WO2022027154A1 - Linux系统运行时状态的安全度量与安全验证方法 - Google Patents

Linux系统运行时状态的安全度量与安全验证方法 Download PDF

Info

Publication number
WO2022027154A1
WO2022027154A1 PCT/CN2020/000317 CN2020000317W WO2022027154A1 WO 2022027154 A1 WO2022027154 A1 WO 2022027154A1 CN 2020000317 W CN2020000317 W CN 2020000317W WO 2022027154 A1 WO2022027154 A1 WO 2022027154A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
module
component
security
file
Prior art date
Application number
PCT/CN2020/000317
Other languages
English (en)
French (fr)
Inventor
曾毅
吕应龙
王戍靖
Original Assignee
中科方德软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中科方德软件有限公司 filed Critical 中科方德软件有限公司
Publication of WO2022027154A1 publication Critical patent/WO2022027154A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2107—File encryption

Definitions

  • the embodiments of the present invention relate to the field of Linux system security operation methods, in particular to a security measurement and security verification method of a Linux system runtime state.
  • the Linux operating system is a clone system developed based on the UNIX operating system. It was born on October 5, 1991 in [Linux Desktop] (this is the time when it was officially announced to the public for the first time). With the help of the Internet network and the joint efforts of computer enthusiasts all over the world, it has become the most used UNIX operating system in the world today, and the number of users is still growing rapidly.
  • the Linux system uses the sha1 algorithm for encryption calculation by default, and the security strength is not enough, and there is a risk of being decrypted;
  • the existing measurement module can only measure files one by one, and cannot directly measure multiple files such as folders, that is, all executable and loadable class files in the folder;
  • the file content and file attributes/extended attributes are generated through the encryption hash algorithm to generate corresponding verification values, which are stored in the file system node in the form of extended attributes; when the system is running, before the file is accessed , the kernel module determines whether the file has been illegally tampered with offline by verifying the verification value of the file.
  • the measurement values are the same, and the unique measurement verification cannot be performed; and the measurement verification is only for a single file, which is inefficient.
  • the embodiment of the present invention provides a security measurement and security verification method for the runtime state of the Linux system.
  • the present invention performs extended research and development and security reinforcement according to the original security mechanism of the Linux operating system, and adopts a modular design to realize rich API interfaces.
  • the function and mechanism are more flexible, and the application layer scheme is more practical.
  • the Linux system When the Linux system is running, it also implements a unique, safe and efficient integrity measurement and verification mechanism at the file level to ensure system integrity.
  • a security measurement and a security verification method for the runtime state of a Linux system including a security runtime system and a method for realizing the security measurement and security verification of the runtime state of the Linux system by using the security runtime system. method;
  • the security operation system includes a measurement root module, a storage root module, a trusted report root module, an integrity verification module, and a configuration information management module;
  • the measurement root module is used to measure the file and generate the unique identifier of the file
  • the storage root module is used to store encrypted strings of all measured files
  • the integrity verification module is used to verify the integrity of the module
  • the trusted reporting module is used to obtain the running status information of the process
  • the self-defined information of the configuration information module is loaded into the kernel by the boot process service to realize the relevant information management function;
  • the method for realizing the security measurement and security verification of the runtime state of the Linux system by using the security operating system includes the following steps:
  • the configuration information module After the operating system boot service is started, after the configuration information is set, the configuration information module automatically reads the preset configuration information, and the information is automatically loaded into the kernel to perform policy management of metric verification;
  • the measurement root module comprehensively measures all executable and loadable type files in the Linux operating system, and only the trusted files can be executable or loadable;
  • the storage root module interacts with the measurement root module in real time, and stores the encrypted string generated by the measurement root module in real time.
  • the data stored in the storage root module exists in the form of a data set and is read when the process is running;
  • the integrity verification module is used to verify the relevant data and take effect in the running state of the process, that is, measure the process file in the running state of the process, calculate the measurement value of the process file in real time, and use it to judge the integrity of the running process sex;
  • the trusted report module obtains the key information in the running process, transmits it to the user space in real time, and prints it to the log file by the information display function module in a time-sharing manner.
  • the metric root module includes the following functional components: a file information collection component, an encrypted calculation component, a generated metric root string component, an API operation function module component, etc.;
  • the user runs the executable process or calls related API functions through the API operation function module component.
  • the file information collection component collects the file information and then calls the encryption calculation component for calculation.
  • the calculation result is generated by the metric root string component to generate the unique encrypted word corresponding to the file string, which is always reserved.
  • the generating metric root string component adopts an international standard addition and solution algorithm to generate a unique encrypted value for the file, ensuring that the storage root can only be operated by a specified process or API.
  • the storage fields include at least information fields such as file name, file path, etc.
  • the data storage form needs to take into account the read and write efficiency of user-mode and kernel-mode processes to ensure that the data written in user-mode can be read in real-time by kernel-mode. Pick.
  • the integrity verification module includes the following functional components: an information data reading component, a real-time encrypted string generation component, a data verification component, a runtime operation decision component, etc.;
  • the information data reading component is implemented by the kernel and obtains file information in real time
  • the real-time encrypted string generation component is implemented by the kernel, and uses the international standard encryption algorithm to generate the measurement root string according to the collected file information;
  • the data verification component is implemented by the kernel and is used to compare the real-time generated metric root with the previously stored metric root, and map the comparison result into a status string;
  • the runtime operation decision component is used to decide the running state of the current process.
  • runtime operation decision component will release the current runtime process or block the current runtime process according to the status string given by the integrity verification module.
  • the trusted reporting module includes the following functional components: an operation information acquisition component, an information transmission component, an information display component, etc.;
  • the operation information acquired by the operation information acquisition component specifically includes: information of all files that have been measured, information of processes that have passed the verification, and information of processes that have not passed the verification;
  • the information transmission component includes two parts: user mode and kernel mode.
  • the kernel mode transmits the information to be displayed to the user mode, and the user mode is displayed in a time-sharing manner;
  • the information display component is used to write the corresponding information into the user state file for the user to consult.
  • the configuration information module includes the following functional components: a boot service process component, an information configuration component, an information loading component, etc.;
  • the boot service process component runs at boot time to ensure the correct loading of related processes and configuration information
  • Users can use the information configuration component to customize the content items that need to be verified, and manage executable classes and loadable class files;
  • the information add-in component is used to write user-defined information into the kernel.
  • the present invention performs security verification in the running state of the program without changing the executable file; adopts the method of asynchronous operation and step-by-step execution to perform security measurement and verification to meet performance requirements;
  • the file generates a unique encrypted value; ensures that the storage root can only be operated by the specified process or API; realizes that the information of all processes that pass the verification can be displayed in the trusted report; realizes the asynchronous output of the trusted report from the kernel state to the user state, without Affects the real-time performance of the corresponding process; implements a customized metric verification strategy, and can customize the type of files to be verified;
  • the running state program of the entire system still has high stability, Enforceability and security;
  • the present invention is based on the prior art, realizes the operation of the Linux system, and also realizes a mechanism for integrity measurement and verification for the uniqueness, safety and efficiency of the file level, and guarantees the integrity of the system;
  • the present invention conducts extended research and development and security reinforcement, and adopts a modular design to realize rich API interface functions, the mechanism usage method is more flexible, and the application layer scheme is more practical, specifically including:
  • a unique identification value is implemented for files of the same name with the same content
  • Adopt a modular design scheme to separate and implement user operation, data processing and kernel operation logic; provide rich interface functions for third-party application software, and the operation method is more flexible, convenient and practical.
  • Fig. 1 is the method step flow chart that utilizes the safe operation system to realize the safety measurement and the safety verification of the Linux system runtime state provided by the present invention
  • Fig. 2 is the block diagram of the safe operation system provided by the present invention.
  • 1 measurement root module 1 measurement root module, 2 storage root module, 3 trusted reporting root module, 4 integrity verification module, 5 configuration information management module.
  • the security measurement and security verification method of the Linux system runtime state of this embodiment include a security runtime system and a method for realizing the security measurement and security verification of the Linux system runtime state by utilizing the security runtime system;
  • the security operation system includes a measurement root module 1, a storage root module 2, a trusted report root module 3, an integrity verification module 4, and a configuration information management module 5;
  • the measurement root module 1 is used to measure the file and generate the unique identifier of the file
  • the metric root module 1 includes the following functional components: a file information collection component, an encrypted calculation component, a generated metric root string component, an API operation function module component, etc.;
  • the user runs the executable process or invokes the relevant API functions through the API operation function module component.
  • the file information collection component collects the file information, it calls the encryption calculation component for calculation, and the calculation result is generated by the metric root string component to generate the unique encrypted word corresponding to the file string, which is always reserved.
  • the generating metric root string component adopts an international standard addition and solution algorithm to generate a unique encrypted value for the file, ensuring that the storage root can only be operated by a specified process or API.
  • the storage root module 2 is used to store the encrypted strings of all measured files
  • the storage fields at least include information fields such as file name, file path, etc.
  • the data storage form needs to take into account the read and write efficiency of user-mode and kernel-mode processes to ensure that data written in user-mode can be real-time by kernel-mode. read.
  • the integrity verification module 4 is used to verify the integrity of the module
  • the integrity verification module 4 includes the following functional components: an information data reading component, a real-time encrypted string generation component, a data verification component, a runtime operation decision component, etc.;
  • the information data reading component is implemented by the kernel and obtains file information in real time
  • the real-time encrypted string generation component is implemented by the kernel, and uses the international standard encryption algorithm to generate the measurement root string according to the collected file information;
  • the data verification component is implemented by the kernel and is used to compare the real-time generated metric root with the previously stored metric root, and map the comparison result into a status string;
  • the runtime operation decision component is used to decide the running state of the current process.
  • the runtime operation decision component will release the current runtime process or block the current runtime process according to the status string given by the integrity verification module 4 .
  • the trusted reporting module is used to obtain the running status information of the process
  • the trusted reporting module includes the following functional components: an operation information acquisition component, an information transmission component, an information display component, etc.;
  • the operation information acquired by the operation information acquisition component specifically includes: information of all files that have been measured, information of processes that have passed the verification, and information of processes that have not passed the verification;
  • the information transmission component includes two parts: user mode and kernel mode.
  • the kernel mode transmits the information to be displayed to the user mode, and the user mode is displayed in a time-sharing manner;
  • the information display component is used to write the corresponding information into the user state file for the user to consult.
  • the self-defined information of the configuration information module is loaded into the kernel by the boot process service to realize the relevant information management function;
  • the configuration information module includes the following functional components: a boot service process component, an information configuration component, an information loading component, etc.;
  • the boot service process component runs at boot time to ensure the correct loading of related processes and configuration information
  • Users can use the information configuration component to customize the content items that need to be verified, and manage executable classes and loadable class files;
  • the information add-in component is used to write user-defined information into the kernel.
  • the method for realizing the security measurement and security verification of the runtime state of the Linux system using this security operating system comprises the following steps:
  • the operating system booting service is started.
  • the configuration information module automatically reads the preset configuration information, and the information is automatically loaded into the kernel to perform policy management of metric verification;
  • the measurement root module 1 comprehensively measures all executable and loadable types of files in the Linux operating system, and only authorized files can be executable or loadable. Measure executable files and loadable class files, and the file information collection component collects After the file information, the encrypted calculation component is called to calculate, and the calculation result is generated as the unique encrypted string corresponding to the file through the generated measurement root string component, and the encrypted strings of all measured files are sent to the storage root module 2 for storage;
  • the storage root module 2 interacts with the measurement root module 1 in real time, and stores the encrypted string generated by the measurement root module 1 in real time.
  • the data stored in the storage root module 2 exists in the form of a data set and is read when the process is running ;
  • the integrity verification module 4 is used to verify the relevant data, and it takes effect in the running state of the process, that is, the process file is measured in the running state of the process. After the information data reading component obtains the file information, the real-time encrypted string is generated. The component generates a metric root string from the file information, and then the data verification component calculates the metric value of the process file in real time, which is used to judge the integrity of the runtime process, and the runtime operation decision component is used to decide the running state of the current process;
  • the trusted report module obtains the key information in the running process, transmits it to the user space in real time, and prints it to the log file by the information display function module in a time-sharing manner.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本发明公开了Linux系统运行时状态的安全度量与安全验证方法，具体涉及Linux系统安全运行方法领域，包括安全运行系统，安全运行系统包括度量根模块、存储根模块、可信报告根模块、完整性验证模块、配置信息管理模块；安全度量与安全验证的方法包括以下步骤：读取预设置的配置信息，进行度量验证的策略管理；度量根模块全盘度量可执行和可加载类型文件；将度量根模块生成的加密字串进行实时存储；数据校验后，判断运行时进程的完整性；可信报告模块将信息实时传输报告给用户。本发明在Linux系统运行时状态，实现一种文件级别可唯一性、安全且高效进行完整性度量与验证的机制，实时判断系统平台是否安全，保障系统完整性，防止被篡改攻击。

Description

Linux系统运行时状态的安全度量与安全验证方法 技术领域
本发明实施例涉及Linux系统安全运行方法领域，具体涉及Linux系统运行时状态的安全度量与安全验证方法。
背景技术
Linux操作系统是基于UNIX操作系统发展而来的一种克隆系统，它诞生于1991年的[Linux桌面]10月5日(这是第一次正式向外公布的时间)。以后借助于Internet网络，并通过全世界各地计算机爱好者的共同努力，已成为今天世界上使用最多的一种UNIX类操作系统，并且使用人数还在迅猛增长。
现有技术中Linux操作系统可以实现度量与验证的基本功能，但目前存在一些缺点：
1.在安全度量相同内容的同名文件时，加密度量值相同，从安全度量角度来说，不能唯一标识对应文件；
2.Linux系统默认使用sha1算法进行加密计算，安全强度不够，有被解密风险；
3.现有度量模块，只能对文件逐个进行度量，不能直接对文件夹等多个文件进行度量，即该文件夹内的所有可执行和可加载类文件；
4.在安全验证模块，不能对解释执行的脚本类实体文件进行验证。
在Linux系统中完整性度量机制，将文件内容和文件的属性/扩展属性，通过加密哈希算法生成对应的验证值，以扩展属性方式保存在文件系统节点中；系统运行时在文件被访问前，内核模块通过校验文件的验证值，判断文件是否被离线非法篡改过。
但对于内容相同文件，度量值相同，无法做到唯一性度量验证；并且仅针对单个文件度量验证，效率不高。
目前没有找到可解决上述问题的相关技术方案。
发明内容
为此，本发明实施例提供Linux系统运行时状态的安全度量与安全验证方法，本发明根据linux操作系统原有安全机制，进行扩展研发及安全加固，并且采用模块化设计，实现丰富的API接口函数，机制使用方法更灵活，应用层方案更实用，实现Linux系统运行时，还实现一种针对文件级别可唯一性、安全且高效进行完整性度量与验证的机制，保障系统完整性。
为了实现上述目的，本发明实施例提供如下技术方案：Linux系统运行时状态的安全度量与安全验证方法，包括安全运行系统以及利用该安全运行系统实现Linux系统运行时状态的安全度量与安全验证的方法；
安全运行系统包括度量根模块、存储根模块、可信报告根模块、完整性验证模块、配置信息管理模块；
度量根模块用于度量文件，生成文件的唯一标识；
存储根模块用于存储所有度量过的文件的加密字串；
完整性验证模块用于验证模块的完整性；
可信报告模块用于获取进程的运行时的状态信息；
配置信息模块的自定义信息由开机进程服务加载到内核，实现相关信息管理功能；
利用该安全运行系统实现Linux系统运行时状态的安全度量与安全验证的方法包括以下步骤：
S1、操作系统开机服务启动后，配置信息设置后，配置信息模块自动读取预设置的配置信息，信息自动加载到内核，进行度量验证的策略管理；
S2、度量根模块全盘度量linux操作系统内的所有可执行和可加载类型文件，授信的文件才可执行或可加载；
S3、存储根模块与度量根模块实时交互，将度量根模块生成的加密字串进行实时存储，存储根模块存储的数据以数据集的形式存在，在进程的运行时被读取；
S4、完整性验证模块用于对相关数据进行校验，在进程运行态生效，即在进程的运行时状态对进程文件进行度量，实时计算进程文件的度量数值，用于判断运行时进程的完整性；
S5、可信报告模块获取此运行过程中的关键信息，实时传输到用户空间， 由信息展示功能模块分时打印到日志文件。
进一步地，所述度量根模块包括以下功能组件：文件信息采集组件、加密计算组件、生成度量根字串组件、API操作函数模块组件等；
用户运行可执行进程或通过API操作函数模块组件调用相关API函数，文件信息采集组件采集文件信息后调用加密计算组件进行计算，计算结果经生成度量根字串组件生成为该文件对应的唯一加密字串，始终保留该字串。
进一步地，所述生成度量根字串组件采用国际标准加解算法，给文件生成唯一的加密数值，保障存储根只能被指定进程或API操作。
进一步地，存储根模块中，存储字段至少包括文件名称、文件路径等信息字段，数据存储形式需要兼顾用户态与内核态进程的读写效率，保证用户态写入的数据能被内核态实时读取。
进一步地，所述完整性验证模块包括以下功能组件：信息数据读取组件、实时加密字串生成组件、数据验证组件、运行时操作决策组件等；
信息数据读取组件由内核实现，实时获取文件信息；
实时加密字串生成组件由内核实现，根据采集的文件信息使用国际标准加密算法来生成度量根字串；
数据验证组件由内核实现，用于比对实时生成的度量根和先前存储的度量根，将比对结果映射成状态字串；
运行时操作决策组件用于决策当前进程的运行状态。
进一步地，所述运行时操作决策组件会根据完整性验证模块给出的状态字串放行当前运行时进程或阻断当前运行时进程。
进一步地，所述可信报告模块包括以下功能组件：操作信息获取组件、信息传输组件、信息展示组件等；
操作信息获取组件获取的操作信息具体包括：度量过的所有文件的信息，验证通过的进程的信息，验证未通过的进程的信息；
信息传输组件包括用户态和内核态两部分，内核态将要展示的信息传输到用户态，用户态分时展示；
信息展示组件用于将对应信息写入用户态文件，供用户查阅。
进一步地，所述配置信息模块包括以下功能组件：开机服务进程组件、 信息配置组件、信息加载组件等；
开机服务进程组件在开机时运行，保障相关进程和配置信息的正确加载；
用户可使用信息配置组件自定义需要验证的内容项，对可执行类和可加载类文件进行管理；
信息加载项组件用于将用户的自定义信息写入内核。
本发明实施例具有如下优点：
1、本发明在程序的运行态，不改变该可运行文件的情况下进行安全验证；采用异步操作且分步执行的方法进行安全度量与验证来满足性能要求；采用国际标准加解算法，给文件生成唯一的加密数值；保障存储根只能被指定进程或API操作；实现了可信报告里可以显示验证通过的所有进程的信息；实现了可信报告由内核态向用户态异步输出，未影响对应进程实时运行的性能；实现了定制的度量验证策略，可对需要验证的文件的类型进行自定义设置；整个系统的运行态程序在实时性的特点下，依然具有较高的稳定性、执行性和安全性；
2、本发明基于现有技术，实现Linux系统运行时，还实现一种针对文件级别可唯一性、安全且高效进行完整性度量与验证的机制，保障系统完整性；
3、本发明根据linux操作系统原有安全机制，进行扩展研发及安全加固，并且采用模块化设计，实现丰富的API接口函数，机制使用方法更灵活，应用层方案更实用，具体包括：
a.针对相同内容的同名文件实现了唯一标识值；
b.实用增强安全算法进行加密计算，提高安全性；
c.实现对文件夹度量，提升系统运行效率；
d.实现对解释执行的脚本类实体文件进行验证；
e.采用模块化设计方案，将用户操作、数据处理及内核运行逻辑分离实现；给第三方应用软件提供丰富接口函数，操作使用方法更灵活、便捷、实用。
附图说明
为了更清楚地说明本发明的实施方式或现有技术中的技术方案，下面将 对实施方式或现有技术描述中所需要使用的附图作简单地介绍。显而易见地，下面描述中的附图仅仅是示例性的，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图引申获得其它的实施附图。
本说明书所绘示的结构、比例、大小等，均仅用以配合说明书所揭示的内容，以供熟悉此技术的人士了解与阅读，并非用以限定本发明可实施的限定条件，故不具技术上的实质意义，任何结构的修饰、比例关系的改变或大小的调整，在不影响本发明所能产生的功效及所能达成的目的下，均应仍落在本发明所揭示的技术内容得能涵盖的范围内。
图1为本发明提供的利用安全运行系统实现Linux系统运行时状态的安全度量与安全验证的方法步骤流程图；
图2为本发明提供的安全运行系统框图；
图中：1度量根模块、2存储根模块、3可信报告根模块、4完整性验证模块、5配置信息管理模块。
具体实施方式
以下由特定的具体实施例说明本发明的实施方式，熟悉此技术的人士可由本说明书所揭露的内容轻易地了解本发明的其他优点及功效，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
参照说明书附图2，该实施例的Linux系统运行时状态的安全度量与安全验证方法，包括安全运行系统以及利用该安全运行系统实现Linux系统运行时状态的安全度量与安全验证的方法；
安全运行系统包括度量根模块1、存储根模块2、可信报告根模块3、完整性验证模块4、配置信息管理模块5；
度量根模块1用于度量文件，生成文件的唯一标识；
进一步地，所述度量根模块1包括以下功能组件：文件信息采集组件、加密计算组件、生成度量根字串组件、API操作函数模块组件等；
用户运行可执行进程或通过API操作函数模块组件调用相关API函数， 文件信息采集组件采集文件信息后调用加密计算组件进行计算，计算结果经生成度量根字串组件生成为该文件对应的唯一加密字串，始终保留该字串。
所述生成度量根字串组件采用国际标准加解算法，给文件生成唯一的加密数值，保障存储根只能被指定进程或API操作。
存储根模块2用于存储所有度量过的文件的加密字串；
进一步地，存储根模块2中，存储字段至少包括文件名称、文件路径等信息字段，数据存储形式需要兼顾用户态与内核态进程的读写效率，保证用户态写入的数据能被内核态实时读取。
完整性验证模块4用于验证模块的完整性；
进一步地，所述完整性验证模块4包括以下功能组件：信息数据读取组件、实时加密字串生成组件、数据验证组件、运行时操作决策组件等；
信息数据读取组件由内核实现，实时获取文件信息；
实时加密字串生成组件由内核实现，根据采集的文件信息使用国际标准加密算法来生成度量根字串；
数据验证组件由内核实现，用于比对实时生成的度量根和先前存储的度量根，将比对结果映射成状态字串；
运行时操作决策组件用于决策当前进程的运行状态。
所述运行时操作决策组件会根据完整性验证模块4给出的状态字串放行当前运行时进程或阻断当前运行时进程。
可信报告模块用于获取进程的运行时的状态信息；
进一步地，所述可信报告模块包括以下功能组件：操作信息获取组件、信息传输组件、信息展示组件等；
操作信息获取组件获取的操作信息具体包括：度量过的所有文件的信息，验证通过的进程的信息，验证未通过的进程的信息；
信息传输组件包括用户态和内核态两部分，内核态将要展示的信息传输到用户态，用户态分时展示；
信息展示组件用于将对应信息写入用户态文件，供用户查阅。
配置信息模块的自定义信息由开机进程服务加载到内核，实现相关信息管理功能；
进一步地，所述配置信息模块包括以下功能组件：开机服务进程组件、信息配置组件、信息加载组件等；
开机服务进程组件在开机时运行，保障相关进程和配置信息的正确加载；
用户可使用信息配置组件自定义需要验证的内容项，对可执行类和可加载类文件进行管理；
信息加载项组件用于将用户的自定义信息写入内核。
参照说明书附图1，利用该安全运行系统实现Linux系统运行时状态的安全度量与安全验证的方法包括以下步骤：
S1、操作系统开机服务启动，配置信息设置后，配置信息模块自动读取预设置的配置信息，信息自动加载到内核，进行度量验证的策略管理；
S2、度量根模块1全盘度量linux操作系统内的所有可执行和可加载类型文件，授信的文件才可执行或可加载，对可执行文件度量以及对可加载类文件度量，文件信息采集组件采集文件信息后调用加密计算组件进行计算，计算结果经生成度量根字串组件生成为该文件对应的唯一加密字串，所有度量过的文件的加密字串发送给存储根模块2进行存储；
S3、存储根模块2与度量根模块1实时交互，将度量根模块1生成的加密字串进行实时存储，存储根模块2存储的数据以数据集的形式存在，在进程的运行时被读取；
S4、完整性验证模块4用于对相关数据进行校验，在进程运行态生效，即在进程的运行时状态对进程文件进行度量，信息数据读取组件获取文件信息后，实时加密字串生成组件将文件信息生成度量根字串，再由数据验证组件实时计算进程文件的度量数值，用于判断运行时进程的完整性，运行时操作决策组件用于决策当前进程的运行状态；
当运行时验证通过，获取度量验证失败的信息和成功的信息；
对于失败的信息，拦截进程运行；
对于验证成功的信息，进程运行成功；
S5、可信报告模块获取此运行过程中的关键信息，实时传输到用户空间，由信息展示功能模块分时打印到日志文件。
虽然，上文中已经用一般性说明及具体实施例对本发明作了详尽的描述，但在本发明基础上，可以对之作一些修改或改进，这对本领域技术人员而言是显而易见的。因此，在不偏离本发明精神的基础上所做的这些修改或改进，均属于本发明要求保护的范围。

Claims (8)

  1. Linux系统运行时状态的安全度量与安全验证方法，其特征在于：包括安全运行系统以及利用该安全运行系统实现Linux系统运行时状态的安全度量与安全验证的方法；
    安全运行系统包括度量根模块(1)、存储根模块(2)、可信报告根模块(3)、完整性验证模块(4)、配置信息管理模块(5)；
    度量根模块(1)用于度量文件，生成文件的唯一标识；
    存储根模块(2)用于存储所有度量过的文件的加密字串；
    完整性验证模块(4)用于验证模块的完整性；
    可信报告模块用于获取进程的运行时的状态信息；
    配置信息模块的自定义信息由开机进程服务加载到内核，实现相关信息管理功能；
    利用该安全运行系统实现Linux系统运行时状态的安全度量与安全验证的方法包括以下步骤：
    S1、操作系统开机服务启动后，配置信息设置后，配置信息模块自动读取预设置的配置信息，信息自动加载到内核，进行度量验证的策略管理；
    S2、度量根模块(1)全盘度量linux操作系统内的所有可执行和可加载类型文件；
    S3、存储根模块(2)与度量根模块(1)实时交互，将度量根模块(1)生成的加密字串进行实时存储，存储根模块(2)存储的数据以数据集的形式存在，在进程的运行时被读取；
    S4、完整性验证模块(4)用于对相关数据进行校验，在进程运行态生效，即在进程的运行时状态对进程文件进行度量，实时计算进程文件的度量数值，用于判断运行时进程的完整性；
    S5、可信报告模块获取此运行过程中的关键信息，实时传输到用户空间，由信息展示功能模块分时打印到日志文件。
  2. 根据权利要求1所述的Linux系统运行时状态的安全度量与安全验证方 法，其特征在于：所述度量根模块(1)包括以下功能组件：文件信息采集组件、加密计算组件、生成度量根字串组件、API操作函数模块组件；
    用户运行可执行进程或通过API操作函数模块组件调用相关API函数，文件信息采集组件采集文件信息后调用加密计算组件进行计算，计算结果经生成度量根字串组件生成为该文件对应的唯一加密字串，始终保留该字串。
  3. 根据权利要求2所述的Linux系统运行时状态的安全度量与安全验证方法，其特征在于：所述生成度量根字串组件采用国际标准加解算法，给文件生成唯一的加密数值，保障存储根只能被指定进程或API操作。
  4. 根据权利要求1所述的Linux系统运行时状态的安全度量与安全验证方法，其特征在于：存储根模块(2)中，存储字段包括文件名称、文件路径，数据存储形式需要兼顾用户态与内核态进程的读写效率，保证用户态写入的数据能被内核态实时读取。
  5. 根据权利要求1所述的Linux系统运行时状态的安全度量与安全验证方法，其特征在于：所述完整性验证模块(4)包括以下功能组件：信息数据读取组件、实时加密字串生成组件、数据验证组件、运行时操作决策组件；
    信息数据读取组件由内核实现，实时获取文件信息；
    实时加密字串生成组件由内核实现，根据采集的文件信息使用国际标准加密算法来生成度量根字串；
    数据验证组件由内核实现，用于比对实时生成的度量根和先前存储的度量根，将比对结果映射成状态字串；
    运行时操作决策组件用于决策当前进程的运行状态。
  6. 根据权利要求5所述的Linux系统运行时状态的安全度量与安全验证方法，其特征在于：所述运行时操作决策组件会根据完整性验证模块(4)给出的状态字串放行当前运行时进程或阻断当前运行时进程。
  7. 根据权利要求1所述的Linux系统运行时状态的安全度量与安全验证方法，其特征在于：所述可信报告模块包括以下功能组件：操作信息获取组件、信息传输组件、信息展示组件；
    操作信息获取组件获取的操作信息具体包括：度量过的所有文件的信息，验证通过的进程的信息，验证未通过的进程的信息；
    信息传输组件包括用户态和内核态两部分，内核态将要展示的信息传输到用户态，用户态分时展示；
    信息展示组件用于将对应信息写入用户态文件，供用户查阅。
  8. 根据权利要求1所述的Linux系统运行时状态的安全度量与安全验证方法，其特征在于：所述配置信息模块包括以下功能组件：开机服务进程组件、信息配置组件、信息加载组件；
    开机服务进程组件在开机时运行，保障相关进程和配置信息的正确加载；
    用户可使用信息配置组件自定义需要验证的内容项，对可执行类和可加载类文件进行管理；
    信息加载项组件用于将用户的自定义信息写入内核。
PCT/CN2020/000317 2020-08-07 2020-12-24 Linux系统运行时状态的安全度量与安全验证方法 WO2022027154A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010786339.4A CN111914303B (zh) 2020-08-07 2020-08-07 Linux系统运行时状态的安全度量与安全验证方法
CN202010786339.4 2020-08-07

Publications (1)

Publication Number Publication Date
WO2022027154A1 true WO2022027154A1 (zh) 2022-02-10

Family

ID=73288139

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/000317 WO2022027154A1 (zh) 2020-08-07 2020-12-24 Linux系统运行时状态的安全度量与安全验证方法

Country Status (2)

Country Link
CN (1) CN111914303B (zh)
WO (1) WO2022027154A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115098034A (zh) * 2022-07-07 2022-09-23 北京双洲科技有限公司 一种linux操作系统环境下文件加密密钥的存储方法
CN115510427A (zh) * 2022-11-21 2022-12-23 博智安全科技股份有限公司 跨平台进程运行可信监控方法和系统
CN115688187A (zh) * 2023-01-04 2023-02-03 中科方德软件有限公司 一种硬链接数据的安全管理方法、装置、电子设备及计算机可读存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111914303B (zh) * 2020-08-07 2023-08-18 中科方德软件有限公司 Linux系统运行时状态的安全度量与安全验证方法
CN112929222A (zh) * 2021-03-04 2021-06-08 睿石网云(杭州)科技有限公司 一种复杂应用系统运行态势感知方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101504704A (zh) * 2009-03-17 2009-08-12 武汉大学 由星型信任链支持的嵌入式平台应用程序完整性验证方法
CN104573516A (zh) * 2014-12-25 2015-04-29 中国科学院软件研究所 一种基于安全芯片的工控系统可信环境管控方法和平台
CN105956466A (zh) * 2016-04-28 2016-09-21 浪潮电子信息产业股份有限公司 一种基于tpm的主动度量及异常上报系统和方法
CN111914303A (zh) * 2020-08-07 2020-11-10 中科方德软件有限公司 Linux系统运行时状态的安全度量与安全验证方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101344904B (zh) * 2008-09-02 2010-09-01 中国科学院软件研究所 一种动态度量方法
US9118666B2 (en) * 2010-06-30 2015-08-25 Google Inc. Computing device integrity verification
CN103577748B (zh) * 2013-11-20 2017-01-18 北京可信华泰信息技术有限公司 基于可信计算的动态度量方法与管理系统
US9405920B1 (en) * 2014-05-21 2016-08-02 Amazon Technologies, Inc. Data integrity verification
CN108399338B (zh) * 2018-02-06 2022-03-18 南京航空航天大学 基于进程行为的平台完整性状态信息度量方法
CN111291371A (zh) * 2020-01-10 2020-06-16 北京深之度科技有限公司 一种应用程序安全验证方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101504704A (zh) * 2009-03-17 2009-08-12 武汉大学 由星型信任链支持的嵌入式平台应用程序完整性验证方法
CN104573516A (zh) * 2014-12-25 2015-04-29 中国科学院软件研究所 一种基于安全芯片的工控系统可信环境管控方法和平台
CN105956466A (zh) * 2016-04-28 2016-09-21 浪潮电子信息产业股份有限公司 一种基于tpm的主动度量及异常上报系统和方法
CN111914303A (zh) * 2020-08-07 2020-11-10 中科方德软件有限公司 Linux系统运行时状态的安全度量与安全验证方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115098034A (zh) * 2022-07-07 2022-09-23 北京双洲科技有限公司 一种linux操作系统环境下文件加密密钥的存储方法
CN115510427A (zh) * 2022-11-21 2022-12-23 博智安全科技股份有限公司 跨平台进程运行可信监控方法和系统
CN115688187A (zh) * 2023-01-04 2023-02-03 中科方德软件有限公司 一种硬链接数据的安全管理方法、装置、电子设备及计算机可读存储介质

Also Published As

Publication number Publication date
CN111914303A (zh) 2020-11-10
CN111914303B (zh) 2023-08-18

Similar Documents

Publication Publication Date Title
WO2022027154A1 (zh) Linux系统运行时状态的安全度量与安全验证方法
CN110199288B (zh) 交叉平台包围区数据密封方法和系统
AU2017395733B2 (en) Data unsealing with a sealing enclave
US8549288B2 (en) Dynamic creation and hierarchical organization of trusted platform modules
US9288155B2 (en) Computer system and virtual computer management method
CN110199286B (zh) 利用密封包围区的数据密封的方法及系统
Zheng et al. Using replication and partitioning to build secure distributed systems
AU2017395731C1 (en) Abstract enclave identity
US20060026418A1 (en) Method, apparatus, and product for providing a multi-tiered trust architecture
KR20190108574A (ko) 크로스-플랫폼 엔클레이브 신원
US8689318B2 (en) Trusted computing entities
CN112800429B (zh) 一种基于基础性的uefi bios固件系统中驱动程序保护的方法
WO2018140166A1 (en) Enclave abstraction model
Goodrich et al. Athos: Efficient authentication of outsourced file systems
BR112014031586B1 (pt) Sistema para emular um ambiente de execução confiável e midia de armazenamento de computador
Van Dijk et al. Offline untrusted storage with immediate detection of forking and replay attacks
JP6769999B2 (ja) セキュア計算環境
KR100949024B1 (ko) 리소스 획득 방법 및 컴퓨터 판독 가능 매체
Tuveri et al. Start your ENGINEs: dynamically loadable contemporary crypto
Catuogno et al. An architecture for kernel-level verification of executables at run time
US11435907B2 (en) Ensuring data authenticity using notary as a service
Ott et al. Universal Remote Attestation for Cloud and Edge Platforms
JPWO2021086737A5 (zh)
CN108880785A (zh) 一种检测C++虚表被hook的方法、装置、终端及可读介质
Cabuk et al. Trusted Integrity Measurement and Reporting for Virtualized Platforms: (Work-in-Progress)

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20948705

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11/05/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20948705

Country of ref document: EP

Kind code of ref document: A1