A trusted computing software integrity measurement system and method

Abstract

The present invention provides a trusted computing software integrity measurement system and method. The present invention mainly provides a method for measuring software integrity based on TEE and Linux system (including domestic Linux system), and does not monopolize the CPU core, and has a very low impact on system performance. A trusted computing software integrity measurement method, the software measurement system used includes the following modules: measurement object, system kernel, security firmware and security hardware, which correspond to user state, kernel state, security state and trusted root in turn.

Description

Technical Field

[0001] The invention relates to computer active defense technology, and in particular to a trusted computing software integrity measurement method. Background Art

[0002] Computer security technologies mainly include passive defense and active defense. In view of the increasingly severe computer security situation, passive defense has the problem of lagging vulnerability library updates, making it difficult to achieve good protection effects; active defense can effectively solve this problem. In active defense, software integrity measurement can effectively prevent untrusted software from executing in the system.

[0003] Common software integrity measurement methods include: 1. The measurement software occupies one core of the CPU. In a desktop environment, the number of CPU cores is relatively small, which will greatly reduce system performance; 2. External measurement hardware devices will increase hardware costs; 3. The integrity of application software, dynamic library files, etc. needs to be frequently calculated during measurement, which requires a lot of CPU computing resources.

[0004] However, the above methods often have the defect of occupying the CPU, so that such defense methods greatly affect the performance of the system. Summary of the invention

[0005] Based on this, it is necessary to provide a trusted computing software integrity measurement system and method for the above problems. The present invention mainly provides a method for software integrity measurement based on TEE and Linux system (including domestic Linux system), and does not monopolize the CPU core, and has little impact on system performance.

[0006] A trusted computing software integrity measurement method, the software measurement system used includes the following modules: measurement object, system kernel, security firmware and security hardware, which correspond to user state, kernel state, security state and trusted root in sequence; wherein,

[0007] Measurement object: The measured object refers to the executable programs, dynamic libraries, and kernel modules that users and other software need to run or load after the REE system is started.

[0008] TEE-CA: TEE user application, also one of the measured objects, provides whitelist initialization and user-mode whitelist access related interfaces

[0009] The system kernel includes LSM, measurement module and TEE kernel driver; LSM: Linux security module, when the measured object needs to run or load, the corresponding LSM Hook will be triggered; measurement module: kernel module that implements measurement, registered LSM Hook; TEE kernel driver: provides REE access to TEE function support.

[0010] The secure firmware includes TEE; TEE: Trusted Execution Environment, which works in the secure state of the CPU, stores data securely, and provides measurement value verification;

[0011] Security hardware includes TCM;TCM: security hardware, providing trusted root;

[0012] A method for measuring the integrity of trusted computing software, the process of this method is as follows.

[0013] The first step is to start the TEE / REE system; (1) The TEE kernel driver and measurement module will be loaded at startup; (2) After the startup is completed, TEE-TA loads the whitelist and whitelist status. If the whitelist is not initialized at this time, TEE-TA will notify TEE-CA, and CA will initialize the whitelist; (3) After the initialization is completed, normal software integrity measurement can be performed; (4) When untrusted software attempts to load or allow, its HASH value is not in the whitelist and the measurement fails; if the software added to the whitelist is tampered with, its HASH value will change and the measurement will fail. When the measurement fails, the LSM will return failure, and the kernel will intercept the software and not allow it to be loaded or run.

[0014] The second step is to initialize the software whitelist; (1) The whitelist is the file SM3 HASH value, which is stored in the TEE file, and the TEE stores the initialization mark in the file;

[0015] (2) When TEE-TA is running, it checks the initialization flag. If it is not initialized, the measurement module and TEE-CA will notify the whitelist that it is not initialized when accessing the interface;

[0016] (3) When not initialized, the measurement module will return measurement success by default; and TEE-CA will automatically start initialization;

[0017] ①At this time, the equipment should be in a safe and controllable environment, such as a manufacturer's production line;

[0018] ②TEE-CA will start multiple scanning processes based on the established OS file system structure and scan the file system directory in parallel;

[0019] ③When scanning the directory, parse the file attributes and search for target type files: ELF files, script files, and files with executable permissions;

[0020] ④After finding the target type of file, call the openssl interface to calculate the SM3 HASH of the file;

[0021] ⑤TEE-CA adds HASH to the whitelist through the interface provided by TEE-TA;

[0022] ⑥After the scan is completed, TEE-TA updates the whitelist initialization mark and stores it in the file. The mark can only be changed from uninitialized to initialized;

[0023] (4) After the whitelist is initialized, the system is in a trusted protection state.

[0024] Whitelist data is encrypted and stored in the REE file system through TEE, and only TEE can decrypt and access it;

[0025] The third step is TEE metadata protection;

[0026] (1) TEE metadata stores encrypted key data such as whitelist initialization flags and whitelist attributes; (OS administrators can delete this file, so it must be protected);

[0027] (2) The measurement module and TEE agree on the path of the metadata file;

[0028] (3) The measurement module registers the LSM inode_unlink Hook. When a file deletion operation occurs, the file path is compared. If the path is a TEE metadata file, it returns no permission.

[0029] (4) In this way, no user (including root) can delete the metadata file, but TEE can modify it; REE tampering with the metadata file will cause metadata corruption, and the measurement module will intercept all software to protect user data;

[0030] Step 4: Software integrity measurement; (1) TEE does not monopolize the CPU core. Only when the whitelist data needs to be updated or the measurement module calls the whitelist verification service, the measurement module will call the TEE kernel driver. At this time, the kernel will enter the secure state through the SMC instruction and transfer the CPU core authority to the TEE;

[0031] (2) The metric module registers the LSM hooks: bprm_check_security, mmap_file, kernel_module_request, kernel_read_file, kernel_load_data;

[0032] (3) When software needs to be run or loaded, the LSM-related Hook will be triggered to call the measurement module to measure the software. The measurement module calculates the HASH value of the software and calls the kernel driver interface of TEE to verify whether the HASH is in the whitelist;

[0033] (4) If the verification fails, the software trust mark is removed, the software is prohibited from running, and the user is notified that he has no permission;

[0034] (5) If the verification is successful, the software is marked as trustworthy, and the timestamp of the successful measurement is saved in the mark. During the next measurement, if the trustworthy mark and its timestamp are valid, the software is allowed to run.

[0035] (6) The trusted tag is stored in the security xattr of the file. If a software file is written, the kernel measurement module removes the trusted tag of the software and allows the user to write the file.

[0036] (7) Trusted tag protection is performed through the two LSM hooks file_permission and inode_permission. If there is a file write operation, the measurement module will remove the trusted tag;

[0037] (8) Through the trusted tag and its timestamp mechanism, the software will not repeat the measurement within the effective time, which greatly reduces the workload of HASH calculation and ensures system security with extremely low performance loss;

[0038] By using this method, the following advantages can be achieved:

[0039] ① Ensure that whitelist initialization is irreversible through TEE metadata protection.

[0040] ② It does not occupy CPU cores and runs TEE only when measurement is needed, with low performance loss;

[0041] ③Through trusted tags, there is no need to frequently calculate file HASH, which further reduces CPU performance loss and protects trusted tags. Administrators and users cannot modify them, ensuring the security of trusted tags. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of the software measurement system is provided;

[0043] Figure 2 This is a schematic diagram of the complete software measurement process;

[0044] Figure 3 This is a schematic diagram of the specific process of software integrity measurement. DETAILED DESCRIPTION

[0045] In order to facilitate the understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. The preferred embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thoroughly understood.

[0046] A trusted computing software integrity measurement method, the software measurement system used includes the following modules: measurement object, system kernel, security firmware and security hardware, which correspond to user state, kernel state, security state and trusted root in sequence; wherein,

[0047] Measurement object: The measured object refers to the executable programs, dynamic libraries, and kernel modules that users and other software need to run or load after the REE system is started;

[0048] TEE-CA: TEE user application, also one of the measured objects, provides whitelist initialization and user-mode whitelist access related interfaces;

[0049] The system kernel includes LSM, measurement module and TEE kernel driver; LSM: Linux security module, when the measured object needs to run or load, the corresponding LSM Hook will be triggered; measurement module: kernel module that implements measurement, registered LSM Hook; TEE kernel driver: provides REE access to TEE function support.

[0050] The secure firmware includes TEE; TEE: Trusted Execution Environment, which works in the secure state of the CPU, stores data securely, and provides measurement value verification;

[0051] Security hardware includes TCM;TCM: security hardware, providing trusted root;

[0052] A method for measuring the integrity of trusted computing software, the process of this method is as follows.

[0053] The first step is to start the TEE / REE system; (1) The TEE kernel driver and measurement module will be loaded at startup; (2) After the startup is completed, TEE-TA loads the whitelist and whitelist status. If the whitelist is not initialized at this time, TEE-TA will notify TEE-CA, and CA will initialize the whitelist; (3) After the initialization is completed, normal software integrity measurement can be performed; (4) When untrusted software attempts to load or allow, its HASH value is not in the whitelist and the measurement fails; if the software added to the whitelist is tampered with, its HASH value will change and the measurement will fail. When the measurement fails, the LSM will return failure, and the kernel will intercept the software and not allow it to be loaded or run.

[0054] The second step is to initialize the software whitelist; (1) The whitelist is the file SM3 HASH value, which is stored in the TEE file, and the TEE stores the initialization mark in the file;

[0055] (2) When TEE-TA is running, it checks the initialization flag. If it is not initialized, the measurement module and TEE-CA will notify the whitelist that it is not initialized when accessing the interface;

[0056] (3) When not initialized, the measurement module returns measurement success by default; TEE-CA will automatically start initialization:

[0057] ①At this time, the equipment should be in a safe and controllable environment, such as a manufacturer's production line;

[0058] ②TEE-CA will start multiple scanning processes based on the established OS file system structure and scan the file system directory in parallel;

[0059] ③When scanning the directory, parse the file attributes and search for target type files: ELF files, script files, and files with executable permissions;

[0060] ④After finding the target type of file, call the openssl interface to calculate the SM3 HASH of the file;

[0061] ⑤TEE-CA adds HASH to the whitelist through the interface provided by TEE-TA;

[0062] ⑥After the scan is completed, TEE-TA updates the whitelist initialization mark and stores it in the file. The mark can only be changed from uninitialized to initialized;

[0063] (4) After the whitelist is initialized, the system is in a trusted protection state.

[0064] Whitelist data is encrypted and stored in the REE file system through TEE, and only TEE can decrypt and access it;

[0065] The third step is TEE metadata protection;

[0066] (1) TEE metadata stores encrypted key data such as whitelist initialization flags and whitelist attributes; (OS administrators can delete this file, so it must be protected);

[0067] (2) The measurement module and TEE agree on the path of the metadata file;

[0068] (3) The measurement module registers the LSM inode_unlink Hook. When a file deletion operation occurs, the file path is compared. If the path is a TEE metadata file, it returns no permission.

[0069] (4) In this way, no user (including root) can delete the metadata file, but TEE can modify it; REE tampering with the metadata file will cause metadata corruption, and the measurement module will intercept all software to protect user data;

[0070] Therefore, TEE metadata protection ensures that whitelist initialization is irreversible.

[0071] like Figure 3 As shown in the figure, the fourth step is software integrity measurement; (1) TEE does not monopolize the CPU core. Only when the whitelist data needs to be updated or the measurement module calls the whitelist verification service, the measurement module will call the TEE kernel driver. At this time, the kernel will enter the secure state through the SMC instruction and transfer the CPU core authority to the TEE;

[0072] (2) The metric module registers the LSM hooks: bprm_check_security, mmap_file, kernel_module_request, kernel_read_file, kernel_load_data;

[0073] (3) When software needs to be run or loaded, the LSM-related Hook will be triggered to call the measurement module to measure the software. The measurement module calculates the HASH value of the software and calls the kernel driver interface of TEE to verify whether the HASH is in the whitelist;

[0074] (4) If the verification fails, the software trust mark is removed, the software is prohibited from running, and the user is notified that he has no permission;

[0075] (5) If the verification is successful, the software is marked as trustworthy, and the timestamp of the successful measurement is saved in the mark. During the next measurement, if the trustworthy mark and its timestamp are valid, the software is allowed to run.

[0076] (6) The trusted tag is stored in the security xattr of the file. If a software file is written, the kernel measurement module removes the trusted tag of the software and allows the user to write the file.

[0077] (7) Trusted tag protection is performed through the two LSM hooks file_permission and inode_permission. If there is a file write operation, the measurement module will remove the trusted tag;

[0078] (8) Through the trusted tag and its timestamp mechanism, the software will not repeat the measurement within the effective time, which greatly reduces the workload of HASH calculation and ensures system security with extremely low performance loss;

[0079] By using this method, the following advantages can be achieved:

[0080] ① It does not occupy CPU cores and runs TEE only when measurement is needed, with low performance loss;

[0081] ②Through trusted tags, there is no need to frequently calculate file HASH, which further reduces CPU performance loss and protects trusted tags. Administrators and users cannot modify them, ensuring the security of trusted tags.

[0082] The specific working principle is as follows: when software is started, dynamic library is loaded or kernel module is loaded, LSM related Hook will be triggered to call the measurement module to measure the software, mainly measuring the trusted mark of the file. If the trusted mark is valid, loading or running is allowed. If the trusted mark is invalid, the measurement module starts to calculate the hash value of the file and calls the kernel driver interface of TEE to verify whether the HASH is in the whitelist. If it is in the whitelist, the measurement module updates the file integrity mark. If it is not in the whitelist, running or loading is prohibited.

[0083] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A measurement method based on a trusted computing software integrity measurement system, characterized in that: The following steps are included: The first step is to start the TEE / REE system; The second step is to initialize the software whitelist; The third step is TEE metadata protection; Step 4: Software integrity measurement; The trusted computing software integrity measurement system includes the following modules: measurement object, TEE-CA, system kernel, secure firmware and secure hardware, which correspond to user state, kernel state, secure state and trusted root respectively; The objects to be measured are the executable programs, dynamic libraries, and kernel modules that users and other software need to run or load after the REE system is started; TEE-CA is a user application of TEE and one of the measured objects. It provides interfaces related to whitelist initialization and user-mode whitelist access. The system kernel includes LSM, measurement module and TEE kernel driver; The secure firmware includes TEE, which is a trusted execution environment that works in the secure state of the CPU, stores data securely, and provides measurement value verification. The LSM is a Linux security module. When the measured object needs to be run or loaded, the corresponding LSM Hook will be triggered; The measurement module is a kernel module that implements measurement and registers the LSM Hook; The TEE kernel driver provides functional support for REE to access TEE; When the TEE / REE system starts, the TEE kernel driver and the measurement module are loaded; After the startup is completed, TEE-TA loads the whitelist and whitelist status. If the whitelist is not initialized at this time, TEE-TA will notify TEE-CA, and CA will initialize the whitelist. After the initialization is completed, normal software integrity measurement can be performed; When untrusted software attempts to load or allow, its HASH value is not in the whitelist and the measurement fails. If the software added to the whitelist is tampered with, its HASH value will change and the measurement will fail. When the measurement fails, LSM will return failure. At this time, the kernel will intercept the software and not allow it to be loaded or run. The whitelist is the file SM3 HASH value, which is stored in the TEE file. At the same time, TEE stores the initialization mark in the file. When TEE-TA is running, the initialization mark is checked. If it is not initialized, the measurement module and TEE-CA will notify the whitelist that it is not initialized when accessing the interface. If it is not initialized, the measurement module will return the measurement success by default. TEE-CA will automatically start initialization. The initialization includes the following steps: ① The device should be in a safe and controllable environment at this time; ② TEE-CA will start multiple scanning processes according to the established OS file system structure and scan the file system directory in parallel; ③ When scanning the directory, parse the file attributes and find the target type of file: ELF file, script file, and file with executable permission; ④After finding the target type of file, call the openssl interface to calculate the SM3 HASH of the file; ⑤TEE-CA adds HASH to the whitelist through the interface provided by TEE-TA;⑥After the scan is completed, TEE-TA updates the whitelist initialization mark and stores it in the file. The mark can only be changed from uninitialized to initialized; The metadata of the TEE stores encrypted whitelist initialization flags and key whitelist attribute data; The measurement module and TEE agree on the path of the metadata file; The measurement module registers the LSM inode_unlink Hook. When there is a file deletion operation, the file path is compared. If the path is a TEE metadata file, it returns no permission. In this way, no user can delete the metadata file, but TEE can modify it. If REE tampers with the metadata file, the metadata will be damaged. The measurement module will intercept all software to protect user data. When software needs to be run or loaded, the LSM-related Hook will be triggered to call the measurement module to measure the software. The measurement module calculates the HASH value of the software and calls the kernel driver interface of TEE to verify whether the HASH is in the whitelist; If the verification fails, the software trust mark is removed, the software is prohibited from running, and the user is notified that he has no permission; If the verification is successful, the software is marked as trusted, and the timestamp of the successful measurement is saved in the tag. The next time the measurement is performed, if the trusted tag and its timestamp are valid, the software is allowed to run. The trusted tag is stored in the security xattr of the file. If the software file is written, the kernel measurement module removes the trusted tag of the software and allows the user to write the file. Trusted tag protection is performed through two LSM Hooks, file_permission and inode_permission. If there is a file write operation, the measurement module will remove the trusted tag. Through the trusted tag and its timestamp mechanism, the software will not repeat the measurement within the effective time, which greatly reduces the workload of HASH calculation and ensures system security with extremely low performance loss.

Images