy comprises a measurement policy, a verification policy, and a control policy.

3. The method of claim 2, wherein the measurement policy comprises a name of a required measurement object and an extended PCR, wherein MBR, boot. img, and core. img are default measurement objects.

4. The method as claimed in claim 2, wherein the verification policy includes a measurement object name, a measurement object reference value, and a reference value update time.

5. The method of claim 2, wherein the control policy comprises alarm start, alarm authorized start, and alarm prohibited start.

6. The method for building the OS trust chain without the physical root of trust according to claim 1, wherein the security service is specifically as follows:

based on the secure space provided by the TPM simulator, the signature key and the private data may be stored.