Information verification method and device
By generating and verifying remote certificates on the first electronic device, and storing the verification information in the blockchain, the risk of Enclave data being accessed by forged hardware is solved, and the legitimacy of the Enclave hardware module is verified and data security is guaranteed. .
Patent Information
- Application Number
- CN202010598160.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-06-28
- Publication Date
- 2025-01-21
- Estimated Expiration
- 2041-01-21
AI Technical Summary
The data in Enclave has uncontrollable risks such as hardware forgery, and there is a risk of forgery hardware access, which threatens the data security.
By generating a remote certificate for verifying the target hardware module on the first electronic device, verifying its legality, generating verification information and storing it in the blockchain, the second electronic device can verify the first electronic device based on this information. The legality of the target hardware module.
It effectively solves the risk of data in the Enclave being accessed by forged hardware and ensures the security of the data in the Enclave, so that devices communicating with unverified Enclave can know its security.
Smart Images
Figure CN111797380B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to information verification technology in the computer field, and in particular to an information verification method and device. Background Art
[0002] With the continuous development of network technology, data security has received more and more attention from people; among them, Intel Software Guard Extensions (Intel SGX) is a hardware-based computing and data protection technology. The protection method of SGX is to encapsulate the security operations of legitimate software in the corresponding enclave to protect it from attacks by malicious software. In actual applications, Enclave can be deployed in the same management domain or in different management domains; regardless of whether the data is deployed in the same management domain or in different management domains, there are uncontrollable risks such as hardware counterfeiting; therefore, the data in the Enclave is also at risk of being accessed by counterfeit hardware. Summary of the invention
[0003] The embodiments of the present application are intended to provide an information verification method and device.
[0004] The technical solution of this application is implemented as follows:
[0005] An information verification method is applied to a first electronic device, the first electronic device corresponds to a first node of a blockchain, and the method includes:
[0006] Generating a remote attestation for verifying a target hardware module on the first electronic device; the target hardware module is used to access a trusted execution storage block;
[0007] Verifying the legitimacy of the remote attestation and obtaining an attestation report; wherein the attestation report indicates whether the remote attestation is legitimacy;
[0008] Generate verification information based on the certification report and the target identifier of the trusted execution storage block; wherein the target identifier is used to uniquely identify the trusted execution storage block;
[0009] The verification information is stored in the blockchain; the verification information is used by a second electronic device to determine whether the certification report is legal; the second electronic device corresponds to a second node of the blockchain.
[0010] Optionally, the generating a remote certificate for verifying a target hardware module on the first electronic device includes:
[0011] Generate a remote certificate for verifying the target hardware module and target information; wherein the target information is stored in the trusted execution storage module;
[0012] Accordingly, the verification of the legitimacy of the remote attestation to obtain an attestation report includes:
[0013] Sending the remote proof to a third electronic device; wherein the trust level of the third electronic device is greater than a preset level;
[0014] Receive the certification report for the remote certification sent by the third electronic device; wherein the certification report is generated after the third electronic device verifies the legitimacy of the remote certification.
[0015] Optionally, the generating verification information based on the attestation report and the target identifier of the trusted execution storage block includes:
[0016] Determine the random factor;
[0017] The verification information is generated based on the attestation report, the target identifier and the random factor.
[0018] Optionally, storing the verification information in the blockchain includes:
[0019] The smart contract corresponding to the target identifier of the blockchain is called, and the verification information is stored in the blockchain through the smart contract.
[0020] An information verification method, the method is applied to a second electronic device, the second electronic device corresponds to a second node of a blockchain, the method comprising:
[0021] Obtaining a target identifier of a trusted execution storage block of a first electronic device, and obtaining verification information corresponding to the target identifier from the blockchain; the first electronic device corresponds to a first node of the blockchain; wherein the target identifier is used to uniquely identify the trusted execution storage block;
[0022] Obtaining a certification report from the verification information, and verifying the legitimacy of the certification report to obtain a verification result;
[0023] Based on the verification result, determine whether a target hardware module on the first electronic device is legal; wherein the target hardware module is used to access a trusted execution storage block.
[0024] Optionally, obtaining a certification report from the verification information and verifying the legitimacy of the certification report to obtain a verification result includes:
[0025] Obtaining a random factor from the verification information;
[0026] The legitimacy of the certification report is verified based on the random factor to obtain the verification result.
[0027] Optionally, the obtaining a target identifier of a trusted execution storage block of the first electronic device, and obtaining verification information corresponding to the target identifier from the blockchain includes:
[0028] Obtaining a target identifier of the trusted execution storage block;
[0029] A smart contract corresponding to the target identifier is called, and verification information corresponding to the target identifier is obtained from the blockchain through the smart contract.
[0030] Optionally, determining whether the target hardware module on the first electronic device is legal based on the verification result includes:
[0031] Based on the verification result, determining whether the target hardware module on the first electronic device is legal and whether the target information has been tampered with; wherein the target information is stored in the trusted execution storage block;
[0032] Accordingly, the method further includes:
[0033] If the verification result indicates that the trusted execution storage block is legal and the target information has not been tampered with, a trusted mark is added to the trusted execution storage block; wherein the trusted mark indicates that the first electronic device can perform data transmission through the trusted execution storage block.
[0034] A first electronic device, the first electronic device corresponding to a first node of a blockchain, the first electronic device comprising: a generation unit, a verification unit and a storage unit, wherein:
[0035] The generating unit is used to generate a remote certificate for verifying a target hardware module on the first electronic device; the target hardware module is used to access a trusted execution storage block;
[0036] The verification unit is used to verify the legitimacy of the remote certification and obtain a certification report; wherein the certification report indicates whether the remote certification is legal;
[0037] The generating unit is further configured to generate verification information based on the certification report and the target identifier of the trusted execution storage block; wherein the target identifier is used to uniquely identify the trusted execution storage block;
[0038] The storage unit is used to store the verification information in the blockchain; the verification information is used by the second electronic device to determine whether the certification report is legal; the second electronic device corresponds to the second node of the blockchain.
[0039] A second electronic device, the second electronic device corresponding to a second node of a blockchain, the second electronic device comprising: an acquisition unit, a processing unit, and a determination unit, wherein:
[0040] The acquisition unit is used to acquire a target identifier of a trusted execution storage block of a first electronic device, and acquire verification information corresponding to the target identifier from the blockchain; the first electronic device corresponds to a first node of the blockchain; wherein the target identifier is used to uniquely identify the trusted execution storage block;
[0041] The processing unit is used to obtain a certification report from the verification information, and verify the legitimacy of the certification report to obtain a verification result;
[0042] The determination unit is used to determine whether a target hardware module on the first electronic device is legal based on the verification result; wherein the target hardware module is used to access a trusted execution storage block.
[0043] The information verification method and device provided by the embodiments of the present application, the first electronic device generates a remote certificate for verifying the target hardware module for accessing the trusted execution storage block on the first electronic device, verifies the legitimacy of the remote certificate to obtain a certificate report, generates verification information based on the certificate report and the target identifier of the trusted execution storage block and stores the verification information in the blockchain, the second electronic device obtains the target identifier of the trusted execution storage block of the first electronic device, and obtains the verification information corresponding to the target identifier from the blockchain, then obtains the certificate report from the verification information and verifies the legitimacy of the certificate report to obtain a verification result, and finally determines whether the target hardware module on the first electronic device is legal based on the verification result, so that the legitimacy of the hardware module accessing the unverified Enclave can be verified based on the verification information generated for the unverified Enclave, and the device communicating with the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of forged hardware access to the data in the Enclave in the relative technology and ensuring the security of the data in the Enclave. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] Figure 1 A flowchart of an information verification method provided in an embodiment of the present application;
[0045] Figure 2 A flowchart of another information verification method provided in an embodiment of the present application;
[0046] Figure 3 A flowchart of another information verification method provided in an embodiment of the present application;
[0047] Figure 4 A schematic diagram of the architecture of an information verification method provided in an embodiment of the present application;
[0048] Figure 5 A schematic diagram of the structure of a first electronic device provided in an embodiment of the present application;
[0049] Figure 6 A schematic diagram of the structure of a second electronic device provided in an embodiment of the present application;
[0050] Figure 7 A schematic structural diagram of another first electronic device provided in an embodiment of the present application;
[0051] Figure 8 A schematic structural diagram of another second electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0052] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.
[0053] The embodiment of the present application provides an information verification method, which is applied to a first electronic device, the first electronic device corresponding to a first node of a blockchain, and Figure 1 As shown, the method comprises the following steps:
[0054] Step 101: Generate a remote certificate for verifying a target hardware module on a first electronic device.
[0055] The target hardware module is used to access the trusted execution storage block.
[0056] In an embodiment of the present application, the first electronic device may be an electronic device that is not trusted by other electronic devices and has a feasible execution storage block; the trusted execution storage block may be a storage block of a trusted execution environment, and the data and code and other information in the storage block can only be accessed by the corresponding central processing unit (CPU) and itself, and cannot be accessed by any other object. In a feasible implementation, the trusted execution storage block may include an Enclave.
[0057] It should be noted that the remote certification may be generated by the first electronic device according to the hardware parameters of the target hardware module.
[0058] Step 102: Verify the legitimacy of the remote certification and obtain a certification report.
[0059] Among them, the attestation report represents whether the remote attestation is legal.
[0060] After generating the remote certificate, the first electronic device can verify the legitimacy of the remote certificate by itself, or it can verify the legitimacy of the remote certificate through a third electronic device; the embodiments of the present application do not limit how to verify the legitimacy of the remote certificate, and any technology that can verify the legitimacy of the remote certificate is applicable.
[0061] Step 103: Generate verification information based on the attestation report and the target identifier of the trusted execution storage block.
[0062] The target identifier is used to uniquely identify the trusted execution storage block.
[0063] The target identifier of the trusted execution storage block may include an Enclave identifier. Of course, the Enclave identifier may uniquely identify the Enclave; the verification information may be generated by packaging the certification report and the target identifier.
[0064] Step 104: Store the verification information in the blockchain.
[0065] Among them, the verification information is used by the second electronic device to determine whether the certification report is legal; the second electronic device corresponds to the second node of the blockchain.
[0066] The information verification method provided in the embodiments of the present application is that the first electronic device generates a remote certificate for verifying the target hardware module for accessing the trusted execution storage block on the first electronic device, verifies the legitimacy of the remote certificate to obtain a certificate report, generates verification information based on the certificate report and the target identifier of the trusted execution storage block and stores the verification information in the blockchain. In this way, the second electronic device can verify the legitimacy of the hardware module accessing the unverified Enclave based on the verification information generated for the unverified Enclave, and other devices communicating with the first electronic device corresponding to the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of forged hardware access to the data in the Enclave in the relative technology and ensuring the security of the data in the Enclave.
[0067] The embodiment of the present application provides an information verification method, which is applied to a second electronic device, the second electronic device corresponding to the second node of the blockchain, referring to Figure 2 As shown, the method comprises the following steps:
[0068] Step 201: Obtain a target identifier of a trusted execution storage block of a first electronic device, and obtain verification information corresponding to the target identifier from a blockchain.
[0069] Among them, the first electronic device corresponds to the first node of the blockchain; the target identifier is used to uniquely identify the trusted execution storage block.
[0070] In other embodiments of the present application, the target identifier of the trusted execution storage block of the first electronic device may be the Enclave identifier of the first electronic device; the first electronic device has stored the generated verification information in the blockchain, and the second electronic device may directly obtain the verification information corresponding to the Enclave identifier of the first electronic device from the blockchain, so as to subsequently verify the legitimacy of the target hardware module of the first electronic device.
[0071] Step 202: Obtain a certification report from the verification information, and verify the legitimacy of the certification report to obtain a verification result.
[0072] The second electronic device can parse and analyze the verification information to obtain a certification report for the target hardware module of the first electronic device; after obtaining the certification report, the second electronic device verifies the legitimacy of the certification report. It should be noted that the legitimacy of the certification report can be verified based on a random factor in the verification information or by using a key.
[0073] Step 203: Based on the verification result, determine whether the target hardware module on the first electronic device is legal.
[0074] The target hardware module is used to access the trusted execution storage block.
[0075] In other embodiments of the present application, if the verification result is that the certification report is legal, it is determined that the target hardware module on the first electronic device is legal; if the verification result is that the certification report is illegal, it is determined that the target hardware module on the first electronic device is illegal.
[0076] It should be noted that the explanation and description of the same or corresponding steps in the embodiments of the present application can refer to the description in other embodiments and will not be repeated here.
[0077] The information verification method provided in the embodiments of the present application is that the first electronic device generates a remote certificate for verifying the target hardware module for accessing the trusted execution storage block on the first electronic device, verifies the legitimacy of the remote certificate to obtain a certificate report, generates verification information based on the certificate report and the target identifier of the trusted execution storage block and stores the verification information in the blockchain. In this way, the second electronic device can verify the legitimacy of the hardware module accessing the unverified Enclave based on the verification information generated for the unverified Enclave, and other devices communicating with the first electronic device corresponding to the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of forged hardware access to the data in the Enclave in the relative technology and ensuring the security of the data in the Enclave.
[0078] Based on the above embodiments, the embodiments of the present application provide an information verification method, referring to Figure 3 As shown, the method comprises the following steps:
[0079] Step 301: The first electronic device generates a remote certificate for verifying a target hardware module and target information.
[0080] The target information is stored in the trusted execution storage module; the target hardware module is used to access the trusted execution storage block.
[0081] In other embodiments of the present application, remote attestation may be generated based on the hardware parameters of the target hardware module and the content of the target information; wherein the hardware parameters may include: hardware environment, hardware model, hardware serial number and other parameters; in a feasible implementation method, if the target information includes the software information of the application, then the content of the target information may include information such as the binary content of the software and the code of the software.
[0082] Step 302: The first electronic device sends remote certification to a third electronic device.
[0083] The trust level of the third electronic device is greater than a preset level.
[0084] In other embodiments of the present application, the third electronic device may refer to a server; the third electronic device is a trusted electronic device; the trust level may refer to a trusted level, and the preset level may be a pre-set level that can ensure data security.
[0085] In a feasible implementation, the third electronic device may refer to a service provider corresponding to the target information; for example, the third electronic device is a service provider corresponding to the target information. Figure 4 As shown, an exemplary description of the verification method of remote attestation is given: after the first electronic device sends the remote attestation to the service provider corresponding to the target information, the service provider can verify the legitimacy of the remote attestation through the Intel Authentication Service (Intel IAS) and generate an attestation report, and then send the attestation report to the first electronic device.
[0086] Step 303: The first electronic device receives a certification report for remote certification sent by the third electronic device.
[0087] The certification report is generated after the third electronic device verifies the legitimacy of the remote certification, and indicates whether the remote certification is legal.
[0088] Step 304: The first electronic device determines a random factor.
[0089] Step 305: The first electronic device generates verification information based on the certification report, the target identifier and the random factor.
[0090] Among them, a pre-agreed random factor can be added to the proof report, and then the proof report with the added random factor and the target identifier are packaged to obtain verification information. Of course, the proof report can also be encrypted with a pre-agreed key, and then the target identifier and the encrypted proof report are packaged to obtain verification information.
[0091] Step 306: The first electronic device calls the smart contract corresponding to the target identifier on the blockchain, and stores the verification information in the blockchain through the smart contract.
[0092] Among them, Figure 4 As shown in , the generated verification information can be stored in the blockchain by calling the smart contract; of course, the first electronic device and the second electronic device can belong to different management domains, such as Figure 4 As shown in , the first electronic device may belong to management domain A, and the second electronic device may belong to management domain B. Of course, Figure 4 The description is merely an exemplary description, and the information verification method provided in the embodiment of the present application may also be applicable to scenarios belonging to the same management domain.
[0093] Step 307: The second electronic device obtains the target identifier of the trusted execution storage block of the first electronic device.
[0094] The second electronic device may be an electronic device that needs to perform data transmission with the first electronic device through a trusted execution storage block; of course, the second electronic device may also be an electronic device that does not need to perform data transmission with the first electronic device through a trusted execution storage block.
[0095] Step 308: The second electronic device calls the smart contract corresponding to the target identifier, and obtains verification information corresponding to the target identifier from the blockchain through the smart contract.
[0096] Step 309: The second electronic device obtains a random factor from the verification information.
[0097] The second electronic device may directly parse the verification information to obtain the random factor.
[0098] Step 310: The second electronic device verifies the legitimacy of the certification report based on the random factor and obtains a verification result.
[0099] Among them, Figure 4As shown in , verification information can be obtained by calling a smart contract; further, the verification of the legitimacy of the proof report can be achieved by the verification program of the second electronic device in the following ways: one is to determine whether the random factor matches the pre-agreed random factor. If it matches, the proof report is determined to be legal; if it does not match, the proof report is determined to be illegal; the other is to determine whether the proof report can be decrypted using a pre-agreed key. If it can be successfully decrypted, it means that the proof report is legal; if it cannot be decrypted, it means that the proof report is illegal.
[0100] Step 311: The second electronic device determines whether the target hardware module on the first electronic device is legal and whether the target information has been tampered with based on the verification result.
[0101] Among them, if the verification result is that the certification report is legal, it is determined that the target hardware module on the first electronic device is legal and the target information has not been tampered with; if the verification result is that the certification report is illegal, it is determined that the target hardware module on the first electronic device is illegal and the target information has been tampered with.
[0102] Step 312: If the verification result indicates that the trusted execution storage block is legal and the target information has not been tampered with, the second electronic device adds a trusted mark to the trusted execution storage block.
[0103] Among them, the trusted mark represents that the first electronic device can transmit data through the trusted execution storage block.
[0104] In other embodiments of the present application, after a trusted mark is added to the trusted execution storage block of the first electronic device, the first electronic device can perform data transmission with the second electronic device or other electronic devices through the trusted execution storage block.
[0105] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.
[0106] The information verification method provided by the embodiments of the present application is that the first electronic device generates a remote certificate for verifying the target hardware module for accessing the trusted execution storage block on the first electronic device, verifies the legitimacy of the remote certificate to obtain a certificate report, generates verification information based on the certificate report and the target identifier of the trusted execution storage block and stores the verification information in the blockchain, the second electronic device obtains the target identifier of the trusted execution storage block of the first electronic device, and obtains the verification information corresponding to the target identifier from the blockchain, then obtains the certificate report from the verification information and verifies the legitimacy of the certificate report to obtain a verification result, and finally determines whether the target hardware module on the first electronic device is legal based on the verification result, so that the legitimacy of the hardware module accessing the unverified Enclave can be verified based on the verification information generated for the unverified Enclave, and the device communicating with the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of forged hardware access to the data in the Enclave in the relative technology and ensuring the security of the data in the Enclave.
[0107] Based on the foregoing embodiments, the embodiments of the present application provide a first electronic device, which corresponds to a first node of a blockchain, and the first electronic device can be applied to Figure 1 and Figure 3 In the information verification method provided in the corresponding embodiment, refer to Figure 5 As shown, the first electronic device includes: a generating unit 41, a verifying unit 42 and a storing unit 43, wherein:
[0108] A generating unit 41, configured to generate a remote certificate for verifying a target hardware module on a first electronic device;
[0109] The target hardware module is used to access the trusted execution storage block;
[0110] A verification unit 42, used to verify the legitimacy of the remote attestation and obtain an attestation report;
[0111] Among them, the attestation report represents whether the remote attestation is legal;
[0112] The generating unit 41 is further configured to generate verification information based on the attestation report and the target identifier of the trusted execution storage block;
[0113] Wherein, the target identifier is used to uniquely identify the trusted execution storage block;
[0114] A storage unit 43, used to store verification information in the blockchain;
[0115] Among them, the verification information is used by the second electronic device to determine whether the certification report is legal; the second electronic device corresponds to the second node of the blockchain.
[0116] In other embodiments of the present application, the generating unit 41 is further used to generate a remote certificate for verifying the target hardware module and the target information;
[0117] The target information is stored in a trusted execution storage module.
[0118] In other embodiments of the present application, the verification unit 42 is further configured to perform the following steps:
[0119] Sending remote proof to a third electronic device; wherein the trust level of the third electronic device is greater than a preset level;
[0120] Receive a certification report for remote certification sent by a third electronic device; wherein the certification report is generated after the third electronic device verifies the legitimacy of the remote certification.
[0121] In other embodiments of the present application, the generating unit 41 is further configured to perform the following steps:
[0122] Determine the random factor;
[0123] Based on the attestation report, the target identifier and the random factor, verification information is generated.
[0124] In other embodiments of the present application, the storage unit 43 is also used to call the smart contract corresponding to the target identifier of the blockchain, and store the verification information in the blockchain through the smart contract.
[0125] It should be noted that the specific implementation process of the steps performed by each unit in this embodiment can refer to Figure 1 and Figure 3 The implementation process of the information verification method provided in the corresponding embodiment will not be repeated here.
[0126] The first device provided in the embodiment of the present application generates a remote attestation for verifying a target hardware module for accessing a trusted execution storage block on the first electronic device, verifies the legitimacy of the remote attestation to obtain an attestation report, generates verification information based on the attestation report and the target identifier of the trusted execution storage block, and stores the verification information in a blockchain. In this way, a second electronic device can verify the legitimacy of a hardware module for accessing an unverified Enclave based on the verification information generated for the unverified Enclave, and a device communicating with the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of forged hardware access to data in the Enclave in the relative technology and ensuring the security of data in the Enclave.
[0127] Based on the foregoing embodiments, the embodiments of the present application provide a second electronic device, the second electronic device corresponds to the second node of the blockchain, and the second electronic device can be applied to Figure 2 and Figure 3 In the information verification method provided in the corresponding embodiment, refer to Figure 6 As shown, the second electronic device includes: an acquisition unit 51, a processing unit 52 and a determination unit 53, wherein:
[0128] An acquisition unit 51 is used to acquire a target identifier of a trusted execution storage block of a first electronic device, and acquire verification information corresponding to the target identifier from a blockchain;
[0129] The first electronic device corresponds to a first node of the blockchain; the target identifier is used to uniquely identify the trusted execution storage block;
[0130] The processing unit 52 is used to obtain a certification report from the verification information and verify the legitimacy of the certification report to obtain a verification result;
[0131] A determination unit 53, configured to determine whether the target hardware module on the first electronic device is legal based on the verification result;
[0132] The target hardware module is used to access the trusted execution storage block.
[0133] In other embodiments of the present application, the processing unit 52 is further configured to perform the following steps:
[0134] Get the random factor from the verification information;
[0135] The legitimacy of the certification report is verified based on the random factor to obtain the verification result.
[0136] In other embodiments of the present application, the acquisition unit 51 is further configured to perform the following steps:
[0137] Obtain a target identifier of a trusted execution storage block;
[0138] The smart contract corresponding to the target ID is called, and the verification information corresponding to the target ID is obtained from the blockchain through the smart contract.
[0139] In other embodiments of the present application, the determination unit 53 is further configured to determine, based on the verification result, whether the target hardware module on the first electronic device is legal and whether the target information has been tampered with;
[0140] Wherein, the target information is stored in a trusted execution storage block;
[0141] In other embodiments of the present application, refer to Figure 6 As shown, the second electronic device further includes: a marking unit 54, wherein:
[0142] A marking unit 54, configured to add a trusted mark to the trusted execution storage block if the verification result indicates that the trusted execution storage block is legal and the target information has not been tampered with;
[0143] Among them, the trusted mark represents that the first electronic device can transmit data through the trusted execution storage block.
[0144] It should be noted that the specific implementation process of the steps performed by each unit in this embodiment can refer to Figure 2 and Figure 3 The implementation process of the information verification method provided in the corresponding embodiment will not be repeated here.
[0145] The second electronic device provided in the embodiment of the present application can verify the legitimacy of the hardware module accessing the unverified Enclave based on the verification information generated for the unverified Enclave, and the device communicating with the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of forged hardware access to the data in the Enclave in the relative technology and ensuring the security of the data in the Enclave.
[0146] Based on the foregoing embodiments, the embodiments of the present application provide a first electronic device, which can be applied to Figure 1 and Figure 3 In the information verification method provided in the corresponding embodiment, refer to Figure 7 As shown, the first electronic device includes: a first processor 61, a first memory 62 and a first communication bus 63;
[0147] The first communication bus 63 is used to realize the communication connection between the first processor 61 and the first memory 62;
[0148] The first processor 63 is used to execute the information verification program in the first memory 62 to implement the following steps:
[0149] Generate a remote certificate for verifying a target hardware module on a first electronic device; the target hardware module is used to access a trusted execution storage block;
[0150] Verify the legitimacy of the remote attestation and obtain an attestation report; wherein the attestation report indicates whether the remote attestation is legal;
[0151] Generate verification information based on the attestation report and the target identifier of the trusted execution storage block; wherein the target identifier is used to uniquely identify the trusted execution storage block;
[0152] The verification information is stored in the blockchain; wherein the verification information is used by the second electronic device to determine whether the certification report is legal; the second electronic device corresponds to the second node of the blockchain.
[0153] In other embodiments of the present application, the first processor 63 is used to execute the generation of the information verification program in the first memory 62 to verify the remote attestation of the target hardware module on the first electronic device, so as to implement the following steps:
[0154] Generate a remote attestation for verifying a target hardware module and target information; wherein the target information is stored in a trusted execution storage module;
[0155] Accordingly, the first processor 63 is used to execute the information verification program in the first memory 62 to verify the legitimacy of the remote attestation to obtain an attestation report, so as to implement the following steps:
[0156] Sending remote proof to a third electronic device; wherein the trust level of the third electronic device is greater than a preset level;
[0157] Receive a certification report for remote certification sent by a third electronic device; wherein the certification report is generated after the third electronic device verifies the legitimacy of the remote certification.
[0158] In other embodiments of the present application, the first processor 63 is used to execute the information verification program in the first memory 62 to generate verification information based on the attestation report and the target identifier of the trusted execution storage block, so as to implement the following steps:
[0159] Determine the random factor;
[0160] Based on the attestation report, the target identifier and the random factor, verification information is generated.
[0161] In other embodiments of the present application, the first processor 63 is used to execute the information verification program in the first memory 62 to store the verification information in the blockchain to implement the following steps:
[0162] Call the smart contract corresponding to the target identifier on the blockchain, and store the verification information in the blockchain through the smart contract.
[0163] It should be noted that the specific implementation process of the steps executed by the processor in this embodiment can refer to Figure 1 and Figure 3 The implementation process of the information verification method provided in the corresponding embodiment will not be repeated here.
[0164] The first device provided in the embodiment of the present application generates a remote attestation for verifying a target hardware module for accessing a trusted execution storage block on the first electronic device, verifies the legitimacy of the remote attestation to obtain an attestation report, generates verification information based on the attestation report and the target identifier of the trusted execution storage block, and stores the verification information in a blockchain. In this way, a second electronic device can verify the legitimacy of a hardware module for accessing an unverified Enclave based on the verification information generated for the unverified Enclave, and a device communicating with the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of forged hardware access to data in the Enclave in the relative technology and ensuring the security of data in the Enclave.
[0165] Based on the above embodiments, the embodiments of the present application provide a second electronic device, which can be applied to Figure 2 and Figure 3 In the information verification method provided in the corresponding embodiment, refer to Figure 8 As shown, the second electronic device includes: a second processor 71, a second memory 72 and a second communication bus 73;
[0166] The second communication bus 73 is used to realize the communication connection between the second processor 71 and the second memory 72;
[0167] The second processor 73 is used to execute the information verification program in the second memory 72 to implement the following steps:
[0168] Obtaining a target identifier of a trusted execution storage block of a first electronic device, and obtaining verification information corresponding to the target identifier from a blockchain; the first electronic device corresponds to a first node of the blockchain; wherein the target identifier is used to uniquely identify the trusted execution storage block;
[0169] Obtain a certification report from the verification information, and verify the legitimacy of the certification report to obtain a verification result;
[0170] Based on the verification result, it is determined whether the target hardware module on the first electronic device is legal; wherein the target hardware module is used to access the trusted execution storage block.
[0171] In other embodiments of the present application, the second processor 73 is used to execute the information verification program in the second memory 72 to obtain a certification report from the verification information, and verify the legitimacy of the certification report to obtain a verification result, so as to implement the following steps:
[0172] Get the random factor from the verification information;
[0173] The legitimacy of the certification report is verified based on the random factor to obtain the verification result.
[0174] In other embodiments of the present application, the second processor 73 is used to execute the information verification program in the second memory 72 to obtain the target identifier of the trusted execution storage block of the first electronic device, and obtain the verification information corresponding to the target identifier from the blockchain to implement the following steps:
[0175] Obtain a target identifier of a trusted execution storage block;
[0176] The smart contract corresponding to the target ID is called, and the verification information corresponding to the target ID is obtained from the blockchain through the smart contract.
[0177] In other embodiments of the present application, the second processor 73 is used to execute the information verification program in the second memory 72 to determine whether the target hardware module on the first electronic device is legal based on the verification result, so as to implement the following steps:
[0178] Based on the verification result, determining whether the target hardware module on the first electronic device is legal and whether the target information has been tampered with; wherein the target information is stored in the trusted execution storage block;
[0179] Accordingly, the second processor 73 is used to execute the information verification program in the second memory 72, and can also implement the following steps:
[0180] If the verification result indicates that the trusted execution storage block is legal and the target information has not been tampered with, a trusted mark is added to the trusted execution storage block; wherein the trusted mark indicates that the first electronic device can perform data transmission through the trusted execution storage block.
[0181] It should be noted that the specific implementation process of the steps executed by the processor in this embodiment can refer to Figure 2 and Figure 3 The implementation process of the information verification method provided in the corresponding embodiment will not be repeated here.
[0182] The second electronic device provided by the embodiment of the present application can obtain the target identifier of the trusted execution storage block of the first electronic device, and obtain the verification information corresponding to the target identifier from the blockchain, and then obtain the certification report from the verification information and verify the legitimacy of the certification report to obtain the verification result, and finally determine whether the target hardware module on the first electronic device is legal based on the verification result. In this way, the second electronic device can verify the legitimacy of accessing the hardware module of the unverified Enclave based on the verification information generated for the unverified Enclave, and the device communicating with the unverified Enclave can know whether the unverified Enclave is safe, thereby solving the risk of data in the Enclave being forged by hardware access in the relative technology and ensuring the security of the data in the Enclave.
[0183] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the following. Figures 1 to 3 The corresponding embodiments provide steps of the information verification method.
[0184] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.
[0185] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0186] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0187] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0188] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.
Claims
1. An information verification method, the method being applied to a first electronic device, the first electronic device corresponding to a first node of a blockchain, the method comprising: generating a remote attestation for verifying a target hardware module on the first electronic device; The target hardware module is used to access the trusted execution storage block; Verifying the legitimacy of the remote attestation and obtaining an attestation report; wherein the attestation report indicates whether the remote attestation is legitimacy; Generate verification information based on the certification report and the target identifier of the trusted execution storage block; wherein the target identifier is used to uniquely identify the trusted execution storage block; The verification information is stored in the blockchain; the verification information is used by a second electronic device to determine whether the certification report is legal; the second electronic device corresponds to a second node of the blockchain; The generating verification information based on the attestation report and the target identifier of the trusted execution storage block includes: Determine the random factor; The verification information is generated based on the attestation report, the target identifier and the random factor.
2. The method according to claim 1, wherein generating a remote attestation for verifying a target hardware module on the first electronic device comprises: Generate a remote certificate for verifying the target hardware module and target information; wherein the target information is stored in the trusted execution storage module; Accordingly, the verification of the legitimacy of the remote attestation to obtain an attestation report includes: Sending the remote proof to a third electronic device; wherein the trust level of the third electronic device is greater than a preset level; Receive the certification report for the remote certification sent by the third electronic device; wherein the certification report is generated after the third electronic device verifies the legitimacy of the remote certification.
3. The method according to claim 1 or 2, wherein storing the verification information in the blockchain comprises: The smart contract corresponding to the target identifier of the blockchain is called, and the verification information is stored in the blockchain through the smart contract.
4. An information verification method, the method being applied to a second electronic device, the second electronic device corresponding to a second node of a blockchain, the method comprising: Obtaining a target identifier of a trusted execution storage block of the first electronic device, and obtaining verification information corresponding to the target identifier from the blockchain; The first electronic device corresponds to a first node of the blockchain; wherein the target identifier is used to uniquely identify the trusted execution storage block; Obtaining a certification report from the verification information, and verifying the legitimacy of the certification report to obtain a verification result; Based on the verification result, determine whether a target hardware module on the first electronic device is legal; wherein the target hardware module is used to access a trusted execution storage block.
5. The method according to claim 4, wherein obtaining a certification report from the verification information and verifying the legitimacy of the certification report to obtain a verification result comprises: Obtaining a random factor from the verification information; The legitimacy of the certification report is verified based on the random factor to obtain the verification result.
6. The method according to claim 4, wherein obtaining a target identifier of a trusted execution storage block of the first electronic device and obtaining verification information corresponding to the target identifier from the blockchain comprises: Obtaining a target identifier of the trusted execution storage block; A smart contract corresponding to the target identifier is called, and verification information corresponding to the target identifier is obtained from the blockchain through the smart contract.
7. The method according to claim 4, wherein determining whether the target hardware module on the first electronic device is legal based on the verification result comprises: Based on the verification result, determining whether the target hardware module on the first electronic device is legal and whether the target information has been tampered with; wherein the target information is stored in the trusted execution storage block; Accordingly, the method further includes: If the verification result indicates that the trusted execution storage block is legal and the target information has not been tampered with, a trusted mark is added to the trusted execution storage block; wherein the trusted mark indicates that the first electronic device can perform data transmission through the trusted execution storage block.
8. A first electronic device, the first electronic device corresponding to a first node of a blockchain, the first electronic device comprising: A generation unit, a verification unit and a storage unit, wherein: The generating unit is used to generate a remote certificate for verifying a target hardware module on the first electronic device; the target hardware module is used to access a trusted execution storage block; The verification unit is used to verify the legitimacy of the remote certification and obtain a certification report; wherein the certification report indicates whether the remote certification is legal; The generating unit is further configured to generate verification information based on the attestation report and the target identifier of the trusted execution storage block; wherein the target identifier is used to uniquely identify the trusted execution storage block; the generating verification information based on the attestation report and the target identifier of the trusted execution storage block comprises: determining a random factor; generating the verification information based on the attestation report, the target identifier and the random factor; The storage unit is used to store the verification information in the blockchain; the verification information is used by the second electronic device to determine whether the certification report is legal; the second electronic device corresponds to the second node of the blockchain.
9. A second electronic device, the second electronic device corresponding to a second node of the blockchain, the second electronic device comprising: An acquisition unit, a processing unit, and a determination unit, wherein: The acquisition unit is used to acquire a target identifier of a trusted execution storage block of a first electronic device, and acquire verification information corresponding to the target identifier from the blockchain; the first electronic device corresponds to a first node of the blockchain; wherein the target identifier is used to uniquely identify the trusted execution storage block; The processing unit is used to obtain a certification report from the verification information, and verify the legitimacy of the certification report to obtain a verification result; The determination unit is used to determine whether a target hardware module on the first electronic device is legal based on the verification result; wherein the target hardware module is used to access a trusted execution storage block.
Citation Information
Patent Citations
Information processing method and information processing device
CN110519260A