WO2024078159A1 - 完整性度量方法及装置 - Google Patents

完整性度量方法及装置 Download PDF

Info

Publication number
WO2024078159A1
WO2024078159A1 PCT/CN2023/115263 CN2023115263W WO2024078159A1 WO 2024078159 A1 WO2024078159 A1 WO 2024078159A1 CN 2023115263 W CN2023115263 W CN 2023115263W WO 2024078159 A1 WO2024078159 A1 WO 2024078159A1
Authority
WO
WIPO (PCT)
Prior art keywords
tee
measurement
target component
module
component
Prior art date
Application number
PCT/CN2023/115263
Other languages
English (en)
French (fr)
Inventor
朱少峰
左鹏
张小虎
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024078159A1 publication Critical patent/WO2024078159A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • the embodiments of the present application relate to the field of network security, and in particular to an integrity measurement method and device.
  • DIM dynamic integrity measurement
  • the DIM method of the prior art is that the measurement module performs integrity verification on the target object, but the measurement module may also be attacked. If the security of the measurement module cannot be guaranteed, the credibility of the integrity verification result obtained will be affected.
  • the embodiments of the present application provide an integrity measurement method and device, which can improve the security of the system to a certain extent.
  • an embodiment of the present application provides an integrity measurement method.
  • the method is applied to an electronic device, which includes a trusted execution environment TEE and a non-TEE.
  • the TEE includes a first trusted area and a TEE management module, the first trusted area is isolated from each component in the non-TEE, and the first trusted area is also isolated from other trusted areas in the TEE.
  • the first trusted area includes a measurement module, and the volume of the TEE management module is lightweight.
  • the method includes: the TEE management module obtains measurement request information, and the measurement request information is used to request integrity measurement of the target component; wherein the target component is a component in the TEE or non-TEE.
  • the TEE management module responds to the measurement request information and sends measurement indication information to the measurement module; the measurement indication information is used to instruct the measurement module to perform integrity measurement on the target component.
  • the TEE management module receives the integrity measurement result fed back by the measurement module. Among them, the integrity measurement result is used to indicate whether the target component is complete.
  • the embodiment of the present application is used for the measurement module that performs integrity measurement, and the management module is used as a trusted base to perform the interaction process of integrity measurement. Since the management module is a lightweight module, the attack surface can be effectively reduced, thereby further reducing the probability of attacking the measurement module through the management module. Furthermore, since the metric module is isolated from other components, it is itself protected from being attacked directly or indirectly by other components.
  • the TEE management module is the TEE manager in the embodiment of the present application.
  • the measurement request information may be sent by a target component or by a periodic measurement module.
  • the TEE also includes a second trusted area, which includes at least one TEE application and a TEE operating system, wherein at least one TEE application depends on the TEE operating system.
  • the first trusted area does not include the TEE operating system, and the measurement module depends on the TEE management module.
  • the measurement module belongs to a trusted area alone and does not depend on the TEE operating system of a larger magnitude, which can effectively reduce the area that may be attacked and improve the security of the measurement module.
  • the TEE application in the second trusted area depends on the TEE operating system, and the TEE operating system has the permission to access the TEE application, that is, the TEE operating system can access the memory of the TEE application. If there is an attack, the TEE application may be attacked through the TEE operating system. Since the measurement module belongs to a trusted area alone, it does not depend on the TEE OS, but only on the lightweight TEE manager, which makes the attack surface smaller and reduces the risk of being attacked by the TEE manager.
  • the TEE management module sends measurement indication information to the measurement module in response to the measurement request information, including: the TEE management module verifies the legitimacy of the target component based on the measurement request information. When the legitimacy verification of the target component is successful, the TEE management module sends the measurement indication information to the measurement module.
  • the TEE manager in the embodiment of the present application adds a legitimacy verification function to prevent illegal applications from accessing the measurement module through the TEE manager, thereby ensuring the security of the measurement module. For example, illegal software disguises itself as a target component and sends measurement request information to the TEE manager. However, since the TEE manager does not save the relevant information of the illegal software in advance, its legitimacy verification fails. The TEE manager rejects requests from illegal software, thereby preventing illegal software from accessing the measurement module through the TEE manager.
  • the measurement request information includes the identification information and target storage address information of the target component, and the target storage address information is used to indicate the target storage space where the program code of the target component is located;
  • the TEE management module verifies the legitimacy of the target component based on the measurement request information, including: the TEE management module verifies the identification information and target storage address information of the target component based on the pre-saved component information;
  • the component information is obtained by the TEE management module when the electronic device is installed with the TEE management module, and the component information includes the identification information and storage address information corresponding to all components in the non-TEE.
  • the TEE management module determines that the legitimacy verification of the target component is successful.
  • the embodiment of the present application maintains the identification and address of the legal component in advance.
  • the component is determined to be legal.
  • the disguised illegal component since its identification information and storage address are not maintained in advance, it is determined to be an illegal component, and its other operations are rejected to ensure the security of the system and avoid illegal component access.
  • the TEE management module sends measurement indication information to the measurement module in response to the measurement request information, and also includes: when the legitimacy verification of the target component is successful, the TEE management module updates the target component's access rights to the target storage space from the first access right to the second access right, and sends the measurement indication information to the measurement module; wherein the first access right is a prohibited access right, and the second access right is a read access right; the measurement indication information includes the target storage address information, so that the measurement module obtains the program code of the target component from the target storage space based on the target storage address information and the second access right, and performs integrity measurement on the program code of the target component.
  • the measurement module is allowed to access the memory of other components only when the measurement module needs to perform integrity measurement on the component, so as to achieve the granularity of the access setting with the read access right of a single application, and to avoid attacking other components through the measurement module by precisely controlling the access rights, thereby improving the security of the component.
  • the method further includes: the TEE management module updates the target component's access rights to the target storage space from the second access rights to the first access rights.
  • the permissions of the measurement module are promptly reclaimed to prevent other components from being attacked by the measurement module. For example, when illegal software attacks the measurement module and attempts to further access other components through the measurement module to tamper with the program code of other components. Since the measurement module does not have access rights to other components, the system denies access to the measurement module.
  • the target component is an application, an operating system, or a service.
  • the target component can be an application or an operating system in a non-TEE environment.
  • the target component can also be an application, an operating system, or a virtualization manager (also understood as a virtualization management service) in a virtual machine (or virtualized environment) in a non-TEE environment.
  • the target component can also be a TEE App or TEE OS in a TEE.
  • an embodiment of the present application provides an integrity measurement device.
  • the device includes a trusted execution environment TEE and a non-TEE, the TEE includes a first trusted area and a TEE management module, the first trusted area is isolated from each component in the non-TEE, the first trusted area is isolated from other trusted areas in the TEE, the first trusted area includes a measurement module, and the TEE management module is lightweight; the TEE management module is used to obtain measurement request information, the measurement request information is used to request integrity measurement of the target component; wherein the target component is a component in the TEE or non-TEE; the TEE management module is also used to send measurement indication information to the measurement module in response to the measurement request information; the measurement indication information is used to instruct the measurement module to perform integrity measurement on the target component; the measurement module is used to perform integrity measurement on the target component based on the measurement request information.
  • the measurement module requests information, performs integrity measurement on the target component, and obtains the integrity measurement result; wherein the integrity measurement result is used to indicate whether the target component is complete;
  • the TEE also includes a second trusted area, which includes at least one TEE application and a TEE operating system, wherein at least one TEE application depends on the TEE operating system; the first trusted area does not include the TEE operating system, and the measurement module depends on the TEE management module.
  • the TEE management module is specifically used to: verify the legitimacy of the target component based on the measurement request information; and send measurement indication information to the measurement module when the legitimacy verification of the target component is successful.
  • the measurement request information includes identification information and target storage address information of the target component, and the target storage address information is used to indicate the target storage space where the program code of the target component is located;
  • the TEE management module is specifically used to: verify the identification information and target storage address information of the target component based on pre-saved component information; the component information is obtained by the TEE management module when the TEE management module is installed in the electronic device, and the component information includes identification information and storage address information corresponding to all components in the non-TEE; when the identification information and target storage address information of the target component are successfully verified, it is determined that the legitimacy verification of the target component is successful.
  • the TEE management module is specifically used to: when the legitimacy verification of the target component is successful, the TEE management module updates the target component's access rights to the target storage space from a first access right to a second access right, and sends measurement indication information to the measurement module; wherein the first access right is a prohibited access right, and the second access right is a read access right; the measurement indication information includes target storage address information; the measurement module is used to obtain the program code of the target component from the target storage space based on the target storage address information and the second access right, and perform integrity measurement on the program code of the target component.
  • the TEE management module is specifically configured to: after receiving the integrity measurement result fed back by the measurement module, update the access permission of the target component to the target storage space from the second access permission to the first access permission.
  • the target component is an application, an operating system, or a service.
  • an embodiment of the present application provides a computer-readable medium for storing a computer program, wherein the computer program includes instructions for executing the method in the first aspect or any possible implementation of the first aspect.
  • an embodiment of the present application provides a computer program, which includes instructions for executing the method in the first aspect or any possible implementation of the first aspect.
  • an embodiment of the present application provides a chip, the chip comprising a processing circuit and a transceiver pin, wherein the transceiver pin and the processing circuit communicate with each other through an internal connection path, and the processing circuit executes the method in the first aspect or any possible implementation of the first aspect to control the receiving pin to receive a signal and control the sending pin to send a signal.
  • FIG1 is a diagram showing an exemplary system architecture
  • FIG2 is a schematic diagram showing a structure of multiple trusted domains
  • FIG3 is a schematic diagram of the structure of a non-TEE shown as an example
  • FIG4 is a flow chart showing an exemplary integrity measurement technology
  • FIG5 is a diagram showing an exemplary system architecture
  • FIG6 is a diagram showing an exemplary system architecture
  • FIG7 is a schematic diagram of the structure of a TEE provided in an embodiment of the present application.
  • FIG8 is a schematic diagram showing an exemplary deployment of a TEE
  • FIG9 is a schematic diagram showing exemplary module interaction
  • FIG10 is a schematic diagram of an exemplary process of integrity measurement
  • FIG. 11 is a schematic diagram showing the structure of an exemplary device.
  • a and/or B in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist.
  • a and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone.
  • first and second in the description and claims of the embodiments of the present application are used to distinguish different objects rather than to describe a specific order of objects.
  • a first target object and a second target object are used to distinguish different target objects rather than to describe a specific order of target objects.
  • words such as “exemplary” or “for example” are used to indicate examples, illustrations or descriptions. Any embodiment or design described as “exemplary” or “for example” in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as “exemplary” or “for example” is intended to present related concepts in a specific way.
  • multiple refers to two or more than two.
  • multiple processing units refer to two or more processing units; multiple systems refer to two or more systems.
  • FIG1 is an exemplary system architecture diagram. Please refer to FIG1.
  • a trusted execution environment (TEE) and a rich execution environment (REE) are included. Highly security-sensitive applications are isolated from the general software environment, a dedicated trusted execution environment TEE is provided, and the confidentiality, integrity and access rights of the application's resources and data are protected; a general rich execution environment REE is provided for traditional operating systems such as Android that are vulnerable to attack.
  • Applications executed on the REE side are called client applications (CA), such as third-party payment applications such as banking applications, and applications executed on the TEE side are called trusted applications (TA), such as applications that perform key services such as signatures, encryption and decryption calculations.
  • CA client applications
  • TA trusted applications
  • the trusted execution environment TEE includes the trusted execution environment internal application programming interface (TEE Internal API) and trusted operating system components.
  • TEE Internal API trusted execution environment internal application programming interface
  • the main functions of the TEE Internal API are: to provide the functions of the trusted operating system components to the upper layer, to communicate with the client application CA, to realize TA-TA communication, to provide secure storage, cryptographic functions, time functions, etc.
  • the trusted operating system components mainly include the trusted core framework, trusted functions, trusted kernel and trusted execution environment TEE communication agent.
  • the trusted core framework provides TA with operating system-like functions; the trusted functions provide support capabilities for application developers; the trusted kernel is used to interact with trusted devices in the platform hardware; the trusted execution environment communication agent provides a secure communication channel for TA and CA.
  • the trusted execution environment communication agent passes messages to the rich execution environment communication agent through the platform hardware to realize the interaction between TA and CA.
  • the Rich Execution Environment REE includes the Trusted Execution Environment Client Application Programming Interface (TEE Client API), the Trusted Execution Environment Functional Application Programming Interface (TEE Functional API) and the multimedia operating system.
  • the multimedia operating system components mainly include public device drivers and the Rich Execution Environment Communication Agent.
  • the Rich Execution Environment Communication Agent is used to communicate with TEE.
  • CA and TA provide a secure communication channel.
  • the public device driver is used to drive the public devices in the platform hardware.
  • CA uses TEE Client API and TEE Functional API to access the security services provided by TA.
  • the collection of all security protection mechanisms used to implement computer system security protection can be referred to as the trusted base of the computer system.
  • the mechanism can appear in the form of hardware, firmware and/or software. Once a component of the trusted base has a program error, If there are any errors or safety hazards, it will endanger the safety of the entire system.
  • FIG. 1 is only a schematic example, and in other embodiments, more or fewer components or modules may be included, and this application does not limit this.
  • the terminal described in the embodiments of the present application may be an electronic device such as a tablet computer, a mobile terminal (such as a mobile phone), a laptop computer, a desktop computer, a wearable device, an optical line terminal (OLT), an optical network terminal (ONT), etc., and the present application does not limit this.
  • system framework involved in the embodiments of the present application can be an ARM architecture or other architectures, and this application does not limit it.
  • the TEE may include at least one trusted domain (which may also be referred to as a trusted area or a security domain, which is not limited in this application).
  • Figure 2 is a schematic diagram of a structure of multiple trusted domains. Please refer to Figure 2.
  • the TEE may include at least one trusted domain.
  • Figure 2 only takes the example of the TEE including the first trusted domain, the second trusted domain, and the third trusted domain as an example.
  • the system may include more or fewer trusted domains, which is not limited in this application.
  • multiple trusted domains in TEE are similar to virtualization in non-TEE (see FIG. 3 ), and can also be understood as a virtualization solution. That is, in the embodiment of the present application, multiple trusted domains can be virtualized on the structure of TEE.
  • each trusted domain is isolated from each other, that is, different trusted domains cannot access each other without authorization. It can also be understood that the memory of the trusted domains is isolated from each other. That is, different trusted domains cannot access each other's memory without authorization.
  • At least one of TA and TEE OS may be included between trusted domains.
  • the first trusted domain includes at least one TA and TEE OS.
  • the second trusted domain includes TEE OS.
  • the third trusted domain includes at least one TA.
  • the specific layout can be set according to actual needs and is not limited in this application.
  • the TEE also includes a TEE manager (also referred to as a TEE management module).
  • the TEE manager also referred to as a TEE management module, is used to provide services for establishing and managing trusted domains in the TEE.
  • the TEE manager is responsible for fewer functions and a smaller amount of code.
  • FIG. 3 is a schematic diagram of the structure of a non-TEE shown as an example. Please refer to Figure 3.
  • a virtualized environment may be set in a non-TEE, including but not limited to: a first VM (Virtual machine), a second VM, and a third VM. It should be noted that the number of VMs and the components included in Figure 3 are only illustrative examples and are not limited in this application.
  • each VM includes but is not limited to at least one application (App) and an operating system (OS, Operating System).
  • App application
  • OS Operating System
  • a virtualization manager also referred to as a virtualization management module, a virtualization management unit, or a virtualization management component, etc., which is not limited in this application
  • the virtualization manager is used to create and manage at least one VM in the non-TEE.
  • the layout in the non-TEE environment in the embodiment of the present application can refer to Figure 1 or Figure 3, that is, the non-TEE can be a virtualized environment, a non-virtualized environment, or a combination of a virtualized environment and a non-virtualized environment, and this application does not limit it.
  • components in non-TEE are vulnerable to attacks, resulting in tampering of the program code (also referred to as program instructions or computer programs, which are not limited in this application) in the memory of the components.
  • program code also referred to as program instructions or computer programs, which are not limited in this application
  • integrity measurement technology can be used to perform integrity checks on the components to detect whether the components are complete, that is, whether they have been tampered with.
  • integrity measurement technology is a mechanism for monitoring the integrity of programs such as Apps and OS when a computing system is running.
  • the program code or program code and data stored in the memory of the target component to be measured is read, and the measurement Hash value is calculated. By comparing it with the reference Hash value, it is determined whether the integrity of the target component to be measured is damaged.
  • the principle of integrity measurement is to detect whether the program code of the component currently stored in the memory is consistent with the original program code of the component. If they are consistent, the component is complete; if they are inconsistent, the component is incomplete, that is, it has been tampered with.
  • the target component described in the embodiments of the present application can be a component in a non-TEE, such as an application, an operating system, and a virtualization manager, or a component in a TEE, such as a TEE App, TEE OS, etc.
  • the embodiments of the present application only take the integrity measurement of the target component in a non-TEE as an example.
  • the integrity measurement can also refer to the integrity measurement process in non-TEE, and this application will not give examples one by one.
  • the application and operating system described in the embodiment of this application may refer to the application and operating system in the non-virtualized environment in Figure 1, or may refer to the application and operating system in the virtualized environment in Figure 3. This application does not limit it and will not be repeated below.
  • the data of the target component can also be referred to as a read-only data segment, which can optionally be immutable data in the target component.
  • the mutable data due to its variability during program execution, its integrity cannot be measured, which will not be repeated below.
  • FIG4 is a flowchart of an exemplary integrity measurement technology.
  • the target component in the non-TEE may send a measurement request to the measurement module in the TEE.
  • the measurement request includes but is not limited to: identification information of the target component, memory address information of the target component, etc.
  • the measurement request is used to request the measurement module to perform integrity measurement on the target component.
  • the memory address information of the target component includes but is not limited to: memory address information of the program code of the target component and memory address information of the data of the target component.
  • the memory address information is used to indicate the location where the corresponding code or data is stored in the memory space.
  • the program code of the target component is the program code executed when the hardware calls the target component.
  • the data of the target component may optionally be some data corresponding to the target component, such as a user account, password, etc., which is not limited in this application.
  • the measurement module obtains the program code and data of the target component from the memory control indicated by the target address information in response to the measurement request.
  • the measurement module can generate a hash value (hereinafter referred to as the measurement hash value) based on the program code and data of the target component obtained.
  • the specific generation method can refer to the existing technical embodiments, and this application will not repeat them.
  • the measurement module pre-stores a hash value corresponding to at least one component in the non-TEE, which is referred to as a reference hash value in the embodiment of the present application, for example, including reference hash values 1 to reference hash values n.
  • the reference hash value is optionally obtained by the measurement module in the initial stage, that is, the measurement module can obtain the program code and data of each component in the non-TEE in the initial stage (which can also be understood as the first installation or loading), generate a corresponding reference hash value and save it.
  • the measurement module can compare the measurement hash value of the target component with the reference hash value of the target component.
  • the integrity check is successful, that is, the target component is complete, which can also be understood as the current target component program code and data of the target component are consistent with those obtained during the initialization phase of the measurement module.
  • the integrity check fails, that is, the target component is incomplete (or can be understood as being tampered with), which can also be understood as the current target component program code and data of the target component are inconsistent with those obtained during the initialization phase of the measurement module.
  • the measurement module may feed back a measurement result to the target component, wherein the measurement result includes an integrity check success indication or an integrity check failure indication.
  • the measurement module can feed back the measurement result to the target component and the remote user, wherein the remote user can be the host of the terminal or other terminal users connected to the terminal, which is not limited in this application.
  • the result can be fed back to the target component and the remote user. If the integrity check fails, it proves that the target component is abnormal, and there is no need to feed back the result to the target component, but the result can be fed back directly to the remote user.
  • the target component may perform subsequent operations in response to the received measurement result. For example, if the measurement request is sent to the measurement module before the target component needs to run or downloads data, if the measurement result is that the integrity check succeeds, the target component may continue to run or download data. If the measurement result is that the integrity check fails, the target component stops running.
  • a prompt message can be displayed on the remote user's display screen to alert the user.
  • the specific subsequent process can be set according to actual needs and is not limited in this application.
  • FIG5 and FIG6 respectively show the system architecture diagrams in the prior art embodiments.
  • the virtualization environment is used as the implementation basis, and the system's trusted base includes a virtualization manager and some other security firmware or security hardware.
  • the measurement module is set in the virtualization manager.
  • the specific steps include but are not limited to:
  • the measurement module saves reference Hash values of all components to be measured (including applications, operating systems, etc., such as Apps in the first VM) through internal calculation during loading or external import.
  • the target component sends a measurement request to the measurement module located in the virtualization manager.
  • the measurement module directly reads the program code and data of the target component in the target memory space (see the schematic diagram in FIG. 4 ) according to the measurement request, and calculates the measurement hash value.
  • the measurement module compares the calculated measurement Hash value with the reference Hash value of the target component and obtains the measurement result.
  • the measurement module feeds back the measurement results to the target component and/or the remote user.
  • the measurement module depends on the virtualization management module, and the code volume of the virtualization module is usually 846KloC. Since the code volume of the trusted base on which the measurement module depends is large, the system attack surface is large. In addition, since the privilege level (also referred to as the permission level) of the virtualization manager is high, it has the authority to access the memory space of all VMs and the applications and operating systems included therein. Therefore, if the measurement module is attacked due to its own vulnerabilities, it may access all virtualized operating systems and virtualized applications running on the virtualization manager in the system through the measurement module, and destroy the integrity of the applications and/or operating systems in the VMs.
  • the privilege level also referred to as the permission level
  • the measurement module is also set in the virtual manager, and since the virtual manager includes other components, it is possible that due to program vulnerabilities in other components, the enemy may attack the measurement module through other components, and may tamper with the integrity of the applications and operating systems in the non-TEE through the measurement module, and since the measurement module itself may be attacked, the credibility of the measurement results obtained by it is reduced.
  • the trusted base of the system includes but is not limited to: TEE OS and secure firmware or secure hardware in the trusted domain.
  • the specific steps include but are not limited to: the target component sends a measurement request to TEE OS, TEE OS sends the measurement request to the measurement module, and the measurement module performs integrity measurement.
  • the specific description can be referred to above and will not be repeated here.
  • the measurement module feeds back the measurement results to TEE OS, and TEE OS feeds back the measurement results to the target component.
  • the measurement module also has access to all applications and operating systems.
  • the measurement module depends on the operating system, that is, it interacts with other components through the operating system. Since the code size of the TEE OS is about 253KloC, the DIM solution of the measurement module depends on a large trusted base (that is, a large code size), resulting in a large attack surface. Moreover, similar to the process in FIG5 , since the measurement module has a large authority, if the measurement module is attacked, the attacker can access all applications and operating systems running in the system through the measurement module and destroy the integrity of the applications and operating systems.
  • an embodiment of the present application provides an integrity measurement method.
  • the measurement module is set in an independent TEE environment and relies on a lightweight trusted base, thereby ensuring the security of the measurement module and improving the overall security and stability of the system.
  • FIG. 7 is a schematic diagram of the structure of the TEE provided in the embodiment of the present application.
  • the TEE may include at least one trusted area, such as a first trusted area, a second trusted area, and a third trusted area. It should be noted that the number and layout of the trusted areas in the embodiment of the present application are only illustrative examples and are not limited in this application.
  • the first trusted area includes a measurement module.
  • the second trusted area includes, but is not limited to, at least one TA and TEE OS.
  • the third trusted area includes, but is not limited to, TEE OS.
  • the number and type of components included in the second trusted area and the third trusted area are only illustrative examples.
  • the second trusted area and the third trusted area may include at least one of TA and TEE OS, for example, only TA, TA and TEE OS, or only TEE OS. It can be set according to actual needs and is not limited in this application.
  • the trusted base of TEE includes but is not limited to: a TEE manager and some secure firmware or secure hardware, etc.
  • the layout in the non-TEE may refer to FIG. 1 or FIG. 3 , and the present application does not make any limitation thereto.
  • the measurement module may be used to perform integrity measurement on a target component.
  • the TEE manager may optionally include but is not limited to a measurement relay module (or a measurement relay component), wherein the measurement relay module includes a verification unit and a permission control unit (also referred to as a verification component or a permission control component, which is not limited in this application).
  • the verification unit is used to perform security verification on components that require integrity measurement.
  • the permission control unit is used to manage and control the access rights of the measurement module to other components.
  • the measurement relay module exchanges data with the measurement module, and the measurement relay module can be used to send measurement indications to the measurement module or receive measurement results fed back by the measurement module. That is to say, in the embodiment of the present application, the measurement module is dependent on the measurement relay module, and it only exchanges control information (including measurement indications and measurement results) with the measurement relay module.
  • the terminal includes but is not limited to a processor and an internal memory.
  • the internal memory can be used to store computer executable program code, and the executable program code includes instructions.
  • the internal memory may include a high-speed random access memory, and may also include a non-volatile memory (Flash), such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.
  • Flash non-volatile memory
  • UFS universal flash storage
  • the terminal before the system is started (it can also be understood as before the terminal is initialized), the images of the measurement module, TEE manager, target component (not shown in the figure), TEE App, TEE OS and other components are stored in the non-volatile memory.
  • the terminal specifically, it can be the startup module in the terminal (such as BootLoader), which will not be repeated below) loads multiple images in the non-volatile memory into the system memory (such as DRAM).
  • the memory includes but is not limited to: the memory of the first trusted domain, the memory of the TEE manager, the memory of the second trusted domain, and the memory of the target component.
  • the memory of the first trusted domain includes the memory of the measurement module.
  • the memory of the measurement module is used to store the program code of the measurement module. That is, the memory space where the program code of the measurement module is located is located in the memory area (or memory space) of the first trusted domain.
  • the memory of the second trusted domain includes, but is not limited to: the memory of the TEE App and the memory of the TEE OS.
  • the memory of the TEE App is used to store the program code and data of the TEE App
  • the memory of the TEE OS is used to store the program code of the TEE OS.
  • the memory space where the program code (and data) of the TEE App is located and the memory space where the program code of the TEE OS is located are both located in the memory area of the second trusted domain.
  • the memory of the TEE manager is used to store the program code of each component included in the TEE manager.
  • the memory of the target component is used to store the program code of the target component, or the program code and data of the target component.
  • the memory of the first trusted domain where the measurement module is located is isolated from any component in the terminal except the TEE manager (including components in the TEE or components in non-TEE).
  • the memory of the measurement module is isolated from other components. That is to say, in the embodiment of the present application, any component in the terminal except the TEE manager does not have access to the memory of the measurement module.
  • the measurement module if the measurement module is not set to have access rights to the memory of other components, the measurement module also does not have access rights to the memory of other components.
  • the configuration method of the access rights of the measurement module will be described in detail below and will not be repeated here.
  • memory isolation can also be understood as component isolation, that is, mutually isolated components cannot access each other's memory without authorization.
  • the memory of the measurement module belongs exclusively to a memory area, that is, exclusively to a trusted domain, and no other components are included in the trusted domain.
  • the trusted domain to which the measurement module belongs may also include at least one TEE App of a smaller magnitude (that is, the program code is lightweight).
  • the total amount of program code of the TEE App in the same trusted domain as the measurement module is less than a threshold value (which can be set according to actual needs and is not limited in this application) to reduce the magnitude of the trusted domain, reduce the attack surface, and reduce the probability of being attacked.
  • the identification information and address information of all components in the non-TEE can be loaded into the memory of the TEE manager, or the identification information and address information of components in the non-TEE that need to be integrity checked can be loaded.
  • the identification information can be the ID of the component.
  • the address information is the address corresponding to the memory space where the program code or data of the component is located (also called the memory address).
  • the identification information and address information of the component can be stored in the memory of the TEE manager in the form of a list, etc., which is not limited in this application.
  • the TEE manager specifically the verification module
  • security verification also called legality verification, which is not limited in this application
  • the specific verification method will be described in detail below.
  • the identification information and memory address information of the components maintained in the TEE manager may be stored in the form of a list (e.g., an address space layout list). In other embodiments, it may also be stored in other forms, which is not limited in this application.
  • a virtual VM including an application and/or an operating system
  • an application and/or an operating system may be newly installed in the non-TEE, and the memory of the TEE manager will also obtain the identification information and address information of the newly installed components.
  • the page table of the measurement module (hereinafter referred to as the measurement module page table) is also loaded into the memory of the TEE manager.
  • the measurement module page table includes but is not limited to: the memory address of the component, the physical address corresponding to the memory address, and access rights, etc.
  • the component is all components in the non-TEE, or the component that needs to be measured for integrity.
  • the memory address is the memory address of the memory space described by the component.
  • the physical address is the actual physical address corresponding to the memory address.
  • Access rights include but are not limited to: read access rights, Write access rights and deny access rights, etc.
  • the initial access rights in the page table are all deny access rights.
  • the permission of the measurement module to the memory space of each component indicated in the page table is "deny access", that is, the measurement module is prohibited from accessing the memory space of the component. It can be understood that, as described above, the measurement module in the embodiment of the present application does not have the permission to access other components without authorization.
  • the program code of the measurement module and the reference hash value list are stored in the memory of the measurement module.
  • the reference hash value list includes but is not limited to the correspondence between the memory address information of each component (which may be all components in the non-TEE or components that need to be measured for integrity) and the reference hash value.
  • the reference hash value list may include but is not limited to: the correspondence between the identification information of each component and the reference hash value.
  • the reference hash value list may also include only the reference hash value of each component. This application is not limited.
  • the reference hash value of each component can be calculated by the terminal (for example, it can be a startup module) based on the program code of the component, or it can be calculated based on the program code and data of the component.
  • the specific calculation method can refer to the existing technology, and this application will not go into details.
  • the reference hash value of the component can also be imported externally, for example, it can be downloaded from the supplier server of the component, which is not limited in this application. It can be understood that the reference hash value is a benchmark for verifying whether the component is complete, that is, whether the program code and/or data of the component are complete. In this way, the measurement module can perform integrity verification on the components that need to be measured for integrity based on the pre-saved reference hash value. The specific verification method will be described in detail below.
  • other components also correspond to their own page tables, and the page table of each component is used to record the access rights of the component to the memory of different components.
  • the memory of the measurement module is isolated from other components, that is, other components except the TEE manager do not have access rights to the memory of the measurement module (which can also be understood as the memory of the first trusted domain).
  • the page table of other components may not include relevant information of the memory of the measurement module (or the first trusted area) to indicate that the component does not have the right to access the memory of the measurement module.
  • the page table of the component may include relevant information of the memory of the measurement module, and the corresponding access right is to prohibit access.
  • This layout method can be considered as the measurement module realizing an independent trusted domain, which is isolated from components in other trusted domains and components in non-TEE, thereby avoiding the attacker from attacking the measurement module through other components and reducing the probability of the measurement module being attacked.
  • the measurement module no longer relies on components with large volume (i.e., program code) such as TEEOS or virtualization manager, but relies on the smaller TEE manager, that is, the DIM solution in the embodiment of the present application is implemented with the TEE manager as the trusted base, wherein the program code (i.e., volume) of the TEE manager is of the order of 10KLoC, which is much smaller than that of the TEE OS and virtualization manager.
  • the volume of the TEE manager is small, and the attack surface is correspondingly small, thereby reducing the probability of attacking the measurement module through the TEE manager.
  • the DIM interaction process of the measurement module relying on the TEE manager will be described in detail in the following embodiments.
  • the processor runs the program code in the memory, which enables the terminal to perform the corresponding function.
  • the processor in the integrity measurement stage, can run the measurement module and the TEE manager.
  • the processor reads the memory of the measurement module to run the program code of the measurement module, and the processor reads the memory of the TEE manager to run the program code of the relevant components of the TEE manager.
  • FIG9 is an exemplary schematic diagram of module interaction.
  • the target component sends a measurement request to the TEE manager when there is an integrity verification requirement.
  • the measurement request includes but is not limited to: identification information of the target component (e.g., the ID of the target component) and memory address information (the concept can be referred to above).
  • the target component can send a metric request to the metric relay module through an API interface with the TEE manager.
  • the integrity requirement of the target component may be before the target component determines that it needs to be started in response to a received user instruction, or it may be after the target component is started and needs to read or write data to the storage.
  • the specific setting can be based on actual needs and is not limited in this application.
  • the number of target components described in the embodiments of the present application may be one or more. That is to say, multiple target components can send measurement requests to the TEE manager simultaneously or sequentially to request integrity measurement.
  • the TEE manager and the measurement module can process measurement requests of multiple target components in series or in parallel, which is not limited in this application.
  • the processing method of multiple components is the same as that of a single component. This application only takes a single target component as an example for illustration, and will not be repeated below.
  • the TEE may further include a period measurement module (not shown in the figure), and the period measurement module may be provided with a timer.
  • the timing duration of the timer may be set according to actual needs, for example, 5 minutes, which is not limited in this application.
  • the periodic measurement module can maintain the identification information and memory address information of all components in the non-TEE or components that need to perform integrity measurement.
  • the measurement module sends a measurement request to the measurement relay module, and the measurement request includes but is not limited to: the identification information and memory address information of at least one component maintained by the measurement module, which is used to request integrity verification of at least one component.
  • the measurement relay module may execute the integrity measurement process.
  • FIG10 is a schematic diagram of an exemplary integrity measurement process. Referring to FIG10 , the steps specifically include but are not limited to the following:
  • the measurement relay module performs a validity check on the target component in response to the received measurement request.
  • the measurement relay module (specifically, the verification unit, which will not be described again below) obtains a measurement request from a target component, and obtains identification information and memory address information of the target component in the measurement request.
  • the memory of the measurement relay module i.e., the TEE manager
  • maintains an address space layout list wherein the list includes but is not limited to the identification information and memory address information of components (including all components not in the TEE or components that need to be measured for integrity, which will not be repeated below).
  • the measurement relay module can match the identification information of the component in the measurement request with the identification information of the component in the address space layout list.
  • the measurement relay module can determine that the component sending the measurement request is an illegal component. That is, in the embodiment of the present application, if an illegal component pretends to be a legal component to apply for integrity measurement, the legality verification fails because the measurement relay module does not store the relevant information of the illegal component in advance. The measurement relay module can determine that the component is an illegal component and reject its integrity measurement request to prevent the illegal component from attacking the measurement module through the measurement relay module.
  • the measurement relay module obtains the memory address space corresponding to the identification information of the successful match.
  • the measurement relay module compares the memory address information in the measurement request with the address space information of the successful match to determine whether the two are consistent.
  • the measurement relay module ends the integrity measurement process of the target component.
  • the measurement relay module can also execute an exception handling process.
  • the exception handling process may include displaying an alarm message on the display screen of the terminal, or requesting the processor to uninstall the illegal component, etc., which is not limited in this application.
  • the measurement relay module grants the measurement module a read access right to the target component.
  • the verification unit may send a trigger instruction to the authority control unit to instruct the authority control unit to authorize the measurement module.
  • the TEE manager maintains a measurement module page table, which includes the measurement module's access rights to each component in the page table.
  • the measurement module's access rights to each component are all prohibited.
  • the measurement relay module obtains the measurement module page table.
  • the measurement relay module matches the memory address information of the target component obtained from the measurement request in the page table, and obtains the physical address information and permission information corresponding to the successfully matched memory address information.
  • the current permission information of the target component indicates that access is prohibited, that is, the measurement module is prohibited from accessing the target component, which can also be understood as prohibiting the measurement module from reading or writing data from the memory of the target component.
  • the measurement relay module modifies the measurement module's access rights to the target component into read access rights, that is, the permission information corresponding to the target component in the page table is modified into read access rights (also referred to as readable access rights or read-only access rights).
  • the measurement module can read the data in the memory of the target component, but the measurement module does not have rights other than read access rights to the target component.
  • the measurement module cannot operate on the data in the memory of the target component (e.g., write, that is, it does not have write access rights).
  • the measurement relay module sends a measurement indication to the measurement module.
  • the measurement relay module after the measurement relay module authorizes the measurement module, it sends a measurement indication to the measurement module.
  • the measurement indication includes but is not limited to: memory address information of the target component.
  • the measurement indication is used to instruct the measurement module to perform integrity check on the target component.
  • the measurement module reads the program code and data of the target component.
  • the measurement module receives the measurement indication and extracts the memory address information. Based on the memory address information, the measurement module can obtain the program code and data of the target component from the corresponding memory space (wherein the data may be empty, which will not be repeated below).
  • the measurement module corresponds to a measurement module page table.
  • the measurement module can send a read request to the MMU (Memory Management Unit), and the read request can include the memory address information of the target component for requesting to read The contents of the memory space indicated by the target component's memory address information.
  • MMU Memory Management Unit
  • the MMU may traverse the measurement module page table based on the memory address information of the target component to find the permission information corresponding to the memory address information.
  • the measurement relay module has authorized the measurement module, that is, the access permission information of the measurement module to the target component is read access permission.
  • the MMU determines that the measurement module has read access permission to the memory of the target component based on the access permission information corresponding to the memory address information, that is, the measurement module is allowed to read data from the memory space of the target component.
  • the measurement module can read the contents stored in the memory space of the target component from the memory based on the correspondence between the memory address information and the physical address information in the page table, including but not limited to: the program code and data of the target component.
  • the specific reading method of the measurement module can refer to the existing technical embodiments, and this application does not limit it.
  • the measurement module generates a measurement hash value based on the program code and data of the target component.
  • the measurement module can generate a measurement hash value of the target component based on the program code and data.
  • the generation method can refer to the existing technical embodiments, and this application does not limit it.
  • the measurement module performs integrity verification on the target component based on the measurement hash value and the reference hash value.
  • the metric module maintains a reference hash value list.
  • the hash value list may include different combinations:
  • the measurement module can traverse the reference hash value list based on the memory address of the target component in the measurement indication. The measurement module obtains the reference hash value corresponding to the memory address information that matches successfully.
  • the reference hash value list includes but is not limited to: the correspondence between the identification information of each component and the reference hash value. Accordingly, the measurement indication sent by the measurement relay module also needs to include the identification information of the target component. The measurement module can traverse the reference hash value list based on the identification information of the target component and obtain the reference hash value corresponding to the identification information that matches successfully.
  • the measurement module can match the measurement hash value with the reference hash value in the list one by one. If the match is successful, that is, the list includes the same reference hash value as the measurement hash value, it can be directly determined that the integrity verification is successful. If the match fails, it is determined that the integrity measurement fails.
  • the measurement module after the measurement module obtains the reference hash value of the target component, it compares the reference hash value with the measurement hash value.
  • the integrity measurement is successful, that is, the program code and data of the target component are complete and have not been tampered with, and S1007 is executed.
  • the integrity measurement fails. For example, if the target component is tampered by the attacker, resulting in the program code being inconsistent with the initial state, the measurement hash value of the target component generated by the measurement module will be inconsistent with the reference hash value.
  • the measurement module sends the measurement result to the measurement relay module.
  • a measurement result is obtained, and the measurement result includes a success in the integrity check (or referred to as a success in integrity measurement) or a failure in the integrity check (or referred to as a failure in integrity measurement).
  • the measurement module sends the address information and measurement result of the target component to the measurement relay module.
  • the measurement module may also feed back the identification information and measurement result of the target component to the measurement relay module to identify the target component corresponding to the measurement result.
  • the measurement relay module revokes the measurement module's read access permission to the target component.
  • the measurement relay module may determine that the measurement module has completed the integrity measurement operation on the target component, and the measurement relay module immediately revokes the measurement module's read access permission to the target component.
  • the metric relay module (specifically the permission control unit) traverses the address space layout list based on the identification information or memory address information of the target component, and determines the access permission information corresponding to the successfully matched identification information or memory address information.
  • the current access permission information is read access permission.
  • the measurement relay module modifies the access permission information to prohibit access, that is, revokes the measurement module's read access permission to the target component.
  • the measurement module itself has a vulnerability, the attacker attacks the measurement module and attempts to read the measurement module through the measurement module.
  • the memory of the target component is used to modify the program code and/or data in the memory of the target component. In this scenario, since the measurement module has a prohibited access right to the target component, the measurement module cannot operate (including read or write) on the contents in the memory of the target component.
  • the measurement module since the measurement module only has read access rights during the integrity measurement process, if the measurement module is attacked, since the measurement module does not have other access rights to the memory of the target component, such as write access rights, the attacker cannot tamper with the contents in the memory of the target component through the measurement module.
  • the authority of the measurement module to the target component, and specifying the granularity of the authority control to a single component, and further specifying the read access rights of a single component, it is possible to effectively prevent the attacker from tampering with the target component through the measurement module to protect the security and integrity of the component.
  • the measurement relay module after the measurement relay module obtains the measurement result fed back by the measurement module, it can also feed back the measurement result to the target component and/or the remote user.
  • the processing of the target component can refer to the description in the above embodiment, which will not be repeated here.
  • the measurement request may also be sent by the periodic measurement module.
  • the measurement relay module feeds back the measurement result to the periodic measurement module.
  • the periodic measurement module can feed back all measurement results to the corresponding components.
  • the periodic measurement module may also only feed back to the component whose measurement result is the integrity measurement failure, which is not limited in this application.
  • the access rights in the page table of the measurement module may all be prohibited access, or may include at least one component with read access rights.
  • the access rights of the measurement module to the first component are read access rights, and the access rights of other components are prohibited access.
  • the measurement relay module may receive a measurement request from the second component, and modify the access rights of the measurement module to the second component to read access rights.
  • the access rights of the measurement module to the first component and the access rights of the second component are both readable.
  • FIG10 only takes one integrity measurement operation of a single target component as an example.
  • the terminal can perform integrity measurement operations on multiple target components based on the process of FIG10.
  • the integrity measurement operation of each component is an independent process, that is, it does not affect each other.
  • a single target component can also trigger the integrity measurement process multiple times, wherein each time in the integrity measurement process, the measurement module's access rights to the component are dynamically modified.
  • S1005 and S1006 may also be completed by a remote verification server.
  • the measurement module does not need to pre-store the reference hash value during the loading phase, and the reference hash value may be stored on the remote server.
  • the measurement hash value may be sent to the remote server, which performs a comparison operation between the measurement hash value and the reference hash value and feeds back the measurement result to the measurement module.
  • the measurement module since the measurement module is isolated from other components, it is protected, which can reduce the probability of the attacker attacking the measurement module through other modules. For example, if the attacker attempts to access the measurement module through the TEE App in the second trusted domain to tamper with the program code of the measurement module, and since other components do not have access rights to the measurement, access to the memory of the measurement module will be denied to prevent the measurement module from being attacked.
  • the measurement module relies on a TEE manager whose program code is lightweight (for example, at the level of 10KLoC), that is, the measurement module interacts with the TEE manager for control information, and no longer relies on an operating system with a larger level, thereby reducing the attack surface and the probability of being attacked.
  • the attacker attacks the measurement module through the TEE manager, since the granularity of the access rights of the measurement module is set to read access rights for a single component, the attacker cannot tamper with the program code of the component through the measurement module, further ensuring the security of the component. For example, if the attacker successfully attacks the measurement module through the TEE manager, and further attempts to tamper with other components through the measurement module, and since the access rights of the measurement module to the component are prohibited, access is denied.
  • the electronic device includes hardware and/or software modules corresponding to the execution of each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to be beyond the scope of the present application.
  • FIG11 shows a schematic block diagram of a device 1100 according to an embodiment of the present application.
  • the device 1100 may include: a processor 1101 and a transceiver/transceiver pin 1102 , and optionally, a memory 1103 .
  • bus 1104 includes a power bus, a control bus, and a status signal bus in addition to a data bus.
  • bus 1104 various buses are referred to as bus 1104 in the figure.
  • the memory 1103 may be used for the instructions in the aforementioned method embodiment.
  • the processor 1101 may be used to execute the instructions in the memory 1103, and control the receiving pin to receive a signal, and control the sending pin to send a signal.
  • the apparatus 1100 may be the electronic device or a chip of the electronic device in the above method embodiment.
  • an embodiment of the present application provides an integrity measurement device.
  • the device includes a trusted execution environment TEE and a non-TEE environment.
  • the TEE includes but is not limited to: a first trusted area and a TEE management module.
  • the first trusted area is isolated from each component in the non-TEE, and the first trusted area is isolated from other trusted areas in the TEE.
  • the first trusted area includes a measurement module, that is, the measurement module is isolated from each component in the non-TEE, and the measurement module is isolated from other trusted areas in the TEE.
  • the volume of the TEE management module is lightweight. Specifically, the TEE management module is used to obtain measurement request information, and the measurement request information is used to request integrity measurement of the target component.
  • the target component is a component in the TEE or non-TEE.
  • the TEE management module is also used to send measurement indication information to the measurement module in response to the measurement request information; the measurement indication information is used to instruct the measurement module to perform integrity measurement on the target component.
  • the measurement module is used to perform integrity measurement on the target component based on the measurement request information, and obtain the integrity measurement result.
  • the integrity measurement result is used to indicate whether the target component is complete; the measurement module is also used to feed back the integrity measurement result to the TEE management module.
  • the TEE also includes a second trusted area, which includes at least one TEE application and a TEE operating system, wherein at least one TEE application depends on the TEE operating system; the first trusted area does not include the TEE operating system, and the measurement module depends on the TEE management module.
  • the TEE management module is specifically used to: verify the legitimacy of the target component based on the measurement request information; and send measurement indication information to the measurement module when the legitimacy verification of the target component is successful.
  • the measurement request information includes identification information and target storage address information of the target component, and the target storage address information is used to indicate the target storage space where the program code of the target component is located;
  • the TEE management module is specifically used to: verify the identification information and target storage address information of the target component based on pre-saved component information; the component information is obtained by the TEE management module when the TEE management module is installed in the electronic device, and the component information includes identification information and storage address information corresponding to all components in the non-TEE; when the identification information and target storage address information of the target component are successfully verified, it is determined that the legitimacy verification of the target component is successful.
  • the TEE management module is specifically used to: when the legitimacy verification of the target component is successful, the TEE management module updates the target component's access rights to the target storage space from a first access right to a second access right, and sends measurement indication information to the measurement module; wherein the first access right is a prohibited access right, and the second access right is a read access right; the measurement indication information includes target storage address information; the measurement module is used to obtain the program code of the target component from the target storage space based on the target storage address information and the second access right, and perform integrity measurement on the program code of the target component.
  • the TEE management module is specifically configured to: after receiving the integrity measurement result fed back by the measurement module, update the access permission of the target component to the target storage space from the second access permission to the first access permission.
  • This embodiment further provides a computer storage medium, in which computer instructions are stored.
  • the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned related method steps to implement the method in the above-mentioned embodiment.
  • This embodiment also provides a computer program product.
  • the computer program product When the computer program product is run on a computer, the computer is enabled to execute the above-mentioned related steps to implement the method in the above-mentioned embodiment.
  • an embodiment of the present application also provides a device, which may specifically be a chip, component or module, and the device may include a connected processor and memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor may execute the computer-executable instructions stored in the memory so that the chip executes the methods in the above-mentioned method embodiments.
  • the electronic device, computer storage medium, computer program product or chip provided in this embodiment is used to execute the corresponding method provided above, so the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above. No longer.
  • the disclosed devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed.
  • Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium.
  • the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute all or part of the steps of the methods of each embodiment of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.
  • the steps of the method or algorithm described in conjunction with the disclosed content of the embodiments of the present application can be implemented in hardware or by a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (Random Access Memory, RAM), flash memory, read-only memory (Read Only Memory, ROM), erasable programmable read-only memory (Erasable Programmable ROM, EPROM), electrically erasable programmable read-only memory (Electrically EPROM, EEPROM), registers, hard disks, mobile hard disks, read-only compact disks (CD-ROMs) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium.
  • the storage medium can also be a component of the processor.
  • the processor and the storage medium can be located in an ASIC.
  • Computer-readable media include computer storage media and communication media, wherein the communication media include any media that facilitates the transmission of a computer program from one place to another.
  • the storage medium can be any available medium that a general or special-purpose computer can access.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例提供了一种完整性度量方法及装置，方法所应用的电子设备中包括TEE和非TEE两种环境。其中，TEE中包括第一可信区域和TEE管理模块。第一可信区域与非TEE中的各组件以及TEE中的其他可信区域隔离，即非TEE中的各组件与TEE中的其他可信区域中的组件在未被授权的情况下，是不具备对第一可信区域中的组件的访问权限的。本申请实施例中用于执行完整性度量的度量模块位于第一可信区域中，且以轻量级的TEE管理模块为可信基执行完整性度量流程，从而使得度量模块在具备隔离性，以避免被其它组件直接或间接攻击的同时，能够进一步降低被可信基，即TEE管理器攻击的风险。

Description

完整性度量方法及装置
本申请要求于2022年10月09日提交中国国家知识产权局、申请号为202211226020.1、申请名称为“完整性度量方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及网络安全领域，尤其涉及一种完整性度量方法及装置。
背景技术
随着互联网技术的不断发展，网络安全技术也得到的了长足的发展。近年来，遭受恶意网络攻击的对象已经逐渐从终端设备的系统中可执行文件转移到内存中正在运行的进程，并且这种针对内存的恶意攻击具有很强的隐蔽性。因此，如何准确的验证内存的完整性已经成为当前亟待解决的问题之一
已有技术中通常会采用动态完整性度量(dynamic integrity measurement，DIM)方法来对内存的完整性进行验证。所谓的DIM方法，就是针对内存映像中不发生变化的部分(如内核代码段、内核模块代码段、用户态进程代码段等)进行完整性度量，然后根据得到的度量结果来判断内存映像是否被篡改，从而确定内存是否遭受到恶意攻击。
目前，已有技术的DIM方法是由度量模块对目标对象执行完整性验证，但是，度量模块同样可能受到攻击。而在度量模块的安全性无法得到保证的情况下，将影响其得到的完整性验证结果的可信度。
发明内容
本申请实施例提供一种完整性度量方法及装置，能够一定程度上提供系统的安全性。
第一方面，本申请实施例提供一种完整性度量方法。该方法应用于电子设备，该电子设备包括可信执行环境TEE和非TEE。其中，TEE中包括第一可信区域和TEE管理模块，第一可信区域与非TEE中的各组件隔离，并且，第一可信区域与TEE中的其它可信区域也是隔离的。第一可信区域中包括度量模块，TEE管理模块的体量为轻量级，方法包括：TEE管理模块获取度量请求信息，度量请求信息用于请求对目标组件进行完整性度量；其中，目标组件为TEE或非TEE中的组件。TEE管理模块响应于度量请求信息，向度量模块发送度量指示信息；度量指示信息用于指示度量模块对目标组件执行完整性度量。TEE管理模块接收度量模块反馈的完整性度量结果。其中，完整性度量结果用于指示目标组件是否完整。这样，本申请实施例用于执行完整性度量的度量模块，以管理模块为可信基，执行完整性度量的交互流程。由于管理模块属于轻量级模块，可以有效降低攻击面，从而进一步降低通过管理模块攻击度量模块的概率。此外，由于度量模块与其他组件隔离，其自身受到保护，以避免被其它组件直接或间接攻击。
示例性的，TEE管理模块为本申请实施例中的TEE管理器。
示例性的，度量请求信息可以是目标组件发送的，也可以是周期度量模块发送的。
在一种可能的实现方式中，TEE中还包括第二可信区域，第二可信区域中包括至少一个TEE应用和TEE操作系统，其中，至少一个TEE应用依赖于TEE操作系统。第一可信区域中不包括TEE操作系统，度量模块依赖于TEE管理模块。这样，在本申请实施例中，度量模块独属一块可信区域，且不依赖于量级较大的TEE操作系统，可有效降低可能被攻击的面积，提高度量模块的安全性。
示例性的，第二可信区域中的TEE应用依赖于TEE操作系统，TEE操作系统具有访问TEE应用的权限，即，TEE操作系统可以访问TEE应用的内存。如果存在攻击，则可能通过TEE操作系统攻击TEE应用。而由于度量模块独属于一个可信区域，不依赖于TEE OS，仅依赖于轻量级的TEE管理器，使得攻击面变小，降低被TEE管理器攻击的风险。
在一种可能的实现方式中，TEE管理模块响应于度量请求信息，向度量模块发送度量指示信息，包括：TEE管理模块基于度量请求信息，对目标组件进行合法性验证。在目标组件合法性验证成功的情况下，TEE管理模块向度量模块发送度量指示信息。这样，本申请实施例中的TEE管理器增加合法性验证功能，避免非法应用通过TEE管理器访问度量模块，保证度量模块的安全性。例如非法软件伪装成目标组件向TEE管理器发送度量请求信息。而由于TEE管理器预先未保存非法软件的相关信息，则其合法性验证失败。TEE管理器拒绝非法软件的请求，从而避免非法软件通过TEE管理器访问度量模块。
在一种可能的实现方式中，度量请求信息中包括目标组件的标识信息和目标存储地址信息，目标存储地址信息用于指示目标组件的程序代码所在的目标存储空间；TEE管理模块基于度量请求信息，对目标组件进行合法性验证，包括：TEE管理模块基于预先保存的组件信息，对目标组件的标识信息和目标存储地址信息进行校验；组件信息为电子设备安装TEE管理模块时，TEE管理模块获取到的，组件信息包括非TEE中的所有组件对应的标识信息和存储地址信息。在目标组件的标识信息和目标存储地址信息校验成功的情况下，TEE管理模块确定目标组件合法性校验成功。这样，本申请实施例通过预先维护合法组件的标识和地址。在标识和地址均校验成功的情况下，确定组件合法。而对于伪装的不合法组件，由于未预先维护其标识信息和存储地址，则确定为不合法组件，拒绝其其它操作，以保证系统的安全性，避免非法组件访问。
在一种可能的实现方式中，TEE管理模块响应于度量请求信息，向度量模块发送度量指示信息，还包括：在目标组件合法性校验成功的情况下，TEE管理模块将目标组件对目标存储空间的访问权限从第一访问权限更新为第二访问权限，并向度量模块发送度量指示信息；其中，第一访问权限为禁止访问权限，第二访问权限为读访问权限；度量指示信息包括目标存储地址信息，使得度量模块基于目标存储地址信息和第二访问权限，从目标存储空间中获取目标组件的程序代码，并对目标组件的程序代码进行完整性度量。这样，本申请实施利中只有在度量模块需要对组件进行完整性度量时，才允许度量模块访问其它组件的内存，以实现以单一应用的读访问权限为访问设置的颗粒度，通过精准控制访问权限，以避免通过度量模块攻击其它组件，提高组件的安全性。
在一种可能的实现方式中，TEE管理模块接收度量模块反馈的完整性度量结果之后，方法还包括：TEE管理模块将目标组件对目标存储空间的访问权限从第二访问权限更新为第一访问权限。这样，本申请实施例中通过及时将度量模块的权限回收，以避免其它组件被度量模块攻击。例如，当非法软件攻击度量模块，并尝试进一步通过度量模块访问其它组件，以篡改其它组件的程序代码。则由于度量模块不具有对其他组件的访问权限，则系统拒绝度量模块的访问。
在一种可能的实现方式中，目标组件为应用程序、操作系统或服务。
示例性的，目标组件可以是非TEE环境中的应用程序或者是操作系统。目标组件还可以是非TEE环境中的虚拟机(或称为虚拟化环境)中的应用程序、操作系统或虚拟化管理器(也可以理解为是一种虚拟化管理服务)。目标组件还可以是TEE中的TEE App或TEE OS等。
第二方面，本申请实施例提供一种完整性度量装置。该装置包括可信执行环境TEE和非TEE，TEE中包括第一可信区域和TEE管理模块，第一可信区域与非TEE中的各组件隔离，第一可信区域与TEE中的其它可信区域隔离，第一可信区域中包括度量模块，TEE管理模块的体量为轻量级；TEE管理模块，用于获取度量请求信息，度量请求信息用于请求对目标组件进行完整性度量；其中，目标组件为TEE或非TEE中的组件；TEE管理模块，还用于响应于度量请求信息，向度量模块发送度量指示信息；度量指示信息用于指示度量模块对目标组件执行完整性度量；度量模块，用于基于度量请 求信息，对目标组件执行完整性度量，并获取完整性度量结果；其中，完整性度量结果用于指示目标组件是否完整；度量模块，还用于将完整性度量结果反馈给TEE管理模块。
在一种可能的实现方式中，TEE中还包括第二可信区域，第二可信区域中包括至少一个TEE应用和TEE操作系统，其中，至少一个TEE应用依赖于TEE操作系统；第一可信区域中不包括TEE操作系统，度量模块依赖于TEE管理模块。
在一种可能的实现方式中，TEE管理模块，具体用于：基于度量请求信息，对目标组件进行合法性验证；在目标组件合法性验证成功的情况下，向度量模块发送度量指示信息。
在一种可能的实现方式中，度量请求信息中包括目标组件的标识信息和目标存储地址信息，目标存储地址信息用于指示目标组件的程序代码所在的目标存储空间；TEE管理模块，具体用于：基于预先保存的组件信息，对目标组件的标识信息和目标存储地址信息进行校验；组件信息为电子设备安装TEE管理模块时，TEE管理模块获取到的，组件信息包括非TEE中的所有组件对应的标识信息和存储地址信息；在目标组件的标识信息和目标存储地址信息校验成功的情况下，确定目标组件合法性校验成功。
在一种可能的实现方式中，TEE管理模块，具体用于：在目标组件合法性校验成功的情况下，TEE管理模块将目标组件对目标存储空间的访问权限从第一访问权限更新为第二访问权限，并向度量模块发送度量指示信息；其中，第一访问权限为禁止访问权限，第二访问权限为读访问权限；度量指示信息包括目标存储地址信息；度量模块，用于基于目标存储地址信息和第二访问权限，从目标存储空间中获取目标组件的程序代码，并对目标组件的程序代码进行完整性度量。
在一种可能的实现方式中，TEE管理模块，具体用于：接收度量模块反馈的完整性度量结果之后，将目标组件对目标存储空间的访问权限从第二访问权限更新为第一访问权限。
在一种可能的实现方式中，目标组件为应用程序、操作系统或服务。
第三方面，本申请实施例提供了一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的指令。
第四方面，本申请实施例提供了一种计算机程序，该计算机程序包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的指令。
第五方面，本申请实施例提供了一种芯片，该芯片包括处理电路、收发管脚。其中，该收发管脚、和该处理电路通过内部连接通路互相通信，该处理电路执行第一方面或第一方面的任一种可能的实现方式中的方法，以控制接收管脚接收信号，以控制发送管脚发送信号。
附图说明
图1为示例性示出的系统架构图；
图2为示例性示出的一种多可信域的结构示意图；
图3为示例性示出的非TEE的结构示意图；
图4为示例性示出的完整性度量技术的流程示意图；
图5为示例性示出的系统架构图；
图6为示例性示出的系统架构图；
图7为本申请实施例提供的TEE的结构示意图；
图8为示例性示出的TEE的部署示意图；
图9为示例性示出的模块交互示意图；
图10为示例性示出的完整性度量的流程示意图；
图11为示例性示出的装置的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。
本申请实施例的说明书和权利要求书中的术语“第一”和“第二”等是用于区别不同的对象，而不是用于描述对象的特定顺序。例如，第一目标对象和第二目标对象等是用于区别不同的目标对象，而不是用于描述目标对象的特定顺序。
在本申请实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
在本申请实施例的描述中，除非另有说明，“多个”的含义是指两个或两个以上。例如，多个处理单元是指两个或两个以上的处理单元；多个系统是指两个或两个以上的系统。
图1为示例性示出的系统架构图。请参照图1，在该系统架构中，包括可信执行环境(trusted execution environment，TEE)和富执行环境(rich execution environment，REE)。将高安全敏感的应用与通用的软件环境进行隔离，提供专门的可信执行环境TEE，并保护应用的资源和数据的保密性、完整性和访问权限；对Android等容易被攻击的传统操作系统提供通用的富执行环境REE。在REE侧执行的应用称为客户端应用程序(client application，CA)，比如银行类应用等第三方支付应用，在TEE侧执行的应用称为可信应用程序(trusted application，TA)，比如执行签名、加解密计算等关键服务的应用。由于TA运行在可信执行环境TEE中，TA的部署/升级操作需要严格遵循TEE发行方(通常是终端厂商)的安全验证规范，比如使用数字签名等措施，确保TEE各个环节是真正可信的。可信执行环境TEE中包括可信执行环境内部应用程序编程接口(trusted execution environment internal application programming interface，TEE Internal API)和可信操作系统部件，TEE Internal API的主要作用为：向上提供可信操作系统部件的功能、与客户端应用程序CA通信、实现TA与TA通信、提供安全存储、密码学功能、时间功能等；可信操作系统部件主要包括可信核心框架、可信功能、可信内核和可信执行环境TEE通信代理，其中，可信核心框架为TA提供类似操作系统的功能；可信功能为应用开发者提供支持能力；可信内核用于与平台硬件中的可信设备进行交互；可信执行环境通信代理为TA和CA提供一个安全的通信通道，例如，可信执行环境通信代理通过平台硬件将消息传递至富执行环境通信代理，实现TA和CA的交互。富执行环境REE中包括可信执行环境客户端应用程序编程接口(trusted execution environment client application programming interface，TEE Client API)、可信执行环境功能应用程序编程接口(trusted execution environment functional application programming interface，TEE Functional API)和多媒体操作系统，多媒体操作系统部件主要包括公共设备驱动和富执行环境通信代理，其中，富执行环境通信代理用于与TEE进行通信，CA和TA提供一个安全的通信通道，公共设备驱动用于驱动平台硬件中的公共设备。CA使用TEE Client API、TEE Functional API接入到由TA提供的安全服务。
在本申请实施例中，用于实现计算机系统安全保护的所有安全保护机制的集合可以称为计算机系统的可信基。其中，机制可以硬件、固件和/或软件的形式出现。一旦可信基的某个构件出现程序错 误或者安全隐患，则会对整个系统的安全造成危害。
需要说明的是，图1中的系统架构仅为示意性举例，在其他实施例中，可以包括更多或更少的组件或模块，本申请不做限定。
进一步需要说明的是，本申请实施例中所述的终端可以是诸如平板电脑、移动终端(如手机)、膝上计算机、台式计算机、可穿戴设备、光线路终端(optical line terminal，OLT)、光网络终端(optical network terminal，ONT)等电子设备，本申请不做限定。
进一步需要说明的是，本申请实施例中所涉及到的系统框架可以是ARM架构，也可以是其他架构，本申请不做限定。
在一种可能的实现方式中，TEE中可以包括至少一个可信域(也可以称为可信区域或安全域，本申请不做限定)。图2为示例性示出的一种多可信域的结构示意图。请参照图2，示例性的，TEE中可包括至少一个可信域。图2中仅以TEE中包括第一可信域、第二可信域以及第三可信域为例进行说明，在其他实施例中，系统可以包括更多或更少的可信域，本申请不做限定。
示例性的，TEE中的多可信域与非TEE中的虚拟化(可参照图3)方式类似，同样可以理解为是一种虚拟化方案。即，本申请实施例中可以在TEE的结构上，虚拟化出多个可信域。
示例性的，各可信域之间相互隔离，即，不同可信域之间在未授权的情况下无法相互访问。也可以理解为是可信域的内存相互隔离。即，不同可信域之间在未授权的情况下无法互相访问对方的内存。
示例性的，可信域之间可以包括TA、TEE OS中的至少一种，例如，第一可信域中包括至少一个TA和TEE OS。第二可信域中包括TEE OS。第三可信域中包括至少一个TA。具体布局可根据实际需求设置，本申请不做限定。
示例性的，TEE中还包括TEE管理器(也可以称为TEE管理模块)。TEE管理器，也可以称为TEE管理模块，TEE管理器用于为TEE提供建立和管理TEE中的可信域的服务。在本申请实施例中，TEE管理器负责的功能较少，代码量较小。
可选地，终端中除TEE以外的区域，也可以称为非TEE。图3为示例性示出的非TEE的结构示意图。请参照图3，示例性的，非TEE中可设置虚拟化环境，包括但不限于：第一VM(Virtual machine，虚拟机)、第二VM以及第三VM。需要说明的是，图3中的VM的数量以及包含的组件仅为示意性举例，本申请不做限定。
仍参照图3，示例性的，每个VM中包括但不限于至少一个应用程序(App)和操作系统(OS，Operating System)。可选地，在虚拟化环境下，非TEE中还可以设置虚拟化管理器(也可以称为虚拟化管理模块，虚拟化管理单元，或虚拟化管理组件等，本申请不做限定)，虚拟化管理器用于创建和管理非TEE中的至少一个VM。
需要说明的是，本申请实施例中的非TEE环境中的布局可以参照图1，也可以参照图3，即非TEE中可以是虚拟化环境，也可以是非虚拟化环境，还可以是虚拟化环境与非虚拟化环境的结合，本申请不做限定。
示例性的，在计算机系统运行期间，非TEE中的组件(包括非虚拟化环境下的应用程序、操作系统和/或虚拟化环境下的应用程序和操作系统等)易受到攻击，导致组件在内存中的程序代码(也可以称为程序指令或计算机程序，本申请不做限定)被篡改。为实时监测破坏非TEE组件的完整性攻击，可通过完整性度量技术，对组件进行完整性校验，以检测组件是否完整，即是否被篡改。
示例性的，完整性度量技术是一种监测计算系统运行时程序如App、OS完整性的机制。在系统运行时，通过读取要度量的目标组件的内存中存储的程序代码或者是程序代码与数据，并计算度量Hash(哈希)值。通过与参考Hash值比对的方式，判断度量目标组件完整性是否受到破坏。
也就是说，完整性度量的原理是检测内存中当前存储的组件的程序代码与组件原本的程序代码是否一致。如果一致，则组件完整，如果不一致，则组件不完整，即遭到篡改。
需要说明的是，本申请实施例中所述的目标组件可以是非TEE中的组件，例如可以是应用程序、操作系统和虚拟化管理器等组件，还可以是TEE中的组件，例如可以是TEE App、TEE OS等。本申请实施例中仅以对非TEE中的目标组件进行完整性度量为例进行说明。对于TEE中的组件的完整 性度量同样可以参考非TEE中的完整性度量流程，本申请不再逐一举例说明。可选地，本申请实施例中所述的应用程序与操作系统可以是指图1中的非虚拟化环境下的应用程序和操作系统，也可以是指图3中的虚拟化环境中的应用程序和操作系统，本申请不做限定，下文中不再重复说明。
进一步需要说明的是，在本申请实施例中，目标组件的数据也可以称为是只读数据段，该只读数据段可选地为目标组件中不可变的数据，而对于可变的数据，由于其在程序运行中的可变性，无法对其进行完整性度量，下文中不再重复说明。
举例说明，图4为示例性示出的完整性度量技术的流程示意图。请参照图4，非TEE中的目标组件可向TEE中的度量模块发送度量请求。其中，度量请求中包括但不限于：目标组件的标识信息、目标组件的内存地址信息等，度量请求用于请求度量模块对目标组件进行完整性度量。示例性的，目标组件的内存地址信息包括但不限于：目标组件的程序代码的内存地址信息和目标组件的数据的内存地址信息。其中，内存地址信息用于指示对应的代码或数据所存储在内存空间中的位置。示例性的，目标组件的程序代码即为硬件调用目标组件时所执行的程序代码。目标组件的数据可选地为目标组件所对应的一些数据，例如可以是用户账号、密码等，本申请不做限定。
仍参照图4，示例性的，度量模块响应于度量请求，从目标地址信息所指示的内存控件内，获取目标组件的程序代码和目标组件的数据。度量模块可基于获取到的目标组件的程序代码和数据，生成哈希值(以下称为度量哈希值)。具体生成方式可参照已有技术实施例，本申请不再赘述。
示例性的，度量模块预先保存有非TEE中的至少一个组件对应的哈希值，在本申请实施例中称为参考哈希值，例如包括参考哈希值1至参考哈希值n。其中，参考哈希值可选地度量模块在初始阶段获取到的，即，度量模块在初始阶段(也可以理解为初次安装或加载)，可获取非TEE中的各组件的程序代码和数据，生成对应的参考哈希值并保存。
请继续参照图4，示例性的，度量模块可将目标组件的度量哈希值与目标组件的参考哈希值进行比较。一个示例中，如果两者相同，则完整性校验成功，即目标组件完整，也可以理解为是目标组件当前的目标组件的程序代码和数据与度量模块初始化阶段获取到的是一致的。另一个示例中，如果两者不相同，则完整性校验失败，即目标组件不完整(或可理解为被篡改)，也可以理解为是目标组件当前的目标组件的程序代码和数据与度量模块初始化阶段获取到的不一致。
一个示例中，度量模块可以向目标组件反馈度量结果。其中，度量结果包括完整性校成功指示或完整性校验失败指示。
另一个示例中，度量模块可以向目标组件和远程用户反馈度量结果。其中，远程用户可以是终端的主机，也可以是连接该终端的其它终端用户，本申请不做限定。
又一个示例中，如果完整性校验成功，可以将结果反馈给目标组件和远程用户。如果完整性校验失败，则证明目标组件异常，无需向目标组件反馈结果，可直接向远程用户反馈结果。
示例性的，目标组件响应于接收到的度量结果，可执行后续操作。例如，如果度量请求是目标组件需要运行或者是下载数据之前向度量模块发送的，则如果度量结果是完整性校验成功，则目标组件可继续运行或下载数据。如果度量结果是完整性校验失败，则目标组件停止运行。
示例性的，如果远程用户基于度量结果，确定完整性校验失败，可以在远程用户的显示屏上显示提示信息等，向用户进行告警，具体后续流程可根据实际需求设置，本申请不做限定。
图5和图6分别示出已有技术实施例中的系统架构图。请参照图5，示例性的，在该示例中，以虚拟化环境为实现基础，系统的可信基包括虚拟化管理器以及一些其它安全固件或安全硬件。其中，度量模块设置于虚拟化管理器。示例性的，具体步骤包括但不限于：
1)在启动阶段通过加载时内部计算或外部导入方式，度量模块保存所有要度量的组件(包括应用程序、操作系统等，例如可以是第一VM中的App)的参考Hash值。
2)运行时，目标组件向位于虚拟化管理器中的度量模块发送度量请求。
3)度量模块根据度量请求直接读取目标内存空间(可参照图4中的示意)中的目标组件的程序代码和数据，并计算度量Hash值。
4)度量模块将计算得到的度量Hash值与目标组件的参考Hash值做比较，并得到度量结果。
5)度量模块将度量结果反馈给目标组件和/或远程用户。未描述部分可参照上文，此处不再赘述。
在图5所示的已有技术中，度量模块依赖于虚拟化管理模块，虚拟化模块的代码量通常为846KloC，由于度量模块所依赖的可信基的代码量较大，导致系统攻击面较大。并且，由于虚拟化管理器的特权级别(也可以称为权限级别)较高，其具有访问所有VM及其所包括的应用程序和操作系统的内存空间的权限。因此，如果度量模块由于自身漏洞受到攻击，则其可能通过度量模块访问系统中的虚拟化管理器上运行的所有虚拟化操作系统和虚拟化应用程序，并破坏VM中的应用程序和/或操作系统的完整性。另外，同样是由于度量模块设置于虚拟管理器中，由于虚拟管理器中包括其它组件，则可能由于其它组件存在程序漏洞，而使得敌方通过其它组件攻击度量模块，并可通过度量模块篡改非TEE中的应用程序和操作系统的完整性，以及，由于度量模块自身可能会遭到攻击，则其所得到的度量结果的可信度降低。
请参照图6，示例性的，在该示例中，系统的可信基包括但不限于：可信域中的TEE OS和安全固件或安全硬件等。示例性的，具体步骤包括但不限于：目标组件向TEE OS发送度量请求，TEE OS将度量请求发送给度量模块，度量模块执行完整性度量。具体描述可参照上文，此处不再赘述。度量模块将度量结果反馈给TEE OS，并由TEE OS将度量结果反馈给目标组件。在该示例中，度量模块同样具有访问所有应用程序和操作系统的权限。
在图6所示的已有技术中，度量模块依赖于操作系统，即，通过操作系统与其它组件进行交互，而由于TEE OS的代码量约为253KloC，因此，度量模块的DIM方案依赖的可信基较大(即代码量较大)，导致攻击面较大。并且，与图5中的流程类似，由于度量模块的权限较大，如果度量模块受到攻击，则攻击方可通过度量模块访问系统中运行的所有应用程序和操作系统，并破坏应用程序和操作系统的完整性。
针对已有技术中度量模块易受攻击，安全性较差的问题，本申请实施例提供一种完整性度量方法，在该方法中，度量模块设置于独立的TEE环境中，且依赖于轻量级的可信基，从而保证度量模块的安全性，提升系统整体的安全性和稳定性。
结合图1，图7为本申请实施例提供的TEE的结构示意图。请参照图7，示例性的，TEE中可包括至少一个可信区域，例如第一可信区域、第二可信区域以及第三可信区域。需要说明的是，本申请实施例中的可信区域的数量和布局仅为示意性举例，本申请不做限定。
示例性的，第一可信区域中包括度量模块。第二可信区域包括但不限于：至少一个TA和TEE OS。第三可信区域包括但不限于：TEE OS。在本申请实施例中，第二可信区域与第三可信区域中包括的组件的数量和类型仅为示意性举例，第二可信区域与第三可信区域中可以包括TA与TEE OS中的至少一个，例如可以是仅包括TA，也可以是包括TA和TEE OS，还可以是仅包括TEE OS，可根据实际需求设置，本申请不做限定。
示例性的，TEE的可信基包括但不限于：TEE管理器和一些安全固件或安全硬件等。
在本申请实施例中，非TEE中的布局可以参照图1或图3，本申请不做限定。
示例性的，度量模块可用于对目标组件执行完整性度量。
TEE管理器可选地包括但不限于度量中继模块(或可称为度量中继组件)，其中，度量中继模块中包括校验单元和权限控制单元(也可以称为校验组件、权限控制组件，本申请不做限定)。其中，校验单元，用于对需要进行完整性度量的组件进行安全校验。权限控制单元，用于管理和控制度量模块对其它组件的访问权限。
示例性的，度量中继模块与度量模块进行数据交互，度量中继模块可用于向度量模块发送度量指示或接收度量模块反馈的度量结果。也就是说，本申请实施例中，度量模块是依赖于度量中继模块的，其仅与度量中继模块进行控制信息(包括度量指示和度量结果)的交互。
结合图7，图8为示例性示出的TEE的部署示意图。请参照图8，终端中包括但不限于处理器和内部存储器。内部存储器可以用于存储计算机可执行程序代码，所述可执行程序代码包括指令。内部存储器可以包括高速随机存取存储器，还可以包括非易失性存储器(Flash)，例如至少一个磁盘存储器件，闪存器件，通用闪存存储器(universal flash storage，UFS)等。
在本申请实施例中，在系统启动之前(也可以理解为是终端初始化之前)，度量模块、TEE管理器、目标组件(图中未示出)以及TEE App、TEE OS等组件的镜像存储于非易失性存储器。在系统启动(即终端初始化阶段)后，终端(具体可以是终端中的启动模块(例如BootLoader)，下文中不再重复说明)将非易失性存储器中的多个镜像加载到系统内存(例如DRAM)中。
如图8所示，系统加载后，内存中包括但不限于：第一可信域的内存、TEE管理器内存、第二可信域的内存以及目标组件内存等。
示例性的，第一可信域的内存中包括度量模块的内存。其中，度量模块的内存用于存储度量模块的程序代码。也就是说，度量模块的程序代码所在的内存空间位于第一可信域的内存区域(或内存空间)中。
示例性的，第二可信域的内存中包括但不限于：TEE App的内存和TEE OS的内存。其中，TEE App的内存用于存储TEE App的程序代码和数据，TEE OS的内存用于存储TEE OS的程序代码。也就是说，TEE App的程序代码(和数据)所在的内存空间和TEE OS的程序代码所在的内存空间均位于第二可信域的内存区域中。
示例性的，TEE管理器的内存用于存储TEE管理器所包含的各组件的程序代码。目标组件的内存用于存储目标组件的程序代码，或者，目标组件的程序代码和数据。
在本申请实施例中，度量模块所在的第一可信域的内存对于终端中除TEE管理器以外的任意组件(包括TEE中的组件或非TEE中的组件)是隔离的。相应的，度量模块的内存对于其它组件是隔离的。也就是说，在本申请实施例中，终端中除TEE管理器以外的任意组件，均不具有对度量模块的内存的访问权限。
在本申请实施例中，度量模块在未设置度量模块具有访问其它组件的内存的访问权限的情况下，度量模块同样是不具备访问其它组件的内存的权限的。度量模块的访问权限配置方式将在下文中详细说明，此处再不赘述。
在本申请实施例中，内存的隔离也可以理解为是组件的隔离，即，相互隔离的组件之间在未授权的情况下，不可互相访问对方的内存。
此外，在本申请实施例中，如图8所示，度量模块的内存独属于一个内存区域，即独属于一个可信域，其可信域中不包括其它组件。可选地，在其他实施例中，度量模块所属的可信域中也可以包括至少一个量级较小(即程序代码为轻量级)的TEE App。其中，与度量模块同在一个可信域的TEE App的程序代码总量小于阈值(可根据实际需求设置，本申请不做限定)，以降低可信域的量级，减小攻击面，降低被攻击概率。
在本申请实施例中，在加载阶段，即终端将各组件的镜像加载到内存的阶段，TEE管理器的内存中可加载非TEE中所有的组件(包括应用程序、操作系统和/或虚拟化管理器等)的标识信息和地址信息，或者是加载非TEE中的需要进行完整性校验的组件的标识信息和地址信息。
其中，标识信息可以是组件的ID。地址信息即为组件的程序代码或数据所在内存空间对应的地址(也可以称为内存地址)。可选地，组件的标识信息与地址信息可以以列表等形式存储在TEE管理器的内存中，本申请不做限定。这样，在完整性度量阶段，TEE管理器(具体为校验模块)可以基于维护的地址信息，对组件进行安全校验(也可以称为合法性校验，本申请不做限定)。具体校验方式将在下文中详细说明。
示例性的，TEE管理器中维护的组件的标识信息与内存地址信息可以是以列表(例如称为地址空间布局列表)的形式存储。在其他实施例中也可以是以其他形式存储，本申请不做限定。
可选地，系统启动后，非TEE中也可以新安装虚拟VM(包括应用程序和/或操作系统)、应用程序和/或操作系统，TEE管理器的内存同样会获取新安装的组件的标识信息和地址信息。
示例性的，TEE管理器的内存中还加载度量模块的页表(以下简称度量模块页表)。示例性的，度量模块页表中包括但不限于：组件的内存地址，内存地址对应的物理地址以及访问权限等。其中，组件即为非TEE中的所有组件，或者是需要进行完整性度量的组件。内存地址即为组件所述内存空间的内存地址。物理地址即为内存地址所对应的实际物理地址。访问权限包括但不限于：读访问权限、 写访问权限以及禁止访问权限等。示例性的，页表中的初始访问权限均为禁止访问权限。也就是说，度量模块对页表中所指示的各组件的内存空间的权限为“禁止访问”，即禁止度量模块访问组件的内存空间。可以理解为，如上文所述，本申请实施例中的度量模块在未授权的情况下，是不具有访问其它组件的权限的。
示例性的，度量模块的内存中存储有度量模块的程序代码以及参考哈希值列表。一个示例中，参考哈希值列表中包括但不限于每个组件(可以是非TEE中所有组件或者需要进行完整性度量的组件)的内存地址信息和参考哈希值之间的对应关系。另一个示例中，参考哈希值列表中可以包括但不限于：每个组件的标识信息和参考哈希值之间的对应关系。又一个示例中，参考哈希值列表中也可以仅包括每个组件的参考哈希值。本申请不做限定。
其中，每个组件的参考哈希值可以是终端(例如可以是启动模块)基于组件的程序代码计算得到的，或者是基于组件的程序代码与数据计算得到的，具体计算方式可参照已有技术，本申请不再赘述。可选地，组件的参考哈希值也可以是外部导入的，例如可以是从组件的供应商服务器下载的，本申请不做限定。可以理解为，参考哈希值是验证组件是否完整，即组件的程序代码和/或数据是否完整的基准，这样，度量模块可以基于预先保存的参考哈希值，对需要进行完整性度量的组件进行完整性校验。具体校验方式将在下文中详细说明。
示例性的，与度量模块类似，其它组件同样对应有各自的页表，每个组件的页表用于记录组件对于不同组件的内存的访问权限。在本申请实施例中，如上文所述，度量模块的内存对于其它组件而言是隔离的，即，除TEE管理器以外的其它组件均不具备对度量模块的内存(也可以理解为是第一可信域的内存)的访问权限。相应的，其它组件的页表中可以不包括度量模块(或第一可信区域)的内存的相关信息，以用于表示组件不具备访问度量模块的内存的权限。或者是，组件的页表中可以包括度量模块的内存的相关信息，而对应的访问权限为禁止访问。该种布局方式可以认为是度量模块实现独立可信域，其与其它可信域中的组件以及非TEE中的各组件隔离，从而可避免攻击方通过其它组件攻击度量模块，降低度量模块被攻击的概率。并且，在本申请实施例中，度量模块不再依赖于TEEOS或虚拟化管理器等体量(即程序代码)较大的组件，而是依赖于体量较小的TEE管理器，即本申请实施例中的DIM方案是以TEE管理器为可信基实现的，其中，TEE管理器的程序代码(即体量)为10KLoC量级，远小于TEE OS与虚拟化管理器的量级。相应的，TEE管理器的体量较小，可攻击面相应较小，从而降低通过TEE管理器攻击度量模块的概率。度量模块依赖于TEE管理器的DIM交互过程将在下面实施例中详细说明。
仍参照图8，处理器运行存储器中的程序代码，可使得终端执行相应的功能。例如，在本申请实施例中，在完整性度量阶段，处理器可通过运行度量模块和TEE管理器，在运行过程中，处理器读取度量模块的内存以运行度量模块的程序代码，处理器读取TEE管理器的内存以运行TEE管理器的相关组件的程序代码。
图9为示例性示出的模块交互示意图。请参照图9，示例性的，目标组件在具有完整性校验需求的情况下，向TEE管理器发送度量请求。示例性的，度量请求中包括但不限于：目标组件的标识信息(例如目标组件的ID)和内存地址信息(概念可参照上文)。
可选地，目标组件可以通过与TEE管理器的API接口向度量中继模块发送度量请求。
示例性的，目标组件的完整性需求可以是目标组件响应于接收到的用户指令，确定需要启动之前，也可以是目标组件启动后，需要向存储中读取或写入数据的情况下，具体可根据实际需求设置，本申请不做限定。
需要说明的是，本申请实施例中所述的目标组件的数量可以是一个或多个。也就是说，多个目标组件可以同时或顺序向TEE管理器发送度量请求，以请求进行完整性度量。TEE管理器与度量模块可以串行或并行处理多个目标组件的度量请求，本申请不做限定。多个组件的处理方式是与单个组件的处理方式相同的，本申请仅以单个目标组件为例进行说明，下文中不再重复说明。
在一种可能的实现方式中，TEE中还可以包括周期度量模块(图中未示出)，周期度量模块可以设置有定时器。其中，定时器的定时时长可根据实际需求设置，例如可以5分钟，本申请不做限定。 示例性的，周期度量模块可以维护有非TEE中所有组件或者是需要执行完整性度量的组件的标识信息和内存地址信息。度量模块在定时器触发时刻，向度量中继模块发送度量请求，度量请求中包括但不限于：度量模块维护的至少一个组件的标识信息和内存地址信息，用于请求对至少一个组件进行完整性校验。
示例性的，度量中继模块接收到度量请求后，可执行完整性度量流程。图10为示例性示出的完整性度量的流程示意图。请参照图10，具体包括但不限于如下步骤：
S1001，度量中继模块响应于接收到的度量请求，对目标组件进行合法性校验。
示例性的，度量中继模块(具体为校验单元，下文中不再重复说明)获取来自目标组件的度量请求，并获取度量请求中的目标组件的标识信息和内存地址信息。
如上文所述，度量中继模块(即TEE管理器)的内存中维护有地址空间布局列表，其中，列表中包括但不限于组件(包括非TEE中所有组件或者是需要进行完整性度量的组件，下文中不再重复说明)的标识信息和内存地址信息。示例性的，度量中继模块可将度量请求中的组件的标识信息与地址空间布局列表中的组件的标识信息进行匹配。
一个示例中，如果匹配不成功，则度量中继模块可确定发送度量请求的组件为非法组件。也就是说，在本申请实施例中，如果非法组件伪装成合法组件申请完整性度量，则由于度量中继模块预先未存储有该非法组件的相关信息，则合法性验证失败。度量中继模块可确定该组件为非法组件，并拒绝其完整性度量请求，防止非法组件通过度量中继模块攻击度量模块。
另一个示例中，如果匹配成功，则度量中继模块获取匹配成功的标识信息对应的内存地址空间。度量中继模块将度量请求中的内存地址信息与匹配成功的地址空间信息进行比较，以确定两者是否一致。
一个示例中，如果两者一致，则确定合法性校验成功，执行S1002。另一个示例中，若两者不一致，则确定合法性校验失败。度量中继模块结束目标组件的完整性度量流程。可选地，度量中继模块还可以执行异常处理流程。异常处理流程可以包括在终端的显示屏上显示告警信息、或者是请求处理器卸载非法组件等，本申请不做限定。
S1002，度量中继模块为度量模块授予对目标组件的读访问权限。
示例性的，校验单元确定目标组件的合法性校验成功之后，可向权限控制单元发送触发指令，以指示权限控制单元为度量模块授权。
示例性的，如上文所述，TEE管理器维护有度量模块页表，其中包括度量模块对页表中内的各组件的访问权限。并且，在初始阶段，度量模块对各组件的访问权限均为禁止访问。
示例性的，度量中继模块(具体为权限控制单元，下文中不再重复说明)获取度量模块页表。度量中继模块基于从度量请求中获取到的目标组件的内存地址信息，在页表中进行匹配，并获取匹配成功的内存地址信息对应的物理地址信息和权限信息。其中，目标组件当前的权限信息指示为禁止访问，即禁止度量模块访问目标组件，也可以理解为禁止度量模块从目标组件的内存中读取或写入数据。
示例性的，度量中继模块将度量模块对目标组件的访问权限修改为读访问权限，即，将页表中与目标组件对应的权限信息修改为读访问权限(也可以称为可读访问权限或只读访问权限)。也就是说，度量模块可以读取目标组件的内存中的数据，但是，度量模块不具备对目标组件的除读访问权限以外的权限。例如度量模块不可对目标组件的内存中的数据进行操作(例如写入，即不具备写访问权限)。
S1003，度量中继模块向度量模块发送度量指示。
示例性的，度量中继模块为度量模块授权之后，向度量模块发送度量指示。其中，度量指示中包括但不限于：目标组件的内存地址信息。度量指示用于指示度量模块对目标组件进行完整性校验。
S1004，度量模块读取目标组件的程序代码和数据。
示例性的，度量模块接收度量指示，并提取内存地址信息。度量模块可基于内存地址信息，从对应的内存空间中获取目标组件的程序代码和数据(其中，数据可能是空的，下文中不再重复说明)。
具体的，如上文所述，度量模块对应有度量模块页表。度量模块可以向MMU(Memory Management Unit，内存管理单元)发送读取请求，读取请求中可以包括目标组件的内存地址信息，用于请求读取 目标组件的内存地址信息所指示的内存空间内的内容。
示例性的，MMU可基于目标组件的内存地址信息，遍历度量模块页表，以查找与内存地址信息对应的权限信息。在该示例中，如上文所述，度量中继模块已对度量模块授权，即度量模块对目标组件的访问权限信息为读访问权限。相应的，MMU根据内存地址信息对应的访问权限信息，确定度量模块具有对目标组件的内存的读访问权限，即允许度量模块从目标组件的内存空间中读取数据。
示例性的，度量模块可基于页表中内存地址信息与物理地址信息的对应关系，从内存中读取目标组件的内存空间中所存储的内容，即包括但不限于：目标组件的程序代码和数据。度量模块的具体读取方式可参照已有技术实施例，本申请不做限定。
S1005，度量模块基于目标组件的程序代码和数据，生成度量哈希值。
示例性的，度量模块从目标组件的内存中读取目标组件的程序代码和数据之后，可基于程序代码和数据，生成目标组件的度量哈希值。生成方式可参照已有技术实施例，本申请不做限定。
S1006，度量模块基于度量哈希值与参考哈希值，对目标组件进行完整性验证。
示例性的，如上文所述，度量模块维护有参考哈希值列表。如上文所述，哈希值列表中可能包括不同组合：
一个示例中，如果参考哈希值列表中包括但不限于每个组件(可以是非TEE中所有组件或者需要进行完整性度量的组件)的内存地址信息和参考哈希值之间的对应关系。相应的，度量模块可基于度量指示中的目标组件的内存地址，遍历参考哈希值列表。度量模块获取匹配成功的内存地址信息所对应的参考哈希值。
另一个示例中，如果参考哈希值列表中包括但不限于：每个组件的标识信息和参考哈希值之间的对应关系。相应的，度量中继模块发送的度量指示中还需要包括目标组件的标识信息。度量模块可基于目标组件的标识信息，遍历参考哈希值列表，并获取匹配成功的标识信息对应的参考哈希值。
又一个示例中，如果参考哈希值列表中仅包括每个组件的参考哈希值，则度量模块可以将度量哈希值逐一与列表中的参考哈希值进行匹配。如果匹配成功，即列表中包括与度量哈希值相同的参考哈希值，则可直接确定完整性验证成功。如果匹配失败，则确定完整性度量失败。
在本申请实施例中，度量模块获取到目标组件的参考哈希值之后，将参考哈希值与度量哈希值进行比较。
一个示例中，如果两者一致，则确定完整性度量成功，即，目标组件的程序代码和数据是完整的，未被篡改，执行S1007。
另一个示例中，如果两者不一致，则确定完整性度量失败。例如，如果目标组件被攻击方篡改，导致程序代码与初始状态不一致。则度量模块所生成的目标组件的度量哈希值将与参考哈希值不一致。
S1007，度量模块向度量中继模块发送度量结果。
示例性的，度量模块执行完整性校验之后，获取到度量结果，度量结果包括完整性校验成功(或称为完整性度量成功)或完整性校验失败(或称为完整性度量失败)。
示例性的，度量模块向度量中继模块发送目标组件的地址信息与度量结果。可选地，如果度量中继模块向度量模块发送的度量指示中包括目标组件的标识信息，则度量模块也可以向度量中继模块反馈目标组件的标识信息和度量结果，以标识度量结果所对应的目标组件。
S1008，度量中继模块撤销度量模块对目标组件的读访问权限。
示例性的，度量中继模块接收到度量模块发送的度量结果之后，可确定度量模块已完成对目标组件的完整性度量操作。度量中继模块即刻撤销度量模块对目标组件的读访问权限。
具体的，度量中继模块(具体为权限控制单元)基于目标组件的标识信息或内存地址信息，遍历地址空间布局列表，并确定匹配成功的标识信息或内存地址信息所对应的访问权限信息。当前访问权限信息为读访问权限。
示例性的，度量中继模块将访问权限信息修改为禁止访问，即撤销度量模块对目标组件的读访问权限。这样，如果由于度量模块自身存在漏洞，导致攻击方攻击度量模块，并尝试通过度量模块读取 目标组件的内存，以修改目标组件的内存中的程序代码和/或数据。在该场景下，由于度量模块对目标组件的访问权限为禁止访问权限，则度量模块是无法对目标组件的内存中的内容进行操作(包括读或写)的。此外，由于完整性度量过程中，度量模块仅具备读访问权限，因此，如果度量模块受到攻击后，由于度量模块不具备对目标组件内存的其他访问权限，例如写访问权限，相应的，攻击方同样无法通过度量模块篡改目标组件的内存中的内容。综上，本申请实施例中，通过动态调整度量模块对目标组件的权限，并且，将权限控制的颗粒度具体到单一组件，进一步具体到单一组件的读访问权限，从而可以有效避免攻击方通过度量模块篡改目标组件，以保护组件的安全性和完整性。
请继续参照图9，示例性的，度量中继模块获取到度量模块反馈的度量结果之后，还可以向目标组件和/或远程用户反馈度量结果。目标组件的处理可参照上文实施例中的描述，此处不再赘述。
可选地，如上文所述，度量请求也可能是由周期度量模块发送的。相应的，度量中继模块将度量结果反馈给周期度量模块。周期度量模块可以将所有度量结果反馈给相应的组件。或者，周期度量模块也可以仅向度量结果为完整性度量失败的组件反馈，本申请不做限定。
需要说明的是，在本申请实施例中，由于度量模块的页表中的访问权限是动态设置的(具体方式将在下文中说明)，则在初始阶段后的任意时刻，度量模块的页表中的访问权限可以全为禁止访问，也可以包括至少一个组件的权限为读访问权限。例如，系统在对第一组件进行完整性度量的过程中，度量模块对第一组件的访问权限即为读访问权限，其它组件的访问权限为禁止访问。在第一组件的完整性度量流程结束之前，度量中继模块可能接收到第二组件的度量请求，并修改度量模块对第二组件的访问权限为读访问权限。而在当前时刻，度量模块的页表中，度量模块对第一组件的访问权限与第二组件的访问权限均为可读。
进一步需要说明的是，图10中仅以单一目标组件的一次完整性度量操作为例进行说明。在本申请实施例中，终端可基于图10的流程对多个目标组件执行完整性度量操作。每个组件的完整性度量操作为独立流程，即互不影响。示例性的，单一目标组件也可以多次触发完整性度量流程，其中，每次完整性度量流程中，度量模块对组件的访问权限均会动态修改。
在一种可能的实现方式中，S1005和S1006也可以由远端校验服务器完成。在该示例中，度量模块在加载阶段无需预先存储参考哈希值，参考哈希值可存储于远端服务器上。度量模块生成度量哈希值之后，可以将度量哈希值发送给远端服务器，由远端服务器执行度量哈希值与参考哈希值的比较操作，并向度量模块反馈度量结果。
综上，在本申请实施例中，由于度量模块与其他组件隔离，其自身受到保护，可降低攻击方通过其它模块攻击度量模块的概率。例如，如果攻击方尝试通过第二可信域中的TEE App访问度量模块，以篡改度量模块的程序代码，而由于其它组件是不具备对度量的访问权限的，将会拒绝对度量模块的内存的访问，避免度量模块被攻击。并且，度量模块依赖于程序代码为轻量级(例如为10KLoC量级)的TEE管理器，即，度量模块与TEE管理器进行控制信息交互，不再依赖于量级较大的操作系统，从而降低攻击面，减小被攻击的概率。以及，如果攻击方通过TEE管理器攻击度量模块，由于度量模块的访问权限的颗粒度被设置为针对单一组件的读访问权限，则攻击方无法通过度量模块篡改组件的程序代码，进一步保证了组件的安全性。例如，如果攻击方通过TEE管理器成功攻击度量模块，并进一步尝试通过度量模块以篡改其他组件，而由于度量模块对组件的访问权限为禁止访问，则拒绝访问。
可以理解的是，电子设备为了实现上述功能，其包含了执行各个功能相应的硬件和/或软件模块。结合本文中所公开的实施例描述的各示例的算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以结合实施例对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
一个示例中，图11示出了本申请实施例的一种装置1100的示意性框图装置1100可包括：处理器1101和收发器/收发管脚1102，可选地，还包括存储器1103。
装置1100的各个组件通过总线1104耦合在一起，其中总线1104除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。但是为了清楚说明起见，在图中将各种总线都称为总线1104。
可选地，存储器1103可以用于前述方法实施例中的指令。该处理器1101可用于执行存储器1103中的指令，并控制接收管脚接收信号，以及控制发送管脚发送信号。
装置1100可以是上述方法实施例中的电子设备或电子设备的芯片。
另一个示例中，本申请实施例提供一种完整性度量装置。该装置包括可信执行环境TEE和非TEE等环境。其中，TEE中包括但不限于：第一可信区域和TEE管理模块。示例性的，第一可信区域与非TEE中的各组件隔离，并且，第一可信区域与TEE中的其它可信区域隔离。第一可信区域中包括度量模块，也就是说，度量模块与非TEE中的各组件隔离，并且，度量模块与TEE中的其他可信区域隔离。示例性的，TEE管理模块的体量为轻量级。具体的，TEE管理模块用于获取度量请求信息，度量请求信息用于请求对目标组件进行完整性度量。其中，目标组件为TEE或非TEE中的组件。TEE管理模块还用于响应于度量请求信息，向度量模块发送度量指示信息；度量指示信息用于指示度量模块对目标组件执行完整性度量。度量模块用于基于度量请求信息，对目标组件执行完整性度量，并获取完整性度量结果。其中，完整性度量结果用于指示目标组件是否完整；度量模块还用于将完整性度量结果反馈给TEE管理模块。
在一种可能的实现方式中，TEE中还包括第二可信区域，第二可信区域中包括至少一个TEE应用和TEE操作系统，其中，至少一个TEE应用依赖于TEE操作系统；第一可信区域中不包括TEE操作系统，度量模块依赖于TEE管理模块。
在一种可能的实现方式中，TEE管理模块，具体用于：基于度量请求信息，对目标组件进行合法性验证；在目标组件合法性验证成功的情况下，向度量模块发送度量指示信息。
在一种可能的实现方式中，度量请求信息中包括目标组件的标识信息和目标存储地址信息，目标存储地址信息用于指示目标组件的程序代码所在的目标存储空间；TEE管理模块，具体用于：基于预先保存的组件信息，对目标组件的标识信息和目标存储地址信息进行校验；组件信息为电子设备安装TEE管理模块时，TEE管理模块获取到的，组件信息包括非TEE中的所有组件对应的标识信息和存储地址信息；在目标组件的标识信息和目标存储地址信息校验成功的情况下，确定目标组件合法性校验成功。
在一种可能的实现方式中，TEE管理模块，具体用于：在目标组件合法性校验成功的情况下，TEE管理模块将目标组件对目标存储空间的访问权限从第一访问权限更新为第二访问权限，并向度量模块发送度量指示信息；其中，第一访问权限为禁止访问权限，第二访问权限为读访问权限；度量指示信息包括目标存储地址信息；度量模块，用于基于目标存储地址信息和第二访问权限，从目标存储空间中获取目标组件的程序代码，并对目标组件的程序代码进行完整性度量。
在一种可能的实现方式中，TEE管理模块，具体用于：接收度量模块反馈的完整性度量结果之后，将目标组件对目标存储空间的访问权限从第二访问权限更新为第一访问权限。
其中，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本实施例还提供一种计算机存储介质，该计算机存储介质中存储有计算机指令，当该计算机指令在电子设备上运行时，使得电子设备执行上述相关方法步骤实现上述实施例中的方法。
本实施例还提供了一种计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述相关步骤，以实现上述实施例中的方法。
另外，本申请的实施例还提供一种装置，这个装置具体可以是芯片，组件或模块，该装置可包括相连的处理器和存储器；其中，存储器用于存储计算机执行指令，当装置运行时，处理器可执行存储器存储的计算机执行指令，以使芯片执行上述各方法实施例中的方法。
其中，本实施例提供的电子设备、计算机存储介质、计算机程序产品或芯片均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处 不再赘述。
通过以上实施方式的描述，所属领域的技术人员可以了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
本申请各个实施例的任意内容，以及同一实施例的任意内容，均可以自由组合。对上述内容的任意组合均在本申请的范围之内。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。
结合本申请实施例公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read Only Memory，ROM)、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请实施例所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
上面结合附图对本申请的实施例进行了描述，但是本申请并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本申请的启示下，在不脱离本申请宗旨和权利要求所保护的范围情况下，还可做出很多形式，均属于本申请的保护之内。

Claims (17)

  1. 一种完整性度量方法，其特征在于，应用于电子设备，所述电子设备包括可信执行环境TEE和非TEE，所述TEE中包括第一可信区域和TEE管理模块，所述第一可信区域与所述非TEE中的各组件隔离，所述第一可信区域与所述TEE中的其它可信区域隔离，所述第一可信区域中包括度量模块，所述TEE管理模块的体量为轻量级，所述方法包括：
    所述TEE管理模块获取度量请求信息，所述度量请求信息用于请求对目标组件进行完整性度量；其中，所述目标组件为所述TEE或所述非TEE中的组件；
    所述TEE管理模块响应于所述度量请求信息，向所述度量模块发送度量指示信息；所述度量指示信息用于指示所述度量模块对所述目标组件执行完整性度量；
    所述TEE管理模块接收所述度量模块反馈的完整性度量结果；其中，所述完整性度量结果用于指示所述目标组件是否完整。
  2. 根据权利要求1所述的方法，其特征在于，所述TEE中还包括第二可信区域，所述第二可信区域中包括至少一个TEE应用和TEE操作系统，其中，所述至少一个TEE应用依赖于所述TEE操作系统；
    所述第一可信区域中不包括TEE操作系统，所述度量模块依赖于所述TEE管理模块。
  3. 根据权利要求1所述的方法，其特征在于，所述TEE管理模块响应于所述度量请求信息，向所述度量模块发送度量指示信息，包括：
    所述TEE管理模块基于所述度量请求信息，对所述目标组件进行合法性验证；
    在所述目标组件合法性验证成功的情况下，所述TEE管理模块向所述度量模块发送所述度量指示信息。
  4. 根据权利要求3所述的方法，其特征在于，所述度量请求信息中包括所述目标组件的标识信息和目标存储地址信息，所述目标存储地址信息用于指示所述目标组件的程序代码所在的目标存储空间；所述TEE管理模块基于所述度量请求信息，对所述目标组件进行合法性验证，包括：
    所述TEE管理模块基于预先保存的组件信息，对所述目标组件的标识信息和目标存储地址信息进行校验；所述组件信息为所述电子设备安装所述TEE管理模块时，所述TEE管理模块获取到的，所述组件信息包括所述非TEE中的所有组件对应的标识信息和存储地址信息；
    在所述目标组件的标识信息和目标存储地址信息校验成功的情况下，所述TEE管理模块确定所述目标组件合法性校验成功。
  5. 根据权利要求4所述的方法，其特征在于，所述TEE管理模块响应于所述度量请求信息，向所述度量模块发送度量指示信息，还包括：
    在所述目标组件合法性校验成功的情况下，所述TEE管理模块将所述目标组件对所述目标存储空间的访问权限从第一访问权限更新为第二访问权限，并向所述度量模块发送所述度量指示信息；其中，所述第一访问权限为禁止访问权限，所述第二访问权限为读访问权限；所述度量指示信息包括所述目标存储地址信息，使得所述度量模块基于所述目标存储地址信息和所述第二访问权限，从所述目标存储空间中获取所述目标组件的程序代码，并对所述目标组件的程序代码进行完整性度量。
  6. 根据权利要求5所述的方法，其特征在于，所述TEE管理模块接收所述度量模块反馈的完整性度量结果之后，所述方法还包括：
    所述TEE管理模块将所述目标组件对所述目标存储空间的访问权限从所述第二访问权限更新为所述第一访问权限。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述目标组件为应用程序、操作系统或服务。
  8. 一种完整性度量装置，其特征在于，所述装置包括可信执行环境TEE和非TEE，所述TEE中包括第一可信区域和TEE管理模块，所述第一可信区域与所述非TEE中的各组件隔离，所述第一可信区域与所述TEE中的其它可信区域隔离，所述第一可信区域中包括度量模块，所述TEE管理模块的体量为轻量级；
    所述TEE管理模块，用于获取度量请求信息，所述度量请求信息用于请求对目标组件进行完整性度量；其中，所述目标组件为所述TEE或所述非TEE中的组件；
    所述TEE管理模块，还用于响应于所述度量请求信息，向所述度量模块发送度量指示信息；所述度量指示信息用于指示所述度量模块对所述目标组件执行完整性度量；
    所述度量模块，用于基于所述度量请求信息，对所述目标组件执行完整性度量，并获取完整性度量结果；其中，所述完整性度量结果用于指示所述目标组件是否完整；
    所述度量模块，还用于将所述完整性度量结果反馈给所述TEE管理模块。
  9. 根据权利要求8所述的装置，其特征在于，所述TEE中还包括第二可信区域，所述第二可信区域中包括至少一个TEE应用和TEE操作系统，其中，所述至少一个TEE应用依赖于所述TEE操作系统；
    所述第一可信区域中不包括TEE操作系统，所述度量模块依赖于所述TEE管理模块。
  10. 根据权利要求8所述的装置，其特征在于，所述TEE管理模块，具体用于：
    基于所述度量请求信息，对所述目标组件进行合法性验证；
    在所述目标组件合法性验证成功的情况下，向所述度量模块发送所述度量指示信息。
  11. 根据权利要求10所述的装置，其特征在于，所述度量请求信息中包括所述目标组件的标识信息和目标存储地址信息，所述目标存储地址信息用于指示所述目标组件的程序代码所在的目标存储空间；所述TEE管理模块，具体用于：
    基于预先保存的组件信息，对所述目标组件的标识信息和目标存储地址信息进行校验；所述组件信息为所述电子设备安装所述TEE管理模块时，所述TEE管理模块获取到的，所述组件信息包括所述非TEE中的所有组件对应的标识信息和存储地址信息；
    在所述目标组件的标识信息和目标存储地址信息校验成功的情况下，确定所述目标组件合法性校验成功。
  12. 根据权利要求11所述的装置，其特征在于，所述TEE管理模块，具体用于：
    在所述目标组件合法性校验成功的情况下，所述TEE管理模块将所述目标组件对所述目标存储空间的访问权限从第一访问权限更新为第二访问权限，并向所述度量模块发送所述度量指示信息；其中，所述第一访问权限为禁止访问权限，所述第二访问权限为读访问权限；所述度量指示信息包括所述目标存储地址信息；
    所述度量模块，用于基于所述目标存储地址信息和所述第二访问权限，从所述目标存储空间中获取所述目标组件的程序代码，并对所述目标组件的程序代码进行完整性度量。
  13. 根据权利要求12所述的装置，其特征在于，所述TEE管理模块，具体用于：
    接收所述度量模块反馈的完整性度量结果之后，将所述目标组件对所述目标存储空间的访问权限从所述第二访问权限更新为所述第一访问权限。
  14. 根据权利要求8至13任一项所述的装置，其特征在于，所述目标组件为应用程序、操作系统或服务。
  15. 一种计算机存储介质，其特征在于，包括计算机指令，当所述计算机指令在电子设备上运行时，使得所述电子设备执行如权利要求1-7任一项所述的方法。
  16. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得所述计算机执行如权利要求1-7任一项所述的方法。
  17. 一种芯片，其特征在于，包括一个或多个接口电路和一个或多个处理器；所述接口电路用于从电子设备的存储器接收信号，并向所述处理器发送所述信号，所述信号包括存储器中存储的计算机指令；当所述处理器执行所述计算机指令时，使得所述电子设备执行权利要求1-7任一项所述的方法。
PCT/CN2023/115263 2022-10-09 2023-08-28 完整性度量方法及装置 WO2024078159A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211226020.1 2022-10-09
CN202211226020.1A CN117892359A (zh) 2022-10-09 2022-10-09 完整性度量方法及装置

Publications (1)

Publication Number Publication Date
WO2024078159A1 true WO2024078159A1 (zh) 2024-04-18

Family

ID=90644621

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/115263 WO2024078159A1 (zh) 2022-10-09 2023-08-28 完整性度量方法及装置

Country Status (2)

Country Link
CN (1) CN117892359A (zh)
WO (1) WO2024078159A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111125707A (zh) * 2019-11-22 2020-05-08 苏州浪潮智能科技有限公司 一种基于可信密码模块的bmc安全启动方法、系统及设备
CN111859394A (zh) * 2020-07-21 2020-10-30 中国人民解放军国防科技大学 基于tee的软件行为主动度量方法及系统
CN112434306A (zh) * 2020-12-11 2021-03-02 中国科学院信息工程研究所 可信度量方法，装置，系统，电子设备及存储介质
CN114462051A (zh) * 2022-04-12 2022-05-10 中电云数智科技有限公司 一种基于可信计算环境的可信计算系统及方法
CN116257889A (zh) * 2021-12-10 2023-06-13 华为技术有限公司 数据完整性保护方法及相关装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111125707A (zh) * 2019-11-22 2020-05-08 苏州浪潮智能科技有限公司 一种基于可信密码模块的bmc安全启动方法、系统及设备
CN111859394A (zh) * 2020-07-21 2020-10-30 中国人民解放军国防科技大学 基于tee的软件行为主动度量方法及系统
CN112434306A (zh) * 2020-12-11 2021-03-02 中国科学院信息工程研究所 可信度量方法，装置，系统，电子设备及存储介质
CN116257889A (zh) * 2021-12-10 2023-06-13 华为技术有限公司 数据完整性保护方法及相关装置
CN114462051A (zh) * 2022-04-12 2022-05-10 中电云数智科技有限公司 一种基于可信计算环境的可信计算系统及方法

Also Published As

Publication number Publication date
CN117892359A (zh) 2024-04-16

Similar Documents

Publication Publication Date Title
US11514159B2 (en) Method and system for preventing and detecting security threats
US7139915B2 (en) Method and apparatus for authenticating an open system application to a portable IC device
US7010684B2 (en) Method and apparatus for authenticating an open system application to a portable IC device
TWI607376B (zh) 用於處理改變依照統一可延伸韌體介面計算裝置中之系統安全資料庫及韌體儲存區請求的系統及方法
CN107533609B (zh) 用于对系统中的多个可信执行环境进行控制的系统、设备和方法
US8213618B2 (en) Protecting content on client platforms
JP5992457B2 (ja) オペレーティングシステムのコンフィグレーション値の保護
KR101281678B1 (ko) 이동 저장 장치에서 호스트 인증 방법, 호스트 인증을 위한정보 제공 방법, 장치, 및 기록매체
JP5346608B2 (ja) 情報処理装置およびファイル検証システム
US8566815B2 (en) Mechanism for updating software
TWI745629B (zh) 電腦系統以及初始化電腦系統的方法
CN114651253A (zh) 用于策略强制实施的虚拟环境类型验证
CN115329321A (zh) 一种固件的启动方法、芯片及计算设备
KR20200041639A (ko) 차량용 소프트웨어 업데이트 장치 및 그 제어 방법
WO2024078159A1 (zh) 完整性度量方法及装置
CN113515779A (zh) 文件的完整性校验方法、装置、设备及存储介质
LU500441B1 (en) Attestable read-only protected memory in a distributed system
LU500442B1 (en) Enforcement of attestation of read-only protected memory during attestation validity period
CN115033854A (zh) 一种数据处理方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23876364

Country of ref document: EP

Kind code of ref document: A1