A host remote monitoring method based on chip-level privacy computing

Abstract

The invention discloses a host remote monitoring method based on chip-level privacy calculation, including: S1. The monitoring software in the client host is started in a trusted execution environment based on the chip level; S2. Judging whether there is a valid If so, go directly to step S4; otherwise, go to step S3; S3. Establish a secure connection with the supervisor and capture private data; S4. Monitoring software running in a trusted execution environment executes relevant monitoring instructions based on private data , and encrypt and sign the monitoring results and transmit them to the regulator. This scheme uses a trusted execution environment based on privacy computing to ensure the validity, immutability, and security of monitoring information on the client side, and encrypts and signs the monitoring information based on the encryption key and signature key of the regulator. It can store regulatory information locally, avoiding the high overhead cost caused by real-time connection.

Description

technical field [0001] The invention belongs to the technical field of computer security, and in particular relates to a host monitoring method based on chip-level privacy calculation. Background technique [0002] At present, there are some obvious defects in the way that the supervisor remotely monitors all operation information of the client host (such as keyboard, mouse operation, certain programs of the client host, file operation information, etc.) through monitoring software or services (hereinafter referred to as monitoring software). ,Such as: [0003] Insufficient security, after the attacker remotely masters the client host, he can obtain all the running data of all software (including the monitoring software itself) through memory attacks (such as memory dump attack software), and the attacker can modify it at will and inject wrong data ( Wrong keyboard, mouse and other monitoring data) are sent to the supervisor, even if the information is encrypted by the moni...

AI Technical Summary

Problems solved by technology

[0003] Insufficient security, after the attacker remotely masters the client host, he can obtain all the running data of all software (including the monitoring software itself) through memory attacks (such as memory dump attack software), and the attacker can modify it at will and inject wrong data ( Wrong keyboard, mouse and other monitoring data) are sent to the supervisor, even if the information is encrypted by the monitoring software, the attacker can use the memory attack software to obtain the decryption key;

[0004] The data captured by monitoring will not be saved locally on the client side. The supervisor needs to establish a real-time connection with the client host. The supervisor receives the monitoring data from the monitoring software in the client host in real time. However, the cost of real-time connection is relatively high, resulting in monitoring cost increase

Images