WO2024027472A1 - 一种确定内核状态的方法和相关设备 - Google Patents

一种确定内核状态的方法和相关设备 Download PDF

Info

Publication number
WO2024027472A1
WO2024027472A1 PCT/CN2023/106854 CN2023106854W WO2024027472A1 WO 2024027472 A1 WO2024027472 A1 WO 2024027472A1 CN 2023106854 W CN2023106854 W CN 2023106854W WO 2024027472 A1 WO2024027472 A1 WO 2024027472A1
Authority
WO
WIPO (PCT)
Prior art keywords
kernel
parameter
calculated value
tee
address
Prior art date
Application number
PCT/CN2023/106854
Other languages
English (en)
French (fr)
Inventor
沈国华
刘钢
葛振耀
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024027472A1 publication Critical patent/WO2024027472A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/02—Addressing or allocation; Relocation
    • G06F12/06—Addressing a physical block of locations, e.g. base addressing, module addressing, memory dedication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • Embodiments of the present application relate to the field of computers, and more specifically, to a method for determining a kernel state, a computing device, a computing device, a chip system, and a computer-readable storage medium.
  • the security of applications in ordinary operating systems depends on the security of the operating system, and the security of the operating system depends on the security of the kernel.
  • the kernel can safely start the security library of the application in the operating system to confirm that the relevant files of the application have not been modified.
  • the operating system can perform dynamic calculations by extending the corresponding rows and verify whether the application is running in a trustworthy state through local or remote certification.
  • the operating system is a collection of capabilities provided after the kernel is mapped into memory for execution, extended functions are loaded, and necessary system services are started. Therefore, the trustworthiness of the kernel is the basis for the security of the operating system and the applications in the operating system.
  • a rich execution environment rich execution environment
  • a trusted execution environment trusted execution environment, TEE
  • the processor can run in REE or TEE and ensure that the code in the TEE will not be maliciously modified or stolen.
  • REE and TEE cannot obtain each other's execution status.
  • the effective computing information of the current kernel can be obtained through the high-privilege proxy application deployed in the REE, and passed to the trusted operating system/trusted application (trusted execution environment) in the TEE operating system/trusted application, TEEOS/TA).
  • TEEOS/TA After receiving the calculation information, TEEOS/TA considers the kernel trustworthy.
  • the basis for TEEOS/TA to determine that the kernel is trustworthy is that the high-privilege agent application (agent) is trustworthy, and the trustworthiness of the high-privilege agent application depends on the trustworthiness of the kernel.
  • a high-privilege proxy application can still perform calculations on the kernel and send calculation information to TEEOS/TA. After TEEOS/TA receives the calculation information, it will still consider the kernel to be trusted, that is, this method cannot form a trusted closed loop.
  • Embodiments of the present application provide a method, computing device, computing equipment, chip system and computer-readable storage medium for determining the core status, which can directly calculate the data information of the core in the TEE, that is, it is formed in the process of determining the core status. Trusted closed loop, which can more accurately and reliably determine whether the kernel is trustworthy, thus protecting the security of computing devices.
  • the first aspect provides a method to determine the kernel status.
  • the method includes: when receiving the indication information, enter the trusted execution environment TEE, and the indication information is used to indicate and determine the status of the kernel; in the TEE, obtain the data information of the kernel according to the storage location of the kernel in the storage device; in the TEE The data information of the kernel is calculated to determine the actual calculated value of the kernel. The actual calculated value is used to determine the status of the kernel.
  • the status of the kernel includes trustworthy or untrustworthy.
  • the computing device can directly determine the storage location of the kernel in the TEE and obtain the data information of the kernel. It can also directly calculate the data information of the kernel in the TEE to obtain the actual calculation value of the kernel.
  • a trusted closed loop can be formed when determining the status of the kernel, ensuring that the actual calculated value obtained is trustworthy and accurate, thereby more accurately determining whether the kernel is trustworthy, and thereby protecting the computing device. Safety.
  • the first parameter and the second parameter are obtained in the TEE through the basic input and output system BIOS; and the storage location is determined in the TEE based on the first parameter and the second parameter.
  • the first parameter includes the boot address of the kernel and the length of the kernel.
  • the second parameter includes the rich execution environment REE memory in the storage device.
  • the physical starting address of the storage space, or the second parameter includes the physical starting address of the REE storage space and the address offset of the kernel.
  • the computing device can obtain the first parameter and the second parameter through the BIOS, thereby determining the storage location of the kernel in the storage device based on the first parameter and the second parameter.
  • the computing device can obtain the trusted first parameter and the second parameter in the TEE in a safe and trustworthy manner, thereby facilitating the formation of a trusted closed loop and ensuring that the storage location of the obtained kernel is trustworthy. And accurate, so that the core data information can be obtained more accurately.
  • the first parameter is a parameter stored in the BIOS
  • the second parameter is a parameter determined by the BIOS
  • the first parameter can be pre-stored in the BIOS, and the BIOS can directly determine the second parameter, thereby ensuring that the first parameter and the second parameter obtained by the computing device in the TEE are credible and accurate, and thus can Convenient to form a trusted closed loop.
  • the storage location includes the physical starting address of the core in the storage device and the length of the core.
  • the physical starting address of the core in the storage device is based on the physical location of the REE storage space.
  • the starting address is determined by the startup address of the kernel, or the physical starting address of the kernel in the storage device is determined by the physical starting address of the REE storage space, the startup address of the kernel, and the address offset of the kernel.
  • the computing device can determine the physical starting address of the kernel in the storage device and the length of the kernel based on the first parameter and the second parameter in the TEE. Moreover, the computing device can directly read the data information of the kernel in the TEE based on the physical starting address of the kernel in the storage device and the length of the kernel, thereby facilitating calculation of the data information of the kernel, and thereby determining the credible actual calculation. value.
  • the data information of the kernel is read from the storage device according to the physical starting address and length of the kernel in the storage device.
  • the computing device can directly read the data information of the kernel from the storage device according to the storage location of the kernel in the TEE, thereby ensuring that the data information of the read kernel is the real data of the currently running kernel. information, which can more accurately determine whether the kernel is trustworthy.
  • the baseline calculation value and the actual calculation value of the kernel are compared in the TEE, and the baseline calculation value is a preset value; if the baseline calculation value and the actual calculation value are the same, then it is determined The status of the kernel is trusted; if the baseline calculated value and the actual calculated value are different, it is determined that the status of the kernel is untrusted.
  • the computing device can directly compare the actual calculated value of the kernel with the baseline calculated value in the TEE, thereby determining whether the kernel has been attacked or modified based on whether the actual calculated value of the kernel and the baseline calculated value are the same, and then determining whether the kernel has been attacked or modified. status is credible.
  • the baseline calculation value is determined based on the data information of the kernel when the kernel is compiled.
  • the baseline calculation value of the kernel can be determined based on the data information of the kernel during compilation. That is, the baseline calculation value is the calculation value obtained by calculating the data information of the kernel in a trusted state.
  • the computing device can determine that the data information of the kernel has been modified when the actual calculated value is different from the baseline calculated value, thereby determining that the status of the kernel is untrustworthy.
  • the actual calculated value is encrypted in the TEE to obtain the encrypted actual calculated value; the encrypted actual calculated value is sent to the management device, and the encrypted actual calculated value is The calculated values are used by management devices, which are other computing devices connected to the computing device including the storage device, to determine the state of the kernel.
  • the computing device can send the actual calculated value to the management device connected to the computing device, so that the management device can determine whether the kernel of the computing device is trustworthy. Moreover, when the computing device sends the actual calculated value, it can also encrypt the actual calculated value, so that the management device can verify the received actual calculated value and determine whether the received actual calculated value is credible.
  • embodiments of the present application provide a computing device, which includes a unit for implementing the first aspect or any possible implementation of the first aspect.
  • inventions of the present application provide a computer device.
  • the computer device includes a processor, the processor being coupled to a memory, reading and executing instructions and/or program codes in the memory to execute the first aspect or Any possible implementation of the first aspect.
  • inventions of the present application provide a chip system.
  • the chip system includes a logic circuit that is coupled to an input/output interface and transmits data through the input/output interface to perform the first aspect or the first aspect. any possible implementation.
  • embodiments of the present application provide a computer-readable storage medium that stores program code, When the computer storage medium is run on a computer, the computer is caused to execute the first aspect or any possible implementation of the first aspect.
  • inventions of the present application provide a computer program product.
  • the computer program product includes: computer program code.
  • the computer program code When the computer program code is run on a computer, it causes the computer to execute the first aspect or any of the first aspects.
  • FIG. 1 is a schematic architectural diagram of a computing device 100.
  • Figure 2 is a schematic flowchart of a method for determining kernel status according to an embodiment of the present application.
  • Figure 3 is a schematic block diagram of a storage location of a kernel according to an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a method for determining a kernel status according to another embodiment of the present application.
  • Figure 5 is a schematic structural diagram of a computing device according to an embodiment of the present application.
  • Figure 6 is a schematic structural diagram of a computing device according to an embodiment of the present application.
  • the technical solutions of the embodiments of the present application can be applied to various computing devices including kernels and TEEs, such as hosts, desktops, laptops, etc., and the embodiments of the present application are not limited thereto.
  • FIG. 1 is a schematic architectural diagram of a computing device 100.
  • Computing device 100 may include a processor 110, memory 120, a basic input output system (BIOS) BIOS 130, and a hardware platform 140.
  • BIOS basic input output system
  • the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the computing device 100 .
  • the computing device 100 may include more or fewer components than shown, or some components may be combined, some components may be separated, or some components may be arranged differently.
  • the components illustrated may be implemented in hardware, software, or a combination of software and hardware.
  • the processor 110 may be, for example, a central processing unit (CPU) or a graphics processing unit (GPU).
  • the processor 110 is the computing and control core of the computing device 100 and can run in a REE or TEE.
  • the processor 110 runs in a REE or TEE
  • the processor 110 runs in a REE or TEE state
  • the processor 110 runs in a REE or TEE environment
  • the processor 110 runs in a REE or TEE”
  • the processor 110 runs in the REE, it can only access the hardware, software, and storage resources in the REE, but cannot access the hardware, software, and storage resources in the TEE. For example, when the processor 110 runs in REE, it can only access the REE storage 121 in the memory 120 but cannot access the TEE storage 122 in the memory 120 . When the processor 110 runs in the TEE, it can access the hardware, software and storage resources in the TEE, and can also access the storage resources in the REE. For example, when the processor 110 is running in a TEE, it can not only access the TEE storage 122 in the memory 120, but also access the REE storage 121 in the memory 120.
  • the processor 110 may enter the trusted execution environment TEE when receiving the indication information. This indication information is used to determine the status of the kernel.
  • the processor 110 may also determine the storage location of the core in the memory 120 in the TEE, that is, determine the location of the core 1211. This storage location is used by the processor 110 to read the data information in the core 1211.
  • the processor 110 can also calculate the data information in the core 1211 in the TEE based on the storage location, and determine the actual calculated value of the core 1211. The actual calculated value is used to determine the status of the core 1211, which includes trusted or untrusted.
  • the processor 110 may also obtain the first parameter and the second parameter through the BIOS 130 in the TEE.
  • the first parameter may include the boot address of the core 1211 and the length of the core 1211.
  • the boot address of kernel 1211 is the physical starting address when the compressed kernel is decompressed into memory 120.
  • the second parameter may include the physical starting address of the REE storage space in the memory 120 .
  • the physical start address of the REE storage space in the memory 120 may be the physical start address of the REE storage 121 in FIG. 1 .
  • the second parameter may include the physical starting address of the REE storage space and the address offset of the kernel 1211.
  • KASLR kernel address space layout randomization
  • the address offset of the kernel 1211 is an address offset randomly generated by the computing device 100 before starting the kernel. This address offset is used to make the address of the kernel different with each boot of the computing device 100, that is, it can This makes it impossible for attackers to determine the physical address of kernel 1211, thus enhancing the security of the kernel.
  • the processor 110 may also determine the storage location of the core 1211 in the memory 120 according to the first parameter and the second parameter in the TEE.
  • the first parameter may be a parameter stored in the BIOS.
  • the first parameter may be an administrator of computing device 100 Manually import the parameters in the BIOS.
  • the administrator can import the first parameter into the BIOS through the BIOS menu, gateway, command-line interface (CLI), etc.
  • the first parameter is stored before the BIOS and may be encrypted, such as signed.
  • the public key for verifying the first parameter can be stored in the BIOS. That is to say, the first parameter stored in the BIOS is an encrypted parameter, and the BIOS can verify whether the first parameter is trustworthy through the public key, thereby enhancing the security of the kernel.
  • the second parameter may be a parameter determined by the BIOS.
  • the BIOS can initialize the memory 120 and allocate storage space for REE and TEE, that is, determine the storage locations of the REE storage 121 and the TEE storage 122 in the memory 120 . That is, the BIOS can determine the physical starting location of REE storage 121. In cases where KASLR technology is enabled in a computing device, the BIOS can also determine the address offset of a randomly generated kernel.
  • the storage location of the core 1211 in the REE storage 121 may include the physical starting address of the core 1211 in the memory 120 and the length of the core 1211.
  • the storage location of core 1211 in REE storage 121 includes the physical start address and physical end address of core 1211 in memory 120 .
  • the physical start address of the core 1211 in the memory 120 may be determined based on the physical start address of the REE storage 121 and the boot address of the core 1211.
  • the physical starting address of the core 1211 in the memory 120 is determined based on the physical starting address of the REE storage 121 , the boot address of the core 1211 and the address offset of the core 1211 .
  • the processor 110 can also obtain the data information of the core 1211 according to the storage location of the core 1211 in the TEE.
  • the processor 110 can also perform calculations on the data information of the core 1211 to obtain actual calculation values.
  • the actual calculated value includes at least one data bit of data.
  • the processor 110 may compare the baseline calculated value and the actual calculated value of the core 1211 in the TEE.
  • the baseline calculation value is a preset value, including data of at least one data bit. In the case where the baseline calculated value is the same as the actual calculated value, the processor 110 may determine that the status of the core is trusted. In the event that the baseline calculated value is different from the actual calculated value, the processor 110 may determine that the status of the kernel is untrusted.
  • the processor 110 may perform encryption processing, such as signing, on the actual calculated value in the TEE to obtain the encrypted actual calculated value.
  • the processor 110 may also send the encrypted actual calculated value to the management device.
  • Management devices are other computing devices connected to computing device 100 .
  • the management device can determine whether the kernel 1211 of the computing device 100 is trustworthy based on the encrypted actual calculated value, that is, the encrypted actual calculated value is used by the management device to determine the status of the kernel 1211.
  • the management device may also verify whether the encrypted actual calculated value is credible, and if it is determined that the encrypted actual calculated value is credible, determine the kernel of the computing device 100 based on the encrypted actual calculated value. Is 1211 credible?
  • the memory 120 can be used to store data or instructions, for example, it can be random access memory (random access memory, RAM), static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access Memory (synchronous dynamic RAM, SDRAM), double rate synchronous dynamic random access memory (double date rate SDRAM, DDR SDRAM), etc., are not limited in the embodiments of the present application.
  • the storage space in the memory 120 is divided into REE storage 121 and TEE storage 122.
  • REE storage 121 may store data or instructions in the REE.
  • Processor 110 may access data or instructions in REE storage 121 when running in REE or TEE.
  • the REE storage 121 can also store data information of the kernel, that is, the REE storage 121 includes the kernel 1211.
  • the kernel 1211 includes kernel data information, such as program code and other information.
  • TEE storage 122 may store data or instructions in the TEE.
  • Processor 110 can access data and instructions in TEE storage 122 while running in the TEE.
  • TEE storage 122 can also store data information of TEEOS/TA, that is, TEE storage 122 includes TEEOS/TA 1221.
  • TEEOS/TA 1221 includes TEEOS/TA data information, such as program code and other information.
  • the BIOS 130 includes the basic input and output programs of the computing device 100, the self-test program after power-on, the system startup program, etc., and is mainly used to provide the lowest level hardware settings and control for the computing device 100.
  • the first parameter can be stored in BIOS 130.
  • the BIOS 130 may include a unified extensible firmware interface (UEFI) variable area for storing the first parameter.
  • the BIOS 130 can also store a public key for verifying the first parameter, and can verify the first parameter according to the stored public key, thereby determining whether the first parameter is trustworthy.
  • BIOS 130 may also initialize memory 120 after startup, allocate REE storage 121 for REEs, and allocate TEE storage 122 for TEEs, thereby determining the second parameter.
  • the BIOS 130 may also pass the first parameter and the second parameter to the TEE storage 122, thereby facilitating the processor 110 to determine the storage location of the kernel in the memory 120 in the TEE.
  • the computing device 100 in Figure 1 can directly determine the storage location of the kernel in the TEE and perform calculations on the kernel, thereby forming a trusted closed loop in the process of determining the kernel status, and can more accurately determine whether the kernel is trustworthy, thereby protecting the computing Security of device 100.
  • Figure 2 is a schematic flow chart of a method for determining the status of a kernel. The method in Figure 2 includes the following steps.
  • the computing device may receive indication information instructing the computing device to determine the state of the kernel.
  • the computing device can also enter the TEE when receiving the indication information, thereby determining the status of the kernel in the TEE.
  • the indication information may come from other devices connected to the computing device, such as a management device.
  • the indication information may be triggered periodically within the computing device.
  • the indication information can be triggered by the user.
  • the indication may be triggered when a change occurs in the computing device.
  • the change in the computing device may be a change in the hardware of the computing device, or it may be a change in the software of the computing device, which is not limited in the embodiments of the present application.
  • S220 Obtain the data information of the kernel in the TEE according to the storage location of the kernel in the storage device.
  • the computing device can directly obtain the data information of the kernel from the storage device according to the location of the kernel in the storage device in the TEE.
  • the data information of the kernel refers to all data information stored by the kernel in the storage device, that is, all data information from the physical starting position of the kernel in the storage device to the physical end position of the kernel in the storage device.
  • the data information of the kernel includes all data information within the length of the kernel in the storage device.
  • the computing device can also access the data information in the REE storage space in the storage device in the TEE, and the kernel is located in the REE storage space in the storage device, the computing device can directly determine the storage location of the kernel in the TEE. Read the kernel data information in the REE storage space. That is to say, the computing device can start reading the data information of the kernel in the TEE according to the physical start address of the kernel in the storage device, and end reading the data information of the kernel at the physical end address of the kernel in the storage device.
  • the physical end address of the kernel in the storage device may be the sum of the physical start address of the kernel in the storage device and the length of the kernel. In other words, the computing device can directly read the data information of the kernel from the storage device in the TEE according to the physical starting address and length of the kernel in the storage device.
  • the computing device may directly determine the storage location of the kernel in the storage device in the TEE. This storage location can be used to obtain kernel data information.
  • the storage location may include the physical starting address of the core in the storage device and the length of the core.
  • the storage location may include the physical start address and physical end address of the kernel in the storage device, etc., which is not limited in the embodiments of the present application.
  • the computing device may determine the storage location of the kernel in the storage device according to the first parameter and the second parameter in the TEE.
  • the first parameter and the second parameter may be stored in a TEE storage space in the storage device.
  • the first parameter may include the boot address of the kernel and the length of the kernel.
  • the second parameter may include the physical starting address of the REE storage space in the storage device.
  • the second parameter may include the physical starting address of the REE storage space and the address offset of the kernel.
  • the physical starting address of the REE storage space is the physical starting address relative to the full physical address of the storage device. It should also be understood that in the case where the TEE storage space is hidden by the computing device, the physical starting address of the REE storage space is equivalent to the relative address of the TEE storage space in the storage device.
  • the physical starting address of the kernel in the storage device is determined based on the physical starting address of the REE storage space and the boot address of the kernel.
  • the physical starting address of the kernel in the storage device is determined based on the physical starting address of the REE storage space, the kernel's startup address, and the kernel's address offset.
  • the storage location of the kernel in the storage device may be as shown in FIG. 3 .
  • Figure 3 is a schematic block diagram of the storage locations of the kernel.
  • REE storage 310 in FIG. 3 is similar to REE storage 121 in FIG. 1
  • core 311 in FIG. 3 is similar to core 1211 in FIG. 1 .
  • the physical starting address of the kernel 311 in the storage device is the sum of the physical starting address of the REE, the startup address of the kernel, and the address offset of the kernel.
  • the physical start address of the REE is the physical start address of the REE storage 310 relative to the storage device.
  • the physical starting address of the kernel in the storage device is the physical starting address of the REE. and the kernel's boot address.
  • the computing device can transfer the first parameter and the second parameter to the TEE storage space through the BIOS, so that the computing device can obtain the first parameter and the second parameter in the TEE.
  • the first parameter is a parameter stored in the BIOS
  • the second parameter is a parameter determined by the BIOS.
  • the first parameter may be a parameter manually stored in the BIOS by an administrator of the computing device.
  • the administrator can store the first parameter into the BIOS through the BIOS menu, gateway, CLI, etc.
  • the first parameter may be determined when compiling the kernel.
  • the first parameter may be the same or different, which is not limited in the embodiments of the present application.
  • the step of storing the first parameter into the BIOS may be performed once when the version of the kernel changes. That is to say, if the kernel version or kernel in the computing device has not changed, the first parameter can be stored in the BIOS in the computing device when the computing device is run for the first time or before the first run. There is no need to repeatedly import the first parameter during subsequent operations of the computing device. If the kernel version in the computing device changes, the updated first parameter needs to be stored in the BIOS of the computing device when or before the computing device whose kernel version has been updated is run for the first time. The updated first parameter is determined based on the updated kernel.
  • the first parameter may be encrypted, for example, a digest of the first parameter may be signed.
  • the public key for verifying the first parameter may be stored in the BIOS. That is to say, the first parameter stored in the BIOS can be an encrypted parameter, and the BIOS can verify whether the first parameter is trustworthy through the public key, thereby enhancing the security of the kernel.
  • the manager can use a summary algorithm to process the first parameter and obtain a first summary of the first parameter.
  • the first digest can then be signed using the private key, thereby obtaining an encrypted first digest.
  • the first parameter and the encrypted first digest may then be stored in the BIOS.
  • the BIOS starts, it can use the public key to decrypt the encrypted first digest and obtain the decrypted first digest.
  • the first parameter can then be processed using the same digest algorithm to obtain a second digest of the first parameter.
  • it can be determined whether the first parameter is credible by comparing whether the first summary and the second summary are the same. Specifically, if the first digest and the second digest are the same, it means that the first parameter has not been tampered with and can be trusted. If the first digest and the second digest are different, it means that the first parameter has been tampered with and cannot be trusted.
  • the second parameter is a parameter determined by the BIOS during operation.
  • BIOS can initialize the storage device and allocate storage space for REE and TEE, that is, determine the REE storage space and TEE storage space in the storage device.
  • the REE storage space you can determine the physical starting address of the REE storage space and the length of the REE storage space.
  • the physical start address and physical end address of the REE storage space may be determined, which is not limited in the embodiments of the present application.
  • the BIOS may also determine the address offset of the kernel.
  • the kernel's address offset is an offset randomly generated by the BIOS based on KASLR technology, which is used to improve the kernel's address security.
  • the computing device can directly read the data information of the kernel from the storage device based on the storage location in the TEE.
  • S230 Calculate the data information of the kernel in the TEE to determine the actual calculated value of the kernel.
  • the computing device can calculate the data information of the kernel after obtaining the data information of the kernel in the TEE, thereby determining the actual calculation value of the kernel. This actual calculated value can be used to determine the status of the kernel, that is, it can be used to determine whether the kernel is trustworthy.
  • the computing device can calculate the data information of the kernel according to the measurement algorithm in the TEE, thereby obtaining the actual calculated value.
  • the actual calculated value includes at least one data bit of data.
  • the measurement algorithm may include a hash algorithm, such as secure hash algorithm-256 (SHA-256) or Shangmi 3 (SM3) cryptographic hash algorithm.
  • SHA-256 algorithm can output calculation results of a fixed length (for example, 256 data bits) without limiting the length of the input data. Also, the output of the SHA-256 algorithm is different if any bit in the input data is modified.
  • the first output result obtained through the SHA-256 algorithm is the same as the second output result. At least one bit is different. Or, assuming that the lengths of the first input data and the second input data are different, at least one bit of the first output result and the second output result are different.
  • the first output result is the output result corresponding to the first input data
  • the second output result is the output result corresponding to the second input data.
  • the computing device can use the SHA-256 algorithm in the TEE to calculate the data information of the kernel to obtain a 256-bit actual calculated value.
  • the computing device may directly compare the baseline calculated value and the actual calculated value of the kernel in the TEE.
  • the baseline calculation value is a preset value and may include at least one data bit of data. If the baseline calculated value and the actual calculated value are the same, the computing device can determine that the status of the kernel is trustworthy. If the baseline calculated value and the actual calculated value are different, the computing device may determine that the status of the kernel is untrusted.
  • the actual calculated value and the baseline calculated value both include 256 data bits of data. If the actual calculated value and the baseline calculated value contain exactly the same 256 data bits, it means that the actual calculated value and the baseline calculated value are the same. If the actual calculated value is different from the data on one or more of the 256 data bits of the baseline calculated value, it means that the actual calculated value is different from the baseline calculated value.
  • the core's baseline calculation value may be stored in a TEE storage space in the storage device.
  • the kernel's baseline calculation value can be stored in the REE storage space in the storage device after encryption processing.
  • the baseline calculation value of the kernel can be determined based on the data information of the kernel when the kernel is compiled. That is, the baseline of the kernel
  • the calculated value is the calculated value obtained by calculating the data information of the kernel in a trusted state.
  • the computing device may determine the status of the core in the TEE based on the actual calculation value and the measurement model of the core.
  • the metric model may be a mapping relationship between the actual calculated value of the kernel and the state of the kernel.
  • the measurement model can also include baseline calculations.
  • the computing device can encrypt the actual calculated value in the TEE to obtain the encrypted actual calculated value.
  • the computing device can also send the encrypted actual calculated value to the management device.
  • the management device is other computing device connected to the computing device.
  • the management device can determine the status of the core of the computing device based on the encrypted actual calculation value, that is, the encrypted actual calculation value is used by the management device to determine the status of the core of the computing device.
  • the management device may also verify whether the received actual calculated value is credible, and if it is determined that the actual calculated value is credible, determine the status of the kernel of the computing device based on the actual calculated value.
  • the computing device can process the actual calculated value in the TEE according to the digest algorithm to obtain the first digest of the actual calculated value.
  • the computing device can then use the private key in the TEE to sign the first digest of the actual calculated value, obtain the encrypted first digest, and send the actual calculated value and the encrypted first digest to the management device.
  • the management device can decrypt the encrypted first digest using the public key to obtain the decrypted first digest.
  • the management device can also process the received actual calculated value according to the same digest algorithm to obtain a second digest of the actual calculated value.
  • the management device may determine whether the actual calculated value is credible based on whether the first digest and the second digest are the same. If the first digest and the second digest are the same, it can be determined that the actual calculated value is credible. If the first digest and the second digest are different, it can be determined that the actual calculated value is not credible.
  • the management device may store the baseline calculation value of the kernel of the computing device, and determine the status of the kernel of the computing device based on the baseline calculation value and the encrypted actual calculation value.
  • the management device may compare the baseline calculated value and the actual calculated value when determining that the actual calculated value is credible. If the baseline calculated value and the actual calculated value are the same, the computing device can determine that the status of the kernel is trustworthy. If the baseline calculated value and the actual calculated value are bit different, the management device may determine that the status of the kernel of the computing device is untrusted.
  • the computing device may periodically perform steps S220 and S230 in the TEE.
  • the computing device may perform steps S220 and S230 in the TEE when receiving the instruction information from the management device.
  • the indication information is used to instruct the computing device to determine the state of the kernel.
  • the computing device may perform steps S220 and S230 when detecting certain changes or updates of itself, which is not limited in the embodiments of the present application.
  • the computing device can obtain the trusted first parameter and the second parameter in the TEE, and can determine the storage location of the kernel based on the first parameter and the second parameter.
  • the computing device can also directly read the data information of the kernel in the TEE and perform calculations on the data information of the kernel to determine the actual calculated value. Since the steps for the computing device to determine the actual calculated value are all performed in the TEE, the actual calculated value is accurate and credible. That is to say, the method in the embodiment of the present application can form a trusted closed loop in the process of determining the kernel status, so that whether the kernel is trustworthy can be determined more accurately and reliably, thereby protecting the security of the computing device.
  • Figure 4 is a schematic flow chart of a method for determining the status of a kernel. The method in Figure 4 includes the following steps.
  • step S410 When receiving the instruction information, enter the trusted execution environment TEE.
  • the specific implementation of step S410 is similar to step S210, and will not be described again here.
  • the computing device may obtain the first parameter and the second parameter through the BIOS in the TEE.
  • the first parameter may include the boot address of the kernel and the length of the kernel.
  • the second parameter may include the physical starting address of the REE storage space in the storage device, or the second parameter may include the physical starting address of the REE storage space and the address offset of the kernel.
  • the first parameter may be pre-stored in the BIOS, that is, the first parameter may be a parameter manually stored in the BIOS by an administrator of the computing device.
  • the administrator can store the first parameter into the BIOS through the BIOS menu, gateway, CLI, etc.
  • the first parameter may be determined when compiling the kernel.
  • the first parameter may be the same or different, which is not limited in the embodiments of the present application.
  • the step of storing the first parameter into the BIOS may be performed once when the version of the kernel changes. That is to say, if the kernel version or kernel in the computing device has not changed, the first parameter can be stored in the BIOS in the computing device when the computing device is run for the first time or before the first run. There is no need to repeatedly import the first parameter during subsequent operations of the computing device. If the kernel version in the computing device changes, the updated first parameter needs to be stored in the BIOS of the computing device when or before the computing device whose kernel version has been updated is run for the first time. The updated first parameter is determined based on the updated kernel.
  • the first parameter may be encrypted, for example, a digest of the first parameter may be signed.
  • the BIOS may also store a public key for verifying the first parameter.
  • the first parameter stored in the BIOS can As encrypted parameters, the BIOS can verify whether the first parameter is trustworthy through the public key, thereby enhancing the security of the kernel.
  • the specific verification method please refer to the description in step S220.
  • the BIOS may determine the second parameter at runtime.
  • the BIOS can initialize the storage device and allocate storage space for REE and TEE, that is, determine the REE storage space and TEE storage space in the storage device.
  • the REE storage space you can determine the physical starting address of the REE storage space and the length of the REE storage space.
  • the physical start address and physical end address of the REE storage space may be determined, which is not limited in the embodiments of the present application.
  • the BIOS may also determine the address offset of the kernel.
  • the kernel's address offset is an offset randomly generated by the BIOS based on KASLR technology, which is used to improve the kernel's address security.
  • the BIOS can transfer the first parameter and the second parameter to the TEE storage space, so that the computing device can obtain the first parameter and the second parameter in the TEE.
  • step S420 may be executed once when the computing device is powered on and started. That is to say, if the computing device has just been powered on and started, step S420 can be performed once. If the computing device is continuously powered on and running, there is no need to repeat step S420.
  • S430 Determine the storage location of the kernel in the storage device according to the first parameter and the second parameter in the TEE.
  • the computing device can obtain the first parameter and the second parameter in the TEE storage space, and directly determine the storage location of the kernel in the REE storage space in the storage device in the TEE based on the first parameter and the second parameter.
  • the storage location may include the physical starting address of the kernel in the REE storage space and the length of the kernel.
  • the storage location may include the physical start address and physical end address of the kernel in the REE storage space, etc., which is not limited in the embodiments of the present application.
  • the physical starting address of the kernel in the REE storage space is determined based on the physical starting address of the REE storage space and the startup address of the kernel.
  • the physical starting address of the kernel in the REE storage space is determined based on the physical starting address of the REE storage space, the startup address of the kernel, and the address offset of the kernel. This is not determined in the embodiment of the present application.
  • the physical starting address of the REE storage space is the starting address relative to the full physical address of the storage device. It should also be understood that in the case where the TEE storage space is hidden by the computing device, the physical starting address of the REE storage space is equivalent to the relative address of the TEE storage space in the storage device.
  • step S430 can be executed once when the computing device is powered on and started, or it can be executed repeatedly every time the status of the kernel needs to be determined. This is not certain in the embodiment of the present application.
  • the computing device can directly store the location of the kernel in the storage device into the TEE storage space, thereby eliminating the need to repeat the execution every time the state of the kernel needs to be determined.
  • Step S430 the computing device can encrypt the storage location of the kernel in the storage device and store it in the REE storage space, so that step S430 does not need to be repeated every time the state of the kernel needs to be determined.
  • Step S440 Obtain the data information of the kernel according to the storage location of the kernel in the storage device in the TEE. Step S440 is similar to step S220 and will not be described again here.
  • Step S450 Calculate the core data information in the TEE to obtain the actual calculated value. Step S450 is similar to step S230 and will not be described again here.
  • step S460 may be executed by a computing device or may be executed by a management device, which is not limited in the embodiments of the present application.
  • the management device may be other computing devices connected to the computing device.
  • the baseline calculation value may be stored in the TEE storage space, or may be encrypted and stored in the REE storage space.
  • the baseline calculation value can be stored in the management device, which is not limited in the embodiments of the present application.
  • the baseline calculation value of the kernel can be determined based on the data information of the kernel when the kernel is compiled.
  • the baseline calculation value of the kernel is the calculated value obtained by calculating the data information of the kernel in a trusted state.
  • the computing device can directly compare the actual calculated value with the baseline calculated value after obtaining the actual calculated value in the TEE, thereby determining the status of the core.
  • both the actual calculated value and the baseline calculated value may include at least one data bit of data. If the data on each data bit of the actual calculated value and the baseline calculated value are the same, it means that the baseline calculated value and the actual calculated value are the same. If the data on one or more data bits of the actual calculated value and the baseline calculated value are different, it means that the baseline calculated value is different from the actual calculated value.
  • the actual calculated value and the baseline calculated value both include 256 data bits of data. If the actual calculated value and the baseline calculated value contain exactly the same 256 data bits, it means that the actual calculated value and the baseline calculated value are the same. If the actual calculated value is different from the baseline calculated value If the data on one or more of the 256 data bits is different, it means that the actual calculated value is different from the baseline calculated value.
  • the actual calculated value can be sent to the management device.
  • the management device can determine whether the kernel of the computing device is trustworthy by determining whether the baseline calculated value is the same as the actual calculated value.
  • the computing device can perform encryption processing when sending the actual calculated value, so that the management device can verify whether the actual calculated value received is trustworthy.
  • encryption processing when sending the actual calculated value, so that the management device can verify whether the actual calculated value received is trustworthy.
  • step S470 may be performed.
  • step S480 may be performed.
  • the computing device determines that the actual calculated value is the same as the baseline calculated value, it can be determined that the status of the kernel is trustworthy, that is, it can be determined that the kernel has not been attacked or modified.
  • the computing device can operate normally.
  • the computing device can take certain measures, such as sending a kernel security notification message to the user or management device.
  • the management device may take certain measures, such as sending a kernel security notification message to the computing device or the administrator, etc. This is not limited in the embodiments of the present application.
  • the computing device determines that the actual calculated value is different from the baseline calculated value, it can be determined that the status of the kernel is untrusted, that is, it can be determined that the kernel has been attacked or modified.
  • the computing device can take certain measures, for example, it can send an alarm to the user or management device, or it can directly suspend the operation, thereby preventing the computing device from being further attacked.
  • the management device may send a notification message that the kernel is unsafe to the computing device or the administrator, or may directly suspend the operation of the computing device, etc. This is not the case in the embodiment of the present application. limited.
  • the computing device can obtain the first parameter and the second parameter in the TEE through the BIOS, thereby directly determining the storage location of the kernel in the REE storage space in the TEE, and then directly reading the data information of the kernel.
  • the computing device can also calculate the data information of the kernel in the TEE to obtain the actual calculated value, thereby forming a trusted closed loop in the process of determining the kernel status, and thereby determining the kernel status more accurately and reliably.
  • FIG. 5 is a schematic structural diagram of a computing device 500 according to an embodiment of the present application.
  • Computing device 500 includes a conversion module 510, an acquisition module 520, and a determination module 530.
  • the conversion module 510 is configured to enter the trusted execution environment TEE when receiving indication information, where the indication information is used to indicate the status of the kernel.
  • the conversion module 510 may perform step S210 in the method of FIG. 2 or step S410 in the method of FIG. 4 .
  • the acquisition module 520 is used to obtain the data information of the kernel according to the storage location of the kernel in the storage device in the TEE.
  • the acquisition module 520 may perform step S220 in FIG. 2 and steps S420-440 in FIG. 4 .
  • the determination module 530 is used to calculate the data information of the kernel in the TEE and determine the actual calculation value of the kernel. The actual calculated values are used to determine the state of the kernel, which can be trusted or untrusted.
  • the determination module 530 executes step S230 in the method of FIG. 2 and steps S450-480 in the method of FIG. 4 .
  • computing device 500 also includes a sending module (not shown).
  • the sending module can encrypt the actual calculated value in the TEE and obtain the encrypted actual calculated value.
  • the sending module can also send the encrypted or signed actual calculated value to the management device.
  • the actual calculated value after encryption is used by the management device to determine the state of the kernel.
  • Management devices are other computing devices connected to the computing device including the storage device.
  • FIG. 6 is a structural block diagram of a computing device 600 provided according to an embodiment of the present application.
  • the computing device 600 shown in FIG. 6 includes: a processor 601, a memory 602, and a communication interface 603.
  • the processor 601, the memory 602, and the communication interface 603 communicate through a bus 604.
  • the receiver 605 is used to receive information or pending requests from other devices (such as management devices) connected to the computing device 600, and the sender 606 is used to transmit the actual calculated values stored in the memory 602 or the encrypted actual calculated values. Sent to other devices connected to the computing device 600 (eg, management devices).
  • the methods disclosed in the above embodiments of the present invention can be applied to the processor 601 or implemented by the processor 601.
  • the processor 601 may be a central processing unit (CPU), or other general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or a field-programmable processor.
  • a general-purpose processor can be a microprocessor or any conventional processor, etc.
  • each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the processor 601 . can be realized or executed Disclosed methods, steps and logical block diagrams in the embodiments of the present invention.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.
  • the steps of the method disclosed in conjunction with the embodiments of the present invention can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor.
  • Software modules may be located in memory 602.
  • the processor 601 reads the instructions in the memory 602 and completes the steps of the above method in combination with its hardware.
  • the memory 602 may store instructions for performing the methods performed by the computing devices in the above-described embodiments.
  • Memory 602 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • non-volatile memory can be read-only memory (ROM), programmable ROM (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically removable memory. Erase electrically programmable read-only memory (EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which is used as an external cache.
  • RAM static random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • Double data rate synchronous dynamic random access memory double data date SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • synchronous link dynamic random access memory direct rambus RAM, DR RAM
  • direct rambus RAM direct rambus RAM
  • the processor 601 can execute the instructions stored in the memory 602 and combine with other hardware (such as the receiver 605 and the transmitter 606) to complete the steps of the computing device in the above embodiments.
  • other hardware such as the receiver 605 and the transmitter 606
  • bus 604 may also include a power bus, a control bus, a status signal bus, etc.
  • bus 604 may also include a power bus, a control bus, a status signal bus, etc.
  • the various buses are labeled bus 604 in the figure.
  • Embodiments of the present application also provide a chip system.
  • the chip system includes a logic circuit that is coupled to an input/output interface and transmits data through the input/output interface to perform the tasks performed by the computing device in the above embodiment. various steps.
  • the present application also provides a computer program product.
  • the computer program product includes: computer program code.
  • the computer program code When the computer program code is run on a computer, it causes the computer to execute each of the above embodiments. step.
  • the present application also provides a computer-readable medium.
  • the computer-readable medium stores program code.
  • the program code When the program code is run on a computer, it causes the computer to execute each of the above-mentioned embodiments. step.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例提供了一种确定内核状态的方法和相关设备。该方法包括：当接收到指示信息时，进入可信执行环境TEE中；在TEE中根据内核在存储设备中的存储位置，获得内核的数据信息；在TEE中对内核的数据信息进行计算，确定内核的实际计算值，该实际计算值用于确定内核的状态，内核的状态包括可信或不可信。该方法可以在TEE中直接获得内核的数据信息，并在TEE中直接对内核的数据信息进行计算，获得内核的实际计算值。通过本申请实施例中的方法，可以在确定内核的状态时形成可信闭环，保证获得的实际计算值可信且准确，从而可以更为准确地确定内核是否可信，进而可以保护计算设备的安全。

Description

一种确定内核状态的方法和相关设备
本申请要求于2022年8月3日提交中国专利局、申请号为202210925211.0、申请名称为“一种确定内核状态的方法和相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及计算机领域，并且更具体地，涉及一种确定内核状态的方法、计算装置、计算设备、芯片系统和计算机可读存储介质。
背景技术
目前普通的操作系统中的应用的安全依赖于操作系统的安全，而操作系统的安全依赖于内核的安全。具体而言，内核可以对操作系统中的应用的安全库进行安全启动，从而确认应用的相关文件没有被修改过。在应用运行的过程中，操作系统可以通过扩展可对应行实施动态计算，通过本地或远程证明以确认应用是否运行在可信的状态中。操作系统是内核被映射到内存执行之后，通过加载模块扩展功能、启动必要的系统服务之后提供的能力集合，因此内核的可信是操作系统和操作系统中的应用的安全的基础。
目前可以通过对计算设备中的硬件进行划分，在计算设备内部部署富执行环境(rich execution environment，REE)和可信执行环境(trusted execution environment，TEE)。同时，可以通过计算设备中的处理器的分时复用，使得处理器可以运行在REE或TEE中，并保证TEE中的代码不会被恶意修改或窃取。但由于REE和TEE的划分过于底层，因此REE和TEE无法获取对方的执行状态。在确定REE中的内核是否可信时，可以通过部署在REE中的高权限代理应用获得当前内核的有效的计算信息，并传递至TEE中的可信操作系统/可信应用程序(trusted execution environment operating system/trusted application，TEEOS/TA)。TEEOS/TA接收到该计算信息后认为内核可信。该方法中，TEEOS/TA确定内核可信的基础是该高权限代理应用(agent)可信，而该高权限代理应用的可信依赖于内核的可信。也就是说，在内核已被恶意修改的情况下，高权限代理应用仍可对该内核进行计算，并将计算信息发送给TEEOS/TA。TEEOS/TA接收到该计算信息后仍会认为内核可信，即该方法并不能形成可信闭环。
因此，如何在确定内核状态的过程中形成可信闭环，从而提高确定内核状态的准确性和可信度成为亟待解决的问题。
发明内容
本申请实施例提供一种确定内核状态的方法、计算装置、计算设备、芯片系统和计算机可读存储介质，可以直接在TEE中对内核的数据信息进行计算，即在确定内核状态的过程中形成可信闭环，从而可以更为准确可信地确定内核是否可信，进而保护计算设备的安全。
第一方面，提供了一种确定内核状态的方法。该方法包括：当接收到指示信息时，进入可信执行环境TEE中，指示信息用于指示确定内核的状态；在TEE中根据内核在存储设备中的存储位置，获得内核的数据信息；在TEE中对内核的数据信息进行计算，确定内核的实际计算值，实际计算值用于确定内核的状态，内核的状态包括可信或不可信。
本申请实施例中，计算设备可以在TEE中直接确定内核的存储位置，获得内核的数据信息，还可以在TEE中直接对内核的数据信息进行计算，获得内核的实际计算值。通过本申请实施例中的方法，可以在确定内核的状态时形成可信闭环，保证获得的实际计算值可信且准确，从而可以更为准确地确定内核是否可信，进而可以保护计算设备的安全。
结合第一方面，在第一方面的某些实现方式中，在TEE中通过基本输入输出系统BIOS获得第一参数和第二参数；在TEE中根据第一参数和第二参数，确定存储位置。
其中，第一参数包括内核的启动地址和内核的长度。第二参数包括存储设备中富执行环境REE存 储空间的物理起始地址，或者第二参数包括REE存储空间的物理起始地址和内核的地址偏移量。
本申请实施例中，计算设备可以通过BIOS获得第一参数和第二参数，从而根据第一参数和第二参数，确定内核在存储设备中的存储位置。通过本申请实施例中的方法，计算设备可以通过安全可信的方式在TEE中获得可信的第一参数和第二参数，从而有利于形成可信闭环，保证获得的内核的存储位置可信且准确，进而可以更为准确地获得内核的数据信息。
结合第一方面，在第一方面的某些实现方式中，第一参数为存储在BIOS中的参数，和/或，第二参数为BIOS确定的参数。
本申请实施例中，第一参数可以预先存储在BIOS中，并且BIOS可以直接确定第二参数，从而可以保证计算设备在TEE中获得的第一参数和第二参数的可信与准确，进而可以便于形成可信闭环。
结合第一方面，在第一方面的某些实现方式中，存储位置包括内核在存储设备中的物理起始地址和内核的长度，内核在存储设备中的物理起始地址根据REE存储空间的物理起始地址和内核的启动地址确定，或者内核在存储设备中的物理起始地址根据REE存储空间的物理起始地址、内核的启动地址和内核的地址偏移量确定。
本申请实施例中，计算设备可以在TEE中根据第一参数和第二参数，确定内核在存储设备中的物理起始地址和内核的长度。并且，计算设备可以在TEE中直接根据内核在存储设备中的物理起始地址和内核的长度，读取内核的数据信息，从而便于对内核的数据信息进行计算，进而可以确定可信的实际计算值。
结合第一方面，在第一方面的某些实现方式中，在TEE中，根据内核在存储设备中的物理起始地址和长度，从存储设备中读取内核的数据信息。
本申请实施例中，计算设备可以在TEE中，根据内核的存储位置从存储设备中直接读取内核的数据信息，从而可以保证读取出的内核的数据信息是目前正在运行的内核的真实数据信息，进而可以较为准确地确定内核是否可信。
结合第一方面，在第一方面的某些实现方式中，在TEE中比较内核的基线计算值和实际计算值，基线计算值为预设数值；若基线计算值和实际计算值相同，则确定内核的状态为可信；若基线计算值和实际计算值不同，则确定内核的状态为不可信。
本申请实施例中，计算设备可以在TEE中直接比较内核的实际计算值与基线计算值，从而根据内核的实际计算值与基线计算值是否相同，确定内核是否已被攻击或修改，进而确定内核的状态是否可信。
结合第一方面，在第一方面的某些实现方式中，基线计算值根据内核编译时内核的数据信息确定。
本申请实施例中，可以根据在编译时内核的数据信息，确定内核的基线计算值，即该基线计算值是内核在可信状态下，对内核的数据信息进行计算所获得的计算值。通过本申请实施例中的方法，计算设备可以在实际计算值与基线计算值不同时，确定内核的数据信息已被修改，从而确定内核的状态为不可信。
结合第一方面，在第一方面的某些实现方式中，在TEE中对实际计算值进行加密，获得加密后的实际计算值；将加密后的实际计算值发送给管理设备，加密后的实际计算值用于管理设备确定内核的状态，管理设备为与包含存储设备的计算设备连接的其他计算设备。
本申请实施例中，计算设备可以将实际计算值发送给与该计算设备连接的管理设备，从而使管理设备可以确定该计算设备的内核是否可信。并且，计算设备在发送实际计算值时，还可以对该实际计算值进行加密，从而可以使管理设备对接收到的实际计算值进行校验，确定接收到的实际计算值是否可信。
第二方面，本申请实施例提供一种计算装置，该计算装置包括用于实现第一方面或第一方面的任一种可能的实现方式的单元。
第三方面，本申请实施例提供一种计算机设备，该计算机设备包括处理器，该处理器用于与存储器耦合，读取并执行该存储器中的指令和/或程序代码，以执行第一方面或第一方面的任一种可能的实现方式。
第四方面，本申请实施例提供一种芯片系统，该芯片系统包括逻辑电路，该逻辑电路用于与输入/输出接口耦合，通过该输入/输出接口传输数据，以执行第一方面或第一方面任一种可能的实现方式。
第五方面，本申请实施例提供一种计算机可读存储介质，该计算机可读存储介质存储有程序代码， 当该计算机存储介质在计算机上运行时，使得计算机执行如第一方面或第一方面的任一种可能的实现方式。
第六方面，本申请实施例提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行如第一方面或第一方面的任一种可能的实现方式。
附图说明
图1是计算设备100的示意性架构图。
图2是根据本申请一个实施例的确定内核状态的方法的示意性流程图。
图3是根据本申请一个实施例的内核的存储位置的示意性框图。
图4是根据本申请另一实施例的确定内核状态的方法的示意性流程图。
图5是根据本申请一个实施例的计算装置的结构示意图。
图6是根据本申请一个实施例的计算设备的结构示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种包含内核和TEE的计算设备中，例如主机、台式机、笔记本电脑等，本申请实施例对此并不限定。
图1是计算设备100的示意性架构图。计算设备100可以包括处理器110、存储器120、基本输入输出系统(basic input output system，BIOS)BIOS 130和硬件平台140。
可以理解的是，本申请实施例示意的结构并不构成对计算设备100的具体限定。在本申请另一些实施例中，计算设备100可以包括比图示更多或更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件，软件或软件和硬件的组合实现。
其中，处理器110例如可以是中央处理器(central processing unit，CPU)或图形处理器(graphics processing unit，GPU)等。处理器110是计算设备100的运算和控制核心，可以运行在REE或TEE中。
应理解，“处理器110运行在REE或TEE中”、“处理器110运行在REE或TEE状态下”、“处理器110运行在REE或TEE环境中”、“处理器110在REE或TEE中”的含义类似。
处理器110运行在REE中时，仅可以访问REE中的硬件、软件和存储资源，不可以访问TEE中的硬件、软件和存储资源。例如处理器110运行在REE中时，仅可以访问存储器120中的REE存储121，不可以访问存储器120中的TEE存储122。处理器110运行在TEE中时，可以访问TEE中的硬件、软件和存储资源，还可以访问REE中的存储资源。例如，处理器110运行在TEE中时，不仅可以访问存储器120中的TEE存储122，还可以访问存储器120中的REE存储121。
处理器110可以在接收到指示信息时，进入可信执行环境TEE中。该指示信息用于指示确定内核的状态。处理器110还可以在TEE中确定内核在存储器120中的存储位置，即确定内核1211的位置。该存储位置用于处理器110读取内核1211中的数据信息。处理器110还可以在TEE中根据该存储位置，对内核1211中的数据信息进行计算，确定内核1211的实际计算值。该实际计算值用于确定内核1211的状态，内核1211的状态包括可信或不可信。
处理器110还可以在TEE中通过BIOS 130获得第一参数和第二参数。该第一参数可以包括内核1211的启动地址和内核1211的长度。内核1211的启动地址是压缩的内核被解压缩到存储器120时的物理起始地址。该第二参数可以包括存储器120中REE存储空间的物理起始地址。存储器120中REE存储空间的物理起始地址可以为图1中的REE存储121的物理起始地址。或者，在计算设备中启用了内核地址随机化(kernel address space layout randomization，KASLR)技术的情况下，第二参数可以包括REE存储空间的物理起始地址和内核1211的地址偏移量。内核1211的地址偏移量是计算设备100在启动内核之前随机生成的地址偏移量，该地址偏移量用于使内核的地址可以随着计算设备100的每次开机启动而不同，即可以使攻击者无法确定内核1211的物理地址，从而增强内核的安全性。处理器110还可以在TEE中根据第一参数和第二参数，确定内核1211在存储器120中的存储位置。
可选地，第一参数可以是存储在BIOS中的参数。或者，第一参数可以是计算设备100的管理员人 工导入BIOS中的参数。例如，管理员可以通过BIOS菜单、网关、命令行界面(command-line interface，CLI)等方式将第一参数导入到BIOS中。
可选地，第一参数存储在BIOS之前，可以进行加密处理，例如进行签名。校验第一参数的公钥可以存储在BIOS中。也就是说，BIOS中存储的第一参数为加密后的参数，BIOS可以通过公钥校验该第一参数是否可信，从而可以增强内核的安全性。
可选地，第二参数可以是BIOS确定的参数。BIOS在启动后，可以初始化存储器120，并为REE和TEE分配存储空间，即确定REE存储121和TEE存储122在存储器120中的存储位置。也就是说，BIOS可以确定REE存储121的物理起始位置。在计算设备中启用了KASLR技术的情况下，BIOS还可以确定随机生成的内核的地址偏移量。
可选地，内核1211在REE存储121中的存储位置可以包括内核1211在存储器120中的物理起始地址和内核1211的长度。或者，内核1211在REE存储121中的存储位置包括内核1211在存储器120中的物理起始地址和物理结束地址。
可选地，内核1211在存储器120中的物理起始地址可以根据REE存储121的物理起始地址和内核1211的启动地址确定。或者，内核1211在存储器120中的物理起始地址根据REE存储121的物理起始地址、内核1211的启动地址和内核1211的地址偏移量确定。
处理器110还可以在TEE中根据内核1211的存储位置，获得内核1211的数据信息。处理器110还可以对内核1211的数据信息进行计算，获得实际计算值。该实际计算值包括至少一个数据位的数据。
可选地，处理器110可以在TEE中比较内核1211的基线计算值和实际计算值。该基线计算值为预设数值，包括至少一个数据位的数据。在基线计算值与实际计算值相同的情况下，处理器110可以确定内核的状态为可信。在基线计算值与实际计算值不同的情况下，处理器110可以确定内核的状态为不可信。
可选地，处理器110可以在TEE中对实际计算值进行加密处理，例如签名，获得加密后的实际计算值。处理器110还可以将该加密后的实际计算值发送给管理设备。管理设备为与计算设备100连接的其他计算设备。管理设备可以根据该加密后的实际计算值确定计算设备100的内核1211是否可信，即加密后的实际计算值用于管理设备确定内核1211的状态。
可选地，管理设备还可以验证该加密后的实际计算值是否可信，并在确定该加密后的实际计算值可信的情况下，根据加密后的实际计算值，确定计算设备100的内核1211是否可信。
存储器120可以用于存储数据或指令，例如可以是随机存取存储器(random access memory，RAM)、静态随机存储器(static RAM，SRAM)、动态随机存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous dynamic RAM，SDRAM)、双倍速率同步动态随机存储器(double date rate SDRAM，DDR SDRAM)等，本申请实施例对此并不限定。存储器120中的存储空间分为REE存储121和TEE存储122。
REE存储121可以存储REE中的数据或指令。处理器110运行在REE或TEE中时可以访问REE存储121中的数据或指令。REE存储121中还可以存储内核的数据信息，即REE存储121中包括内核1211。内核1211中包括内核的数据信息，例如程序代码等信息。
TEE存储122可以存储TEE中的数据或指令。处理器110运行在TEE中时可以访问TEE存储122中的数据和指令。TEE存储122中还可以存储TEEOS/TA的数据信息，即TEE存储122中包括TEEOS/TA 1221。TEEOS/TA 1221中包括TEEOS/TA的数据信息，例如程序代码等信息。
BIOS 130中包括计算设备100的基本输入输出的程序、开机后自检程序和系统启动程序等，主要用于为计算设备100提供最底层的硬件设置和控制。BIOS 130中可以存储第一参数。BIOS 130中可以包括统一可扩展固件接口(unified extensible firmware interface，UEFI)变量区域，用于存储第一参数。BIOS 130还可以存储验证该第一参数的公钥，并可以根据存储的公钥对第一参数进行验证，从而确定第一参数是否可信。BIOS 130还可以在启动后初始化存储器120，为REE分配REE存储121，并为TEE分配TEE存储122，从而确定第二参数。BIOS 130还可以将第一参数和第二参数传递至TEE存储122，从而便于处理器110在TEE中确定内核在存储器120中的存储位置。
图1中的计算设备100可以在TEE中直接确定内核的存储位置，并对内核进行计算，从而在确定内核状态的过程中形成可信闭环，可以更加准确地确定内核是否可信，进而保护计算设备100的安全。
图2是确定内核的状态的方法的示意性流程图，图2中的方法包括如下步骤。
S210，当接收到指示信息时，进入可信执行环境TEE中。
计算设备可以接收指示信息，该指示信息用于指示计算设备确定内核的状态。计算设备还可以在接收到指示信息时，进入TEE中，从而在TEE中确定内核的状态。
可选地，指示信息可以来自于计算设备连接的其他设备，例如管理设备。或者，该指示信息可以在计算设备内被周期性触发。或者，该指示信息可以由用户触发。或者，该指示信息可以在计算设备发生变化时触发。计算设备发生变化可以是计算设备的硬件发生变化，或者可以是计算设备的软件发生变化，本申请实施例对此并不限定。
S220，在TEE中根据内核在存储设备中的存储位置，获得内核的数据信息。
计算设备可以在TEE中根据内核在存储设备中的位置，从存储设备中直接获得内核的数据信息。内核的数据信息指的是内核在存储设备中存储的所有数据信息，即从内核在存储设备中的物理起始位置至内核在存储设备中的物理结束位置中的所有数据信息。或者可以说，内核的数据信息包括在存储设备中内核的长度内的所有数据信息。
应理解，由于计算设备在TEE中也可以访问存储设备中REE存储空间内的数据信息，并且内核位于存储设备中的REE存储空间内，因此计算设备可以在TEE中确定内核的存储位置后，直接读取REE存储空间中的内核的数据信息。也就是说，计算设备可以在TEE中根据内核在存储设备中的物理起始地址开始读取内核的数据信息，并在内核在存储设备中的物理结束地址结束读取内核的数据信息。内核在存储设备中的物理结束地址可以为内核在存储设备中的物理起始地址与内核的长度之和。或者说，计算设备可以在TEE中，根据内核在存储设备中的物理起始地址和长度，直接从存储设备中读取内核的数据信息。
可选地，在步骤S220前，计算设备可以在TEE中直接确定内核在存储设备中的存储位置。该存储位置可以用于获得内核的数据信息。
示例性地，该存储位置可以包括内核在存储设备中的物理起始地址和内核的长度。或者，该存储位置可以包括内核在存储设备中的物理起始地址和物理结束地址等，本申请实施例对此并不限定。
可选地，计算设备可以在TEE中根据第一参数和第二参数，确定内核在存储设备中的存储位置。该第一参数和第二参数可以存储在存储设备中的TEE存储空间中。第一参数可以包括内核的启动地址和内核的长度。第二参数可以包括存储设备中REE存储空间的物理起始地址。或者，在计算设备中启用了KASLR技术的情况下，第二参数可以包括REE存储空间的物理起始地址和内核的地址偏移量。
应理解，REE存储空间的物理起始地址是相对于存储设备的全量物理地址的物理起始地址。还应理解，在计算设备将TEE存储空间隐藏的情况下，REE存储空间的物理起始地址相当于在存储设备中去除TEE存储空间的相对地址。
可选地，内核在存储设备中的物理起始地址根据REE存储空间的物理起始地址和内核的启动地址确定。或者，内核在存储设备中的物理起始地址根据REE存储空间的物理起始地址、内核的启动地址和内核的地址偏移量确定。
示例性地，在计算设备中启用了KASLR技术的情况下，即在第二参数包括内核的地址偏移量的情况下，内核在存储设备中的存储位置可以如图3所示。
图3为内核的存储位置的示意性框图。图3中的REE存储310与图1中的REE存储121类似，图3中的内核311与图1中的内核1211类似。从图3可以看出，内核311在存储设备中的物理起始地址为REE的物理起始地址、内核的启动地址和内核的地址偏移量之和。其中，REE的物理起始地址为REE存储310相对于存储设备的物理起始地址。
示例性地，在计算设备中未启用KASLR技术的情况下，即在第二参数不包括内核的地址偏移量的情况下，内核在存储设备中的物理起始地址为REE的物理起始地址和内核的启动地址之和。
可选地，计算设备可以通过BIOS将第一参数和第二参数传递至TEE存储空间中，从而使计算设备可以在TEE中获得第一参数和第二参数。该第一参数为存储在BIOS中的参数，和/或，该第二参数为BIOS确定的参数。
示例性地，第一参数可以是计算设备的管理员人工存储至BIOS中的参数。例如，管理员可以通过BIOS菜单、网关、CLI等方式将第一参数存储到BIOS中。
示例性地，第一参数可以在编译内核时确定。对于不同版本的内核，第一参数可以相同，或者也可以不同，本申请实施例对此并不限定。
示例性地，将第一参数存储至BIOS的步骤可以在内核的版本变化时执行一次。也就是说，若计算设备中的内核版本或内核一直未发生变化，则可以在该计算设备的第一次运行时或第一次运行前将第一参数存储至该计算设备中的BIOS中，在该计算设备的后续运行过程中不需要重复导入第一参数。若计算设备中的内核版本发生了变化，则需要在内核版本已被更新的计算设备第一次运行时或第一次运行前，将更新后的第一参数存储到该计算设备的BIOS中。该更新后的第一参数根据更新后的内核确定。
示例性地，在将第一参数存储至BIOS之前，可以对该第一参数进行加密处理，例如对第一参数的摘要进行签名。校验该第一参数的公钥可以存储在BIOS中。也就是说，BIOS中存储的第一参数可以为加密后的参数，BIOS可以通过公钥校验该第一参数是否可信，从而可以增强内核的安全性。
例如，管理人员可以使用摘要算法对第一参数进行处理，获得第一参数的第一摘要。然后可以使用私钥对第一摘要进行签名，从而获得加密后的第一摘要。之后可以将第一参数和加密后的第一摘要存储至BIOS中。BIOS在启动时，可以使用公钥对加密后的第一摘要进行解密，获得解密后的第一摘要。然后可以使用相同的摘要算法对第一参数进行处理，获得第一参数的第二摘要。最后可以通过比较第一摘要与第二摘要是否相同，从而确定第一参数是否可信。具体地，若第一摘要和第二摘要相同，则表示第一参数未被篡改，可以信任。若第一摘要和第二摘要不同，则表示第一参数已被篡改，不可以信任。
示例性地，第二参数是BIOS在运行中确定的参数。BIOS可以初始化存储设备，并为REE和TEE分配存储空间，即确定存储设备中的REE存储空间和TEE存储空间。在确定REE存储空间时，可以确定REE存储空间的物理起始地址和REE存储空间的长度。或者，可以确定REE存储空间的物理起始地址和物理结束地址等，本申请实施例对此并不限定。
示例性地，在计算设备中启用了KASLR技术的情况下，BIOS还可以确定内核的地址偏移量。内核的地址偏移量为BIOS根据KASLR技术随机生成的偏移量，用于提高内核的地址安全性。
计算设备在确定内核在存储设备中的存储位置之后，可以在TEE中根据该存储位置，直接从存储设备中读取内核的数据信息。
S230，在TEE中对内核的数据信息进行计算，确定内核的实际计算值。
计算设备可以在TEE中获得内核的数据信息后，对内核的数据信息进行计算，从而确定内核的实际计算值。该实际计算值可以用于确定内核的状态，即可以用于确定内核是否可信。
可选地，计算设备可以在TEE中根据度量算法对内核的数据信息进行计算，从而获得实际计算值。该实际计算值包括至少一个数据位的数据。
示例性地，度量算法可以包括哈希算法，例如安全散列算法-256(secure hash algorithm-256，SHA-256)或商密3(shang mi 3，SM3)密码杂凑算法。SHA-256算法可以在不限制输入数据的长度的情况下，输出固定长度(例如256个数据位)的计算结果。并且，在输入数据中的任一位被修改的情况下，SHA-256算法的输出不同。
例如，假设第一输入数据与第二输入数据的长度相同，第一输入数据与第二输入数据的一位数据不同，则经过SHA-256算法获得的第一输出结果与第二输出结果中的至少一个比特位不同。或者，假设第一输入数据与第二输入数据的长度不同，则第一输出结果与第二输出结果的至少一个比特位不同。第一输出结果为第一输入数据对应的输出结果，第二输出结果为第二输入数据对应的输出结果。
示例性地，计算设备可以在TEE中使用SHA-256算法对内核的数据信息进行计算，获得256位的实际计算值。
可选地，在TEE中获得内核的实际计算值之后，计算设备可以在TEE中直接比较内核的基线计算值和实际计算值。该基线计算值为预设数值，可以包括至少一个数据位的数据。若基线计算值和实际计算值相同，则计算设备可以确定内核的状态为可信。若基线计算值和实际计算值不同，则计算设备可以确定内核的状态为不可信。
例如，假设实际计算值与基线计算值均包括256个数据位的数据，若实际计算值与基线计算值的256个数据位上的数据完全相同，则说明实际计算值与基线计算值相同。若实际计算值与基线计算值的256个数据位中的一个或多个数据位上的数据不同，则说明实际计算值与基线计算值不同。
示例性地，内核的基线计算值可以存储在存储设备中的TEE存储空间中。或者，内核的基线计算值可以在加密处理后存储在存储设备中的REE存储空间中。
示例性地，内核的基线计算值可以根据内核编译时内核的数据信息确定。也就是说，内核的基线 计算值是内核在可信状态下，对内核的数据信息进行计算获得的计算值。
可选地，计算设备可以在TEE中根据内核的实际计算值和度量模型，确定内核的状态。该度量模型可以是内核的实际计算值与内核的状态之间的映射关系。该度量模型还可以包括基线计算值。
可选地，在TEE中获得内核的实际计算值之后，计算设备可以在TEE中对实际计算值进行加密，获得加密后的实际计算值。计算设备还可以将加密后的实际计算值发送给管理设备。该管理设备为与该计算设备连接的其他计算设备。该管理设备可以根据该加密后的实际计算值确定该计算设备的内核的状态，即该加密后的实际计算值用于管理设备确定该计算设备的内核的状态。
示例性地，管理设备还可以验证接收到的实际计算值是否可信，并在确定该实际计算值可信的情况下，根据该实际计算值，确定计算设备的内核的状态。
例如，计算设备可以在TEE中根据摘要算法，对实际计算值进行处理，获得实际计算值的第一摘要。然后计算设备可以在TEE中使用私钥对实际计算值的第一摘要进行签名处理，获得加密后的第一摘要，并将实际计算值和加密后的第一摘要发送给管理设备。管理设备可以在使用公钥对加密后的第一摘要进行解密，获得解密后的第一摘要。管理设备还可以根据相同的摘要算法，对接收到的实际计算值进行处理，获得实际计算值的第二摘要。管理设备可以根据第一摘要和第二摘要是否相同，从而确定该实际计算值是否可信。若该第一摘要和第二摘要相同，则可以确定该实际计算值可信。若第一摘要和第二摘要不同，则可以确定该实际计算值不可信。
示例性地，管理设备可以存储计算设备的内核的基线计算值，并根据该基线计算值与加密后的实际计算值，确定计算设备的内核的状态。
例如，管理设备可以在确定实际计算值可信的情况下，比较基线计算值和实际计算值。若基线计算值和实际计算值相同，则计算设备可以确定内核的状态为可信。若基线计算值和实际计算值比特不同，则管理设备可以确定该计算设备的内核的状态为不可信。
可选地，计算设备可以在TEE中周期性地执行步骤S220和S230。或者，计算设备可以在接收到来自于管理设备的指示信息时，在TEE中执行步骤S220和S230。该指示信息用于指示计算设备确定内核的状态。或者，计算设备可以在检测到自身的某些变化或更新时，执行步骤S220和S230，本申请实施例对此并不限定。
应理解，计算设备可以在TEE中获得可信的第一参数和第二参数，并可以根据该第一参数和第二参数，确定内核的存储位置。计算设备还可以在TEE中直接读取内核的数据信息，并对内核的数据信息进行计算，从而确定实际计算值。由于计算设备确定实际计算值的步骤均在TEE中执行，因此该实际计算值是准确且可信的。也就是说，通过本申请实施例中的方法可以在确定内核状态的过程中形成可信闭环，从而可以更为准确可信地确定内核是否可信，进而可以保护计算设备的安全。
图4是确定内核的状态的方法的示意性流程图，图4中的方法包括如下步骤。
S410，当接收到指示信息时，进入可信执行环境TEE中。步骤S410的具体实现方式与步骤S210类似，此处不再赘述。
S420，通过BIOS获得第一参数和第二参数。
计算设备可以在TEE中通过BIOS获得第一参数和第二参数。其中，第一参数可以包括内核的启动地址和内核的长度。第二参数可以包括存储设备中REE存储空间的物理起始地址，或者第二参数包括REE存储空间的物理起始地址和内核的地址偏移量。
可选地，BIOS中可以预存储第一参数，即第一参数可以是计算设备的管理员人工存储至BIOS中的参数。例如，管理员可以通过BIOS菜单、网关、CLI等方式将第一参数存储到BIOS中。
示例性地，第一参数可以在编译内核时确定。对于不同版本的内核，第一参数可以相同，或者也可以不同，本申请实施例对此并不限定。
示例性地，将第一参数存储至BIOS的步骤可以在内核的版本变化时执行一次。也就是说，若计算设备中的内核版本或内核一直未发生变化，则可以在该计算设备的第一次运行时或第一次运行前将第一参数存储至该计算设备中的BIOS中，在该计算设备的后续运行过程中不需要重复导入第一参数。若计算设备中的内核版本发生了变化，则需要在内核版本已被更新的计算设备第一次运行时或第一次运行前，将更新后的第一参数存储到该计算设备的BIOS中。该更新后的第一参数根据更新后的内核确定。
示例性地，在将第一参数存储至BIOS之前，可以对该第一参数进行加密处理，例如对第一参数的摘要进行签名。BIOS中还可以存储校验该第一参数的公钥。也就是说，BIOS中存储的第一参数可以 为加密后的参数，BIOS可以通过公钥校验该第一参数是否可信，从而可以增强内核的安全性。具体校验方式可以参照步骤S220中的描述。
在一些实施例中，BIOS在运行时可以确定第二参数。
示例性地，BIOS可以初始化存储设备，并为REE和TEE分配存储空间，即确定存储设备中的REE存储空间和TEE存储空间。在确定REE存储空间时，可以确定REE存储空间的物理起始地址和REE存储空间的长度。或者，可以确定REE存储空间的物理起始地址和物理结束地址等，本申请实施例对此并不限定。
示例性地，在计算设备中启用了KASLR技术的情况下，BIOS还可以确定内核的地址偏移量。内核的地址偏移量为BIOS根据KASLR技术随机生成的偏移量，用于提高内核的地址安全性。
可选地，在BIOS运行后，BIOS可以将第一参数和第二参数传递至TEE存储空间中，从而使计算设备可以在TEE中获得第一参数和第二参数。
可选地，步骤S420可以在计算设备上电启动时执行一次。也就是说，若计算设备刚刚上电启动，则可以执行一次步骤S420。若计算设备处于持续通电运行的状态，则无需重复执行步骤S420。
S430，在TEE中根据第一参数和第二参数，确定内核在存储设备中的存储位置。
计算设备可以在TEE存储空间中获得第一参数和第二参数，并根据该第一参数和第二参数，直接在TEE中确定内核在存储设备中的REE存储空间中的存储位置。
可选地，该存储位置可以包括内核在REE存储空间中的物理起始地址和内核的长度。或者，该存储位置可以包括内核在REE存储空间中的物理起始地址和物理结束地址等，本申请实施例对此并不限定。
可选地，内核在REE存储空间中的物理起始地址根据REE存储空间的物理起始地址和内核的启动地址确定。或者，内核在REE存储空间中的物理起始地址根据REE存储空间的物理起始地址、内核的启动地址和内核的地址偏移量确定，本申请实施例对此并不确定。
应理解，REE存储空间的物理起始地址是相对于存储设备的全量物理地址的起始地址。还应理解，在计算设备将TEE存储空间隐藏的情况下，REE存储空间的物理起始地址相当于在存储设备中去除TEE存储空间的相对地址。
可选地，步骤S430可以在计算设备上电启动时执行一次，也可以在每次需要确定内核的状态时重复执行，本申请实施例对此并不确定。也就是说，计算设备可以在确定内核在存储设备中的存储位置后，将内核在存储设备中的位置直接存储至TEE存储空间中，从而不需要在每次需要确定内核的状态时，重复执行步骤S430。或者，计算设备可以将内核在存储设备中的存储位置加密后存储至REE存储空间中，从而不需要在每次需要确定内核的状态时，重复执行步骤S430。
S440，在TEE中根据内核在存储设备中的存储位置，获得内核的数据信息。步骤S440与步骤S220类似，此处不再赘述。
S450，在TEE中对内核的数据信息进行计算，获得实际计算值。步骤S450与步骤S230类似，此处不再赘述。
S460，确定基线计算值与实际计算值是否相同。
可选地，步骤S460可以由计算设备执行，或者可以由管理设备执行，本申请实施例对此并不限定。管理设备可以是与该计算设备连接的其他计算设备。
在一些实施例中，基线计算值可以存储在TEE存储空间中，或者可以加密后存储在REE存储空间中。或者，基线计算值可以存储在管理设备中，本申请实施例对此并不限定。
示例性地，内核的基线计算值可以根据内核编译时内核的数据信息确定。也就是说，内核的基线计算值是内核在可信状态下，对内核的数据信息进行计算获得的计算值。
可选地，计算设备可以在TEE中获得实际计算值之后，直接对实际计算值和基线计算值进行比较，从而确定内核的状态。
在一些实施例中，实际计算值和基线计算值均可以包括至少一个数据位的数据。若实际计算值与基线计算值的每个数据位上的数据均相同，则说明基线计算值与实际计算值相同。若实际计算值与基线计算值的一个或多个数据位上的数据不同，则说明基线计算值与实际计算值不同。
例如，假设实际计算值与基线计算值均包括256个数据位的数据，若实际计算值与基线计算值的256个数据位上的数据完全相同，则说明实际计算值与基线计算值相同。若实际计算值与基线计算值的 256个数据位中的一个或多个数据位上的数据不同，则说明实际计算值与基线计算值不同。
可选地，计算设备在TEE中获得实际计算值之后，可以将该实际计算值发送给管理设备。管理设备可以通过确定基线计算值与实际计算值是否相同，从而确定计算设备的内核是否可信。
在一些实施例中，计算设备在发送实际计算值时可以进行加密处理，从而使管理设备可以校验接收到的实际计算值是否可信。具体实现方式可以参见步骤S230中的描述。
在实际计算值与基线计算值相同的情况下，可以执行步骤S470。
在实际计算值与基线计算值不同的情况下，可以执行步骤S480。
S470，确定内核的状态为可信。
在计算设备确定实际计算值与基线计算值相同的情况下，可以确定内核的状态为可信，即可以确定内核未被攻击或修改。
在确定内核的状态为可信的情况下，计算设备可以正常运行。或者，计算设备可以采取一定的措施，例如向用户或管理设备发出内核安全的通知消息等。或者，管理设备可以采取一定的措施，例如向该计算设备或管理员发出内核安全的通知消息等，本申请实施例对此并不限定。
S480，确定内核的状态为不可信。
在计算设备确定实际计算值与基线计算值不同的情况下，可以确定内核的状态为不可信，即可以确定内核已被攻击或修改。
在确定内核的状态为不可信的情况下，计算设备可以采取一定的措施，例如可以向用户或管理设备发出告警，或者可以直接暂停运行，从而阻止计算设备被进一步攻击。或者，在确定内核的状态为不可信的情况下，管理设备可以向该计算设备或管理员发送内核不安全的通知消息，或者可以直接暂停计算设备的运行等，本申请实施例对此并不限定。
计算设备可以通过BIOS在TEE中获得第一参数和第二参数，从而可以直接在TEE中确定内核在REE存储空间中的存储位置，进而可以直接读取内核的数据信息。计算设备还可以在TEE中对内核的数据信息进行计算，获得实际计算值，从而在确定内核状态的过程中形成可信闭环，进而可以更加准确可信地确定内核的状态。
图5是根据本申请一个实施例的计算装置500的结构示意图。计算装置500包括转换模块510、获取模块520和确定模块530。
转换模块510用于当接收到指示信息时，进入可信执行环境TEE中，指示信息用于指示确定内核的状态。转换模块510可以执行图2的方法中的步骤S210或图4的方法中的步骤S410。
获取模块520用于在TEE中根据内核在存储设备中的存储位置，获得内核的数据信息。获取模块520可以执行图2中的步骤S220、图4中的步骤S420-440。
确定模块530用于在TEE中对内核的数据信息进行计算，确定内核的实际计算值。实际计算值用于确定内核的状态，内核的状态包括可信或不可信。确定模块530执行图2的方法中的步骤S230、图4的方法中的步骤S450-480。
在一些实施例中，计算装置500还包括发送模块(图中未示出)。发送模块可以在TEE中对实际计算值进行加密，获得加密后的实际计算值。发送模块还可以将加密或签名后的实际计算值发送给管理设备。加密后的实际计算值用于管理设备确定内核的状态。管理设备为与包含存储设备的计算设备连接的其他计算设备。
图6是根据本申请实施例提供的计算设备600的结构框图。图6所示的计算设备600包括：处理器601、存储器602和通信接口603，处理器601、存储器602和通信接口603通过总线604相通信。接收器605用于接收来自于与该计算设备600连接的其他设备(例如管理设备)的信息或待处理请求，发送器606用于将存储器602中存储的实际计算值或加密后的实际计算值发送至与该计算设备600连接的其他设备(例如管理设备)。
上述本发明实施例揭示的方法可以应用于处理器601中，或者由处理器601实现。处理器601可以是中央处理器(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者是任何常规的处理器等。在实现过程中，上述方法的各步骤可以通过处理器601中的硬件的集成逻辑电路或者软件形式的指令完成。可以实现或者执行 本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于存储器602中。处理器601读取存储器602中的指令，结合其硬件完成上述方法的步骤。
存储器602可以存储用于执行上述实施例中计算设备执行的方法的指令。存储器602可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data date SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。处理器601可以执行存储器602中存储的指令，并结合其他硬件(例如接收器605和发送器606)完成上述实施例中计算设备的步骤，具体工作过程和有益效果可以参考上述实施例中的描述。
总线604除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线604。
本申请实施例还提供了一种芯片系统，该芯片系统包括逻辑电路，该逻辑电路用于与输入/输出接口耦合，通过该输入/输出接口传输数据，以执行上述实施例中计算设备执行的各个步骤。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行上述实施例中的各个步骤。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行上述实施例中的各个步骤。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (19)

  1. 一种确定内核状态的方法，其特征在于，包括：
    当接收到指示信息时，进入可信执行环境TEE中，所述指示信息用于指示确定内核的状态；
    在所述TEE中根据所述内核在存储设备中的存储位置，获得所述内核的数据信息；
    在所述TEE中对所述内核的数据信息进行计算，确定所述内核的实际计算值，所述实际计算值用于确定所述内核的状态，所述内核的状态包括可信或不可信。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    在所述TEE中通过基本输入输出系统BIOS获得第一参数和第二参数，所述第一参数包括所述内核的启动地址和所述内核在所述存储设备中的长度，所述第二参数包括所述存储设备中富执行环境REE存储空间的物理起始地址，或者所述第二参数包括所述REE存储空间的物理起始地址和所述内核的地址偏移量；
    在所述TEE中根据所述第一参数和第二参数，确定所述存储位置。
  3. 根据权利要求2所述的方法，其特征在于，所述第一参数为存储在所述BIOS中的参数，和/或，所述第二参数为所述BIOS确定的参数。
  4. 根据权利要求2或3所述的方法，其特征在于，所述存储位置包括所述内核在所述存储设备中的物理起始地址和所述长度，所述内核在所述存储设备中的物理起始地址根据所述REE存储空间的物理起始地址和所述内核的启动地址确定，或者所述内核在所述存储设备中的物理起始地址根据所述REE存储空间的物理起始地址、所述内核的启动地址和所述内核的地址偏移量确定。
  5. 根据权利要求4所述的方法，其特征在于，所述在所述TEE中根据所述内核在存储设备中的存储位置，获得所述内核的数据信息，包括：
    在所述TEE中，根据所述内核在所述存储设备中的物理起始地址和所述长度，从所述存储设备中读取所述内核的数据信息。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述方法还包括：
    在所述TEE中比较所述内核的基线计算值和所述实际计算值，所述基线计算值为预设数值；
    若所述基线计算值和所述实际计算值相同，则确定所述内核的状态为可信；
    若所述基线计算值和所述实际计算值不同，则确定所述内核的状态为不可信。
  7. 根据权利要求6所述的方法，其特征在于，所述基线计算值根据所述内核编译时所述内核的数据信息确定。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述方法还包括：
    在所述TEE中对所述实际计算值进行加密，获得加密后的实际计算值；
    将所述加密后的实际计算值发送给管理设备，所述加密后的实际计算值用于所述管理设备确定所述内核的状态，所述管理设备为与包含所述存储设备的计算设备连接的其他计算设备。
  9. 一种计算装置，其特征在于，包括：
    转换模块，用于当接收到指示信息时，进入可信执行环境TEE中，所述指示信息用于指示确定内核的状态；
    获取模块，用于在所述TEE中根据所述内核在存储设备中的存储位置，获得所述内核的数据信息；
    确定模块，用于在所述TEE中对所述内核的数据信息进行计算，确定所述内核的实际计算值，所述实际计算值用于确定所述内核的状态，所述内核的状态包括可信或不可信。
  10. 根据权利要求9所述的装置，其特征在于，所述获取模块还用于：
    在所述TEE中通过基本输入输出系统BIOS获得第一参数和第二参数，所述第一参数包括所述内核的启动地址和所述内核的长度，所述第二参数包括所述存储设备中富执行环境REE存储空间的物理起始地址，或者所述第二参数包括所述REE存储空间的物理起始地址和所述内核的地址偏移量；
    在所述TEE中根据所述第一参数和第二参数，确定所述存储位置。
  11. 根据权利要求10所述的装置，其特征在于，所述第一参数为存储在所述BIOS中的参数，和/或，所述第二参数为所述BIOS确定的参数。
  12. 根据权利要求10或11所述的装置，其特征在于，所述存储位置包括所述内核在所述存储设 备中的物理起始地址和所述内核的长度，所述内核在所述存储设备中的物理起始地址根据所述REE存储空间的物理起始地址和所述内核的启动地址确定，或者所述内核在所述存储设备中的物理起始地址根据所述REE存储空间的物理起始地址、所述内核的启动地址和所述内核的地址偏移量确定。
  13. 根据权利要求12所述的装置，其特征在于，所述获取模块，具体用于在所述TEE中，根据所述内核在所述存储设备中的物理起始地址和所述长度，从所述存储设备中读取所述内核的数据信息。
  14. 根据权利要求9至13中任一项所述的装置，其特征在于，所述确定模块还用于：
    在所述TEE中比较所述内核的基线计算值和所述实际计算值，所述基线计算值为预设数值；
    若所述基线计算值和所述实际计算值相同，则确定所述内核的状态为可信；
    若所述基线计算值和所述实际计算值不同，则确定所述内核的状态为不可信。
  15. 根据权利要求14所述的装置，其特征在于，所述基线计算值根据所述内核编译时所述内核的数据信息确定。
  16. 根据权利要求9至15中任一项所述的装置，其特征在于，所述装置还包括发送模块，所述发送模块用于：
    在所述TEE中对所述实际计算值进行加密，获得加密后的实际计算值；
    将所述加密后的实际计算值发送给管理设备，所述加密后的实际计算值用于所述管理设备确定所述内核的状态，所述管理设备为与包含所述存储设备的计算设备连接的其他计算设备。
  17. 一种计算机设备，其特征在于，包括：处理器，所述处理器用于与存储器耦合，读取并执行所述存储器中的指令和/或程序代码，以执行如权利要求1-8中任一项所述的方法。
  18. 一种芯片系统，其特征在于，包括：逻辑电路，所述逻辑电路用于与输入/输出接口耦合，通过所述输入/输出接口传输数据，以执行如权利要求1-8中任一项所述的方法。
  19. 一种计算机可读介质，其特征在于，所述计算机可读介质存储有程序代码，当所述计算机程序代码在计算机上运行时，使得计算机执行如权利要求1-8中任一项所述的方法。
PCT/CN2023/106854 2022-08-03 2023-07-12 一种确定内核状态的方法和相关设备 WO2024027472A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210925211.0A CN117556418A (zh) 2022-08-03 2022-08-03 一种确定内核状态的方法和相关设备
CN202210925211.0 2022-08-03

Publications (1)

Publication Number Publication Date
WO2024027472A1 true WO2024027472A1 (zh) 2024-02-08

Family

ID=89815246

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/106854 WO2024027472A1 (zh) 2022-08-03 2023-07-12 一种确定内核状态的方法和相关设备

Country Status (2)

Country Link
CN (1) CN117556418A (zh)
WO (1) WO2024027472A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060242406A1 (en) * 2005-04-22 2006-10-26 Microsoft Corporation Protected computing environment
KR20070019191A (ko) * 2005-08-11 2007-02-15 주식회사 웨어플러스 커널 메모리를 보호하는 방법 및 그 장치
CN104951316A (zh) * 2014-03-25 2015-09-30 华为技术有限公司 一种内核可信启动方法和装置
CN112231072A (zh) * 2019-07-15 2021-01-15 杭州中天微系统有限公司 一种处理器及内核切换处理方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060242406A1 (en) * 2005-04-22 2006-10-26 Microsoft Corporation Protected computing environment
KR20070019191A (ko) * 2005-08-11 2007-02-15 주식회사 웨어플러스 커널 메모리를 보호하는 방법 및 그 장치
CN104951316A (zh) * 2014-03-25 2015-09-30 华为技术有限公司 一种内核可信启动方法和装置
CN112231072A (zh) * 2019-07-15 2021-01-15 杭州中天微系统有限公司 一种处理器及内核切换处理方法

Also Published As

Publication number Publication date
CN117556418A (zh) 2024-02-13

Similar Documents

Publication Publication Date Title
US10931451B2 (en) Securely recovering a computing device
JP4971466B2 (ja) コンピューティング・デバイスの安全なブート
TWI436280B (zh) 存取基本輸入輸出系統設定的認證方法
US8291480B2 (en) Trusting an unverified code image in a computing device
US8560820B2 (en) Single security model in booting a computing device
US8161285B2 (en) Protocol-Independent remote attestation and sealing
US8127146B2 (en) Transparent trust validation of an unknown platform
KR101402542B1 (ko) 지속형 보안 시스템 및 지속형 보안 방법
US20090259855A1 (en) Code Image Personalization For A Computing Device
US20120278597A1 (en) Compatible trust in a computing device
KR20170057279A (ko) 보안 입력 메커니즘 기반 관리자 모드를 위한 방법
WO2021197040A1 (zh) 可信度量方法及相关装置
US11909882B2 (en) Systems and methods to cryptographically verify an identity of an information handling system
US9537738B2 (en) Reporting platform information using a secure agent
WO2023179745A1 (zh) 可信验证方法及装置
WO2024027472A1 (zh) 一种确定内核状态的方法和相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23849181

Country of ref document: EP

Kind code of ref document: A1