CN117149439B - Method and system for reducing frequency and frequency of trusted computing static measurement - Google Patents

Abstract

The invention discloses a method and a system for reducing the frequency and the frequency of trusted computing static measurement, belonging to the technical field of information security. Aiming at the problem that the CPU resource consumption is excessive because the cryptographic signature algorithm is required to be frequently applied to measure the strategy file in the trusted computing process, before the measurement is executed on the strategy file, judging according to the attribute vector cache table of the strategy file in the memory, and judging whether the content of the strategy file is changed or not on the basis of the last measurement; if not, the credible measurement is not needed, and the measurement result of the last time is taken as the basis; if the change occurs, the credible measurement is needed, and meanwhile, the attribute vector cache table of the strategy file in the memory is updated according to the measurement result. The invention reduces the frequency and the frequency of the trusted measurement while ensuring the integrity and the correctness of the trusted measurement, thereby reducing the occupation and the consumption of the trusted measurement on CPU resources and ensuring the smooth operation of the whole operation system service.

Description

A method and system for reducing the frequency and frequency of trusted computing static measurements

Technical field

The invention belongs to the technical field of information security and relates to a method and system for reducing the frequency and frequency of static measurement of trusted calculations.

Background technique

Trusted Computing (TC) is a technology promoted and developed by the Trusted Computing Group (TCG). One of the key goals of trusted computing is to ensure the integrity of the operating system and applications, thereby ensuring that the operating system or application can run as expected and within a predetermined range. Trustworthiness and security are closely related. Trustworthiness is the basis of security. Only by mastering trustworthiness can we better grasp security and lay a solid foundation for building a stronger safety management system.

Trustworthiness, as the core of trusted computing, is an indispensable key link in trusted computing. Credibility measurement is divided into two types: static measurement and dynamic measurement. Static measurement generally refers to the process of trustworthy measurement of static files based on hash or cryptographic signature algorithms during system boot, operating system startup, application execution, and file system access. Static files include system images, executable programs, and Dependent libraries, etc. In the process of authenticating files, a cryptographic signature algorithm or a hash algorithm needs to be used. The use of a hash algorithm or a cryptographic signature algorithm consumes CPU resources of the operating system, especially when the file is authenticated. When the file itself is relatively large, it will put a greater burden on CPU resources. Therefore, how to reduce the consumption of CPU resources by the trustworthiness process has become an unavoidable issue in the field of trusted computing.

Contents of the invention

The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a method and system for reducing the frequency and frequency of static measurement of trusted calculations, so as to solve the problem of excessive consumption of CPU resources when static measurement files are used, which in turn reduces the CPU resources of the operating system. Issues that cause a greater burden.

In order to achieve the above objectives, the present invention adopts the following technical solutions to achieve:

A method to reduce the frequency and frequency of trusted computing static measurements, including the following steps:

S1, query the attribute vector cache table to determine whether the policy file is the first trustworthy measure. If so, execute S2; if not, compare whether the actual attributes of the policy file are consistent with the cached attributes. If they are consistent, end the judgment. If they are inconsistent, execute S2. ; The cached attributes are the attributes of the policy file cached in the attribute vector cache table, and the actual attributes are the built-in attributes of the policy file;

S2, trusts the measurement policy file, and writes the current measurement value and the last measurement time in the attribute vector cache table of the policy file.

Further improvements of the present invention are:

Preferably, in S1, determining whether the policy file is a first-time trustworthy measure includes: querying the attributes of the policy file in the attribute vector cache table. If the attribute cannot be queried, the policy file is a first-time trustworthy measure.

Preferably, during execution of S1, the attribute changes of the policy file are monitored in real time in the kernel layer of the operating system.

Preferably, in S1, both cache attributes and actual attributes include index nodes, time information variables and the last disk writeback time.

Preferably, in S1, the specific process of comparing whether the actual attributes of the policy file are consistent with the cached attributes is: determine whether the index node of the policy file has changed. If it has changed, determine that it is inconsistent and execute S2; if it has not changed, determine whether the policy file has changed. Whether the time information variable of the policy file has changed. If it has not changed, no credibility measurement is required. If the time information variable has changed, determine whether the last disk write-back time of the policy file has changed. If it has not changed, no credibility measurement is required. , otherwise execute S2.

Preferably, the time information variable includes the last measurement time, the last modification time and the last attribute change time.

Preferably, if any one of the last measurement time, the last modification time and the last attribute change time changes, it is considered that the time information variable has changed.

Preferably, in S1, when no reliability measurement is required, the last measurement result is extracted from the attribute vector cache table as the current measurement result.

A system that reduces the frequency and frequency of trusted computing static measurements, including:

The measurement judgment module is used to query the attribute vector cache table to determine whether the policy file is the first reliable measurement. If so, execute the measurement module; if not, compare the actual attributes of the policy file with the cached attributes to see if they are consistent. If they are consistent, end the judgment. If inconsistent, execute the measurement module; the cached attributes are the attributes of the policy file cached in the attribute vector cache table, and the actual attributes are the built-in attributes of the policy file;

The measurement module is used in the trusted measurement policy file to write the current measurement value and the last measurement time in the attribute vector cache table of the policy file.

Preferably, it also includes:

The attribute change monitoring module is used to monitor attribute changes of policy files in the attribute vector cache table in real time.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention discloses a method for reducing the frequency and frequency of static measurement of trusted computing. In view of the problem that cryptographic algorithms need to be frequently applied to perform trustworthy measurement on files in trusted computing technology, resulting in large consumption of CPU resources, the method can be used to perform policy files when executing policy files. Before trust measurement, first determine whether the attributes of the policy file have changed based on the last trust measurement based on the attribute vector cache table of the policy file in the memory; if they have not changed, there is no need to measure this time. The above Based on the measurement results once; if it changes, trust measurement needs to be performed, and the attribute vector cache table of the policy file in memory is updated at the same time. While ensuring the integrity and correctness of trustworthiness, the frequency and frequency of trustworthiness are reduced, thereby reducing the occupation and consumption of CPU resources by trustworthiness and ensuring the smooth operation of operating system services. The present invention minimizes the frequency and frequency of trustworthiness, achieves "no measurement unless necessary", and at the same time ensures the integrity and correctness of trustworthiness, thereby reducing the occupation and consumption of CPU resources by trustworthiness. The method of the invention is simple to implement, safe and reliable, and can be widely used in many fields such as network servers, industrial control, cloud computing and data centers.

Further, the present invention monitors the attribute changes of the policy file in real time at the operating system kernel layer, and at the same time builds the attribute vector cache table of the policy file in the memory.

Description of the drawings

Figure 1 is a flow chart of the method of reducing the frequency and frequency of trusted calculation static measurements according to the present invention;

Figure 2 is a detailed flow chart of the method of reducing the frequency and frequency of trusted calculation static measurements according to the present invention;

Figure 3 is a system module diagram for reducing the frequency and frequency of trusted calculation static measurements in the present invention.

Detailed ways

It should be noted that the terms "first", "second", etc. in the description and drawings of the present invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the invention described herein are capable of being practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus that encompasses a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

In order to clearly explain the solution of the present invention, the following terms are explained:

CPU: Central Processing Unit, the full name is Central Processing Unit. As the computing and control core of the computer system, it is the final execution unit for information processing and program execution.

AVC: Attribute vector cache table, the full name is Attribute Vector Cache, used to cache attribute information and metric information of policy files.

Trustworthiness, as the core of trusted computing, is an indispensable key link in trusted computing. Trustworthiness is generally based on cryptographic signature algorithms or hash algorithms to trust files or processes. The hash algorithm includes bit operations and hash functions. Bit operations generally do not occupy too much CPU resources, but the hash function is a strong CPU-consuming operation, so when the hash algorithm is used intensively, the CPU resource occupancy rate is certain. Will remain high. Compared with hashing algorithms, cryptographic signature algorithms are more consuming of CPU resources. When the number of files that require trustworthiness in the operating system is large or the files are large, it will inevitably lead to the CPU resources of the operating system being occupied. The rate is too high, affecting normal business operations. Therefore, it is necessary to design an effective method to reduce the occupation and consumption of CPU resources by trustworthy quantities while ensuring the integrity and correctness of trustworthy quantities.

In order to solve the above problems, referring to Figure 1, the first purpose of the present invention is to provide a method for reducing the frequency and frequency of trusted computing static measurements, which includes the following steps:

S1, query the attribute vector cache table to determine whether the policy file is the first trustworthy measure. If so, execute S2; if not, compare whether the actual attributes of the policy file are consistent with the cached attributes. The cached attribute is that the policy file is cached in the attribute vector cache table. The actual attributes are the attributes of the policy file; if they are consistent, it is deemed that the actual attributes have not changed relative to the cached attributes, no trustworthiness is required, and the judgment ends; if they are inconsistent, S2 is executed.

S2, the trusted measurement policy file, writes the current measurement value and the last measurement time in the attribute vector cache table of the policy file.

This method monitors the attribute changes of the policy file in real time at the operating system kernel layer, builds the attribute vector cache table of the policy file in the memory, and determines whether measurement is needed based on the cached attributes in the attribute vector cache table before trustworthy measurement. "Do not measure unless necessary", thereby minimizing the frequency and frequency of reliable measurements.

Referring to Figure 2, one embodiment of the present invention discloses a method for reducing the frequency and frequency of trusted calculation static measurements. Specifically, the method includes the following steps:

S1, when the policy file triggers trustworthiness, first query the attribute vector cache table for the cached attribute information of the policy file, that is, cached attributes. If the query cannot be found, it means that the current file is measured for the first time, and the measurement module needs to be called to perform trust measurement on the policy file, that is, execute S2; after the trust measurement is completed, the measurement value and the last measurement time of the policy file will be stored in the attribute vector cache table. middle. If the cached attributes of the policy file can be queried in the attribute vector cache table, compare the actual attributes and cached attributes of the policy file to determine whether the content of the policy file has changed based on the last measurement. If the content of the policy file has not changed, there is no need to measure this time, and the last measurement result will be used as the basis; if the content of the policy file has changed, measurement needs to be performed, and the cached attributes of the policy file in the attribute vector cache table will be updated synchronously based on the measurement results.

Specifically, it is necessary to compare the actual attributes that come with the current policy file with the cached attributes in the attribute vector cache table to see whether there have been changes. Based on the last measurement of the policy file, the basis for determining whether the content in the policy file has changed is as follows:

(1) First determine whether the index node (i.e. inode) of the policy file has changed. If the index node of the policy file has changed, it means that the policy file may be a brand new file. There is no need to judge other attributes of the policy file and proceed directly. Trusted measurement; after the trusted measurement is completed, the current measurement value and the last measurement time are stored in the attribute vector cache table. The last measurement time is the measurement time of the current measurement value.

(2) If the index node of the policy file has not changed, determine whether the actual attributes are consistent with the time information variables in the cache attributes. Specific time information variables include the last measurement time, the last modification time, and the last attribute change time. If the three time information variables in the cached attributes and the actual attributes are consistent, it is considered that the content of the policy file has not changed based on the last measurement. There is no need to measure this time. The last time of the policy file is extracted from the attribute vector cache table. The measurement results are used as the measurement results this time. Among them, the last modification time refers to the time when the content of the policy file changes; the last attribute change time includes the last access time, index node number change time, file size and other attribute change times. Any change in these times requires Modify the last attribute change time.

(3) If any of the last measurement time, last modification time and last attribute change time of the policy file changes in the previous step, it does not mean that the content of the file has changed. It is also necessary to further determine whether the disk write-back time of the policy file has changed. If the disk write-back time has not changed, it is considered that the content of the policy file has not changed based on the last measurement. There is no need to measure this time. The dependent attribute vector The last measurement result of the policy file is extracted from the cache table as the current measurement result; conversely, if the disk writeback time also changes, trust measurement needs to be performed and the attribute vector cache table of the file needs to be updated.

As one of the preferred solutions, if there is no attribute vector cache table in the operating system; before performing S1, build the attribute vector cache table of the policy file in the memory of the operating system to store the measurement value, measurement time and attributes of the policy file. .

S2: Perform trust measurement on the policy file. After the policy file performs a trust measurement, the current measurement value and the last measurement time are stored in the attribute vector cache table.

As one of the preferred solutions, the attribute changes of the policy file are monitored in real time at the operating system kernel layer. The monitored attributes include but are not limited to the index node of the policy file, the last modification time, the last attribute change time, and the last disk write-back time. and the last measurement time and other information.

Referring to Figure 3, the second purpose of the present invention is to provide a system for reducing the frequency and frequency of trusted computing static measurements. The system includes:

The measurement judgment module is used to query the attribute vector cache table to determine whether the policy file is the first reliable measurement. If so, execute the measurement module; if not, compare the actual attributes of the policy file with the cached attributes to see if they are consistent. If they are consistent, end the judgment. If they are inconsistent, the measurement module is executed; the cached attributes are attributes cached in the attribute vector cache table of the policy file, and the actual attributes are self-contained attributes of the policy file.

The measurement module is used in the trusted measurement policy file to write the current measurement value and the last measurement time in the attribute vector cache table of the policy file.

Furthermore, it also includes an attribute change monitoring module for real-time monitoring of attribute changes of the policy files in the attribute vector cache table.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included in the present invention. within the scope of protection.

Claims (8)

1. A method for reducing the frequency and frequency of trusted computing static metrics, comprising the steps of:

s1, inquiring an attribute vector cache table, judging whether a policy file is a first credible measurement, and if so, executing S2; if not, comparing whether the actual attribute of the policy file is consistent with the cache attribute, if so, ending the judgment, and if not, executing S2; the cache attribute is an attribute of the policy file cached in an attribute vector cache table, and the actual attribute is a self-contained attribute of the policy file;

in S1, both the cache attribute and the actual attribute comprise an index node, a time information variable and the last disk write-back time;

in S1, the specific process of comparing whether the actual attribute and the cache attribute of the policy file are consistent is as follows: judging whether index nodes of the strategy file change or not, if so, determining that the index nodes are inconsistent, and executing S2; if the time information variable of the policy file is unchanged, judging whether the time information variable of the policy file is changed, and if the time information variable of the policy file is unchanged, not requiring a trusted measure; if the time information variable is changed, judging whether the last disc write-back time of the strategy file is changed, if not, not needing the credible measurement, otherwise executing S2;

s2, the policy file is measured in a trusted way, and the current measurement value and the last measurement time are written in an attribute vector cache table of the policy file.

2. The method for reducing the frequency and the frequency of trusted computing static metrics according to claim 1, wherein in S1, the determining whether the policy file is a first trusted metric comprises: the attribute vector cache table is queried for the attribute of the policy file, and if the query is not received, the policy file is the first trusted measure.

3. The method of claim 1, wherein S1 monitors the change of the attributes of the policy file in real time in the kernel layer of the operating system during execution.

4. The method of claim 1, wherein the time information variables include last time of measurement, last time of modification, and last time of attribute change.

5. The method of reducing the frequency and frequency of trusted computing as claimed in claim 4, wherein any one of the last time the metric, the last time the modification and the last time the attribute was changed is changed, the time information variable is considered to be changed.

6. The method for reducing the frequency and the frequency of trusted computing static measurement according to claim 1, wherein in S1, when the trusted measurement is not needed, the last measurement result is extracted from the attribute vector cache table as the current measurement result.

7. A system for reducing the frequency and frequency of trusted computing static metrics for implementing the method of claim 1, comprising:

the measurement judging module is used for inquiring the attribute vector cache table and judging whether the strategy file is the first trusted measurement or not, and if so, the measurement module is executed; if not, comparing whether the actual attribute of the policy file is consistent with the cache attribute, if so, ending the judgment, and if not, executing the measurement module; the cache attribute is an attribute of the policy file cached in an attribute vector cache table, and the actual attribute is a self-contained attribute of the policy file;

and the measurement module is used for credibly measuring the policy file and writing the current measurement value and the last measurement time into an attribute vector cache table of the policy file.

8. The system for reducing the frequency and frequency of trusted computing static metrics of claim 7 further comprising:

and the attribute change monitoring module is used for monitoring the attribute change of the strategy file in the attribute vector cache table in real time.