Host remote monitoring method based on chip hierarchy privacy calculation

Abstract

The invention discloses a host remote monitoring method based on chip hierarchy privacy calculation. The host remote monitoring method comprises: S1, starting monitoring software in a client host in a trusted execution environment based on chip hierarchy; S2, judging whether valid private data exists in the local of the user side host, if so, directly entering a step S4, and otherwise, entering a step S3; S3, establishing secure connection with a supervisor and capturing privacy data; and S4, executing a related monitoring instruction by the monitoring software operating in the trusted execution environment based on the privacy data, encrypting and signing a monitoring result, and transmitting the monitoring result to a supervisor. According to the scheme, the validity, non-tampering property and monitoring safety of the monitoring information of the user side are ensured by utilizing a trusted execution environment based on privacy calculation, and the monitoring information is encrypted and signed based on the encryption key and the signature key of the supervisor, so that the supervisory information can be stored locally, and high overhead cost caused by real-time connection is avoided.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to a host monitoring method based on chip-level privacy calculation. Background technique [0002] At present, there are some obvious defects in the way that the supervisor remotely monitors all operation information of the client host (such as keyboard, mouse operation, certain programs of the client host, file operation information, etc.) through monitoring software or services (hereinafter referred to as monitoring software). ,Such as: [0003] Insufficient security, after the attacker remotely masters the client host, he can obtain all the running data of all software (including the monitoring software itself) through memory attacks (such as memory dump attack software), and the attacker can modify it at will and inject wrong data ( Wrong keyboard, mouse and other monitoring data) are sent to the supervisor, even if the information is encrypted by the moni...

AI Technical Summary

Problems solved by technology

[0003] Insufficient security, after the attacker remotely masters the client host, he can obtain all the running data of all software (including the monitoring software itself) through memory attacks (such as memory dump attack software), and the attacker can modify it at will and inject wrong data ( Wrong keyboard, mouse and other monitoring data) are sent to the supervisor, even if the information is encrypted by the monitoring software, the attacker can use the memory attack software to obtain the decryption key;

[0004] The data captured by monitoring will not be saved locally on the client side. The supervisor needs to establish a real-time connection with the client host. The supervisor receives the monitoring data from the monitoring software in the client host in real time. However, the cost of real-time connection is relatively high, resulting in monitoring cost increase

Images