WO2021197040A1 - 可信度量方法及相关装置 - Google Patents

可信度量方法及相关装置 Download PDF

Info

Publication number
WO2021197040A1
WO2021197040A1 PCT/CN2021/080810 CN2021080810W WO2021197040A1 WO 2021197040 A1 WO2021197040 A1 WO 2021197040A1 CN 2021080810 W CN2021080810 W CN 2021080810W WO 2021197040 A1 WO2021197040 A1 WO 2021197040A1
Authority
WO
WIPO (PCT)
Prior art keywords
measured object
metric value
module
trusted
computing device
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/080810
Other languages
English (en)
French (fr)
Inventor
何达
齐杰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP21778938.7A priority Critical patent/EP4116851A4/en
Publication of WO2021197040A1 publication Critical patent/WO2021197040A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode

Definitions

  • This application relates to the field of information technology, in particular to a credibility measurement method and related devices.
  • the security of the computing device can be determined by measuring the integrity of the code running on the computing device and the integrity of the data stored in the computing device.
  • the code running on the computing device is trusted code and the data stored in the computing device is trusted data, the computing device is trusted.
  • the code running on the computing device can be read from the data stored in the computing device and loaded into the computing device to run. If the data stored in the computing device or the code running in the computing device is tampered with, that is, the integrity of the code running on the computing device and the data stored in the computing device is destroyed, the computing device is not trusted.
  • This application provides a credibility measurement method and related devices, which are used to improve the security of computing equipment.
  • this application provides a credibility measurement method.
  • the method includes: obtaining a metric value of a first measured object in a computing device, where the metric value of the first measured object is used to determine whether a first trusted module implemented based on firmware in the computing device is credible; The first trusted module is used to store the metric value of the second measured object in the computing device; and send the metric value of the first measured object to the second trusted module based on hardware.
  • the metric value of the first measured object used to determine whether the first trusted module is trusted is sent to the second trusted module based on hardware, and the second trusted module can store the received The metric value of the first measured object. Since the security protection level of the internal data in the second trusted module based on hardware is higher than the security protection level of the first trusted module based on firmware, the measurement of the first measured object stored in the second trusted module is used. Value to determine whether the first trusted module is trusted or not will be more secure and accurate. Thereby, the security of computing equipment can be improved.
  • the first measured object includes at least one of the following: the first trusted module or the data in the first trusted module.
  • the data in the first trusted module may include at least one of the following: the data of the first trusted module itself, the metric value of the second measured object, and so on.
  • the first measured object may only include the metric value of the second measured object stored in the first trusted module.
  • the metric value of the second measured object is stored in the first register of the first trusted module in an extended operation; the metric value of the first measured object is The value is stored in the second register of the second trusted module in an extended operation.
  • the second trusted module is also used to store the metric value of the third measured object; the third measured object is the calculation before the first trusted module is started. The measured object in the device; the second measured object is the measured object in the computing device after the first trusted module is started.
  • the first trusted module runs based on a trusted operating system on the computing device;
  • the third tested object includes at least one of the following: BIOS code, The boot loader of the computing device and the boot code of the trusted operating system.
  • the metric value of the third measured object is stored in the third register of the second trusted module in an extended operation manner.
  • the first trusted module is a firmware-based trusted platform module fTPM
  • the metric value of the second measured object is stored in the platform configuration register PCR of the first trusted module
  • the second trusted module is a discrete trusted platform module dTPM or an integrated trusted platform module, and the metric value of the first measured object is stored in the PCR of the second trusted module.
  • the first measured object includes the metric value of the second measured object; before the acquisition of the metric value of the first measured object in the computing device, the method further The method includes: acquiring the metric value of the second measured object; wherein, the second measured object includes at least one of the following: APP, process, program, log, database, file, data in the computing device; The metric value of the second measured object is sent to the first trusted module.
  • the method before the obtaining the metric value of the first measured object in the computing device, the method includes: detecting that the first measured object has changed.
  • the method before the obtaining the metric value of the first measured object in the computing device, the method includes: receiving a periodically triggered status monitoring instruction.
  • the acquiring the metric value of the first measured object in the computing device includes: acquiring a metric value corresponding to at least two first measured objects.
  • this application provides a trustworthiness measurement device.
  • the apparatus includes: an acquiring module, configured to acquire a metric value of a first measured object in a computing device, and the metric value of the first measured object is used to determine a first credible implementation based on firmware in the computing device. Whether the module is trusted; the first trusted module is used to store the measurement value of the second measured object in the computing device; the sending module is used to send the measurement value of the first measured object to the hardware-based The second trusted module implemented.
  • the first measured object includes at least one of the following: the first trusted module or the data in the first trusted module.
  • the metric value of the second measured object is stored in the first register of the first trusted module in an extended operation; wherein, after the extended operation, the first The data in the register is generated based on the data in the first register before the expansion operation and the metric value of the second measured object; the metric value of the first measured object is stored in the expanded operation method.
  • the second register of the second trusted module wherein the data in the second register after the expansion operation is generated based on the data in the second register before the expansion operation and the metric value of the first measured object of.
  • the first trusted module is a firmware-based trusted platform module fTPM
  • the metric value of the second measured object is stored in the platform configuration register PCR of the first trusted module
  • the second trusted module is a discrete trusted platform module dTPM, or, an integrated trusted platform module iTPM, and the metric value of the first measured object is stored in the PCR of the second trusted module .
  • the acquiring module is further configured to acquire the metric value of the second measured object before the acquiring the metric value of the first measured object in the computing device; where The first measured object includes the metric value of the second measured object; the second measured object includes at least one of the following: APP, process, program, log, database, file, data in the computing device
  • the sending module is also used to send the metric value of the second measured object to the first trusted module.
  • the acquiring module is further configured to execute the step of acquiring the metric value of the first measured object in the computing device after detecting that the first measured object has changed.
  • the acquiring module is further configured to execute the step of acquiring the metric value of the first measured object in the computing device after receiving a periodically triggered state monitoring instruction.
  • the acquiring module is specifically configured to acquire a metric value corresponding to at least two first measured objects.
  • the present application provides a computing device that includes: a first trusted module implemented based on the firmware of the computing device, a second trusted module implemented based on hardware, and any one of the second aspect The trusted measurement device; wherein the first trusted module is used to store the measurement value of the second measured object in the computing device; the second trusted module is used to store the measurement value of the first measured object value.
  • the computing device further includes: a verification device, configured to obtain the metric value of the first measured object from the second trusted module, according to the first measured object The metric value determines whether the first measured object is credible.
  • the computing device further includes: a metric execution device, configured to obtain the integrity parameter of the first measured object, and send the first measured object's information to the metric execution device Integrity parameter; and receiving the metric value of the first measured object sent by the metric executing device; the metric executing device is configured to receive the integrity parameter of the first measured object, according to the first measured object An integrity parameter of a measured object generates a metric value of the first measured object.
  • the present application provides a trustworthiness measurement program, which is used to implement any of the trustworthiness measurement methods described in the first aspect when the trustworthiness measurement program is executed.
  • the present application provides a trustworthiness measurement system.
  • the system includes: a first trustworthy module implemented based on the firmware of a computing device, a second trustworthy module implemented based on hardware, and any one of the trustworthy modules described in the second aspect. Trusted measurement device; the first trusted module is used to store the measurement value of the second measured object in the computing device; the second trusted module is used to store the measurement value of the first measured object .
  • the trustworthiness measurement system further includes: a verification device, configured to obtain the metric value of the first measured object from the second trustworthy module, and according to the first measured object The metric value of the measured object determines whether the first measured object is credible.
  • the trustworthiness measurement system further includes: a measurement execution device, configured to obtain the integrity parameter of the first measured object, and send the first measured object to the measurement execution device The integrity parameter of the object; and receiving the metric value of the first measured object sent by the metric execution device; the metric execution device is configured to receive the integrity parameter of the first measured object, according to the The integrity parameter of the first measured object generates a metric value of the first measured object.
  • the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, and the instructions can be executed by one or more processors on a processing circuit.
  • the computer runs on a computer, the computer is caused to execute the method in any possible implementation manner of the above-mentioned first aspect.
  • FIG. 1 is a schematic diagram 1 of the flow of a credibility measurement method provided by an embodiment of this application;
  • FIG. 2 is a schematic diagram of a system architecture of a computing device applying a trust measurement method according to an embodiment of the application
  • FIG. 3 is a schematic diagram 1 of the processing flow of the credibility measurement method provided by this application.
  • Figure 4 is a second schematic diagram of the processing flow of the credibility measurement method provided by this application.
  • FIG. 5 is a third schematic diagram of the processing flow of the credibility measurement method provided by an embodiment of the application.
  • FIG. 6 is a structural schematic diagram 1 of a trust measurement device provided by an embodiment of this application.
  • FIG. 7 is a schematic diagram 2 of the structure of the credibility measurement device provided by an embodiment of this application.
  • FIG. 8 is a schematic structural diagram of a computing device provided by an embodiment of the application.
  • This application provides a credibility measurement method for determining the security of a computing device.
  • the method provided in this application is used to obtain the measurement results of various objects on the computing device, and then the measurement results can be compared with the expected measurement results to determine whether the various objects on the computing device have been tampered with, which can help the user of the computing device When the system environment of the computing device is found to be tampered with, make correct judgments and processing.
  • FIG. 1 is a schematic diagram 1 of the flow of a credibility measurement method provided by an embodiment of this application.
  • the execution subject of the embodiments of the present application may be a trustworthiness measurement device.
  • the trustworthiness measurement device may be an application (APP) program that can be run in a computing device.
  • APP application
  • the steps of the embodiment of the present application may include:
  • S101 Obtain a metric value of a first measured object in a computing device, where the metric value of the first measured object is used to determine whether a first trusted module implemented based on firmware in the computing device is trustworthy; A trusted module is used to store the metric value of the second measured object in the computing device.
  • S102 Send the metric value of the first measured object to a second trusted module implemented based on hardware.
  • a first trusted module and a second trusted module are deployed on the computing device, and both the first trusted module and the second trusted module are used to store the measurement value of the measured object in the computing device.
  • various measured objects in the computing device are called measured objects.
  • the tested object is APP, process, program, file, log, database or data, etc.
  • the measurement value of the measured object may be determined according to the integrity parameter of the measured object, and the integrity parameter of the measured object may be the hash value or signature of the measured object.
  • the first trusted module and the second trusted module have multiple methods for writing data.
  • the first trusted module and the second trusted module support allowing data to be written directly or in an extended operation manner. In practical applications, data written in an extended operation can be detected when tampered with, so as to quickly determine whether the measured object is credible.
  • the first trusted module and the second trusted module support encrypted storage, encrypted reading and writing, and only allowing objects with keys to write data and read data to ensure data security.
  • the first trusted module and the second trusted module can be used to store the metric values of various types of tested objects.
  • the second trusted module receives the metric value to be stored sent by the trusted measurement device.
  • the verification device can be allowed to read the metric value of each measured object in the first trusted module and the second trusted module, and compare the read metric value with the expected metric value to determine whether the tested object is credible , So as to determine whether the computing device is credible by whether the measured object on the computing device is credible.
  • the first trusted module is used to store the metric value of the second measured object
  • the second trusted module is used to store the metric value of the first measured object.
  • Table 1 is an illustration of the corresponding relationship between the measured object's metric value and the storage location.
  • Measured object Measurement value corresponding to the measured object storage location Second tested object The metric value of the second measured object First trusted module First tested object.
  • the second measured object may be various measured objects on the computing device.
  • the second measured object may be the measured object on the computing device after the first trusted module is started.
  • the second tested object may be APP code, APP startup log, APP operation log, database, database operation log, and so on.
  • the first measured object may be a measured object used to determine whether the first trusted module is trustworthy.
  • the first measured object may include at least one of the following: the first trusted module or the data in the first trusted module.
  • the storage capacity of the first trusted module implemented based on firmware can be configured based on the hardware capability of the computing device, so that the first trusted module supports the storage of a large number of measured object metric values.
  • the first trusted module is implemented based on firmware, and the code and data in the first trusted module can actually be stored in the memory. It should be noted that even if it is stored in the secure memory of the trusted execution environment, the data stored in the first trusted module may be tampered with, that is, the metric value stored in the first trusted module may be tampered with.
  • the metric value of the first measured object is sent to the second trusted module based on hardware. The module stores the received metric value of the first measured object.
  • the processing module used to protect information such as internal data and code may be implemented based on hardware, thereby ensuring the security of internal data.
  • the data stored in the second trusted module can be discovered by the verification device when it is tampered with.
  • the processing module used to protect information such as internal data and code may be implemented based on firmware, and thus may be modified.
  • the firmware-based processing module is modified, the first trusted module or the data in the first trusted module may not be discovered when it is tampered with. It can be seen that the security of the second trusted module based on hardware is higher than that of the first trusted module based on firmware. Based on this, it is safer and more accurate to use the metric value of the first measured object stored by the second trusted module to determine whether the first trusted module and the data in the first trusted module are trusted.
  • the first tested object may include the first trusted module as a whole and various data stored in the first trusted module.
  • the first trusted module may be an APP, program, or process corresponding to the first trusted module that is implemented as a whole.
  • the data in the first trusted module may be processes, programs, codes, data that need to be started or loaded when the first trusted module is started or run, and data stored in the registers of the first trusted module, etc.
  • the metric value of the first trusted module and the metric value of the data in the first trusted module can be extended to the second trusted module.
  • the register of the trusted module After that, the verification device can respectively perform verification based on the data stored in the register of the second trusted module, and comprehensively verify the results to make a judgment on whether the first trusted module is trusted.
  • the metric values of various tested objects may be stored in the registers of the first trusted module or the second trusted module in an extended operation manner.
  • the data in the register after the expansion operation is generated based on the data in the register before the expansion operation and the metric value of the measured object to be stored.
  • the metric value of the second measured object is stored in the first register of the first trusted module in an extended operation; the data in the first register after the extended operation is based on the data before the extended operation The data in the first register and the metric value of the second measured object are generated.
  • the metric value of the first measured object can be expanded to the second register of the second trusted module; wherein, the data in the second register after the expansion operation is based on the data in the second register before the expansion operation
  • the data and the metric value of the first measured object are generated. Since the result of the extended operation is irreversible, when the data stored in the first trusted module or the second trusted module by the extended operation is tampered with, it can be quickly discovered by the verification device. Thereby, the security of the computing device can be further improved.
  • the first measured object may include at least one of the following: the first trusted module or the data in the first trusted module.
  • the metric value of the first trusted module can be used to determine whether the code of the first trusted module itself currently running on the computing device is trusted.
  • the data in the first trusted module includes the metric value of the second measured object and the like.
  • the metric value of the second measured object is the basis for determining whether the second measured object is credible, and the metric value of the data in the first credibility module can be used to determine whether the metric value of the second measured object is credible, that is, whether it is based on whether Credible.
  • the second trusted module may also be used to store the metric value of the third measured object.
  • the third measured object is the measured object in the computing device before the first trusted module is started; the second measured object is the measured object in the computing device after the first trusted module is started .
  • the metric value of the third measured object can be used to determine whether the operating environment in the computing device is credible before the first credibility module is enabled.
  • the operating environment may include code in the operating system that has entered the operating state, global variables, data stored in the memory of the computing device, and so on.
  • the measurement of the measured object in the startup process adopts a static measurement method, that is, the code is measured before the code is loaded and executed, and the measurement of the measured object in the running process adopts a dynamic measurement method, that is, in the running process. When the running state of the code in the code changes, or periodically to measure the code in the running process.
  • the third object under test includes the object under test used to activate the first trusted module.
  • the object under test used to start the first trusted module in the computing device includes at least one of the following: BIOS Code, the boot loader of the computing device, or the startup code of the operating system.
  • BIOS Code the boot loader of the computing device
  • the startup code of the operating system is the code used to start the basic functions of the operating system, such as the kernel code of the Linux operating system. It should be noted that the code to be loaded and executed before startup of other types of operating systems and the sequence of loading and execution may also have other implementation manners, which are not limited in the embodiment of the present application.
  • the metric value of the third measured object may also be stored in the register of the second trusted module in an extended operation manner.
  • the foregoing steps may include: the credibility measurement device receives the measurement value of the first measured object determined by the measurement execution device according to the integrity parameter of the first measured object.
  • the measurement execution device is a local measurement module or a measurement server.
  • the local measurement module is an APP or process in the computing device.
  • the above steps may include: the credible measurement device obtains the integrity parameter of the first measured object, and determines the metric value of the first measured object according to the integrity parameter of the first measured object.
  • the metric execution device obtains the integrity parameter of the first trusted module.
  • the digital signature of the first trusted module is acquired as the metric value of the first trusted module.
  • the metric execution device obtains the hash value of the data in the first trusted module, and uses the hash value as the data corresponding to the data. metric. This application does not restrict this.
  • the number of the first measured object is one or more.
  • steps S101-S102 include: obtaining the metric value of each first measured object respectively, and respectively sending the metric value of each first measured object to the second trusted module, and then the second trusted module.
  • the trusted module separately stores the metric value of each first measured object.
  • the above steps include: for any at least two first tested objects among the plurality of first tested objects, obtaining a metric value corresponding to the at least two first tested objects; Send the metric value to the second trusted module; then, the second trusted module uses a register to store the metric value. In this way, a storage space of the second trusted module is used to store the metric values used to determine whether the multiple first tested objects are trusted, which can save the storage space of the second trusted module.
  • the number of first measured objects is N, and N is an integer greater than or equal to 2.
  • the credibility measurement device obtains 1 measurement value corresponding to the N first measured objects.
  • obtain the N integrity parameters corresponding to the N first tested objects and then obtain the integrity parameters of the N integrity parameters, and then determine the N first integrity parameters according to the integrity parameters of the N integrity parameters.
  • the above-mentioned N first measured objects include: APP1 code, APP1 operation log, APP2 code, APP2 operation log, file 1 allowed to be read and written by APP1 and APP2, and so on.
  • the credibility measurement device respectively acquires 1 metric value corresponding to the first measured object related to APP1 and 1 metric value corresponding to the first measured object related to APP2. That is, get the code of APP1, the operation log of APP1, one metric value A corresponding to file 1, and obtain the code of APP2, the operation log of APP2, and one metric value B corresponding to file 1, after which the metric value A And B are sent to the second trusted module. In this way, on the basis of saving the storage space of the second trusted module, it is possible to quickly determine whether the key APP in the computing device is trusted.
  • the above steps S101-S102 support execution under multiple trigger conditions.
  • the credibility measurement device executes steps S101-S102 when it detects that the first measured object has changed.
  • the first tested object includes at least one tested object among APPs, processes, programs, logs, databases, files, or data in the first trusted module of the first trusted module.
  • the data in the first trusted module may include the metric value of the second measured object in a register stored in the first trusted module, and the like.
  • steps S101-S102 are executed. In this way, the measurement of the start-up phase of the first trusted module and the measurement when the measurement value of the second measured object is changed can be realized.
  • the trusted measurement device performs steps S101-S102 when receiving a periodically triggered status monitoring instruction.
  • the credibility measurement device receives the status monitoring instruction generated periodically according to the preset detection period, and after receiving the status monitoring instruction, executes steps S101-S102. In this way, the dynamic measurement of the computing device can be realized, that is, the measured object in the running process can be measured on a regular basis.
  • the metric value of the second measured object in the first trusted module there are multiple ways to obtain the metric value of the second measured object in the first trusted module.
  • the metric value of the second measured object is obtained when a change of the second measured object is detected, or when a periodically triggered status monitoring instruction is received.
  • the second measured object is any measured object on the computing device.
  • the second measured object is another measured object except the first trusted module and the data in the first trusted module.
  • the metric value of the second measured object is sent to the first trusted module by the trusted measurement device.
  • the trusted measurement device detects that the second tested object has changed, it obtains the measurement value of the second tested object and sends it to the first trusted module.
  • the computing device supports the configuration of at least two trustworthy measurement devices; for example, the first and second trustworthy measurement devices.
  • the metric value of the second measured object is obtained by the first credible measurement device and sent to the first credible module; the metric value of the first measured object is obtained by the second credible measurement device and sent to the first credible module.
  • the first measured object may include data in the first trusted module, such as the metric value of the second measured object.
  • the first trusted module may be a trusted platform module (Trust Platform Module, TPM) implemented based on firmware or a trusted cryptographic module (Trust Cryptography Module, TCM).
  • TPM Trust Platform Module
  • TCM trusted cryptographic module
  • the first trusted module is a firmware-based trusted platform module (firmware TPM, fTPM).
  • the metric value of the second measured object can be stored in the platform configuration register PCR of the first trusted module.
  • a hardware-based TPM or TCM can be set in the communication bus between a computing device and an external IO device to learn the code that is actually loaded into the memory to be executed by the CPU and the data to be used, so as to ensure The authenticity of the measured object.
  • the second trusted module may be a TPM implemented based on hardware or a TCM implemented based on hardware.
  • the second trusted module is a discrete trusted platform module (Discrete TPM, dTPM) or an integrated trusted platform module (Integrated TPM).
  • the metric value of the first measured object can be stored in the PCR of the second trusted module.
  • a TPM implemented based on firmware or a TCM implemented based on firmware runs on a computing device that supports Trustzone.
  • the combination of fTPM and dTPM can improve security on the basis of increasing the number of PCRs.
  • the fTPM since the fTPM supports extended definition configuration registers, it can provide a larger number of PCRs.
  • fTPM supports the configuration of more than 24 PCRs.
  • storing the metric value of the fTPM program in the dTPM is used to verify the fTPM module regularly, which can ensure that the running fTPM firmware program is legal.
  • the digest value of all PCR values in fTPM is calculated through the Hash algorithm, and then expanded to the specific PCR of dTPM; when the PCR value of fTPM is detected to change, the digest corresponding to all PCR values is recalculated Value and synchronously expand to the specific PCR of dTPM.
  • the dTPM or the verification device periodically verifies the digest value of the PCRs of the fTPM stored in the specific PCR, and reports an alarm when the verification result is inconsistent with expectations. In this way, data and security in fTPM can be ensured.
  • the trust measurement method provided in the present application will be exemplarily described below.
  • computing devices support the deployment of common operating systems and trusted operating systems.
  • the common operating system may be a Linux or Windows operating system.
  • the fTPM is a trusted application (Trusted Application, TA) that runs based on a trusted operating system.
  • FIG. 2 is a schematic diagram of a system architecture of a computing device applying a trust measurement method according to an embodiment of the application.
  • a computing device includes two parts: hardware (Hardware) and software (Software).
  • the hardware part of the computing device can include: System on Chip (SOC), SOC includes: dTPM, ARM CPU Core, business processing engine, as well as security zone (Trustzone), encryption and decryption engine, hardware random number, electronic fusion EFuse, HardwareUniqueKey (HUK), etc.
  • SOC System on Chip
  • SOC includes: dTPM, ARM CPU Core, business processing engine, as well as security zone (Trustzone), encryption and decryption engine, hardware random number, electronic fusion EFuse, HardwareUniqueKey (HUK), etc.
  • Trustzone, encryption and decryption engine, hardware random number, eFuse, HUK can be used to realize the security isolation of code and data.
  • the Trustzone technology is implemented through hardware isolation.
  • the operating systems of the secure world and the non-secure world run on mutually isolated hardware.
  • the software part of the computing device may include: a non-secure world (Non-Secure world) and a secure world (Secure-world), and the secure world and the non-secure world realize communication through a secure monitor (Secure Monitor).
  • the operating system in the secure world is called the operating system (TEE OS) of the Trust Execute Environment (TEE), which is referred to as the trusted operating system hereinafter.
  • Operating systems in the unsecure world are called ordinary operating systems.
  • common user applications (User App) run based on common operating systems
  • trusted execution environment applications (TEE App) run based on TEE OS.
  • TEE Apps in the secure world include: TA (fTPM), TA (KMC), TA (DIM), and Global Platform TEE internal API.
  • TA fTPM
  • TA is an implementation manner of the first trusted module in the foregoing embodiment.
  • TA (fTPM) can include: Platform Configuration Registers (PCR), TPM command (TPM COMMAND), X509/RS, Secure Hash Algorithm (SHA), Advanced Encryption Standard (AES) ), Sub System, etc.
  • TA (DIM) is the TA of Dynamic Integrity Measurement (DIM).
  • User App in the non-secure world includes: Native App, Key Manager Center (KMC), measurement startup module, Global Platform TEE Client API, etc.
  • KMC Key Manager Center
  • GlobalPlatform TEE internal API and Global Platform TEE Client API are used to establish a communication connection between User APP and each TA.
  • the measurement startup module can be used to obtain the measurement value of the measured object. It should be noted that the measurement startup module can be User applications running on common operating systems can also be system applications and system processes in common operating systems, or TAs in the secure world.
  • TEE OS in the secure world supports operation: TEE Core, TEE function (Func)/database (Libs), encryption function (Crypt), hardware abstraction layer (Hardware Abstraction Layer, HAL), etc.
  • TPM driver TPM Drv
  • TEE driver TEE Drv
  • TPM Drv TEE driver
  • fTPM TA
  • the metric value of the first measured object may be stored in the PCR of the dTPM, and the metric value of the second measured object may be stored in the PCR of the fTPM.
  • the above-mentioned various TPMs are predefined to limit the operations performed on the PCR. These include: on the one hand, it is not allowed to use the port mapping method used when reading and writing the registers of ordinary character devices to read and write the PCR at will; on the other hand, the PCR is set inside various TPMs to Protect the internally stored data; on the other hand, only two operations are allowed to modify the value of PCR: Among them, the reset operation (Reset) and the extended operation (Extend). The reset operation can occur after the machine is powered off or restarted. The value of PCR is automatically reset to zero.
  • extension operation is as follows:
  • PCR[n] HASH ⁇ PCR[n-1]
  • PCR[n-1] represents the data stored in the PCR at the n-1th time
  • PCR[n] represents the data stored in the PCR at the nth time
  • newMeasurement represents the metric value of the measured object obtained at the nth time.
  • the expansion operation can be irreversible. For example, first expand the metric value A to PCR, and then expand the metric value B to PCR, and the obtained PCR value is the same as firstly expanding the metric value B to PCR, and then expanding the metric value B
  • the PCR value obtained by PCR is different.
  • PCR can record an infinite sequence of metric values. The sequence composed of this series of metric values can reflect the changes of the system state. If a certain metric value in this extended sequence changes, subsequent metric sequences will be affected. That is, the value in the PCR does not match the expected value recorded by the verification device.
  • the metric value of the first measured object is sent to the second trusted module in the above step S102
  • the metric value is written into the PCR in an extended manner, that is, the metric value of the first measured object
  • the value is extended to the PCR of the second trusted module.
  • the metric value of the second measured object can also be written into the PCR of the first trusted module in an extended manner.
  • the integrity measurement of the computing device can use a trust transfer mechanism. It is defined in the trust transfer mechanism that under the premise of confirming that the current link is credible, the current link measures the security of the next link, and after the next link is determined to be credible, control is transferred to the next link, and then backwards in turn Advance. Based on this trust transfer mechanism, when the operating environment at a certain moment on the computing device is trusted, if the tested object that needs to be run at the next moment is trusted, it is considered that the tested object that needs to run at the next moment is considered reliable. The operating environment after the test object is credible.
  • Storing the metric value in the form of extended operation can realize the transmission of the trust chain.
  • the loading sequence or calling sequence of some measured objects in the computing device is fixed, for example, multiple programs loaded or executed during the startup phase of the computing device. These measured objects whose loading sequence or calling sequence is fixed can form a sequence of measured objects, which is called a sequence of sequenced measured objects.
  • the metric value corresponding to the measured object in the sequence is written into a PCR in an extended manner.
  • the PCR when the data in the PCR is verified to be credible, the multiple tested objects that were previously called corresponding to the PCR are all credible, and the multiple tested objects can form a trust chain.
  • Each trusted object under test can also serve as the starting point for a new chain of trust.
  • the code loaded and executed during the startup phase of the computing device includes: BIOS code, operating system boot program, and operating system startup code.
  • the measurement process of the computing device during the startup phase includes: obtaining the metric value 1 of the BIOS code, extending the metric value 1 to PCR1 of the second trusted module, obtaining the metric value 2 of the operating system boot program code, and measuring The value 2 is extended to PCR1, the metric value 3 of the operating system startup code is obtained, and the metric value 3 is extended to PCR1.
  • the verification device used to verify the authenticity of the tested object reads the data in PCR1 after each expansion operation and compares it with the expected value to determine whether each code is authentic.
  • the first trusted module since the first trusted module is usually started after the startup code of the operating system is executed, the first trusted module cannot store the metric value of the code that is loaded and executed before its own startup, so it will start The measurement value of the measured object in the phase is stored in the second trusted module in an extended manner, which can be implemented to measure whether the operating environment of the first trusted module is trusted or not before starting.
  • the measurement of the current measured object must be performed by other objects loaded or called before the current measured object, that is, the measurement process needs to be earlier than the scheduled execution process to ensure the authenticity of the measurement object in the measurement process.
  • the verification process of the measurement result can be later than the scheduling execution process, or it can be carried out at the same time as the scheduling execution process.
  • following the principle of measurement before execution when verifying that the measured object to be loaded and executed is not trusted, stop loading the untrusted measured object to help users quickly confirm the security of the computing device.
  • the verification process is later than the scheduled execution process, the tested object that is verified as untrusted is recorded in the log for the user to view.
  • the use of fTPM to define a large number of PCRs can support the measurement of the measured objects in multiple dimensions in the computing device. Exemplarily, it supports the measurement of multiple measurement links planned according to the type of the measured object and the calling sequence.
  • the following uses specific examples to illustrate the credibility measurement method provided in the embodiments of the present application.
  • Fig. 3 is a schematic diagram 1 of the processing flow of the credibility measurement method provided by this application.
  • a complex system can be considered to be divided into two measurement links: a basic system process and a system extended function process.
  • the basic system process is responsible for completing the startup of the framework of the operating system.
  • the metric value of the basic system process loaded and executed during the startup phase is stored in the PCR of the dTPM.
  • the basic system process can be started through the trust chain transfer mode of dTPM, that is, the trust chain in the startup phase may include one or more basic system processes that need to be loaded and executed during the startup phase.
  • the part of code used to obtain the metric value of the basic system process and extend it to the dTPM can also be added to the trust chain in the startup phase.
  • the part of the code that is loaded and executed can only implement part of the functions of the trust measurement device in the foregoing embodiment, so as to ensure the safety of the system's frame operation.
  • the metric value of the system expansion function process is stored in the PCR of the fTPM.
  • the system extension function process is a process that meets at least one of the following conditions: corresponds to an independent function, supports independent startup and exit, or, even if an exception occurs, it does not expand and affect the operating system framework or other system extension function processes .
  • a PCR is used to record the corresponding metric value for each system expansion function process.
  • the system extension function process can be started together with the basic system process, or can be started when needed, which is not limited in this application.
  • the overall security measurement solution for computing devices may include the following steps:
  • the measurement value of the basic system process is obtained and the measurement value is extended to dTPM.
  • the second aspect is to obtain the metric value of the system expansion function process and extend it to fTPM.
  • the third aspect on the basis of the second aspect, when it is detected that the metric value of the system extended function process stored in the fTPM has changed, the metric value of all the PCR stored data in the fTPM is obtained, and the metric value of all the PCR stored data in the fTPM is obtained. The metric value is extended to dTPM.
  • the steps of the second aspect and the third aspect may be executed by the first credibility measurement device, and the steps of the third aspect may be executed by the first credibility measurement device.
  • the steps of the first aspect the basic system process can be measured, and the second and third aspects can be used to measure the process of the extended system. In this way, it is possible to comprehensively confirm whether the computing device is credible from the two aspects of the basic system process and the extended system process.
  • the measurement process of the startup phase and the operation phase of the computing device may include: when the computing device is powered on, first load and run the initial measurement root CRTM.
  • CRTM can determine the code to be executed first when the computing device is started.
  • CRTM itself can be a piece of code.
  • CRTM should be trusted and can be stored in BIOS.
  • CRTM does not have the permission to write dTPM. .
  • CRTM obtains the measurement value of the BIOS, and when it is confirmed that the BIOS is trusted, the BIOS is loaded; after that, because CRTM does not have the write permission, the BIOS extends the measurement value of the BIOS to PCR1 of the dTPM; then, the BIOS obtains the measurement of the basic OS process Value, the metric value of the OS basic process is extended to PCR1 of dTPM; when the OS basic process is confirmed to be credible, the OS basic process is loaded.
  • the secure boot process is used to confirm whether the BIOS and OS basic processes are trustworthy. In practical applications, it is also possible to perform only the measurement step without making a credibility judgment.
  • the measurement data will be used to judge the safety of the startup phase after the startup.
  • the OS basic process obtains the metric value of APP1, extends the metric value of APP1 to PCR2 of fTPM, and then loads APP1; at the same time, the OS basic process obtains the metric value of APP2 and extends the metric value of APP2 to Then load APP2 in PCR3 of fTPM.
  • APP1 and APP2 are APPs used in different application scenarios, and the operation of APP1 and APP2 does not affect each other. For example, the operating environments on which the two operate are not related to each other.
  • Table 2 is an illustration of the corresponding relationship between the measured object's metric value and the storage location.
  • APP1 and APP2 correspond to different application scenarios, and their operation does not affect each other. Therefore, a separate PCR is used to record the metric values of the two.
  • the method of storing the measurement value of the measured object such as the system extended function process in the independent PCR in the first trusted module can make the computing device not need to restrict the system extended function process and the basic system process. Start in a fixed order. That is, the system extension function process can be started and exited independently without affecting the measurement and security of the basic system process.
  • the measurement value of the measured object is determined according to the loading stage of the measured object, whether it is the first trusted module and the data in the first trusted module, the application scenario, and the type of the measured object Storage location.
  • the storage location includes: stored in the first trusted module or the second trusted module, stored in a new PCR or an existing PCR, and so on.
  • the configuration mechanism of the first trusted module is used to increase the number of PCRs. It should be noted that it is agreed that the first trusted module is only used to store the measurement value of the measured object that is not related to the first trusted module. The foregoing steps can be executed by any trust measurement device in the embodiments of the present application.
  • the measurement value of the object under test whose loading phase is the startup phase of the operating system is sent to the second trusted module, and the loading phase is the measurement value of the object under test in the operating phase of the operating system.
  • the value is sent to the second trusted module.
  • the metric value of each second measured object is extended to the PCR corresponding to the application scenario of the second measured object in the first trusted module.
  • the multiple PCRs in the first trusted module correspond to multiple application scenarios one-to-one.
  • a certain PCR in the first trusted module may be used to store a measurement value of the measured object related to an application scenario.
  • the tested object when it is detected that the tested object has nothing to do with the first trusted module and the type of the tested object is APP, process, program, log, database, file, data, it is determined that the tested object is the second The measured object, and the measurement value of the measured object is stored in the first trusted module.
  • a dynamic measurement method is adopted to measure the measured object on the computing device.
  • the object loaded in the computing device is not attacked during initial loading or startup, and the metric value obtained during this period can determine that the object currently loaded and running on the computing device is credible.
  • the running state of various objects on a computing device is not static.
  • the object on the computing device may be damaged during operation, that is, the measurement value obtained when the object is started cannot reflect whether the object is credible during the operation. If it is still measured according to the standards at startup, it may give wrong results.
  • Figure 4 is a second schematic diagram of the processing flow of the credibility measurement method provided by this application.
  • the system measurement is divided into the system startup measurement process and the system operation measurement process.
  • the measured object of the system startup measurement process is the basic measurement object, and the system allows the measured object of the measurement process to be the extended measurement object.
  • the measured object whose running status remains unchanged can also be divided into the start-up measurement process.
  • the specific measurement scheme can be as follows: On the one hand, the measurement value of the basic measurement object involved in the system startup process is stored in the dTPM. Exemplarily, the system startup process includes the fTPM startup process. On the other hand, the measurement value of the extended measurement object involved in the system operation process is stored in the fTPM. It should be noted that the metric value of the extended metric object whose running status can be changed is stored in an independent PCR. In addition, during the operation of the system, if a change in the extended measurement object is detected, for example, a change in a functional module, the measurement value of the changed extended measurement object is re-acquired and updated to the PCR of the fTPM.
  • the corresponding metric values are obtained for all PCR values of fTPM and updated to dTPM. For example, calculate the summary of all PCRs in fTPM and expand it to the PCR of dTPM. Then, by regularly verifying the correctness of the data in the PCR of the dTPM, it is determined whether all running modules are credible.
  • the second trusted module is used to store the code and data stored in the first trusted module and the measurement value of the measured object related to the first trusted module, so that the second trusted module can be used to compare High security improves the security of the first trusted module itself and the metric value stored in the first trusted module, thereby enhancing the security of the computing device.
  • the first trusted module can also be used to expand the measurement value of the measured object in other application scenarios, so that it can be measured from more dimensions. Whether the computing device is trustworthy.
  • the above-mentioned first trusted module and the second trusted module can be used to store the measurement values of various measured objects related to the operating system and user APP deployed on the computing device.
  • the metric value of the measured object is stored in an extended manner
  • the value stored by the PCR that stores the metric value actually corresponds to the trusted state of a trust chain. Based on the starting point of the trust chain and any node is trusted, storing data in an extended manner can be used to determine whether the computing device is always in a trusted state.
  • FIG. 5 is a third schematic diagram of the processing flow of the credibility measurement method provided by an embodiment of the application.
  • the execution subject of the embodiment of the present application involves multiple processes and process scheduling modules.
  • process 1 is a running process in the operating system, and the metric value of process 1 is stored in PCR1 in an extended manner, and it can be determined that process 1 is credible based on the value in PCR1.
  • the steps of the embodiment of the present application may include:
  • Process 1 detects that process 2 needs to be called.
  • process 1 needs to call process 2.
  • Process 1 obtains the metric value of process 2.
  • process 1 obtains the code of process 2, and sends the code of process 2 to the measurement execution device to obtain the measurement value of process 2.
  • process 1 obtains the measurement value of process 2.
  • the process is similar to that obtained by the trusted measurement device in the foregoing embodiment of the measurement value of the measured object.
  • process 1 sends the code of process 2 to the measurement execution device, and the measurement execution device obtains the measurement value of process 2.
  • the measurement value execution device may be a local measurement module or a measurement server.
  • Process 1 extends the metric value of process 2 to PCR1 of the fTPM.
  • step S503 the metric value of process 1 is stored in PCR1.
  • step S503 the metric value concatenated according to the metric value of process 1 and the metric value of process 2 is stored in PCR1.
  • S504 The security verification module verifies the metric value in PCR1.
  • step S504 is an optional step. This step can be used to determine whether process 2 is trustworthy.
  • Process 2 detects that process 3 needs to be called.
  • Process 2 extends the metric value of process 3 to PCR1 of the fTPM.
  • S510 The security verification module verifies the metric value in PCR1.
  • step S510 is an optional step. This step can be used to determine whether process 3 is credible.
  • the trusted measurement device obtains all the measurement values of PCR1 of the fTPM, and expands them to PCR2 of the dTPM.
  • S513 The security verification module verifies the metric value in PCR2.
  • the aforementioned process 1, process 2, and process 3 may also be APPs, applications, etc. that support credibility metrics. That is, the credibility measurement method provided by the embodiments of the present application can be jointly completed by multiple objects in the computing device that support the credibility measurement, so as to ensure the security of the computing device.
  • FIG. 6 is a structural schematic diagram 1 of a trust measurement device provided by an embodiment of this application.
  • the present application provides a trust measurement device 600, which includes an obtaining module 601 and a sending module 602. Among them, the obtaining module 601 is used to perform step S101 in the foregoing embodiment; the sending module 602 is used to perform step S102 in the foregoing embodiment.
  • the credibility measurement device may be an APP, a program, and the like.
  • the trusted measurement device may be a process or APP located in the OS of the computing device, and may be in the REE or TEE.
  • the credibility measurement device provided in the embodiment of the present application can be used to execute the credibility measurement method provided in the foregoing embodiment, and the method provided in the embodiment of the present application can interact with one or more credibility measurement devices in the computing device
  • the steps of the credibility measurement method can be executed by multiple APPs, processes, and other objects in the computing device. This application does not restrict this.
  • FIG. 7 is a second structural diagram of a trust measurement device provided by an embodiment of this application.
  • the trustworthiness measurement apparatus 700 of the embodiment of the present application includes: a processor 701; a memory 702, configured to store one or more programs; when the one or more programs are processed by the one or more The processor executes, so that the one or more processors implement the steps executed by any credibility measurement device in the credibility measurement method in the foregoing embodiment.
  • the trustworthiness measurement device may be a computing device or a component of a computing device.
  • the trusted measurement device 700 may also include an interface 703 for communicating with the first trusted module and the second trusted module. In some scenarios, the interface 703 may also communicate with the verification device and the measurement execution. The device communicates.
  • the server and the bus may also include a bus 704, which is used to implement the internal communication of the credibility measurement device.
  • the credibility measurement device may also be a chip.
  • FIG. 8 is a schematic structural diagram of a computing device provided by an embodiment of the application. As shown in FIG. 8, the present application provides a computing device 800.
  • the computing device includes: a first trusted module 801 implemented based on the firmware of the computing device, a second trusted module 802 implemented based on hardware, and a trusted Measuring device 803;
  • the first trusted module is used to store the metric value of the second measured object in the computing device
  • the trustworthiness measurement device 803 may be the trustworthiness measurement device 700 in the embodiment shown in FIG. 7.
  • the second trusted module is used to store the metric value of the first measured object.
  • the computing device may further include: a verification device 803.
  • the computing device may be connected to a verification device located outside the computing device.
  • the independent verification device is a remote verification server.
  • the verification device and the remote verification server support the execution of the method executed by the verification module in the foregoing embodiment.
  • the verification device is configured to obtain the metric value of the first measured object from the second trusted module, and determine the first trusted module or the metric value of the first measured object according to the metric value of the first measured object. Whether the data in the first trusted module is trusted.
  • the verification device is configured to obtain the metric value of the second measured object from the first trusted module, and determine whether the second measured object can be measured according to the metric value of the second measured object letter.
  • the computing device may further include a metric execution device 804.
  • the credibility measurement device 803 is specifically configured to obtain the integrity parameter of the first measured object, send the integrity parameter of the first measured object to the measurement execution device; and, receive the integrity parameter of the first measured object.
  • the measurement execution device 804 is configured to receive the integrity parameter of the first measured object, and generate the metric value of the first measured object according to the integrity parameter of the first measured object.
  • the metric executing device 804 may also be used to receive the integrity parameter of the second measured object, and generate the metric of the second measured object according to the integrity parameter of the second measured object. value.
  • the computing device may include one or more trust measurement devices.
  • the computing device includes a first credibility measurement device and a second credibility measurement device, wherein the first credibility measurement device is used to obtain the metric value of the second measured object and change the metric value of the second measured object.
  • the value is extended to the register of the first trusted module, and the second trusted measurement device can be used to execute steps S101-S102 in the foregoing embodiment.
  • the second trusted measurement device can be used to execute steps S101-S102 in the foregoing embodiment.
  • the computing device may also be a virtual machine.
  • the first trustworthy module, the second trustworthy module, and the trustworthy measurement device in the computing device in the foregoing embodiment can form a trustworthy measurement system.
  • the system may further include a measurement execution device.
  • the system may include a verification device located in the computing device or a remote verification server independent of the computing device.
  • the present application provides a trustworthiness measurement program, which is used in the trustworthiness measurement method in any one of the foregoing embodiments when the trustworthiness measurement program is executed.
  • the present application provides a computer-readable storage medium in which instructions are stored, and the instructions can be executed by one or more processors on a processing circuit. When it runs on a computer, the computer is caused to execute the method in any possible implementation manner in the foregoing foregoing embodiments.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, DataVData), or a semiconductor medium (for example, a solid state hard disk, Solid State Dataisk), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种可信度量方法及相关装置，所述可信度量方法包括：获取计算设备中的第一被测对象的度量值，第一被测对象的度量值用于确定计算设备中基于固件实现的第一可信模块是否可信；第一可信模块用于存储计算设备中的第二被测对象的度量值（S101）；将第一被测对象的度量值发送至基于硬件实现的第二可信模块（S102）。该方法能够提高计算设备的安全性。

Description

可信度量方法及相关装置
本申请要求于2020年3月31日提交中国国家知识产权局、申请号为202010246265.5、发明名称为“可信度量方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及信息技术领域，特别涉及一种可信度量方法及相关装置。
背景技术
随着信息技术的飞速发展，计算设备的安全性的重要性日益提升。
计算设备的安全性可以通过对计算设备上运行的代码以及计算设备中存储的数据的完整性的度量结果确定。当计算设备上运行的代码是可信的代码，计算设备中存储的数据是可信的数据时，计算设备是可信的。计算设备上运行的代码可以从计算设备中存储的数据中读取并加载至计算设备中运行的。若计算设备中存储的数据或者计算设备中运行的代码被篡改，即计算设备上运行的代码和计算设备中存储的数据的完整性被破坏，则计算设备是不可信的。
目前，计算设备的安全性需要提升。
发明内容
本申请提供了一种可信度量方法及相关装置，用于提高计算设备的安全性。
第一方面，本申请提供一种可信度量方法。所述方法包括：获取计算设备中的第一被测对象的度量值，所述第一被测对象的度量值用于确定所述计算设备中基于固件实现的第一可信模块是否可信；所述第一可信模块用于存储所述计算设备中的第二被测对象的度量值；将所述第一被测对象的度量值发送至基于硬件实现的第二可信模块。
在采用上述方法时，通过将用于确定第一可信模块是否可信的第一被测对象的度量值发送给基于硬件实现的第二可信模块，第二可信模块可存储接收到的第一被测对象的度量值。由于基于硬件实现的第二可信模块中对内部数据的安全保护等级高于基于固件实现的第一可信模块的安全防护等级，其中利用第二可信模块存储的第一被测对象的度量值来确定第一可信模块是否可信将更为安全和准确。从而可以提升计算设备的安全性。
在一种可能的实现方式中，所述第一被测对象包括以下至少一种：所述第一可信模块或所述第一可信模块中的数据。
在一示例中，所述第一可信模块中的数据可以包括以下至少一种：所述第一可信模块自身的数据，所述第二被测对象的度量值等。
在一示例中，第一被测对象可以仅包括第一可信模块中存储的第二被测对象的度量值。
在一种可能的实现方式中，所述第二被测对象的度量值为采用扩展操作的方式存储于所述第一可信模块的第一寄存器中的；所述第一被测对象的度量值为采用扩展操作的方式存储于所述第二可信模块的第二寄存器中的。
在一种可能的实现方式中，所述第二可信模块还用于存储第三被测对象的度量值；所述第三被测对象为在所述第一可信模块启动前所述计算设备中的被测对象；所述第二被测对象 为在所述第一可信模块启动后所述计算设备中的被测对象。
在一种可能的实现方式中，所述第一可信模块为基于所述计算设备上的可信操作系统运行的；所述第三被测对象，包括以下至少一项：BIOS代码，所述计算设备的引导加载程序和所述可信操作系统的启动代码。
在一种可能的实现方式中，所述第三被测对象的度量值为采用扩展操作的方式存储于所述第二可信模块的第三寄存器中的。
在一种可能的实现方式中，所述第一可信模块为基于固件的可信平台模块fTPM，所述第二被测对象的度量值存储于所述第一可信模块的平台配置寄存器PCR；和/或，所述第二可信模块为离散可信平台模块dTPM或集成可信平台模块，所述第一被测对象的度量值存储于所述第二可信模块的PCR。
在一种可能的实现方式中，所述第一被测对象包括所述第二被测对象的度量值；在所述获取计算设备中的第一被测对象的度量值之前，所述方法还包括：获取所述第二被测对象的度量值；其中，所述第二被测对象包括以下至少一种：所述计算设备中的APP、进程、程序、日志、数据库、文件、数据；将所述第二被测对象的度量值发送至所述第一可信模块。
在一种可能的实现方式中，在所述获取计算设备中的第一被测对象的度量值之前，包括：检测到所述第一被测对象发生变更。
在一种可能的实现方式中，在所述获取计算设备中的第一被测对象的度量值之前，包括：接收定期触发的状态监测指示。
在一种可能的实现方式中，所述获取计算设备中的第一被测对象的度量值，包括：获取至少两个第一被测对象对应的一个度量值。
第二方面，本申请提供一种可信度量装置。所述装置包括：获取模块，用于获取计算设备中的第一被测对象的度量值，所述第一被测对象的度量值用于确定所述计算设备中基于固件实现的第一可信模块是否可信；所述第一可信模块用于存储所述计算设备中的第二被测对象的度量值；发送模块，用于将所述第一被测对象的度量值发送至基于硬件实现的第二可信模块。
在一种可能的实现方式中，所述第一被测对象包括以下至少一种：所述第一可信模块或所述第一可信模块中的数据。
在一种可能的实现方式中，所述第二被测对象的度量值为采用扩展操作的方式存储于所述第一可信模块的第一寄存器中的；其中，扩展操作后所述第一寄存器中的数据为根据扩展操作前所述第一寄存器中的数据和所述第二被测对象的度量值生成的；所述第一被测对象的度量值为采用扩展操作的方式存储于所述第二可信模块的第二寄存器中的；其中，扩展操作后所述第二寄存器中的数据为根据扩展操作前所述第二寄存器中的数据和所第一被测对象的度量值生成的。
在一种可能的实现方式中，所述第一可信模块为基于固件的可信平台模块fTPM，所述第二被测对象的度量值存储于所述第一可信模块的平台配置寄存器PCR；和/或，所述第二可信模块为离散可信平台模块dTPM，或，集成可信平台模块iTPM，所述第一被测对象的度量值存储于所述第二可信模块的PCR。
在一种可能的实现方式中，所述获取模块，还用于在所述获取计算设备中的第一被测对象的度量值之前，获取所述第二被测对象的度量值；其中，所述第一被测对象包括所述第二被测对象的度量值；所述第二被测对象包括以下至少一种：所述计算设备中的APP、进程、程 序、日志、数据库、文件、数据；所述发送模块，还用于将所述第二被测对象的度量值发送至所述第一可信模块。
在一种可能的实现方式中，所述获取模块，还用于在检测到所述第一被测对象发生变更后，执行所述获取计算设备中的第一被测对象的度量值的步骤。
在一种可能的实现方式中，所述获取模块，还用于在接收定期触发的状态监测指示后，执行所述获取计算设备中的第一被测对象的度量值的步骤。
在一种可能的实现方式中，所述获取模块，具体用于获取至少两个第一被测对象对应的一个度量值。
第三方面，本申请提供一种计算设备，所述计算设备包括：基于所述计算设备的固件实现的第一可信模块，基于硬件实现的第二可信模块和第二方面任一所述的可信度量装置；其中，所述第一可信模块用于存储计算设备中的第二被测对象的度量值；所述第二可信模块用于存储所述第一被测对象的度量值。
在一种可能的实现方式中，所述计算设备还包括：验证装置，用于从所述第二可信模块中获取所述第一被测对象的度量值，根据所述第一被测对象的度量值确定所述第一被测对象是否可信。
在一种可能的实现方式中，所述计算设备还包括：度量执行装置，用于获取所述第一被测对象的完整性参数，向所述度量执行装置发送所述第一被测对象的完整性参数；以及，接收所述度量执行装置发送的所述第一被测对象的度量值；所述度量执行装置，用于接收所述第一被测对象的完整性参数，根据所述第一被测对象的完整性参数生成所述第一被测对象的度量值。
第四方面，本申请提供一种可信度量程序，所述可信度量程序被执行时用于实现第一方面任一所述的可信度量方法。
第五方面，本申请提供一种可信度量系统，所述系统包括：基于计算设备的固件实现的第一可信模块、基于硬件实现的第二可信模块和第二方面任一所述的可信度量装置；所述第一可信模块，用于存储计算设备中的第二被测对象的度量值；所述第二可信模块，用于存储所述第一被测对象的度量值。
在一种可能的实现方式中，所述可信度量系统还包括：验证装置，用于从所述第二可信模块中获取所述第一被测对象的度量值，根据所述第一被测对象的度量值确定所述第一被测对象是否可信。
在一种可能的实现方式中，所述可信度量系统还包括：度量执行装置，用于获取所述第一被测对象的完整性参数，向所述度量执行装置发送所述第一被测对象的完整性参数；以及，接收所述度量执行装置发送的所述第一被测对象的度量值；所述度量执行装置，用于接收所述第一被测对象的完整性参数，根据所述第一被测对象的完整性参数生成所述第一被测对象的度量值。
第六方面，本申请提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，所述指令可以由处理电路上的一个或多个处理器执行。当其在计算机上运行时，使得计算机执行上述第一方面中任意可能的实现方式中的方法。
附图说明
图1为本申请实施例提供的一种可信度量方法的流程示意图一；
图2为本申请实施例提供的应用可信度量方法的计算设备的系统架构示意图；
图3为本申请提供的可信度量方法的处理流程示意图一；
图4为本申请提供的可信度量方法的处理流程示意图二；
图5为本申请实施例提供的可信度量方法的处理流程示意图三；
图6为本申请实施例提供的可信度量装置的结构示意图一；
图7为本申请实施例提供的可信度量装置的结构示意图二；
图8为本申请实施例提供的一种计算设备的结构示意图。
具体实施方式
本申请的实施方式部分使用的术语仅用于对本申请的具体实施例进行解释，而非旨在限定本申请。
本申请提供用于确定计算设备的安全性的可信度量方法。采用本申请提供的方法获得计算设备上的各种对象的度量结果，之后可以根据度量结果与预期度量结果进行比较来确定计算设备上的各种对象是否被篡改，进而能够帮助计算设备使用者在发现计算设备的系统环境被篡改时作出正确的判断和处理。
图1为本申请实施例提供的一种可信度量方法的流程示意图一。本申请实施例的执行主体可以是可信度量装置。在一示例中，可信度量装置可以是可运行于计算设备中的应用(Application，APP)程序。如图1所示，本申请实施例的步骤可以包括：
S101，获取计算设备中的第一被测对象的度量值，所述第一被测对象的度量值用于确定所述计算设备中基于固件实现的第一可信模块是否可信；所述第一可信模块用于存储所述计算设备中的第二被测对象的度量值。
S102，将所述第一被测对象的度量值发送至基于硬件实现的第二可信模块。
在本申请实施例中，计算设备上部署有第一可信模块和第二可信模块，第一可信模块和第二可信模块均用于存储计算设备中的被测对象的度量值。其中，计算设备中的各种被度量的对象称为被测对象。示例性地，被测对象是APP、进程、程序、文件、日志、数据库或数据等。被测对象的度量值可以是根据被测对象的完整性参数确定的，被测对象的完整性参数可以是被测对象的哈希值或签名等。
第一可信模块和第二可信模块有多种写入数据的方法。在一示例中，第一可信模块和第二可信模块支持允许直接写入数据或者以扩展操作的方式写入数据。在实际应用中，以扩展操作的方式写入的数据在被篡改时可被检测到，从而实现快速地确定被测对象是否可信。在另一示例中，第一可信模块和第二可信模块支持通过加密存储、加密读写、仅允许具有密钥的对象写入数据和读取数据等方式来保证数据的安全性。
第一可信模块和第二可信模块可用于存储各类被测对象的度量值。在一示例中，第二可信模块接收可信度量装置发送待存储的度量值。之后，可以允许验证装置读取第一可信模块、第二可信模块中的各个被测对象的度量值，将读取到的度量值与预期度量值比较，来确定被测对象是否可信，从而能够通过计算设备上的被测对象是否可信确定计算设备是否可信。
在本申请实施例中，第一可信模块用于存储第二被测对象的度量值，第二可信模块用于存储第一被测对象的度量值。表1为被测对象的度量值与存储位置对应关系的一种示意。
表1
被测对象 被测对象对应的度量值 存储位置
第二被测对象 第二被测对象的度量值 第一可信模块
第一被测对象 第一被测对象的度量值 第二可信模块
举例来说，第二被测对象可以是计算设备上的各种被测对象。在实际应用中，第二被测对象可以是在第一可信模块启动后计算设备上的被测对象。示例性地，第二被测对象可以是APP代码、APP的启动日志、APP的操作日志、数据库、数据库操作日志等。第一被测对象可以是用于确定第一可信模块是否可信的被测对象。示例性地，第一被测对象可以包括以下至少一种：第一可信模块或第一可信模块中的数据。
在本申请实施例中，基于固件实现的第一可信模块的存储容量能够基于计算设备的硬件能力配置，从而使得第一可信模块支持存储数量较多的被测对象的度量值。
在本申请实施例中，第一可信模块是基于固件实现的，第一可信模块中的代码和数据实际可存储在内存中。需要说明的是，即使存储于可信执行环境的安全内存中，第一可信模块中存储的数据有可能被篡改，即第一可信模块中存储的度量值有可能被篡改。为了提高第一可信模块以及第一可信模块中的数据的安全性，本申请实施例中将第一被测对象的度量值发送给基于硬件实现的第二可信模块，第二可信模块存储接收到的第一被测对象的度量值。
在基于硬件实现的第二可信模块中，用于保护内部数据和代码等信息的处理模块可以是基于硬件实现的，因而能够保证内部数据的安全。第二可信模块中存储的数据在被篡改时能够被验证装置发现。与第二可信模块相比，在基于固件实现的第一可信模块中，用于保护内部数据和代码等信息的处理模块可以是基于固件实现的，因而可能被修改。当基于固件的处理模块被修改时，可能导致第一可信模块或者第一可信模块中的数据在被篡改时不能被发现。由此可见，基于硬件实现的第二可信模块的安全性高于基于固件实现的第一可信模块。基于此，利用第二可信模块存储的第一被测对象的度量值来确定第一可信模块以及第一可信模块中的数据是否可信更为安全和准确。
在本申请实施例中，举例来说，第一被测对象可以包括作为一个完整整体的第一可信模块以及各种存储于第一可信模块中的数据。示例性地，第一可信模块可以为作为一个完整整体实现的第一可信模块对应的APP、程序、进程。第一可信模块中的数据可以为第一可信模块启动或运行时需要启动或者加载的进程、程序、代码、数据，以及，存储于第一可信模块的寄存器中的数据等。为了提高第一可信模块和第一可信模块中的数据的安全性，可以分别将第一可信模块的度量值，以及，第一可信模块中的数据的度量值，扩展至第二可信模块的寄存器。之后，验证装置就能够分别根据存储于第二可信模块的寄存器中的数据进行验证，并综合验证结果对第一可信模块是否可信作出判断。
在本申请实施例中，各种被测对象的度量值可以采用扩展操作的方式存储于第一可信模块或者第二可信模块的寄存器中。扩展操作后寄存器中的数据为根据扩展操作前寄存器中的数据和待存储的被测对象的度量值生成的。在一示例中，第二被测对象的度量值为采用扩展操作的方式存储于第一可信模块的第一寄存器中的；其中，扩展操作后第一寄存器中的数据为根据扩展操作前的第一寄存器中的数据和第二被测对象的度量值生成的。在另一示例中，可将第一被测对象的度量值扩展至第二可信模块的第二寄存器中；其中，扩展操作后第二寄存器中的数据为根据扩展操作前第二寄存器中的数据和第一被测对象的度量值生成的。由于扩展操作的结果是不可逆的，当采用扩展操作的方式存储于第一可信模块或第二可信模块中的数据被篡改时，能够被验证装置快速发现。从而能够进一步提升计算设备的安全性。
在本申请实施例中，第一被测对象可以包括以下至少一种：第一可信模块或第一可信模块中的数据。其中，第一可信模块的度量值，可用于确定计算设备上当前运行的第一可信模块本身的代码是否可信。在一种实施方式中，第一可信模块中的数据包括第二被测对象的度量值等。第二被测对象的度量值是确定第二被测对象是否可信的依据，第一可信模块中的数据的度量值可用于确定第二被测对象的度量值是否可信，即依据是否可信。
在本申请实施例中，第二可信模块还可以用于存储第三被测对象的度量值。
在一种实施方式中，第三被测对象为在第一可信模块启动前计算设备中的被测对象；第二被测对象为在第一可信模块启动后计算设备中的被测对象。从计算设备整体的角度来看，第三被测对象的度量值能够用于确定在启用第一可信模块之前计算设备中的运行环境是否可信。运行环境可包括操作系统中处于已进入运行状态的代码、全局变量、计算设备的存储器中存储的数据等。示例性地，对启动过程的被测对象的度量采用静态度量的方式，即在代码被加载执行前对代码进行度量，对运行过程的被测对象的度量采用动态度量的方式，即在运行过程中的代码的运行状态发生变化时，或者，周期性地对运行过程中的代码进行度量。
在一示例中，第三被测对象包括用于启动第一可信模块的被测对象。举例来说，在实际应用中，若第一可信模块为基于计算设备上的操作系统运行的；则计算设备中用于启动第一可信模块的被测对象，包括以下至少一项：BIOS代码、计算设备的引导加载程序或操作系统的启动代码。举例来说，操作系统的启动代码为用于启动操作系统的基本功能的代码，如Linux操作系统的内核(kernel)代码。需要说明的是，其他类型的操作系统启动前加载执行的代码及加载执行的顺序还可以有其他实现方式，本申请实施例对此不作限制。在本申请实施例中，第三被测对象的度量值也可以为采用扩展操作的方式存储于第二可信模块的寄存器中的。
在本申请实施例中，步骤S101获取计算设备中的第一被测对象的度量值有多种实施方式。
在一种实施方式中，上述步骤可以包括：可信度量装置接收由度量执行装置根据第一被测对象的完整性参数确定的第一被测对象的度量值。其中，示例性地，度量执行装置为本地度量模块，或者，度量服务器。在一示例中，本地度量模块为计算设备中的APP或者进程。
在另一种实施方式中，上述步骤可以包括：可信度量装置获取第一被测对象的完整性参数，根据第一被测对象的完整性参数确定第一被测对象的度量值。在一示例中，在第一被测对象包括第一可信模块时，度量执行装置获取第一可信模块的完整性参数。例如，获取第一可信模块的数字签名作为第一可信模块的度量值。在另一示例中，在第一被测对象包括第一可信模块中的数据时，度量执行装置获取第一可信模块中的数据的哈希值，将该哈希值作为该数据对应的度量值。本申请对此不作限制。
在本申请实施例中，第一被测对象的数量为一个或多个。当为多个时，步骤S101-S102还可以采用另一组实施方式。在一种可选的实施方式中，上述步骤包括：分别获取各个第一被测对象的度量值，并分别将各个第一被测对象的度量值发送至第二可信模块，之后，第二可信模块分别存储各个第一被测对象的度量值。在另一种可选的实施方式中，上述步骤包括：对于多个第一被测对象中的任意至少两个第一被测对象，获取至少两个第一被测对象对应的一个度量值；将该一个度量值发送至第二可信模块；之后，第二可信模块使用一个寄存器存储该度量值。采用这种方式，利用第二可信模块的一个存储空间，来存储用于确定多个第一被测对象是否可信的度量值，能够节约第二可信模块的存储空间。
举例来说，第一被测对象的数量为N个，N为大于或者等于2的整数。在一示例中，可信度量装置获取N个第一被测对象对应的1个度量值。示例性地，获取N个第一被测对象对应的N个 完整性参数，再获取N个完整性参数的完整性参数，然后，根据N个完整性参数的完整性参数来确定N个第一被测对象对应的1个度量值。在另一示例中，上述N个第一被测对象包括：APP1的代码、APP1的操作日志、APP2的代码、APP2的操作日志、允许被APP1和APP2读写的文件1等。可信度量装置分别获取与APP1有关的第一被测对象对应的1个度量值，以及，与APP2有关的第一被测对象对应的1个度量值。即获取APP1的代码、APP1的操作日志、文件1对应的1个度量值A，以及，获取APP2的代码、APP2的操作日志、文件1对应的1个度量值B，之后，分别将度量值A和B发送至第二可信模块。采用这种方式，能够在节约第二可信模块的存储空间的基础上，实现快速确定计算设备中的关键APP是否可信。
在本申请实施例中，上述步骤S101-S102支持在多种触发条件时执行。
在一示例中，可信度量装置在检测到第一被测对象发生变更时执行步骤S101-S102。举例来说，第一被测对象包括第一可信模块的APP、进程、程序、日志、数据库、文件或者第一可信模块中的数据等中的至少一种被测对象。示例性地，第一可信模块中的数据可以包括存储于第一可信模块中的寄存器中第二被测对象的度量值等。在检测到第一可信模块中的数据发生变更时，或者，在检测到第一可信模块的APP的启动请求，或者，在检测到第一可信模块的任一进程的创建请求，或者，在检测到第一可信模块的任一程序的加载请求或者动态检查请求，或者，在检测到第一可信模块的日志发生变更；或者，在检测到第一可信模块的数据库发生变更时，执行步骤S101-S102。采用这种方式能够实现第一可信模块的启动阶段的度量以及第二被测对象的度量值发生变更时的度量。
在另一示例中，可信度量装置在接收到定期触发的状态监测指示时，执行步骤S101-S102。举例来说，可信度量装置接收按照预先设置的检测周期，定期生成的状态监测指示，并在接收到状态监测指示后，执行步骤S101-S102。采用这种方式能够实现对计算设备的动态度量，即定期对运行过程中的被测对象进行度量。
在本申请实施例中，第一可信模块中的第二被测对象的度量值的获取方式有多种。例如，第二被测对象的度量值为在检测到第二被测对象发生变更时获取到的，或者，在接收定期触发的状态监测指示时获取到的。举例来说，第二被测对象是计算设备上的任意被测对象。在一示例中，第二被测对象是除第一可信模块和第一可信模块中的数据之外的其他被测对象。
在一种可选的实施方式中，在步骤S101之前，第二被测对象的度量值是由可信度量装置发送至第一可信模块中的。示例性地，可信度量装置在检测到第二被测对象发生变更时，获取第二被测对象的度量值，并发送至第一可信模块。
在另一种可选的实施方式中，计算设备支持配置至少两个可信度量装置；例如，第一和第二可信度量装置。其中，第二被测对象的度量值是由第一可信度量装置获取并发送至第一可信模块的；第一被测对象的度量值是由第二可信度量装置获取并发送至第二可信模块的。其中，第一被测对象中可包括第一可信模块中的数据，例如第二被测对象的度量值。
在上述任一实施方式的基础上，在本申请实施例中，第一可信模块可以为基于固件实现的可信平台模块(Trust Platform Module，TPM)或者基于固件实现的可信密码模块(Trust Cryptography Module，TCM)。在一示例中，第一可信模块为基于固件的可信平台模块(firmware TPM，fTPM)。相应的，第二被测对象的度量值可以存储于第一可信模块的平台配置寄存器PCR。举例来说，基于硬件实现的TPM或者TCM可被设置于计算设备与外部IO设备通信的总线中，以获悉实际被加载至内存中待由CPU中执行的代码和要使用的数据，从而可以确保被测对象的真实性。
在本申请实施例中，第二可信模块可以为基于硬件实现的TPM或者基于硬件实现的TCM。在一示例中，第二可信模块为离散可信平台模块(Discrete TPM，dTPM)或集成可信平台模块(Integrated TPM)。相应地，第一被测对象的度量值可以存储于第二可信模块的PCR。举例来说，基于固件实现的TPM或者基于固件实现的TCM运行于支持Trustzone的计算设备。
在本申请实施例，利用fTPM和dTPM结合的方式，能够在提升PCR数量的基础上提升安全性。一方面，由于fTPM中支持扩展定义配置寄存器，因此，能够提供较大数量的PCR。例如，fTPM支持配置超过24个PCR。另一方面，在dTPM中保存fTPM程序的度量值，用以定时对fTPM模块进行验证，能够确保运行的fTPM固件程序合法。
举例来说，对fTPM中所有PCR的值通过哈希Hash算法计算出摘要值，然后扩展到dTPM的特定PCR；在检测到fTPM的PCR的值发生变化时，重新计算所有PCR的值对应的摘要值并同步扩展至dTPM的特定PCR。之后，dTPM或者验证装置定时验证特定PCR中存储的fTPM的PCRs的摘要值，并在验证结果为与预期不一致时上报告警。采用这种方式能够确保fTPM中的数据和安全性。
下面以第一可信模块为fTPM，第二可信模块为dTPM为例，对本申请提供的可信度量方法进行示例性说明。其中，计算设备中支持部署普通操作系统和可信操作系统。示例性地，普通操作系统可以为Linux或Windows操作系统。fTPM为基于可信操作系统运行的可信应用(Trusted Application，TA)。
图2为本申请实施例提供的应用可信度量方法的计算设备的系统架构示意图。如图2所示，计算设备包括硬件(Hardware)和软件(Software)两部分。
计算设备的硬件部分可以包括：片上芯片(System on Chip，SOC)，SOC中包括：dTPM，ARM CPU Core，业务处理引擎，以及，安全区(Trustzone)、加解密引擎、硬件随机数、电子熔丝(eFuse)、硬件唯一密钥(HardwareUniqueKey，HUK)等。其中，Trustzone、加解密引擎、硬件随机数、eFuse、HUK可用于实现代码和数据的安全隔离。需要说明的是，Trustzone技术是通过硬件隔离实现的。示例性地，安全世界和非安全世界的操作系统分别运行于相互隔离的硬件。
计算设备的软件部分可以包括：非安全世界(Non-Secure world)和安全世界(Secure-world)，安全世界和非安全世界通过安全监控器(Secure Monitor)实现通信。安全世界中的操作系统称为可信执行环境(Trust Execute Environment，TEE)的操作系统(TEE OS)，下面简称为可信操作系统。非安全世界的操作系统称为普通操作系统。在非安全世界中，普通的用户应用(User App)基于普通操作系统运行，在安全世界中，可信执行环境的应用(TEE App)基于TEE OS运行。
示例性地，安全世界中的TEE App包括：TA(fTPM)、TA(KMC)、TA(DIM)、全球平台可信执行环境内部接口(GlobalPlatform TEE internal API)。其中，TA(fTPM)为前述实施例中的第一可信模块的一种实现方式。TA(fTPM)可以包括：平台配置寄存器(Platform Configuration Registers，PCR)、TPM命令(TPM COMMAND)、X509/RS、安全散列算法(Secure Hash Algorithm，SHA)、高级加密标准(Advanced Encryption Standard，AES)、子系统Sub System等。TA(DIM)是动态完整性度量(Dynamic Integrity Measurem ent，DIM)的TA。
非安全世界中的User App包括：本地应用(Native App)、密钥管理系统(Key Manager Center，KMC)、度量启动模块、全球平台可信执行环境客户端接口(Global Platform TEE Client API)等。其中，GlobalPlatform TEE internal API和Global Platform TEE Client API用于实现User APP与各个TA之间建立通信连接，度量启动模块可以用于获取被测对象的度 量值，需要说明的是，度量启动模块可以为基于普通操作系统运行的用户应用，也可以为普通操作系统中的系统应用、系统进程，还可以是安全世界中的TA。
安全世界的TEE OS中支持运行：TEE Core、TEE功能(Func)/数据库(Libs)、加密函数(Crypt)、硬件抽象层(Hardware Abstraction Layer，HAL)等。
普通操作系统中支持运行：TPM驱动(TPM Drv)、TEE驱动(TEE Drv)。其中，TEE驱动(TEE Drv)用于实现普通操作系统与TEE OS之间的通信连接，TPM Drv用于实现度量启动APP与安全世界的TA(fTPM)之间的通信连接。
在本申请实施例中，第一被测对象的度量值可以存储于dTPM的PCR中，第二被测对象的度量值可以存储于fTPM的PCR中。
需要说明的是，为了防止PCR中存储的度量值被恶意代码篡改或伪造，上述各种TPM预先定义需限制对PCR执行的操作。其中包括：一方面，不允许采用对普通字符设备的寄存器进行读写时所采用的通过端口映射的方式随意对PCR进行读写；另一方面，将PCR被设置于各种TPM的内部，以保护内部存储的数据；又一方面，只允许两种操作来修改PCR的值：其中，重置操作(Reset)和扩展操作(Extend)，重置操作可发生在机器断电或者重新启动之后，PCR的值自动重新清零。
在系统运行过程中，只能通过扩展操作来改变PCR的内容。示例性地，扩展操作的定义如下：
PCR[n]＝HASH{PCR[n-1]||newMeasurement}。
其中，PCR[n-1]代表第n-1时刻PCR中存储的数据，PCR[n]代表第n时刻PCR中存储的数据，newMeasurement代表第n时刻获得的被测对象的度量值。扩展操作可以是不可逆的，举例来说，先将度量值A扩展至PCR，再将度量值B扩展至PCR，得到的PCR值，与先将度量值B扩展至PCR，再将度量值B扩展至PCR得到的PCR值是不同的。通过扩展操作，PCR能够记录一个无限长的度量值序列，这一系列度量值组成的序列能够反映系统状态的变迁，如果这个扩展序列中的某一个度量值改变，之后的度量序列都会受到影响，即PCR中的数值与验证装置记录的期望数值不符。
在本申请实施例中，在上述步骤S102中将第一被测对象的度量值发送至第二可信模块后，该度量值以扩展的方式写入PCR中，即将第一被测对象的度量值扩展至第二可信模块的PCR中。类似的，第二被测对象的度量值也可以是以扩展的方式写入第一可信模块的PCR中的。
需要说明的是，对计算设备的完整性度量可以利用信任传递机制。信任传递机制中定义，在确认当前环节可信的前提下，由当前环节度量下一环节的安全性，在确定下一环节可信后，将控制权转交给下一环节，然后，依次向后推进。基于这种信任传递机制，当根据计算设备上的某一时刻的运行环境为可信时，若下一时刻需要运行的被测对象为可信的，则认为在运行下一时刻要运行的被测对象之后的运行环境是可信的。
采用以扩展操作的方式存储度量值能够实现信任链的传递。举例来说，计算设备中的一些被测对象的加载顺序或者调用顺序是固定的，例如，计算设备的启动阶段加载或者执行的多个程序。这些加载顺序或者调用顺序为固定的被测对象可组成一个被测对象序列，称为定序被测对象序列。对于任一定序被测对象序列，将该序列中的被测对象对应的度量值以扩展方式写入一个PCR中。对于该PCR来说，当PCR中的数据被验证为可信时，该PCR对应的在先被调用的多个被测对象均是可信的，多个被测对象可组成一条信任链。每个可信的被测对象还可以作为一个新的信任链的起点。当一个新的被测对象是基于一个可信的被测对象执行时， 只要确认该新的被测对象的代码和数据是可信的，则加载该新的被测对象的代码和数据执行后的系统运行环境也是可信的。对于部署有两个操作系统的计算设备来说，计算设备在加载并执行代码时，允许通过切换时间片的方式，逐个加载和执行各个操作系统上的代码，以实现被测对象的依次加载或执行，从而实现信任链的传递。
示例性地，对于图2所示计算设备来说，计算设备的启动阶段加载和执行的代码包括：BIOS代码、操作系统引导程序、操作系统启动代码。在一示例中，计算设备在启动阶段的度量过程包括：获取BIOS代码的度量值1，将度量值1扩展至第二可信模块的PCR1，获取操作系统引导程序代码的度量值2，将度量值2扩展至PCR1，获取操作系统启动代码的度量值3，将度量值3扩展至PCR1。用于校验被测对象是否可信的验证装置在每次扩展操作后读取PCR1中的数据，将其与期望值进行比较，以确定各个代码是否可信。
需要说明的是，由于第一可信模块通常是在操作系统的启动代码执行后启动的，第一可信模块无法存储在其自身启动前被加载和执行的代码的度量值，因此，将启动阶段的被测对象的度量值以扩展方式存储于第二可信模块，能够实现以对第一可信模块启动前的运行环境是否可信进行度量。
在实际应用中，对当前被测对象的度量必须由在当前被测对象之前加载或调用的其他对象执行，即度量过程需要早于调度执行过程，以保障度量过程中的度量对象的真实性。对度量结果的验证过程可以晚于调度执行过程，也可以与调度执行过程同时进行。在一示例中，遵循先度量再执行的原则，在验证待加载执行的被测对象不可信时，停止加载不可信的被测对象，从而帮助用户快速确认计算设备的安全性，在另一示例中，当验证过程晚于调度执行过程时，将验证为不可信的被测对象记录在日志中，以供用户查看。
在本申请实施例中，利用fTPM定义大量PCR，能够支持对计算设备中多个维度的被测对象进行度量。示例性地，支持按照被测对象的类型和调用顺序规划的多个度量链路的度量。下面采用具体的例子对本申请实施例提供的可信度量方法进行示例性说明。
在本申请实施例的应用场景中，对于复杂系统，例如，一个操作系统中可能存在多个进程，这些进程可能分别基于不同的应用场景运行，各个进程的功能相对独立，进程存在独立启动、动态加载的需求，例如，以非预期的执行顺序加载执行或者中断执行。该场景无法直接使用TPM的信任链传递的方式来度量整个系统。此时，考虑按照进程所基于的应用场景规划度量链路。需要说明的是，对于归属于一条度量链路的被测对象可以采用一个PCR记录其对应的度量值。
图3为本申请提供的可信度量方法的处理流程示意图一。如图3所示，在本申请实施例中，对于复杂系统可以考虑分为两个度量链路：基础系统进程和系统扩展功能进程。其中，基础系统进程用于负责完成操作系统的框架的启动。
将启动阶段加载执行的基础系统进程的度量值存储至dTPM的PCR中。需要说明的是，基础系统进程可以通过dTPM的信任链传递方式进行启动，即启动阶段的信任链中可包括启动阶段需要加载执行的一个多个基础系统进程。示例性地，将用于获取基础系统进程的度量值并将其扩展至dTPM中的这部分代码也可以添加到启动阶段的信任链中。其中，在操作系统的框架启动阶段，被加载执行的这部分代码可以仅实现前述实施例中的可信度量装置的部分功能，以确保系统的框架运行安全。
系统扩展功能进程的度量值存储到fTPM的PCR中。示例性地，系统扩展功能进程为满足以下至少一个条件的进程：对应一个独立的功能，支持独立的启动、退出，或者，即使发生异 常也不会扩展影响操作系统框架或其他的系统扩展功能进程。在实际应用中，对每个系统扩展功能进程分别采用一个PCR记录其对应的度量值。在一些场景中，系统扩展功能进程可以随基础系统进程一起启动，也可以在需要时启动，本申请对此不作限制。
基于上述两条度量链路的划分，对于计算设备的整体安全性度量方案可以包括如下步骤：
第一方面，在操作系统的框架启动阶段，获取基础系统进程的度量值，并将度量值扩展至dTPM。第二方面，获取系统扩展功能进程的度量值并扩展至fTPM。第三方面，在第二方面的基础上，当检测到fTPM中存储的系统扩展功能进程的度量值发生变化时，获取fTPM中所有PCR存储数据的度量值，并将fTPM中所有PCR存储数据的度量值扩展至dTPM中。示例性地，第二方面和第三方面的步骤可以由第一可信度量装置执行，第三方面的步骤可以由第一可信度量装置执行。通过第一方面的步骤能够实现对基础系统进程进行度量，通过第二方面和第三方面能够实现对扩展系统进程进程的度量。从而可以从基础系统进程和扩展系统进程两个方面综合确认计算设备是否可信。
举例来说，计算设备的启动阶段和运行阶段的度量流程可以包括：在计算设备上电时，首先加载运行初始度量根CRTM。需要说明的是，在实际应用中，CRTM可决定计算设备启动时先执行的代码，CRTM本身可以是一段代码，CRTM应当是可信的，其可以存储于BIOS中，CRTM可以不具有写dTPM权限。然后，CRTM获取BIOS的度量值，在确认BIOS可信时，加载BIOS；之后，由于CRTM不具有写权限，由BIOS将BIOS的度量值扩展至dTPM的PCR1；然后，BIOS获取OS基础进程的度量值，将OS基础进程的度量值扩展至dTPM的PCR1中；在确认OS基础进程可信时，加载OS基础进程。示例性地，通过安全启动流程确认BIOS、OS基础进程是否可信。在实际应用中，也可以仅执行度量步骤，而不进行是否可信的判断，度量数据将用于在启动后对启动阶段的安全性的判断。在计算设备的运行阶段，OS基础进程获取APP1的度量值，将APP1的度量值扩展至fTPM的PCR2中，然后加载APP1；同时，OS基础进程获取APP2的度量值，将APP2的度量值扩展至fTPM的PCR3中，然后加载APP2。其中，APP1和APP2是不同应用场景使用的APP，APP1与APP2的运行互不影响，例如，二者运行时所依赖的运行环境互不关联。
表2为被测对象的度量值与存储位置的对应关系的一种示意。
表2
Figure PCTCN2021080810-appb-000001
其中，APP1和APP2对应不同的应用场景，二者的运行互不影响。因此分别使用一个单独的PCR记录二者的度量值。
在本申请实施例中，采用将系统扩展功能进程这类被测对象的度量值存储至第一可信模块中的独立PCR的方式，能使得计算设备不需要限制系统扩展功能进程与基础系统进程以固定的顺序启动。即系统扩展功能进程可以独立的启动和退出，不影响基础系统进程的度量和安全性。
在本申请实施例中，根据被测对象的加载阶段、是否是第一可信模块和是否是第一可信模块中的数据、应用场景、被测对象的类型，确定被测对象的度量值的存储位置。其中，存储位置包括：存储于第一可信模块或者第二可信模块，存储于全新PCR还是已有PCR等。当需 要将任一被测对象的度量值存储于第一可信模块的全新PCR中时，利用第一可信模块的配置机制增加PCR的个数。需要说明的是，约定第一可信模块仅用来存储与第一可信模块无关的被测对象的度量值。上述步骤可以由本申请实施例的任一可信度量装置执行。
在一示例中，按照被测对象的加载阶段，将加载阶段为操作系统启动阶段的被测对象的度量值发送至第二可信模块，将加载阶段为操作系统运行阶段的被测对象的度量值发送至第二可信模块。
在另一示例中，按照被测对象的应用场景，将各个第二被测对象的度量值扩展至第一可信模块中与第二被测对象的应用场景相对应的PCR中。在一示例中，第一可信模块中的多个PCR与多个应用场景一一对应。在另一示例中，第一可信模块中的某一个PCR可用于存储一个应用场景相关的被测对象的度量值。
在又一示例中，当检测到被测对象与第一可信模块无关且被测对象的类型为APP、进程、程序、日志、数据库、文件、数据时，就确定该被测对象为第二被测对象，并将该被测对象的度量值存储于第一可信模块中。
在本申请实施例的另一应用场景中，对于操作系统在运行阶段受到破坏的情况，采用动态度量的方式来对计算设备上的被测对象进行度量。
需要说明的是，计算设备中加载的对象在初始加载或者启动时未受到攻击，这个时期获得的度量值可以确定计算设备上当前加载运行的对象是可信的。但是，计算设备上的各种对象的运行状态并不是一成不变的。计算设备上的对象在运行过程中有可能受到破坏，即对象启动时获取的度量值不能反映处于运行过程中对象是否可信。如果仍然按照启动时的标准来衡量，可能会给出错误的结果。
图4为本申请提供的可信度量方法的处理流程示意图二。如图4所示，系统度量分为系统启动度量流程和系统运行度量流程，其中，系统启动度量流程的被测对象为基础度量对象，系统允许度量流程的被测对象为扩展度量对象。在实际应用中，运行状态不变的被测对象也可以划分到启动度量流程。
具体的度量方案可以如下：一方面，将系统启动流程涉及的基础度量对象的度量值存储至dTPM。示例性地，系统启动流程包含fTPM的启动流程。另一方面，将系统运行流程涉及的扩展度量对象的度量值存储至fTPM。需要说明的是，运行状态可改变的扩展度量对象的度量值采用独立的PCR存储。此外，在系统运行过程中，若检测到扩展度量对象发生变化，例如，功能模块发生变化，则对发生变化的扩展度量对象重新获取度量值，并更新至fTPM的PCR。之后，对fTPM的所有PCR的值获取对应的度量值，并更新至dTPM。例如，计算fTPM中所有PCRs值的摘要并将其扩展到dTPM的PCR中。然后，通过定时验证dTPM的PCR中的数据的正确性，来确定所有运行态模块是否可信。
采用动态度量的方式，能够对运行状态可能发生改变的被测对象进行实时度量，从而能够持续地确定计算设备上的被测对象是否可信。
在本申请实施例中，采用第二可信模块存储与第一可信模块中存储的代码、数据以及第一可信模块相关的被测对象的度量值，从而能够利用第二可信模块较高的安全性来提升第一可信模块本身以及第一可信模块中存储的度量值的安全性，进而提升计算设备的安全性。
在本申请实施例的实际应用中，除图3-4所示应用方式外，第一可信模块还可以用于扩展其他应用场景的被测对象的度量值，从而能够从更多的维度衡量计算设备是否可信。
在本申请实施例中，上述第一可信模块和第二可信模块可用于存储计算设备上部署的操 作系统和用户APP等相关的各类被测对象的度量值。当以扩展方式存储被测对象的度量值时，该存储度量值的PCR所存储的数值实际上对应了一条信任链的可信状态。基于信任链的起点以及任一节点均是可信，以扩展方式存储数据能够用来确定计算设备是否始终处于可信状态。
本申请实施例中的其它技术方案细节和技术效果可参见本申请其它实施例中的描述。
图5为本申请实施例提供的可信度量方法的处理流程示意图三。本申请实施例的执行主体涉及多个进程、进程调度模块。其中，进程1为操作系统中正在运行的进程，进程1的度量值以扩展方式存储于PCR1，基于PCR1中的值可确定进程1是可信的。如图5所示，本申请实施例的步骤可以包括：
S501，进程1检测到需要调用进程2。
其中，示例性地，进程1需要调用进程2。
S502，进程1获取进程2的度量值。
其中，在一种实施方式中，进程1获取进程2的代码，将进程2的代码发送至度量执行装置以获取进程2的度量值，该种实施方式中，进程1获取进程2的度量值的过程与前述实施例中可信度量装置获取被测对象的度量值类似。在另一种实施方式中，进程1将进程2的代码发送至度量执行装置，由度量执行装置获取进程2的度量值。其中，度量值执行装置可以为本地度量模块或者度量服务器。
S503，进程1将进程2的度量值扩展至fTPM的PCR1中。
其中，在执行步骤S503之前，PCR1中存储有进程1的度量值。在执行步骤S503后，PCR1中存储有根据进程1的度量值和进程2的度量值拼接的度量值。
S504，安全验证模块对PCR1中的度量值进行验证。
其中，步骤S504为可选的步骤。该步骤可用于确定进程2是否可信。
S505，进程1通知进程调度模块调用进程2。
S506，进程调度模块调用进程2。
S507，进程2检测到需要调用进程3。
S508，进程2获取进程3的度量值。
S509，进程2将进程3的度量值扩展至fTPM的PCR1。
S510，安全验证模块对PCR1中的度量值进行验证。
其中，步骤S510为可选的步骤。该步骤可用于确定进程3是否可信。
S511，进程2通知进程调度模块调用进程3。
S512，可信度量装置获取fTPM的所有PCR1的度量值，并扩展至dTPM的PCR2中。
S513，安全验证模块对PCR2中的度量值进行验证。
在本申请实施例中，上述进程1、进程2、进程3也可以为支持可信度量的APP、应用等。即本申请实施例提供的可信度量方法可以由计算设备中支持可信度量的多个对象共同完成，以确保计算设备的安全性。
本申请实施例中的其它技术方案细节和技术效果可参见本申请其它实施例中的描述。
图6为本申请实施例提供的可信度量装置的结构示意图一。如图6所示，本申请提供一种可信度量装置600，包括获取模块601和发送模块602。其中，获取模块601，用于执行前述实施例中步骤S101；发送模块602，用于执行前述实施例中步骤S102。
在本申请实施例中，可信度量装置可以是APP、程序等。
在本申请实施例中，可信度量装置可以是位于计算设备的OS中的进程或者APP，可以在 REE中，也可以在TEE中。
需要说明的是，本申请实施例提供的可信度量装置可用以执行前述实施例中提供的可信度量方法，本申请实施例提供的方法可由计算设备中的一个或多个可信度量装置相互配合实现，具体可参见前述实施例中的描述。在实际应用中，可信度量方法的步骤可以由计算设备中的多个APP、进程等对象执行。本申请对此不作限制。
图7为本申请实施例提供的可信度量装置的结构示意图二。如图7所示，本申请实施例的可信度量装置700包括：处理器701；存储器702，用于存储一个或多个程序；当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如上述前述实施例可信度量方法中任一可信度量装置执行的步骤。示例性地，该可信度量装置可以是计算设备或者计算设备的组件。在本申请实施例中，可信度量装置700还可以包括接口703，用于与第一可信模块、第二可信模块进行通信，在一些场景中，接口703还可以与验证装置、度量执行装置进行通信。此外，服务器和还可以包括总线704，用于实现可信度量装置内部的通信。在本申请实施例中，可信度量装置还可以是芯片。
本申请实施例中的其它技术方案细节和技术效果可参见本申请其它实施例中的描述。
图8为本申请实施例提供的一种计算设备的结构示意图。如图8所示，本申请提供一种计算设备800，所述计算设备包括：基于所述计算设备的固件实现的第一可信模块801，基于硬件实现的第二可信模块802和可信度量装置803；
其中，所述第一可信模块用于存储计算设备中的第二被测对象的度量值；
其中，可信度量装置803可以为图7所示实施例中的可信度量装置700。
所述第二可信模块用于存储所述第一被测对象的度量值。
在本申请实施例中，计算设备还可以包括：验证装置803。或者，计算设备可与位于计算设备之外的验证装置相连。示例性地，该独立的验证装置是远程验证服务器。
在本申请实施例中，验证装置、远程验证服务器支持执行前述实施例中验证模块执行的方法。在一示例中，验证装置用于从所述第二可信模块中获取所述第一被测对象的度量值，根据所述第一被测对象的度量值确定第一可信模块或者所述第一可信模块中的数据是否可信。在另一示例中，验证装置用于从所述第一可信模块中获取所述第二被测对象的度量值，根据所述第二被测对象的度量值确定第二被测对象是否可信。
在本申请实施例中，计算设备还可以包括度量执行装置804。示例性地，可信度量装置803，具体用于获取所述第一被测对象的完整性参数，向所述度量执行装置发送所述第一被测对象的完整性参数；以及，接收所述度量执行装置发送的所述第一被测对象的度量值。度量执行装置804，用于接收所述第一被测对象的完整性参数，根据所述第一被测对象的完整性参数生成所述第一被测对象的度量值。在本申请其他实施例中，度量执行装置804还可用于接收所述第二被测对象的完整性参数，根据所述第二被测对象的完整性参数生成所述第二被测对象的度量值。
在本申请实施例中，计算设备上可以包括一个或多个可信度量装置。在一示例中，计算设备包括第一可信度量装置和第二可信度量装置，其中，第一可信度量装置用于获取第二被测对象的度量值并将第二被测对象的度量值扩展至第一可信模块的寄存器，第二可信度量装置可以用于执行前述实施例中步骤S101-S102。具体可参看前述实施例中的描述。
在本申请实施例中，计算设备也可以是虚拟机。
在实际应用中，上述实施例中的计算设备中的第一可信模块、第二可信模块、可信度量 装置可组成一种可信度量系统。在一种可能的实现方式中，该系统还可以包括度量执行装置。在一种可能的实现方式中，该系统可以包括位于计算设备中的验证装置或者独立于计算设备之外的远程验证服务器。
本申请实施例中的其它技术方案细节和技术效果可参见本申请其它实施例中的描述。
本申请提供一种可信度量程序，所述可信度量程序被执行时用于前述实施例中任一实施例中的可信度量方法。
本申请提供提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，所述指令可以由处理电路上的一个或多个处理器执行。当其在计算机上运行时，使得计算机执行上述前述实施例中任意可能的实现方式中的方法。
本申请实施例中的其它技术方案细节和技术效果可参见本申请其它实施例中的描述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DataVData)、或者半导体介质(例如固态硬盘Solid State Dataisk)等。

Claims (18)

  1. 一种可信度量方法，其特征在于，包括：
    获取计算设备中的第一被测对象的度量值，所述第一被测对象的度量值用于确定所述计算设备中基于固件实现的第一可信模块是否可信；所述第一可信模块用于存储所述计算设备中的第二被测对象的度量值；
    将所述第一被测对象的度量值发送至基于硬件实现的第二可信模块。
  2. 根据权利要求1所述的方法，其特征在于，所述第一被测对象包括以下至少一种：所述第一可信模块或所述第一可信模块中的数据。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第二被测对象的度量值为采用扩展操作的方式存储于所述第一可信模块的第一寄存器中的；
    所述第一被测对象的度量值为采用扩展操作的方式存储于所述第二可信模块的第二寄存器中的。
  4. 根据权利要求1-3任一所述的方法，其特征在于，
    所述第一可信模块为基于固件的可信平台模块fTPM，所述第二被测对象的度量值存储于所述第一可信模块的平台配置寄存器PCR；和/或，
    所述第二可信模块为离散可信平台模块dTPM或集成可信平台模块，所述第一被测对象的度量值存储于所述第二可信模块的PCR。
  5. 根据权利要求1-4任一所述的方法，其特征在于，所述第一被测对象包括所述第二被测对象的度量值；
    在所述获取计算设备中的第一被测对象的度量值之前，所述方法还包括：
    获取所述第二被测对象的度量值；其中，所述第二被测对象包括以下至少一种：所述计算设备中的APP、进程、程序、日志、数据库、文件和数据；
    将所述第二被测对象的度量值发送至所述第一可信模块。
  6. 根据权利要求1-5任一所述的方法，其特征在于，在所述获取计算设备中的第一被测对象的度量值之前，包括：检测到所述第一被测对象发生变更。
  7. 根据权利要求1-6所述的方法，其特征在于，所述获取计算设备中的第一被测对象的度量值，包括：获取至少两个第一被测对象对应的一个度量值。
  8. 一种可信度量装置，其特征在于，包括：
    获取模块，用于获取计算设备中的第一被测对象的度量值，所述第一被测对象的度量值用于确定所述计算设备中基于固件实现的第一可信模块是否可信；所述第一可信模块用于存储所述计算设备中的第二被测对象的度量值；
    发送模块，用于将所述第一被测对象的度量值发送至基于硬件实现的第二可信模块。
  9. 根据权利要求8所述的装置，其特征在于，所述第一被测对象包括以下至少一种：所述第一可信模块或所述第一可信模块中的数据。
  10. 根据权利要求8或9所述的装置，其特征在于，所述第二被测对象的度量值为采用扩展操作的方式存储于所述第一可信模块的第一寄存器中的；
    所述第一被测对象的度量值为采用扩展操作的方式存储于所述第二可信模块的第二寄存器中的。
  11. 根据权利要求8-10任一所述的装置，其特征在于，
    所述第一可信模块为基于固件的可信平台模块fTPM，所述第二被测对象的度量值存储于 所述第一可信模块的平台配置寄存器PCR；和/或，
    所述第二可信模块为离散可信平台模块dTPM，或，集成可信平台模块，所述第一被测对象的度量值存储于所述第二可信模块的PCR。
  12. 根据权利要求8-11任一所述的装置，其特征在于，
    所述获取模块，还用于在所述获取计算设备中的第一被测对象的度量值之前，获取所述第二被测对象的度量值；其中，所述第一被测对象包括所述第二被测对象的度量值；所述第二被测对象包括以下至少一种：所述计算设备中的APP、进程、程序、日志、数据库、文件、数据；
    所述发送模块，还用于将所述第二被测对象的度量值发送至所述第一可信模块。
  13. 根据权利要求8-12任一所述的装置，其特征在于，所述获取模块，还用于在检测到所述第一被测对象发生变更后，执行所述获取计算设备中的第一被测对象的度量值的步骤。
  14. 根据权利要8-13任一所述的装置，其特征在于，所述获取模块，具体用于获取至少两个第一被测对象对应的一个度量值。
  15. 一种计算设备，其特征在于，所述计算设备包括：基于所述计算设备的固件实现的第一可信模块，基于硬件实现的第二可信模块和如权利要求8-14任一所述的可信度量装置；
    其中，所述第一可信模块用于存储计算设备中的第二被测对象的度量值；
    所述第二可信模块用于存储所述第一被测对象的度量值。
  16. 根据权利要求15所述的计算设备，其特征在于，所述计算设备还包括：
    验证装置，用于从所述第二可信模块中获取所述第一被测对象的度量值，根据所述第一被测对象的度量值确定所述第一被测对象是否可信。
  17. 根据权利要求15或16所述的计算设备，其特征在于，所述计算设备还包括：度量执行装置；
    所述可信度量装置，具体用于获取所述第一被测对象的完整性参数，向所述度量执行装置发送所述第一被测对象的完整性参数；以及，接收所述度量执行装置发送的所述第一被测对象的度量值；
    所述度量执行装置，用于接收所述第一被测对象的完整性参数，根据所述第一被测对象的完整性参数生成所述第一被测对象的度量值。
  18. 一种可信度量程序，其特征在于，所述可信度量程序被执行时用于实现权利要求1-7任一所述的可信度量方法。
PCT/CN2021/080810 2020-03-31 2021-03-15 可信度量方法及相关装置 Ceased WO2021197040A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP21778938.7A EP4116851A4 (en) 2020-03-31 2021-03-15 CONFIDENCE MEASUREMENT METHOD AND ASSOCIATED APPARATUS

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010246265.5 2020-03-31
CN202010246265.5A CN113468535B (zh) 2020-03-31 2020-03-31 可信度量方法及相关装置

Publications (1)

Publication Number Publication Date
WO2021197040A1 true WO2021197040A1 (zh) 2021-10-07

Family

ID=77865676

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/080810 Ceased WO2021197040A1 (zh) 2020-03-31 2021-03-15 可信度量方法及相关装置

Country Status (3)

Country Link
EP (1) EP4116851A4 (zh)
CN (1) CN113468535B (zh)
WO (1) WO2021197040A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114462051A (zh) * 2022-04-12 2022-05-10 中电云数智科技有限公司 一种基于可信计算环境的可信计算系统及方法
WO2023104013A1 (zh) * 2021-12-10 2023-06-15 华为技术有限公司 数据完整性保护方法及相关装置
CN117610025A (zh) * 2024-01-19 2024-02-27 国网信息通信产业集团有限公司 一种基于电力智能终端的嵌入式操作系统安全引导方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113806787A (zh) * 2021-11-19 2021-12-17 苏州浪潮智能科技有限公司 一种arm平台自动解密的方法、装置、设备及可读介质
WO2023112170A1 (ja) * 2021-12-14 2023-06-22 日本電信電話株式会社 ログ出力装置、ログ出力方法およびログ出力プログラム
CN116049866B (zh) * 2022-06-27 2024-06-28 荣耀终端有限公司 一种数据保护方法、电子设备及芯片系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102436566A (zh) * 2012-01-12 2012-05-02 冶金自动化研究设计院 一种动态可信度量方法及安全嵌入式系统
CN105389513A (zh) * 2015-11-26 2016-03-09 华为技术有限公司 一种虚拟可信平台模块vTPM的可信执行方法和装置
CN106127056A (zh) * 2016-06-20 2016-11-16 浪潮电子信息产业股份有限公司 一种国产bmc芯片可信固件的设计方法
CN107451479A (zh) * 2017-07-31 2017-12-08 浪潮(北京)电子信息产业有限公司 一种信任链的构建方法及系统
US20190114431A1 (en) * 2017-10-13 2019-04-18 Baidu Usa Llc Method and apparatus for launching a device

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8375221B1 (en) * 2011-07-29 2013-02-12 Microsoft Corporation Firmware-based trusted platform module for arm processor architectures and trustzone security extensions
CN103973680B (zh) * 2014-04-29 2016-01-13 神华集团有限责任公司 云计算平台完整性验证方法
CN104268461B (zh) * 2014-09-16 2018-03-06 华为技术有限公司 一种可信度量方法及装置
CN104966022A (zh) * 2015-06-12 2015-10-07 浪潮电子信息产业股份有限公司 一种基于芯片的信任链构建方法和装置
CN107301082B (zh) * 2016-04-15 2020-10-09 南京中兴软件有限责任公司 一种实现操作系统完整性保护的方法和装置
WO2018054466A1 (en) * 2016-09-22 2018-03-29 Telefonaktiebolaget Lm Ericsson (Publ) Virtualization of a trusted computing base
CN106548063A (zh) * 2016-11-01 2017-03-29 广东浪潮大数据研究有限公司 一种可信度量方法、装置和系统
CN107480535A (zh) * 2017-08-18 2017-12-15 郑州云海信息技术有限公司 一种两路服务器的可信硬件层设计方法及装置
CN109522721A (zh) * 2017-09-19 2019-03-26 中国科学院沈阳自动化研究所 一种基于tpm的工业控制可信嵌入式平台的启动方法
CN110874494B (zh) * 2018-08-29 2023-05-02 阿里巴巴集团控股有限公司 密码运算处理方法、装置、系统及度量信任链构建方法
CN109255242A (zh) * 2018-09-18 2019-01-22 郑州云海信息技术有限公司 一种基于可信uefi固件引导虚拟机启动的方法及系统
US11017092B2 (en) * 2018-09-27 2021-05-25 Intel Corporation Technologies for fast launch of trusted containers
CN110647750B (zh) * 2019-09-20 2021-09-03 大唐高鸿信安（浙江）信息科技有限公司 文件完整性度量方法、装置、终端及安全管理中心

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102436566A (zh) * 2012-01-12 2012-05-02 冶金自动化研究设计院 一种动态可信度量方法及安全嵌入式系统
CN105389513A (zh) * 2015-11-26 2016-03-09 华为技术有限公司 一种虚拟可信平台模块vTPM的可信执行方法和装置
CN106127056A (zh) * 2016-06-20 2016-11-16 浪潮电子信息产业股份有限公司 一种国产bmc芯片可信固件的设计方法
CN107451479A (zh) * 2017-07-31 2017-12-08 浪潮(北京)电子信息产业有限公司 一种信任链的构建方法及系统
US20190114431A1 (en) * 2017-10-13 2019-04-18 Baidu Usa Llc Method and apparatus for launching a device

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4116851A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023104013A1 (zh) * 2021-12-10 2023-06-15 华为技术有限公司 数据完整性保护方法及相关装置
CN114462051A (zh) * 2022-04-12 2022-05-10 中电云数智科技有限公司 一种基于可信计算环境的可信计算系统及方法
CN117610025A (zh) * 2024-01-19 2024-02-27 国网信息通信产业集团有限公司 一种基于电力智能终端的嵌入式操作系统安全引导方法
CN117610025B (zh) * 2024-01-19 2024-04-05 国网信息通信产业集团有限公司 一种基于电力智能终端的嵌入式操作系统安全引导方法

Also Published As

Publication number Publication date
EP4116851A4 (en) 2023-08-30
CN113468535A (zh) 2021-10-01
CN113468535B (zh) 2024-06-25
EP4116851A1 (en) 2023-01-11

Similar Documents

Publication Publication Date Title
WO2021197040A1 (zh) 可信度量方法及相关装置
TWI530810B (zh) 提供多階鎖步完整性報告機構之技術
US8151262B2 (en) System and method for reporting the trusted state of a virtual machine
KR101402542B1 (ko) 지속형 보안 시스템 및 지속형 보안 방법
CN103765427B (zh) 检验设备的固件完整性
US11714910B2 (en) Measuring integrity of computing system
CN104160403B (zh) 使用单个可信平台模块测量平台部件
US7921286B2 (en) Computer initialization for secure kernel
CN101504704B (zh) 由星型信任链支持的嵌入式平台应用程序完整性验证方法
CN112800429B (zh) 一种基于基础性的uefi bios固件系统中驱动程序保护的方法
CN112035472B (zh) 数据处理方法、装置、计算机设备和存储介质
WO2022143429A1 (zh) 计算机系统、可信功能组件及运行方法
WO2023179745A1 (zh) 可信验证方法及装置
CN101122937A (zh) 由星型信任链支持的嵌入式平台安全引导机制
US12399998B2 (en) Computing systems employing measurement of boot components, such as prior to trusted platform module (TPM) availability, for enhanced boot security, and related methods
CN109583214B (zh) 一种安全控制方法
CN111125707A (zh) 一种基于可信密码模块的bmc安全启动方法、系统及设备
WO2026036803A1 (zh) 文件访问方法与电子设备
US20250039200A1 (en) Computer Security and Methods of Use Thereof
WO2018233638A1 (zh) Ai软件系统安全状态的确定方法及装置
CN110874225B (zh) 一种数据校验方法、装置、嵌入式设备及存储介质
CN114756867A (zh) 一种基于uefi的可信日志的实现方法
US12561440B2 (en) Integrity validation of management devices
WO2024027472A1 (zh) 一种确定内核状态的方法和相关设备
CN119848877A (zh) 基板管理控制器的可信度量方法及终端设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21778938

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021778938

Country of ref document: EP

Effective date: 20221006

NENP Non-entry into the national phase

Ref country code: DE