A method and apparatus for integrity measurement

Abstract

The application relates to the field of network security, in particular to an integrity measurement method and an integrity measurement device. The method comprises the following steps: a first measurement module performs integrity measurement on a second measurement module to obtain a first measurement result. Herein, the credibility of the first measurement module is higher than that of the second measurement module. The first measurement module receives a second measurement result sent by the second measurement module. The second measurement result is obtained by the second measurement module performing integrity measurement on an object to be measured. The first measurement module sends measurement result information to a proof module. The measurement result information is determined by the first measurement result and the second measurement result. The proof module determines whether the object to be measured passes the integrity verification according to the measurement result information. The method can improve the accuracy and reliability of the integrity measurement.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to an integrity measurement method and an integrity measurement device. BACKGROUND

[0002] With the continuous development of Internet technology, network security technology has also made great progress. In recent years, the object of malicious network attacks has gradually shifted from the executable files in the system of terminal devices to the processes running in the memory, and such malicious attacks on the memory have strong concealment. Therefore, how to accurately verify the integrity of the memory has become one of the problems to be solved.

[0003] In the prior art, a dynamic integrity measurement (DIM) method is usually used to verify the integrity of the memory. The so-called DIM method is to measure the integrity of the part in the memory image that does not change (such as the kernel code segment, the kernel module code segment, the user process code segment, etc.), and then determine whether the memory image is tampered with according to the obtained measurement result, so as to determine whether the memory is subjected to malicious attacks. However, the existing DIM process does not establish a complete trust chain, and the security of the measurement module that executes the DIM method cannot be guaranteed, so that the feasibility of the measurement result of the DIM method is low. Therefore, how to improve the accuracy and reliability of the integrity measurement has become one of the problems to be solved. SUMMARY

[0004] In order to solve the above problems, the present application provides an integrity measurement method and an integrity measurement device, which can improve the accuracy and reliability of the integrity measurement.

[0005] In a first aspect, an embodiment of the present application provides an integrity measurement method. A first measurement module can measure the integrity of a second measurement module to obtain a first measurement result. Here, the trustworthiness of the first measurement module is higher than that of the second measurement module. The second measurement module measures the integrity of a to-be-measured object to obtain a second measurement result, and sends the second measurement result to the first measurement module. Then, the first measurement module sends measurement result information to a proof module. Here, the measurement result information is determined by the first measurement result and the second measurement result. The proof module determines whether the to-be-measured object passes the integrity verification according to the measurement result information.

[0006] In the embodiment of the present application, the first measurement module obtains the first measurement result corresponding to the second measurement module and the second measurement result corresponding to the object to be measured, and sends the measurement result information determined by the first measurement result and the second measurement result to the proof module, so that the proof module determines whether the object to be measured passes the integrity verification according to the measurement result information. In the entire measurement process, the first measurement module with higher credibility is used as the measurement root to obtain the integrity measurement results of the first measurement module and the object to be measured and provide the results to the proof module, thereby constructing a complete trust chain and improving the accuracy and reliability of the integrity measurement.

[0007] In combination with the first aspect, in a feasible implementation manner, the first measurement module can determine the first measurement result and the second measurement result as the measurement result information. Then, the first measurement module sends the measurement result information to the proof module. The first measurement module directly determines the first measurement result and the second measurement result as the measurement result information and sends the measurement result information to the second measurement module, which is simple and easy to implement and can improve the efficiency of the integrity measurement.

[0008] In combination with the first aspect, in a feasible implementation manner, the first measurement module can send the first measurement result and the second measurement result to a trusted platform module (TPM) respectively. The TPM can perform platform configuration register (PCR) extension on the first measurement result and the second measurement result respectively to obtain a first PCR value and a second PCR value corresponding to the first measurement result. The TPM determines the first PCR value and the second PCR value as the measurement result information and sends the measurement result information to the proof module. In this implementation manner, the first measurement module extends the measurement result into the corresponding PCR value through the TPM with higher security and reliability, and then sends the extended PCR value as the measurement result information to the proof module through the TPM, which can effectively prevent the measurement result from being tampered with and the like, and ensures the security of the measurement result transmission.

[0009] In combination with the first aspect, in a feasible implementation manner, the second measurement module includes a first measurement submodule and a second measurement submodule. The first measurement result includes a first measurement subresult and a second measurement subresult. The first measurement module performs integrity measurement on the first measurement submodule to obtain the first measurement subresult. The first measurement submodule performs integrity measurement on the second measurement submodule to obtain the second measurement subresult and sends the second measurement subresult to the first measurement module.

[0010] With reference to the first aspect, in a possible implementation of the first aspect, the first measurement module determines the first measurement sub-result, the second measurement sub-result and the second measurement result as measurement result information, and sends the measurement result information to the attestation module.

[0011] With reference to the first aspect, in a possible implementation of the first aspect, the first measurement module sends the first measurement sub-result, the second measurement sub-result and the second measurement result to the TPM respectively. The TPM performs PCR extension on the first measurement sub-result, the second measurement sub-result and the second measurement result respectively to obtain a first sub-PCR value corresponding to the first measurement sub-result, a second sub-PCR value corresponding to the second measurement sub-result and a second PCR value corresponding to the second measurement result. The TPM determines the first sub-PCR value, the second sub-PCR value and the second PCR value as measurement result information, and sends the measurement result information to the attestation module.

[0012] With reference to the first aspect, in a possible implementation of the first aspect, before the first measurement module performs integrity measurement on the second measurement module to obtain the first measurement result, the first measurement module can further determine that a preset measurement trigger condition is met. Here, the measurement trigger condition is at least one of a preset measurement period being reached, a preset system abnormal event occurring, and a measurement trigger instruction from a user being received. Here, different measurement trigger conditions are set to trigger the first measurement module to actively start integrity measurement on the object to be measured, which can reduce the attack time window of the object to be measured and improve the security of the object to be measured.

[0013] With reference to the first aspect, in a possible implementation of the first aspect, when the measurement trigger condition is a preset system abnormal event, if the first measurement module receives a system abnormal message sent by an intrusion detection system (IDS), it is determined that the preset trigger condition is met. Here, the system abnormal message is sent by the IDS when the system abnormal event is detected. Here, the IDS is used to detect whether the system abnormal event occurs, which can reduce the data processing amount of the first measurement module.

[0014] With reference to the first aspect, in a possible implementation of the first aspect, when the first measurement module determines that the preset measurement trigger condition is met, the first measurement module can further send first measurement indication information to the second measurement module, where the first measurement indication information is used to indicate the second measurement module that the first measurement module is about to perform integrity measurement on the second measurement module.

[0015] In a second aspect, the embodiments of the present application provide a method for integrity measurement. A proving module receives measurement result information sent by a first measurement module. The measurement result information is determined by a first measurement result and a second measurement result. The first measurement result is a result of integrity measurement of the second measurement module by the first measurement module. The second measurement result is a result of integrity measurement of an object to be measured by the second measurement module. The credibility of the measurement module is higher than that of the second measurement module. The proving module determines whether the object to be measured passes integrity verification according to the measurement result information. Here, the proving module determines whether the object to be measured passes integrity verification in combination with the first measurement result and the second measurement result, which can avoid the occurrence of low credibility of the measurement result of the object to be measured due to unknown security of the second measurement module, improve the credibility of the integrity measurement result, and improve the accuracy and reliability of the method for integrity measurement.

[0016] In combination with the second aspect, in a first possible implementation manner, the measurement result information includes the first measurement result and the second measurement result. If the proving module determines that the first measurement result is the same as a first baseline value corresponding to the second measurement module and the second measurement result is the same as a second baseline value corresponding to the object to be measured, it is determined that the object to be measured passes integrity verification. If the proving module determines that the first measurement result is not the same as the first baseline value, or determines that the second measurement result is not the same as the second baseline value, it is determined that the object to be measured does not pass integrity verification.

[0017] In combination with the second aspect, in a first possible implementation manner, the measurement result information includes a first PCR value and a second PCR value. The first PCR value is obtained by performing PCR expansion on the first measurement result by a TPM through the first measurement module, and the second PCR value is obtained by performing PCR expansion on the second measurement result by the TPM through the first measurement module. If the proving module determines that the first PCR value is equal to a first PCR check value and the second PCR value is equal to a second PCR check value, it is determined that the object to be measured passes integrity verification. If the proving module determines that the first PCR value is not equal to the first PCR check value, or determines that the second PCR value is not equal to the second PCR check value, it is determined that the object to be measured does not pass integrity verification. The first PCR check value is obtained by performing PCR expansion on the first baseline value corresponding to the second measurement module and a first PCR initial value by the proving module. The second PCR check value is obtained by performing PCR expansion on the second baseline value corresponding to the object to be measured and a second PCR initial value by the proving module.

[0018] With reference to the second aspect, in a possible implementation, the second measurement module includes a first measurement sub-module and a second measurement sub-module, and the first measurement result includes a first measurement sub-result and a second measurement sub-result. The measurement result information includes the first measurement sub-result, the second measurement sub-result, and the second measurement result. If the proving module determines that the first measurement sub-result is the same as a first sub-baseline value corresponding to the first measurement sub-module, the second measurement sub-result is the same as a second sub-baseline value corresponding to the second measurement sub-module, and the second measurement result is the same as a second baseline value corresponding to the object to be measured, it is determined that the object to be measured passes the integrity verification. If the proving module determines that the first measurement sub-result is not the same as the first sub-baseline value corresponding to the first measurement sub-module, or the second measurement sub-result is not the same as the second sub-baseline value corresponding to the second measurement sub-module, or the second measurement result is the same as the second baseline value corresponding to the object to be measured, it is determined that the object to be measured fails the integrity verification.

[0019] With reference to the second aspect, in a possible implementation, the second measurement module includes a first measurement sub-module and a second measurement sub-module, and the first measurement result includes a first measurement sub-result and a second measurement sub-result. The measurement result information includes a first sub-PCR value, a second sub-PCR value, and a second PCR value, the first sub-PCR value is obtained by performing PCR expansion on the first measurement sub-result by the TPM, the second sub-PCR value is obtained by performing PCR expansion on the second measurement sub-result by the TPM, and the second PCR value is obtained by performing PCR expansion on the second measurement result by the TPM. If the proving module determines that the first sub-PCR value is equal to a first sub-PCR verification value, the second sub-PCR value is equal to a second sub-PCR verification value, and the second PCR value is equal to a second PCR verification value, it is determined that the object to be measured passes the integrity verification. If the proving module determines that the first sub-PCR value is not equal to the first sub-PCR verification value, or the second sub-PCR value is not equal to the second sub-PCR verification value, or the second PCR value is not equal to the second PCR verification value, it is determined that the object to be measured fails the integrity verification. The first sub-PCR verification value is obtained by performing PCR expansion on a first sub-baseline value corresponding to the second measurement module and a first sub-PCR initial value by the proving module. The second sub-PCR verification value is obtained by performing PCR expansion on a second sub-baseline value corresponding to the second measurement module and a second sub-PCR initial value by the proving module. The second PCR verification value is obtained by performing PCR expansion on a second baseline value corresponding to the object to be measured and a second PCR initial value by the proving module.

[0020] In a third aspect, the embodiments of the present application provide a method for integrity measurement. In a case where a first measurement module performs integrity measurement on a second measurement module, the second measurement module performs integrity measurement on an object to be measured to obtain a second measurement result. The credibility of the first measurement module is higher than that of the second measurement module. The second measurement module sends the second measurement result to the first measurement module.

[0021] In a possible implementation of the third aspect, if the second measurement module receives the first measurement indication information, it can be determined that the first measurement module performs integrity measurement thereon.

[0022] In a fourth aspect, the embodiments of the present application provide an integrity measurement apparatus, which can be the first measurement module. The integrity measurement apparatus can include:

[0023] a processor unit configured to perform integrity measurement on a second measurement module to obtain a first measurement result, wherein the credibility of the first measurement module is higher than that of the second measurement module.

[0024] a transceiver unit configured to receive a second measurement result sent by the second measurement module, wherein the second measurement result is obtained by performing integrity measurement on an object to be measured by the second measurement module.

[0025] The processor unit is further configured to determine measurement result information according to the first measurement result and the second measurement result.

[0026] The transceiver unit is further configured to send the measurement result information to a proving module, wherein the proving module is configured to determine whether the object to be measured passes integrity verification according to the measurement result information.

[0027] In a possible implementation of the fourth aspect, the processor unit can determine the first measurement result and the second measurement result as the measurement result information. Then, the transceiver unit can send the measurement result information to the proving module.

[0028] In a possible implementation of the fourth aspect, the transceiver unit can send the first measurement result and the measurement result to a TPM, respectively. The TPM can perform platform configuration register PCR extension on the first measurement result and the second measurement result, respectively, to obtain a first PCR value and a second PCR value corresponding to the first measurement result. The TPM can further determine the first PCR value and the second PCR value as the measurement result information and send the measurement result information to the proving module.

[0029] With reference to the fourth aspect, in a possible implementation, the second measurement module includes a first measurement sub-module and a second measurement sub-module. The first measurement result includes a first measurement sub-result and a second measurement sub-result. The processing unit is configured to perform integrity measurement on the first measurement sub-module to obtain the first measurement sub-result. The first measurement sub-module performs integrity measurement on the second measurement sub-module to obtain the second measurement sub-result and sends the second measurement result to the transceiving unit.

[0030] With reference to the fourth aspect, in a possible implementation, the processing unit is configured to determine the first measurement sub-result, the second measurement sub-result and the second measurement result as measurement result information. The first measurement module sends the measurement result information to the attestation module.

[0031] With reference to the fourth aspect, in a possible implementation, the transceiving unit is configured to send the first measurement sub-result, the second measurement sub-result and the second measurement result to the TPM respectively. The TPM performs PCR extension on the first measurement sub-result, the second measurement sub-result and the second measurement result respectively to obtain a first sub-PCR value corresponding to the first measurement sub-result, a second sub-PCR value corresponding to the second measurement sub-result and a second PCR value corresponding to the second measurement result. The TPM determines the first sub-PCR value, the second sub-PCR value and the second PCR value as measurement result information and sends the measurement result information to the attestation module.

[0032] With reference to the fourth aspect, in a possible implementation, before the first measurement module performs integrity measurement on the second measurement module to obtain the first measurement result, the processing unit is further configured to determine that a preset measurement trigger condition is met. Here, the measurement trigger condition is at least one of a preset measurement period being reached, a preset system abnormal event occurring, and a measurement trigger instruction from a user being received.

[0033] With reference to the fourth aspect, in a possible implementation, when the measurement trigger condition is the preset system abnormal event occurring, if the processing unit determines that a system abnormal message sent by the IDS is received, it is determined that the preset trigger condition is met. Here, the system abnormal message is sent by the IDS when the system abnormal event is detected to occur.

[0034] With reference to the fourth aspect, in a possible implementation, when the processing unit determines that the preset measurement trigger condition is met, the transceiving unit is further configured to send first measurement indication information to the second measurement module. The first measurement indication information is used to indicate the second measurement module that the first measurement module is about to perform integrity measurement on the second measurement module.

[0035] In a fifth aspect, an embodiment of the present application provides an integrity measurement device, which can be the attestation module. The integrity measurement device can include:

[0036] a transceiver configured to receive measurement result information sent by the first measurement module. The measurement result information is determined by a first measurement result and a second measurement result. The first measurement result is a result of integrity measurement of the second measurement module by the first measurement module. The second measurement result is a result of integrity measurement of the object to be measured by the second measurement module. The credibility of the measurement module is higher than that of the second measurement module.

[0037] a processing unit configured to determine whether the object to be measured passes the integrity verification according to the measurement result information.

[0038] With reference to the fifth aspect, in a possible implementation, the measurement result information includes the first measurement result and the second measurement result. If the processing unit determines that the first measurement result is the same as a first baseline value corresponding to the second measurement module and the second measurement result is the same as a second baseline value corresponding to the object to be measured, it is determined that the object to be measured passes the integrity verification. If the processing unit determines that the first measurement result is not the same as the first baseline value, or determines that the second measurement result is not the same as the second baseline value, it is determined that the object to be measured does not pass the integrity verification.

[0039] With reference to the fifth aspect, in a possible implementation, the measurement result information includes a first PCR value and a second PCR value. The first PCR value is obtained by performing PCR expansion on the first measurement result by the TPM through the first measurement module, and the second PCR value is obtained by performing PCR expansion on the second measurement result by the TPM through the first measurement module. If the processing unit determines that the first PCR value is equal to a first PCR verification value and the second PCR value is equal to a second PCR verification value, it is determined that the object to be measured passes the integrity verification. If the processing unit determines that the first PCR value is not equal to the first PCR verification value, or determines that the second PCR value is not equal to the second PCR verification value, it is determined that the object to be measured does not pass the integrity verification. The first PCR verification value is obtained by performing PCR expansion on the first baseline value corresponding to the second measurement module and a first PCR initial value by the attestation module. The second PCR verification value is obtained by performing PCR expansion on the second baseline value corresponding to the object to be measured and a second PCR initial value by the attestation module.

[0040] With reference to the fifth aspect, in a possible implementation, the second measurement module includes a first measurement sub-module and a second measurement sub-module, and the first measurement result includes a first measurement sub-result and a second measurement sub-result. The measurement result information includes the first measurement sub-result, the second measurement sub-result, and the second measurement result. If the processing unit determines that the first measurement sub-result is the same as a first sub-baseline value corresponding to the first measurement sub-module, the second measurement sub-result is the same as a second sub-baseline value corresponding to the second measurement sub-module, and the second measurement result is the same as a second baseline value corresponding to the object to be measured, the object to be measured passes the integrity verification. If the processing unit determines that the first measurement sub-result is not the same as the first sub-baseline value corresponding to the first measurement sub-module, or the second measurement sub-result is not the same as the second sub-baseline value corresponding to the second measurement sub-module, or the second measurement result is the same as the second baseline value corresponding to the object to be measured, the object to be measured fails the integrity verification.

[0041] With reference to the fifth aspect, in a possible implementation, the second measurement module includes a first measurement sub-module and a second measurement sub-module, and the first measurement result includes a first measurement sub-result and a second measurement sub-result. The measurement result information includes a first sub-PCR value, a second sub-PCR value, and a second PCR value, the first sub-PCR value is obtained by performing PCR expansion on the first measurement sub-result by the TPM, the second sub-PCR value is obtained by performing PCR expansion on the second measurement sub-result by the TPM, and the second PCR value is obtained by performing PCR expansion on the second measurement result by the TPM. If the processing unit determines that the first sub-PCR value is equal to a first sub-PCR verification value, the second sub-PCR value is equal to a second sub-PCR verification value, and the second PCR value is equal to a second PCR verification value, the object to be measured passes the integrity verification. If the processing unit determines that the first sub-PCR value is not equal to the first sub-PCR verification value, or the second sub-PCR value is not equal to the second sub-PCR verification value, or the second PCR value is not equal to the second PCR verification value, the object to be measured fails the integrity verification. The first sub-PCR verification value is obtained by performing PCR expansion on a first sub-baseline value corresponding to the second measurement module and a first sub-PCR initial value by the attestation module. The second sub-PCR verification value is obtained by performing PCR expansion on a second sub-baseline value corresponding to the second measurement module and a second sub-PCR initial value by the attestation module. The second PCR verification value is obtained by performing PCR expansion on a second baseline value corresponding to the object to be measured and a second PCR initial value by the attestation module.

[0042] In a sixth aspect, an embodiment of the present application provides an integrity measurement device, which can be the second measurement module. The integrity measurement device comprises:

[0043] a processing unit configured to perform integrity measurement on the object to be measured to obtain a second measurement result, if it is determined that the first measurement module performs integrity measurement on the second measurement module.

[0044] a transceiving unit configured to send the second measurement result to the first measurement module.

[0045] In combination with the sixth aspect, in a possible implementation, if the transceiving unit receives first measurement indication information, it can be determined that the first measurement module performs integrity measurement thereon.

[0046] In combination with the first aspect to the sixth aspect, in a possible implementation, the first measurement module is a preset measurement trusted root. Here, the measurement trusted root with the highest credibility is used as the first measurement module, which can further improve the accuracy and reliability of the integrity measurement method.

[0047] In combination with the first aspect to the sixth aspect, in a possible implementation, the first measurement module is a DIM trusted execution environment (TEE) module or a hardware security module (HSM), and the second measurement module is a DIM module.

[0048] In combination with the first aspect to the sixth aspect, in a possible implementation, the first measurement module is an HSM, the first measurement sub-module is a DIM TEE module, and the second measurement sub-module is a DIM module.

[0049] In combination with the first aspect to the third aspect, in a possible implementation, the proof module comprises a local proof module or a remote proof module.

[0050] In combination with the first aspect to the sixth aspect, in a possible implementation, the object to be measured comprises a memory code segment or a static file.

[0051] In combination with the first aspect to the sixth aspect, in a possible implementation, the object to be measured comprises a memory code segment, and the memory code segment comprises at least one of a kernel code segment, a kernel module code segment, and a user state process code segment.

[0052] In a seventh aspect, an embodiment of the present application provides an integrity measurement apparatus. The integrity measurement apparatus can be the first measurement module. The integrity measurement apparatus comprises a memory, a processor and a transceiver. The processor is configured to invoke the code stored in the memory to execute the integrity measurement method provided in any feasible implementation manner of the first aspect.

[0053] In an eighth aspect, an embodiment of the present application provides an integrity measurement apparatus. The integrity measurement apparatus can be the proof module. The integrity measurement apparatus comprises a memory, a processor and a transceiver. The processor is configured to invoke the code stored in the memory to execute the integrity measurement method provided in any feasible implementation manner of the second aspect.

[0054] In a ninth aspect, an embodiment of the present application provides an integrity measurement apparatus. The integrity measurement apparatus can be the second measurement module. The integrity measurement apparatus comprises a memory, a processor and a transceiver. The processor is configured to invoke the code stored in the memory to execute the integrity measurement method provided in any feasible implementation manner of the third aspect.

[0055] In a tenth aspect, an embodiment of the present application provides an integrity measurement apparatus. The integrity measurement apparatus can comprise a first measurement module. The first measurement module is configured to perform integrity measurement on a second measurement module to obtain a first measurement result. The credibility of the first measurement module is higher than the credibility of the second measurement module. The first measurement module is further configured to receive a second measurement result sent by the second measurement module. The second measurement result is obtained by performing integrity measurement on an object to be measured by the second measurement module. The first measurement module is further configured to determine measurement result information according to the first measurement result and the second measurement result. The first measurement module is further configured to send the measurement result information to a proof module. The proof module is configured to determine whether the object to be measured passes the integrity verification according to the measurement result information.

[0056] In combination with the tenth aspect, in a feasible implementation manner, the integrity measurement apparatus further comprises at least one of the proof module, the second measurement module and the object to be measured.

[0057] In an eleventh aspect, an embodiment of the present application provides an integrity measurement apparatus, which can include a processor, and a transceiver. The processor is configured to support the first measurement module to perform the corresponding functions in the integrity measurement method. The processor can also be configured to support at least one of the second measurement module, the proof module, and the object to be measured to perform the corresponding functions in the method. The transceiver is configured to support the communication between the first measurement module and the proof module. The integrity measurement apparatus can also include a memory coupled to the processor, which stores the program instructions and data necessary for at least one of the first measurement module, the second measurement module, the proof module, and the object to be measured.

[0058] In a twelfth aspect, an embodiment of the present application provides a chip or a chip system, which includes an input / output interface and a processing circuit. The input / output interface is configured to exchange information or data. The processing circuit is configured to execute instructions to cause an integrity measurement apparatus in which the chip or the chip system is installed to perform the integrity measurement method in any one of the first aspect to the third aspect.

[0059] In a thirteenth aspect, an embodiment of the present application provides a computer readable storage medium, which stores instructions. The instructions can be executed by one or more processors on a processing circuit. When the instructions are executed on a computer, the computer is caused to perform the integrity measurement method in any one of the first aspect to the third aspect.

[0060] In a fourteenth aspect, an embodiment of the present application provides a computer program product including instructions. When the instructions are executed on a computer, the computer is caused to perform the integrity measurement method in any one of the first aspect to the third aspect. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 FIG. 1 is a structural schematic diagram of an integrity measurement apparatus according to an embodiment of the present application;

[0062] Figure 2 FIG. 2 is a flowchart of an integrity measurement method according to an embodiment of the present application;

[0063] Figure 3 FIG. 3 is another flowchart of an integrity measurement method according to an embodiment of the present application;

[0064] Figure 4 FIG. 4 is a structural schematic diagram of another integrity measurement apparatus according to an embodiment of the present application;

[0065] Figure 5 FIG. 5 is a structural schematic diagram of still another integrity measurement apparatus according to an embodiment of the present application;

[0066] Figure 6 is a structural schematic diagram of still another integrity measurement device provided by an embodiment of the present application;

[0067] Figure 7 is a structural schematic diagram of still another integrity measurement device provided by an embodiment of the present application;

[0068] Figure 8 is a structural schematic diagram of still another integrity measurement device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0069] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0070] It should be noted that the terms "first", "second", and the like in the description and claims of the present application and the drawings are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data or objects thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0071] In the prior art, the DIM method is usually used to measure the integrity of the memory to determine whether the memory has been subjected to malicious attacks. However, the existing DIM process does not establish a complete trust chain, and the security of the measurement module that executes the DIM method cannot be guaranteed during execution. In the case that the security of the measurement module is threatened (such as subjected to a hacker attack), the measurement result obtained is no longer reliable. Therefore, the reliability of the measurement result of the existing DIM method is low.

[0072] Therefore, the technical problem to be solved by the present application is how to improve the accuracy and reliability of integrity measurement.

[0073] Please refer to Figure 1 , Figure 1 is a structural schematic diagram of an integrity measurement device provided by an embodiment of the present application. The integrity measurement device is applicable to the integrity measurement method provided by an embodiment of the present application. As shown in Figure 1The integrity measurement apparatus 10 can specifically include the first measurement module 101 involved in the integrity measurement method provided in the embodiments of the present application. Optionally, the integrity measurement apparatus 10 can further include one or more of the second measurement module 102, the proving module 103 and the object to be measured 104 involved in the integrity measurement method provided in the embodiments of the present application. In actual application, the first measurement module 101 is used to perform integrity measurement on the second measurement module 102 and obtain the result of the integrity measurement of the second measurement module 102 (for the convenience of understanding and distinguishing, the first measurement result will be used instead of description hereinafter). The second measurement module 102 is used to perform integrity measurement on the preset object to be measured 104, and send the result of the integrity measurement of the object to be measured 104 (for the convenience of understanding and distinguishing, the second measurement result will be used instead of description hereinafter) to the first measurement module 101. The first measurement module 101 is further used to determine the measurement result information according to the first measurement result and the second measurement result, and send the measurement result information to the proving module 103. The proving module 103 is used to determine whether the object to be measured 104 passes the integrity verification according to the measurement result information. The specific implementation of the functions of the modules can be referred to the description of the integrity measurement method provided in the embodiments of the present application, which will not be described in detail here.

[0074] It can be understood that the above Figure 1 The above is only an example of the structure of the integrity measurement system 10 provided in the embodiments of the present application, and in actual application, the integrity measurement system 10 can further include other functional modules in addition to the first measurement module 101, the second measurement module 102 and the proving module 103, which are not specifically limited in the present application.

[0075] Further, in an embodiment, the integrity measurement apparatus 10 can be an electronic device itself such as a tablet computer, a mobile terminal (such as a mobile phone), a laptop computer, a desktop computer, a wearable device, an optical line terminal (OLT), an optical network terminal (ONT) and the like, or can be a chip or a chip system inside the electronic device, such as a central processing unit (CPU), a microcontroller unit (MCU) or a system-on-a-chip (SOC) containing the CPU or the MCU inside the electronic device, which are not specifically limited in the present application.

[0076] In combination with Figure 1In an embodiment, the first measurement module 101, the second measurement module 102, the attestation module 103 and the object to be measured 104 can be software programs or software modules running on the integrity measurement apparatus 10. Specifically, the integrity measurement apparatus 10 can include a processor and a memory. The memory stores program codes or instruction sets corresponding to the first measurement module 101, the second measurement module 102, the attestation module 103 and the object to be measured 104, and the processor runs the program codes or instruction sets to support the first measurement module 101, the second measurement module 102, the attestation module 103 and the object to be measured 104 to implement the methods or functions involved in the integrity measurement method provided by the present application. Of course, it can be understood that when the integrity measurement apparatus 10 includes multiple processors and multiple memories, the program codes or instruction sets corresponding to the first measurement module 101, the second measurement module 102, the attestation module 103 and the object to be measured 104 can be respectively stored in different memories and run in different processors, and the present application does not make specific limitations. Here, the processor can be the CPU, MCU, SOC, etc. described above, and the memory can include a high-speed random access memory and a non-volatile memory such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include remote memories relative to the processor, which can be connected to the integrity measurement apparatus 10 through a network. Examples of the network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0077] Further, in yet another embodiment, the first measurement module 101 can also be implemented by a hardware circuit with logic processing capability connected internally or externally to the integrity measurement apparatus 10. Specifically, the hardware circuit can have logic information fixed therein, and the hardware circuit can implement the functions of the first measurement module 101 according to the logic information after being powered on. Optionally, the hardware circuit can be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic components, and the present application does not make specific limitations.

[0078] It should be noted that, in actual applications, the attestation module 103 can be divided into a local attestation module and a remote attestation module according to the location of the attestation module 103. The local attestation module refers to the attestation module 103 and the first measurement module 101 running in the same device. For example, when the attestation module 103 and the first measurement module 101 run on the same computer, the attestation module 103 is a local attestation module for the first measurement module 101. Optionally, in actual applications, when the attestation module 103 is a local attestation module, the attestation module 103 can be included in the first measurement module 101 or exist independently of the first measurement module 101, and the present application does not make specific limitations. The remote attestation module refers to the attestation module 103 and the first measurement module 101 existing in different devices, and the attestation module 103 and the first measurement module 101 need to interact with each other through a secure network. Optionally, when the attestation module 103 is a remote attestation module, it can include a remote attestation server (RA-server) and a remote attestation client (RA-client), and the remote attestation server interacts with the first measurement module 103 through the remote attestation client.

[0079] The process of the integrity measurement method provided by the present application will be described in detail below in combination with the structure of the integrity measurement device 10. Figure 1 The process of the integrity measurement method provided by the present application will be described in detail below in combination with the structure of the integrity measurement device 10. Figure 2 , Figure 2 is a flowchart of an integrity measurement method provided by an embodiment of the present application, as shown in Figure 2 The integrity measurement method includes the following steps:

[0080] S210, the first measurement module performs integrity measurement on the second measurement module and determines a first measurement result.

[0081] S220, the second measurement module performs integrity measurement on the object to be measured 104 to obtain a second measurement result, and sends the second measurement result to the first measurement module.

[0082] S230, the first measurement module determines measurement result information according to the first measurement result and the second measurement result, and sends the measurement result information to the attestation module.

[0083] S240, the attestation module determines whether the object to be measured 104 passes the integrity verification according to the measurement result information.

[0084] In some possible implementation manners, when the first measurement module 101 determines that the integrity measurement of the to-be-measured object 104 is needed, the integrity measurement of the second measurement module 102 is performed first to obtain the first measurement result, as described in step S210.

[0085] It should be noted that the credibility of the first measurement module 101 is higher than that of the second measurement module. Preferably, the first measurement module can be a measurement trusted root of the integrity measurement device 10. Generally, the measurement trusted root is a component that always operates in a preset manner, the content of which cannot be modified, and is absolutely trusted by the device associated with the measurement trusted root. For example, in the embodiment of the present application, the first measurement module 101 can be a measurement trusted root of the integrity measurement device 10, which is absolutely trusted by the integrity measurement device 10 or any functional entity in the integrity measurement device 10. The to-be-measured object 104 can be a memory code segment in a memory image of the integrity measurement device 10 that does not change, such as a kernel code segment, a kernel module code segment, a user process code segment, and the like. Alternatively, the to-be-measured object 104 can also be a static file stored in the memory. In actual application, the to-be-measured object 104 can exist in the integrity measurement device 10 or in another device connected to the integrity measurement device 10, which is not limited in the present application. In actual execution, the to-be-measured object 104 can be preset or determined by the first measurement module 103 based on the instruction input by the user, which is not limited in the present application. For the convenience of understanding and description, the execution process of the integrity measurement method provided in the embodiment of the present application will be described in detail below with the scenario that the first measurement module 101, the second measurement module 102 and the to-be-measured object 104 all exist in the integrity measurement device 10.

[0086] Optionally, referring to Figure 3 , Figure 3 is another flowchart of the integrity measurement method provided in the embodiment of the present application, as shown in Figure 3 Before the first measurement module 101 performs the integrity measurement on the second measurement module 102 and determines the first measurement result, the integrity measurement method can further include the following steps:

[0087] S200, the first measurement module determines that the preset measurement trigger condition is met, and then determines to perform the integrity measurement on the to-be-measured object 104.

[0088] In some possible implementation manners, the first measurement module 101 can first detect whether a preset measurement trigger condition is met. When the first measurement module 101 determines that the measurement trigger condition is met, it is determined to perform integrity measurement on the to-be-measured object 104. When the first measurement module 101 determines that the measurement trigger condition is not met, the operation of detecting whether the preset measurement trigger condition is met is repeated.

[0089] It should be noted that the measurement trigger condition can specifically include arrival of a preset measurement period. Alternatively, the measurement trigger condition can include occurrence of a preset system abnormal event. Here, the system abnormal event includes but is not limited to code segment rewriting, high-risk system call, or abnormal script execution, and the like. These system abnormal events are abnormal events of the operating system in which the to-be-measured object 104 is located, and occurrence of these system abnormal events can pose a security threat to the to-be-measured object 104. Alternatively, the measurement trigger condition can include receiving a measurement trigger instruction from a user. It can be understood that, in actual application, the preset measurement trigger condition can include one or more of the arrival of the preset measurement period, the occurrence of the preset system abnormal event, and the receiving of the measurement trigger instruction from the user, and can further include other conditions in addition to the above three conditions, which are not limited in the present application. Here, setting different measurement trigger conditions to trigger the first measurement module 1003 to actively start the integrity measurement on the to-be-measured object 104 can reduce the attack time window of the to-be-measured object 104 and improve the security of the to-be-measured object 104.

[0090] In one embodiment, when the measurement trigger condition includes arrival of a preset measurement period, it is assumed that the preset measurement period is T1. The first measurement module 101 can detect a time length T2 between a current time and a time at which the to-be-measured object 104 is last measured for integrity. When the first measurement module 101 determines that T2 is equal to T1, it is determined that the preset measurement period arrives, and it is determined to perform integrity measurement on the to-be-measured object 104.

[0091] In another embodiment, when the measurement trigger condition includes occurrence of a preset system abnormal event, an IDS in the operating system in which the to-be-measured object 104 is located can detect whether a system abnormal event occurs in the operating system in real time. When the IDS detects one or more of the system abnormal events occurring in the operating system, the IDS can send a system abnormality indication information to the first measurement module 101 and continue to detect the abnormal events in the operating system. Then, the first measurement module 101 can determine that the preset system abnormal event occurs if the system abnormality indication information sent by the IDS is detected, and it is determined to perform integrity measurement on the to-be-measured object 104.

[0092] In yet another embodiment, when the above-mentioned metric trigger condition is receiving a metric trigger instruction from the user, the first metric module 101 can detect the user instruction it receives in real time. When the first metric module 101 detects that the user instruction it receives includes a preset metric trigger instruction, it can determine to perform integrity measurement on the object to be measured 104. For example, assuming that the preset metric trigger instruction is a metric challenge instruction, when the attestation module 103 is a remote attestation module, the user can input an instruction to the remote attestation server of the attestation module 103 to indicate that the object to be measured is to be measured for integrity. After receiving the instruction, the remote attestation server can send a metric challenge instruction to the first metric module through the remote attestation client in the attestation module 103. After detecting the metric challenge instruction, the first metric module 103 can determine that the preset metric trigger instruction is received, and then determine to perform integrity measurement on the object to be measured 104.

[0093] In yet another embodiment, in the case of Figure 4 , Figure 4 is a structural schematic diagram of yet another integrity measurement device provided by the embodiments of the present application. As shown in Figure 4 , the integrity measurement device 10 can further include a metric trigger module 105. In the case where the integrity measurement system 10 further includes the metric trigger module 104, the operation of determining whether the preset metric trigger condition is met can be performed by the metric trigger module 105. For example, the metric trigger module 105 can determine whether a preset metric period is reached, or detect whether system anomaly indication information from the IDS is received, or detect whether a metric trigger instruction from the user is received. When the metric trigger module 105 determines that the preset metric trigger condition is met, it can send a metric trigger instruction to the first metric module 101. After the first metric module 101 detects the metric trigger instruction, it can determine to perform integrity measurement on the object to be measured 104. Here, performing the operation of determining whether the preset metric trigger condition is met by the metric trigger module 105 can reduce the amount of data interaction of the first metric module 101 with other modules, and also reduce the data processing amount of the first metric module 101 itself, which is conducive to ensuring the security and credibility of the first metric module 101.

[0094] Further, as described in step S210, after the first metric module 101 determines to perform integrity measurement on the object to be measured 104, it can first perform integrity measurement on the second metric module 102. The process of the first metric module 101 measuring the second metric module will be described in detail below in the case of whether the second metric module 102 is an independent module or is composed of multiple sub-modules.

[0095] Scenario one:

[0096] In the scenario where the second measurement module 102 is an independent module, the first measurement module 101 can first acquire the code segment corresponding to the second measurement module 102. For example, the first measurement module 101 can acquire the address space (for the convenience of understanding, the first address space will be used in the following description) fed back by the second measurement module 102 after the first start is completed, and extract the code segment corresponding to the second measurement module 102 from the first address space. For another example, the first measurement module 101 can also traverse all the code segments corresponding to the operating system, and determine the code segment corresponding to the second measurement module 102 from all the code segments of the operating system according to the code segment identifier corresponding to the second measurement module 102. Of course, the first measurement module 101 can also acquire the code segment corresponding to the second measurement module 102 in other manners, which is not limited in the present application. After the first measurement module 101 acquires the code segment corresponding to the second measurement module 102, the first measurement module 101 can perform hash processing on the code segment corresponding to the second measurement module 102 by using a preset hash function (for the convenience of distinction, the first hash function will be used in the following description) to obtain the hash value corresponding to the code segment. Then, the first measurement module 101 can determine the hash value as the first measurement result corresponding to the second measurement module 102.

[0097] Optionally, when the first measurement module 101 determines to measure the integrity of the second measurement module 102, the first measurement module 101 can also send a measurement indication information (for the convenience of distinction, the first measurement indication information will be used in the following description) to the second measurement module 102, which can be used to indicate the second measurement module 102 that the first measurement module 101 will measure the integrity of the second measurement module 102.

[0098] Scenario two:

[0099] In the scenario where the second measurement module 102 has multiple sub-modules, please refer to Figure 5 , Figure 5 is a structure diagram of another integrity measurement apparatus provided by the embodiment of the present application, as shown in Figure 5As shown, the second metric module 102 can include a first metric sub-module 1021 and a second metric sub-module 1022. In a specific implementation, the first metric module 101 can first perform integrity measurement on the first metric sub-module 1021 to obtain a first metric sub-result of the first metric sub-module 1021. Here, the specific process of the first metric module 101 performing integrity measurement on the first metric sub-module 1021 can refer to the process of the first metric module 101 performing integrity measurement on the second metric module 102 described in the foregoing scenario one, which will not be repeated here. Optionally, when the first metric module 101 determines to initiate integrity measurement on the first metric sub-module 1021, the first metric module 101 can also send a measurement indication information (for the convenience of distinction, the following will be described by a second measurement indication information instead) to the first metric sub-module 1021, which can be used to indicate to the first metric sub-module 1021 that the first metric module 101 will perform integrity measurement on it.

[0100] Further, the first metric sub-module 1021 can determine whether the first metric module 101 performs integrity measurement on it. For example, the first metric sub-module 1021 can detect the second measurement indication information in real time, and when it determines to receive the second measurement indication information from the first metric module 101, it can determine that the first metric module 101 performs integrity measurement on it. For another example, the first metric sub-module 1021 can also obtain the current system log and query the system log to determine whether the first metric module 101 performs integrity measurement on it. Of course, the first metric sub-module 1021 can also determine whether the first metric module 101 performs integrity measurement on it in other manners, which will not be specifically limited by the present application. When the first metric sub-module 1021 determines that the first metric module 101 performs integrity measurement on it, it can also perform integrity measurement on the second metric sub-module 1022 to obtain a second metric sub-result corresponding to the second metric sub-module 1022. It should be noted that the specific process of the first metric sub-module 1021 performing integrity measurement on the second metric sub-module 1022 can refer to the process of the first metric module 101 performing integrity measurement on the second metric module 102 described in the foregoing scenario one, which will not be repeated here. Then, the first metric sub-module 1021 can send the second metric sub-result obtained by it to the first metric module 101. Optionally, the first metric sub-module 1021 can also send a measurement indication information (for the convenience of distinction, the following will be described by a third measurement indication information instead) to the second metric sub-module 1022 when performing integrity measurement on the second metric sub-module 1022, which can be used to indicate to the second metric sub-module 1022 that the first metric sub-module 1021 performs integrity measurement on it.

[0101] In brief, in this scenario, the first measurement module 101 performs integrity measurement on the second measurement module 102 which comprises the first measurement sub-module 1021 and the second measurement sub-module 1022, and obtains the second measurement result comprising the first measurement sub-result and the second measurement sub-result.

[0102] It should also be noted that, Figure 5 The structure of the second measurement module 102 shown is only an example, and it can also comprise three or more measurement sub-modules, as long as there is at least one measurement sub-module for performing integrity measurement on the object 104 to be measured. The integrity measurement of the first measurement module 101 on the second measurement module 102 is to perform integrity measurement on each measurement sub-module in the second measurement module 102. The specific measurement process can be similar to that described above. The first measurement module 101 only measures one measurement sub-module A in the three or more measurement sub-modules, and the other measurement sub-modules in the three or more measurement sub-modules can be measured by the measurement sub-module A and send the measurement result to the first measurement module 101. Alternatively, the first measurement module 101 can directly perform integrity measurement on each measurement sub-module respectively and obtain the integrity measurement result of each measurement sub-module.

[0103] In some possible implementation manners, as described in the above step S220, the second measurement module 102 can also perform integrity measurement on the object 104 to be measured and obtain the second measurement result corresponding to the object 104 to be measured. The process of performing integrity measurement on the object 104 to be measured by the second measurement module 102 and obtaining the second measurement result corresponding to the object 104 to be measured will be described below in combination with the above scenario one and scenario two.

[0104] Scenario one:

[0105] In an embodiment, the second measurement module 102 can first determine whether the first measurement module 101 performs integrity measurement on it. For example, the second measurement module 102 can detect whether the first measurement indication information from the first measurement module 101 is received. When the second measurement module 102 determines that the first measurement indication information from the first measurement module is received, it can be determined that the first measurement module 101 performs integrity measurement on it. Alternatively, the second measurement module 102 can also determine whether the first measurement module 101 performs integrity measurement on it by querying the system log. Of course, the second measurement module 102 can also determine whether the first measurement module 101 performs integrity measurement on it by using other manners, which is not limited in the present application.

[0106] Further, after the second metric module 102 determines that the first metric module 101 has performed integrity metric on it, the second metric module 102 can perform integrity metric on the to-be-metric object 104 to obtain the second metric result corresponding to the to-be-metric object 104. Here, the to-be-metric object 104 can be pre-set or specified by the user through user instruction, which is not specifically limited in the present application. As described above, when the to-be-metric object 104 is a memory code segment such as a kernel code segment or a user process code segment, the second metric module 102 can obtain the specific content of the memory code segment, and then perform hash processing on the memory code segment through a pre-set hash function (for the convenience of distinction, the second hash function will be used instead in the following description) to obtain the corresponding hash value, which is the second metric result of the to-be-metric object 104. Similarly, when the to-be-metric object 104 is a static file, the second metric module 102 can obtain the specific content of the static file, and then perform hash processing on the specific content through the second hash function to obtain the corresponding hash value, thereby obtaining the second metric result of the to-be-metric object 104.

[0107] Further, after obtaining the second metric result, the second metric module 102 can also send the second metric result to the first metric module 101.

[0108] Scenario two:

[0109] In an embodiment, the second metric sub-module 1022 in the second metric module 102 can first determine whether the first metric module 101 has performed integrity metric on the first metric sub-module 1021. For example, the second metric sub-module 1022 can detect whether it receives the third metric indication information from the first metric sub-module 1021. If the second metric sub-module 1022 determines that it receives the third metric indication information, it can determine that the first metric module 101 has performed integrity metric on the second metric module 102. Alternatively, the second metric sub-module 1022 can also determine whether the first metric module 101 has performed integrity metric on the second metric module 102 by querying the system log.

[0110] Further, after the second measurement submodule 1022 determines that the first measurement submodule 101 has measured the first measurement submodule 1021, the second measurement submodule 1022 can measure the object 104 to be measured for integrity to obtain a second measurement result corresponding to the object 104 to be measured. Here, the process of measuring the object 104 to be measured for integrity by the second measurement submodule 1022 is the same as the process of measuring the object 104 to be measured for integrity by the second measurement submodule 102 described above, and thus is not described herein again. After obtaining the second measurement result, the second measurement submodule 1022 can directly send the second measurement result to the first measurement submodule 101, or the second measurement submodule 1022 can send the second measurement result to the first measurement submodule 1021, and then the first measurement submodule 1021 forwards the second measurement result to the first measurement submodule 101.

[0111] In some possible implementation manners, after obtaining the first measurement result and the second measurement result, the first measurement submodule 101 can determine measurement result information according to the first measurement result and the second measurement result, and send the measurement result information to the proving submodule 103. The embodiments of the present application provide various ways of determining the measurement result information, and the process of determining the measurement result information by the first measurement submodule 101 and sending the measurement result information to the proving submodule 103 is described below in combination with the above-mentioned scenario one and scenario two and the various ways of determining the measurement result information provided by the embodiments of the present application.

[0112] Measurement result determination manner one:

[0113] As described above in scenario one, after obtaining the first measurement result and the second measurement result, the first measurement submodule 101 can directly determine the first measurement result and the second measurement result as the measurement result information. As described above in scenario two, after obtaining the first measurement result, the second measurement result and the second measurement result, the first measurement submodule 101 can directly determine the first measurement result, the second measurement result and the second measurement result as the measurement result information. Here, the first measurement submodule 101 directly determines the first measurement result and the second measurement result, or the first measurement result, the second measurement result and the second measurement result as the measurement result information and sends the measurement result information to the second measurement submodule 102, which is simple and easy to implement and can improve the efficiency of integrity measurement.

[0114] Furthermore, after determining the aforementioned measurement result information, the first measurement module 101 can send the measurement result information to the second measurement module 102. Optionally, after obtaining the aforementioned measurement result information, the first measurement module 101 can encrypt the aforementioned measurement result information through digital certificates, digital signatures, or other means, and send the encrypted measurement result information to the verification module, thereby improving the security of the measurement result information transmission.

[0115] Method 2 for determining measurement result information:

[0116] Please see Figure 6 , Figure 6 This is a schematic diagram of another integrity measurement device provided in the embodiments of this application, as shown below. Figure 6 As shown, the integrity measurement structure 10 may also include a Trusted Platform Module (TPM) 106. TPM 106 includes a PCR module, which may store one or more PCR values ​​derived from TPM 106.

[0117] In the scenario as described above, after obtaining the first measurement result and the second measurement result, the first measurement module 101 can extend the first measurement result and the second measurement result to the PCR of the TPM 106 respectively, to obtain a first PCR value corresponding to the first measurement result and a second PCR value corresponding to the second measurement result. Specifically, the first measurement module 101 can first initiate a PCR extension operation to the TPM 106, and send the first measurement result to the TPM 106. Then, after determining to perform the PCR extension operation and receiving the first measurement result, the TPM 106 can extract a PCR storage value corresponding to the first measurement result (for the convenience of distinction, the first PCR storage value will be used in the following description) from the PCR, where the first PCR storage value is a PCR value obtained by the first measurement module 101 extending the measurement result of the second measurement module 102 to the PCR of the TPM 106 when the integrity measurement device 10 last performed the integrity measurement on the object to be measured 104. Then, the TPM 106 can perform a PCR extension process on the first measurement result and the first PCR storage value, to obtain the first PCR value corresponding to the first measurement result. For example, the TPM 106 can hash the first measurement result and the first PCR storage value by using a preset hash function (for the convenience of distinction, the third hash function will be used in the following description), and determine the hash value as the first PCR value corresponding to the first measurement result. Optionally, the TPM 106 can also update the current first PCR storage value as the current first PCR value. For example, assuming that the first PCR storage value is d1, and the first measurement result is d2. After obtaining the first measurement result d2 and the PCR storage value d1, the TPM 106 can hash d1 and d2 simultaneously, to obtain the first PCR value d3. Then, the TPM 106 can also update the first PCR storage value from d1 to d3. It should be noted that if this measurement is the first integrity measurement performed by the integrity measurement device 10 on the object to be measured, the TPM 106 can perform a PCR extension process on the first measurement result and the preset PCR initial value of the second measurement module simultaneously, to obtain the first PCR value corresponding to the first measurement result. Similarly, the first measurement module 101 can also perform a PCR extension process on the second measurement result by using the TPM 106, to obtain the second PCR value corresponding to the second measurement result. The specific process can be referred to the process of extending the first measurement result to obtain the first PCR value by using the TPM 106, which will not be described herein again.

[0118] Further, the TPM 106 determines the first PCR value and the second PCR value as measurement result information, and sends the measurement result information to the attestation module 103.

[0119] As described in the above scenario two, after obtaining the first measurement sub-result, the second measurement sub-result and the second measurement result, the first measurement module 101 can extend the first measurement sub-result, the second measurement sub-result and the second measurement result to the PCRs of the TPM 106, to obtain a first sub-PCR value corresponding to the first measurement sub-result, a second sub-PCR value corresponding to the second measurement sub-result and a second PCR value corresponding to the second measurement result. Here, the process of extending the first sub-PCR value, the second sub-PCR value and the second PCR value by the TPM 106 can refer to the process of determining the first PCR value by the TPM 106 described above, which will not be described here again. Then, after obtaining the first sub-PCR value, the second sub-PCR value and the second PCR value, the TPM 106 can determine the first sub-PCR value, the second sub-PCR value and the second PCR value as the measurement result information.

[0120] Further, after determining the measurement result information, the TPM 106 can send the measurement result information to the attestation module 103. Optionally, the TPM 106 can encrypt the measurement result information by a digital certificate, a digital signature or the like, and send the encrypted measurement result information to the attestation module 103, so as to ensure the security of the transmission of the measurement result information.

[0121] Here, the first measurement module 102 extends the measurement result to the corresponding PCR value by the TPM 106 with high security and reliability, and then sends the extended PCR value as the measurement result information to the attestation module 103 by the TPM 106, which can effectively prevent the measurement result from being tampered and the like, and ensure the security of the transmission of the measurement result.

[0122] In some possible implementation manners, as described in the above step S240, after receiving the measurement result information, the attestation module 103 can determine whether the to-be-measured object 104 passes the integrity verification according to the measurement result information. The process of determining whether the to-be-measured object 104 passes the integrity verification according to the measurement result information by the attestation module 103 will be described in detail below in combination with the above measurement result information determination manner one, the measurement result information determination manner two and two different scenarios.

[0123] In an embodiment, when the first measurement module 101 obtains the measurement result information in the above-mentioned manner one, the measurement result information received by the proving module 103 can include the first measurement result and the second measurement result in the above-mentioned scenario. Then, the proving module 103 can obtain the preset first baseline value corresponding to the second measurement module 102 and the second baseline value corresponding to the object to be measured 104. Then, the proving module 103 can determine whether the first measurement result is the same as the first baseline value. If the proving module 103 determines that the first measurement result is the same as the first baseline value, it can continue to determine whether the second measurement result is the same as the second baseline value. If the proving module 103 determines that the second measurement result is the same as the second baseline value, it can determine that the object to be measured 104 passes the integrity verification and its content has not been tampered with. If the proving module 103 determines that the first measurement result is not the same as the first baseline value, or the second measurement result is not the same as the second baseline value, the proving module 103 can determine that the object to be measured 104 fails the integrity verification and its content has been tampered with, which poses a security risk. It can be understood that the proving module 103 can first determine whether the second measurement result is the same as the second baseline value, and then determine whether the first measurement result is the same as the first baseline value. The order of determination is not specifically limited in the present application.

[0124] In another embodiment, when the first measurement module 101 adopts the above-mentioned measurement result information determination manner one to obtain the above-mentioned measurement result information, in the scenario two as described above, the measurement result information received by the proving module 103 can include the first measurement sub-result, the second measurement sub-result and the second measurement result. Then, the proving module 103 can obtain the preset first sub-baseline value corresponding to the first measurement sub-module 1021, the preset second sub-baseline value corresponding to the second measurement sub-module 1022 and the second baseline value corresponding to the object to be measured 104. Then, the proving module 103 can judge whether the first measurement sub-result is the same as the first sub-baseline value, whether the second measurement sub-result is the same as the second sub-baseline value, and whether the second measurement result is the same as the second baseline value. When the proving module 103 determines that the first measurement sub-result is the same as the first sub-baseline value, the second measurement sub-result is the same as the second sub-baseline value, and the second measurement result is the same as the second baseline value, it can be determined that the object to be measured 104 passes the integrity check and its content is not tampered. When the proving module 103 determines that the first measurement sub-result is not the same as the first sub-baseline value, or the second measurement sub-result is not the same as the second sub-baseline value, or the second measurement result is not the same as the second baseline value, it can be determined that the object to be measured 104 does not pass the integrity check and its content is tampered, which exists a security risk. Here, the specific process of the proving module 103 judging whether the object to be measured 104 passes the integrity verification according to the first measurement sub-result, the second measurement sub-result and the second measurement result and the first sub-baseline value, the second sub-baseline value and the second baseline value can refer to the process of the proving module 103 judging whether the object to be measured 104 passes the integrity verification according to the first measurement result, the second measurement result and the first baseline value and the second baseline value as described above, which will not be repeated here.

[0125] In another embodiment, when the first measurement module 101 obtains the measurement result information in the above-described manner two, the measurement result information received by the proving module 103 can include the first PCR value and the second PCR value in the above-described scenario. Then, the proving module 103 can determine the first PCR check value and the second PCR check value corresponding to the second measurement module 102 and the object to be measured. Specifically, the proving module 103 can first extract the preset PCR initial value corresponding to the second measurement module 102 (the PCR initial value is consistent with the PCR initial value corresponding to the second measurement module 102 stored in the TPM 106 at the beginning) and the preset first baseline value corresponding to the second measurement module 102, and then determine the expansion order and the expansion times (here, T1 times) of the TPM 105 to expand the first PCR value by the PCR expansion record of the TPM 105. Then, the proving module 103 can expand the first original PCR value and the first baseline value T1 times according to the expansion order, thereby obtaining the first PCR check value. Here, the PCR expansion of the first original PCR value and the first baseline value by the proving module 103 is the same as the expansion process of the first measurement result and the first PCR storage value by the TPM 106 described above, and the specific process will not be described here. Similarly, the proving module 103 can also expand the second PCR check value corresponding to the object to be measured 104 by the preset second baseline value corresponding to the object to be measured and the PCR initial value corresponding to the object to be measured.

[0126] Then, the proving module 103 can determine whether the first PCR value is the same as the first PCR check value. If the proving module 103 determines that the first PCR value is the same as the first PCR check value, it can continue to determine whether the second PCR value is the same as the second PCR check value. If the proving module 103 determines that the second PCR value is the same as the second PCR check value, it can determine that the object to be measured 104 passes the integrity verification and its content has not been tampered with. If the proving module 103 determines that the first PCR value is not the same as the first PCR check value, or the second PCR value is not the same as the second PCR check value, the proving module 103 can determine that the object to be measured 104 does not pass the integrity verification, its content has been tampered with, and there is a security risk. It can be understood that the proving module 103 can first determine whether the second PCR value is the same as the second PCR check value, and then determine whether the first PCR value is the same as the first PCR check value. The order of determination is not specifically limited in this application.

[0127] In yet another embodiment, when the first measurement module 101 obtains the measurement result information in the above-mentioned measurement result information determination manner two, in the above-mentioned scenario two, the measurement result information received by the proving module 103 can include the first PCR sub-value, the second PCR sub-value and the second PCR value. Then, the proving module 103 can determine the first sub-PCR verification value, the second sub-PCR verification value and the second PCR verification value corresponding to the first measurement sub-module 1021, the second measurement sub-module 1022 and the object to be measured 104. Here, the proving module 103 determines the first sub-PCR verification value, the second sub-PCR verification value and the second PCR verification value can refer to the process of the proving module determining the first PCR verification value described above, which will not be repeated here. Then, the proving module 103 can judge whether the first sub-PCR value and the first sub-PCR verification value are the same, whether the second sub-PCR value and the second sub-PCR verification value are the same, and whether the second PCR value and the second PCR verification value are the same. If the proving module 103 determines that the first sub-PCR value and the first sub-PCR verification value are the same, the second sub-PCR value and the second sub-PCR verification value are the same, and the second PCR value and the second PCR verification value are also the same, it can be determined that the object to be measured 104 passes the integrity verification and its content is not tampered. If the proving module 103 determines that the first sub-PCR value and the first sub-PCR verification value are not the same, or the second sub-PCR value and the second sub-PCR verification value are not the same, or the second PCR value and the second PCR verification value are not the same, it can be determined that the object to be measured 104 does not pass the integrity verification and its content may be tampered, which is a security threat. Here, the specific judgment process performed by the proving module 103 can refer to the judgment process of the proving module 103 on the first PCR value and the second PCR value described above, which will not be repeated here.

[0128] In an optional practical application, in the scenario as described above, the first measurement module 101 can be a DIM TEE module running in the integrity measurement apparatus 10, or a hardware security module (HSM) existing inside or outside the integrity measurement apparatus 10. The second measurement module 102 can be a DIM module running in the integrity measurement apparatus 10, the object to be measured 104 can be one or more of a kernel code segment, a kernel module code segment or a user state process code segment in the memory of the integrity measurement apparatus 10, and the attestation module 103 can be a local attestation module running in the integrity measurement apparatus 10 or a remote attestation module running in another apparatus other than the integrity measurement apparatus 10. In a specific implementation, after determining the integrity measurement of the object to be measured 104, the DIM TEE module or the HSM can first measure the DIM module to obtain a first measurement result, and meanwhile trigger the DIM module to measure the object to be measured 104 to obtain a second measurement result. Then, the DIM TEE module or the HSM can send the measurement result information determined by the first measurement result and the second measurement to the attestation module 103. The attestation module 103 can determine whether the object to be measured 104 passes the integrity verification through the measurement result information. Here, the specific measurement and attestation process can refer to the description above, and thus will not be described herein again.

[0129] In another optional practical application, as described in scenario two above, the first measurement module 101 can be a HSM inside or outside the integrity measurement device 10, the first measurement sub-module in the second measurement module 102 can be a DIM TEE module running in the integrity measurement device 10, the second measurement sub-module can be a DIM module running in the integrity measurement device 10, the object to be measured 104 can be one or more of a kernel code segment, a kernel module code segment or a user state process code segment in the memory of the integrity measurement device 10, and the proving module 103 can be a local proving module running in the integrity measurement device 10 or a remote proving module running in another device other than the integrity measurement device 10. In a specific implementation, after determining to measure the integrity of the object to be measured 104, the HSM can first initiate integrity measurement to the DIM TEE module to obtain a first measurement sub-result of the DIM TEE module, the DIM TEE module can then initiate integrity measurement to the DIM module to obtain a second measurement sub-result of the DIM module and send the second measurement sub-result to the HSM, and the DIM module can also initiate integrity measurement to the object to be measured 104 to obtain a second measurement result of the object to be measured 104 and send the second measurement result to the HSM. Then, the HSM can send measurement result information determined by the first measurement sub-result, the second measurement sub-result and the second measurement result to the proving module 103, so that the proving module 103 can determine whether the object to be measured 104 passes the integrity measurement according to the measurement result information. Here, the specific measurement and proving processes can refer to the description above, and will not be described here again.

[0130] It can be understood here that the first measurement module 101, the second measurement module 102 and the proving module 103 can also be other modules with the same functions other than the above-mentioned modules, and the present application does not make specific limitations.

[0131] In addition, it needs to be explained that in the integrity measurement process shown above, the first measurement module 103 sends the measurement result information determined by the first measurement result and the second measurement result to the proof module 103 for proof after obtaining the first measurement result and the second measurement result. In an embodiment, after obtaining the first measurement result, the first measurement module 103 can first send the first measurement result to the proof module 103, so that the proof module 103 can first perform integrity verification on the second measurement module 102. When the proof module 103 determines that the second measurement module passes the integrity verification (i.e., the first measurement result and the preset baseline value or the PCR value corresponding to the first measurement result and the corresponding PCR check value are the same), the proof module 103 can send a verification pass information to the first measurement module 101. When the proof module 103 determines that the second measurement module 102 does not pass the integrity verification (i.e., the first measurement result and the preset baseline value or the PCR value corresponding to the first measurement result and the preset PCR check value are different), the proof module 103 can send a verification fail information to the first measurement module 101 or not provide any feedback to the first measurement module 101 within a preset time period. Then, if the first measurement module 103 receives the verification pass information, the second measurement module 102 can be triggered to measure the to-be-measured object 104 to obtain the second measurement result, and then the second measurement result is sent to the proof module 103 for integrity verification of the to-be-measured object 104. If the first measurement module 103 receives the verification fail information or does not receive any feedback from the proof module 103 within the preset time period, it is determined that the second measurement module 102 does not pass the integrity verification, and the operation of determining whether the measurement trigger condition is met can be re-executed. Here, the integrity measurement of the to-be-measured object 104 is continued only when the second measurement module 102 passes the integrity verification, which can avoid invalid operations on the to-be-measured object 104 due to the failure of the second measurement module 102 to pass the integrity verification, and can improve the efficiency of the integrity measurement.

[0132] In the embodiments of the present application, the first measurement module 103 obtains the first measurement result corresponding to the second measurement module 102 and the second measurement result corresponding to the to-be-measured object 104, and sends the measurement result information corresponding to the first measurement result and the second measurement result to the proof module 103 for proof, so that the entire measurement method takes the first measurement module 103 with high credibility as the measurement root to obtain all the measurement results and provide them to the proof module 103, so that the credibility of the proof result obtained by the proof module 103 is high, thereby improving the accuracy and reliability of the integrity measurement method.

[0133] Please refer to Figure 7 , Figure 7is a structural schematic diagram of another integrity measurement apparatus provided by an embodiment of the present application. The integrity measurement apparatus 70 can be the first measurement module 101 described above, and the integrity measurement apparatus 70 Figure 7 As shown in the figure, the integrity measurement apparatus 70 includes a processing unit 701 and a transceiver unit 702.

[0134] In a specific implementation, the processing unit 701 can be configured to perform integrity measurement on the second measurement module 102 to obtain a first measurement result. The first measurement module 101 has a higher trustworthiness than the second measurement module 102. The transceiver unit 702 can be configured to receive a second measurement result sent by the second measurement module 102. The second measurement result is obtained by performing integrity measurement on the object to be measured 104 by the second measurement module 102. The processing unit 701 is further configured to determine measurement result information according to the first measurement result and the second measurement result. The transceiver unit 702 is further configured to send the measurement result information to the proof module 103. The proof module 103 is configured to determine whether the object to be measured 104 passes the integrity verification according to the measurement result information.

[0135] In a possible implementation, the processing unit 701 can determine the first measurement result and the second measurement result as the measurement result information. Then, the transceiver unit 702 can send the measurement result information to the proof module 103.

[0136] In a possible implementation, the transceiver unit 702 can send the first measurement result and the measurement result to the TPM, respectively. The TPM can perform platform configuration register PCR extension on the first measurement result and the second measurement result, respectively, to obtain a first PCR value corresponding to the first measurement result and a second PCR value. The TPM can also determine the first PCR value and the second PCR value as the measurement result information and send the measurement result information to the proof module 103.

[0137] In a possible implementation, the second measurement module 102 includes a first measurement sub-module and a second measurement sub-module. The first measurement result includes a first measurement sub-result and a second measurement sub-result. The processing unit 701 is configured to perform integrity measurement on the first measurement sub-module to obtain the first measurement sub-result. The first measurement sub-module performs integrity measurement on the second measurement sub-module to obtain the second measurement sub-result and sends the second measurement sub-result to the transceiver unit 702.

[0138] In a possible implementation, the processing unit 701 is configured to determine the first measurement sub-result, the second measurement sub-result, and the second measurement result as the measurement result information. The first measurement module 101 sends the measurement result information to the proof module 103.

[0139] In an implementation, the transceiver 702 can send the first measurement sub-result, the second measurement sub-result and the second measurement result to the TPM, respectively. The TPM can perform PCR extension on the first measurement sub-result, the second measurement sub-result and the second measurement result to obtain a first sub-PCR value corresponding to the first measurement sub-result, a second sub-PCR value corresponding to the second measurement sub-result and a second PCR value corresponding to the second measurement result, respectively. The TPM can determine the first sub-PCR value, the second sub-PCR value and the second PCR value as measurement result information, and send the measurement result information to the attestation module 103.

[0140] In an implementation, before the first measurement module 101 performs integrity measurement on the second measurement module 102 to obtain the first measurement result, the processing unit 701 can also determine that a preset measurement trigger condition is met. Here, the measurement trigger condition is at least one of a preset measurement period being reached, a preset system abnormal event occurring, and receiving a measurement trigger instruction from a user.

[0141] In an implementation, when the measurement trigger condition is a preset system abnormal event occurring, the processing unit 701 can determine that the preset trigger condition is met if it is determined that a system abnormal message sent by the IDS is received. Here, the system abnormal message is sent by the IDS when the system abnormal event is detected.

[0142] In an implementation, when the processing unit 701 determines that the preset measurement trigger condition is met, the transceiver 702 can also send first measurement indication information to the second measurement module 102. The first measurement indication information is used to indicate the second measurement module 102 that the first measurement module 101 is about to perform integrity measurement on the second measurement module 102.

[0143] In an implementation, the first measurement module 101 is a preset measurement trusted root.

[0144] In an implementation, the first measurement module 101 is a DIMTEE module or an HSM, and the second measurement module 102 is a DIM module.

[0145] In an implementation, the first measurement module 101 is an HSM, the first measurement sub-module is a DIM TEE module, and the second measurement sub-module is a DIM module.

[0146] In an implementation, the attestation module 103 includes a local attestation module 103 or a remote attestation module 103.

[0147] In one feasible implementation, the object to be measured 104 includes a memory code segment or a static file.

[0148] In one feasible implementation, the object to be measured 104 includes a memory code segment, which includes at least one of a kernel code segment, a kernel module code segment, and a user-mode process code segment.

[0149] Please see also Figure 7 The integrity measurement device 70 can also be the verification module 103 described above. Specifically, the transceiver unit 702 receives measurement result information sent by the first measurement module 101. The measurement result information is determined by a first measurement result and a second measurement result. The first measurement result is the integrity measurement result performed by the first measurement module 101 on the second measurement module 102. The second measurement result is the integrity measurement result performed by the second measurement module 102 on the object to be measured 104. The credibility of the first measurement module is higher than that of the second measurement module 102. The processing unit 701 determines whether the object to be measured 104 passes the integrity verification based on the measurement result information.

[0150] In one feasible implementation, the measurement result information includes the first measurement result and the second measurement result. If the processing unit 701 determines that the first measurement result is the same as the first baseline value corresponding to the second measurement module 102 and the second measurement result is the same as the second baseline value corresponding to the object to be measured 104, then the object to be measured 104 is determined to have passed the integrity verification. If the processing unit 701 determines that the first measurement result is not the same as the first baseline value, or determines that the second measurement result is not the same as the second baseline value, then the object to be measured 104 is determined to have failed the integrity verification.

[0151] In an implementation, the measurement result information includes a first PCR value and a second PCR value. The first PCR value is obtained by the first measurement module 101 performing PCR expansion on the first measurement result via a TPM, and the second PCR value is obtained by the first measurement module 101 performing PCR expansion on the second measurement result via the TPM. If the processing unit 701 determines that the first PCR value is equal to a first PCR verification value and the second PCR value is equal to a second PCR verification value, it is determined that the object to be measured 104 passes the integrity verification. If the processing unit 701 determines that the first PCR value is not equal to the first PCR verification value, or that the second PCR value is not equal to the second PCR verification value, it is determined that the object to be measured 104 fails the integrity verification. The first PCR verification value is obtained by the attestation module 103 performing PCR expansion on a first baseline value corresponding to the second measurement module 102 and a first PCR initial value. The second PCR verification value is obtained by the attestation module 103 performing PCR expansion on a second baseline value corresponding to the object to be measured 104 and a second PCR initial value.

[0152] In an implementation, the second measurement module 102 includes a first measurement sub-module and a second measurement sub-module, and the first measurement result includes a first measurement sub-result and a second measurement sub-result. The measurement result information includes the first measurement sub-result, the second measurement sub-result, and the second measurement result. If the processing unit 701 determines that the first measurement sub-result is the same as a first sub-baseline value corresponding to the first measurement sub-module, that the second measurement sub-result is the same as a second sub-baseline value corresponding to the second measurement sub-module, and that the second measurement result is the same as a second baseline value corresponding to the object to be measured 104, it is determined that the object to be measured 104 passes the integrity verification. If the processing unit 701 determines that the first measurement sub-result is not the same as the first sub-baseline value corresponding to the first measurement sub-module, or that the second measurement sub-result is not the same as the second sub-baseline value corresponding to the second measurement sub-module, or that the second measurement result is the same as the second baseline value corresponding to the object to be measured 104, it is determined that the object to be measured 104 fails the integrity verification.

[0153] In an implementation, the second measurement module 102 includes a first measurement sub-module and a second measurement sub-module, and the first measurement result includes a first measurement sub-result and a second measurement sub-result. The measurement result information includes a first sub-PCR value, a second sub-PCR value and a second PCR value, the first sub-PCR value is obtained by performing PCR expansion on the first measurement sub-result by the TPM of the first measurement module 101, the second sub-PCR value is obtained by performing PCR expansion on the second measurement sub-result by the TPM of the first measurement module 101, and the second PCR value is obtained by performing PCR expansion on the second measurement result by the TPM of the first measurement module 101. If the processing unit 701 determines that the first sub-PCR value is equal to a first sub-PCR verification value, the second sub-PCR value is equal to a second sub-PCR verification value, and the second PCR value is equal to a second PCR verification value, it is determined that the object to be measured 104 passes the integrity verification. If the processing unit 701 determines that the first sub-PCR value is not equal to the first sub-PCR verification value, or the second sub-PCR value is not equal to the second sub-PCR verification value, or the second PCR value is not equal to the second PCR verification value, it is determined that the object to be measured 104 fails the integrity verification. The first sub-PCR verification value is obtained by performing PCR expansion on a first sub-baseline value and a first sub-PCR initial value corresponding to the second measurement module 102 by the attestation module 103. The second sub-PCR verification value is obtained by performing PCR expansion on a second sub-baseline value and a second sub-PCR initial value corresponding to the second measurement module 102 by the attestation module 103. The second PCR verification value is obtained by performing PCR expansion on a second baseline value and a second PCR initial value corresponding to the object to be measured 104 by the attestation module 103.

[0154] Referring to Figure 7 The integrity measurement apparatus 70 can also be the second measurement module 102 described above. In an implementation, the processing unit 701 is configured to perform integrity measurement on the object to be measured 104 to obtain a second measurement result, if it is determined that the first measurement module 101 performs integrity measurement on the second measurement module 102. The trustworthiness of the first measurement module 101 is higher than that of the second measurement module 102. The transceiver unit 702 is configured to send the second measurement result to the first measurement module 101.

[0155] In an implementation, if the processing unit 701 determines that the transceiver unit 702 receives first measurement indication information, it can be determined that the first measurement module 101 performs integrity measurement thereon.

[0156] It should be noted that when one or more of the first measurement module 101, the second measurement module 102, the attestation module 103 and the object to be measured 104 work in the integrity measurement apparatus 70, the processing unit 701 and the transceiver unit 701 can perform the functions corresponding to the one or more modules respectively. For details, refer to the foregoing description, and details are not repeated here.

[0157] Please refer to Figure 8 , Figure 8 is another structure diagram of an integrity measurement apparatus provided by the embodiment of the present application. Due to the difference in integration, the integrity measurement apparatus 80 can include one or more of the components as shown in Figure 8 , which can be used to perform the methods or steps involving the first measurement module 101 in the above embodiments. As Figure 8 , the integrity measurement apparatus 80 can include a processor 801, a memory 802 and a transceiver 803. The processor 801, the transceiver 803 and the memory 802 are connected by a bus or other means, and the specific connection medium between the above components is not limited by the embodiment of the present application. In one example, the integrity measurement apparatus 80 can be a whole machine device, which implements the integrity measurement method in the above embodiments. In another example, the integrity measurement apparatus 80 can be a chip system or a processing system, which is applied to a whole machine device to control the whole machine device to implement the integrity measurement method in the above embodiments. The chip system or the processing system can include a processor and optionally a computer readable storage medium / memory.

[0158] In a specific implementation, the transceiver 803 can be used to support the communication between the first measurement module 101 and other modules (such as the second measurement module 102, the attestation module 103, etc.). For example, the transceiver 803 can be used to perform the process of sending the measurement result information to the attestation module 103 in step S230. For another example, the transceiver 803 can also be used to perform the process of sending the first measurement indication information to the second measurement module 102 in step 210.

[0159] The processor 801 is used to control and manage the actions of the first measurement module 101, and is used to perform the processing performed by the first measurement module 101 in the above embodiments. For example, the processor 801 can be used to perform the process of measuring the integrity of the second measurement module 102 in step 210. For another example, the processor 801 can also be used to perform the step of determining the measurement result information according to the first measurement result and the second measurement result in step S230.

[0160] Optionally, the memory 803 stores instructions, programs or data for implementing the technical solutions of the present application. For example, the memory 803 can include instructions sufficient to allow the integrity measurement apparatus 80 to perform the functions of the first measurement module 101 involved in the above-described embodiments.

[0161] Optionally, the processor 803 can further include a processing circuit and a communication interface circuit. The processing circuit can be configured to perform the steps of determining the measurement result information described in step S230 in the embodiments, and can also be configured to perform the steps of determining that the measurement trigger condition is met as in step 200. The communication interface circuit is configured to output the information generated by the processing circuit, and can also be configured to input the information received by the first measurement module or the instructions in the memory to the processing circuit for processing.

[0162] Optionally, the memory 803 can be an internal memory located in the processor, or an external memory coupled to the processor.

[0163] Please refer to Figure 8 The integrity measurement apparatus 80 can also be configured to perform the methods or steps of the attestation module 103 involved in the above-described embodiments. Here, the description of the structure of the integrity measurement apparatus 80 can be referred to the foregoing, and will not be repeated here. The transceiver 803 can be configured to support the data transmission between the attestation module 103 and the first measurement module 101 or the second measurement module 102. For example, the transceiver 803 can be configured to perform the step of receiving the measurement result information described in step 240.

[0164] The processor 801 is configured to control and manage the actions of the attestation module 103, and is configured to perform the processing performed by the attestation module 103 in the above-described embodiments. For example, the processor 801 can be configured to perform the step of determining whether the object to be measured 104 passes the integrity verification according to the measurement result information described in step S240.

[0165] Optionally, the memory 802 stores instructions, programs or data for implementing the technical solutions of the present application. For example, the memory 802 can include instructions sufficient to allow the integrity measurement apparatus 80 to perform the functions of the attestation module 103 involved in any of the above-described embodiments.

[0166] Optionally, the processor 802 can include a processing circuit and a communication interface circuit. The processing circuit can be configured to determine whether the object to be measured 104 passes the integrity verification according to the measurement result information. The communication interface circuit is configured to output the information generated by the processing circuit, and can also be configured to input the information received by the attestation module 103 or the instructions in the memory to the processing circuit for processing.

[0167] Optionally, the memory 802 can be an internal memory located inside the processor, or an external memory coupled to the processor.

[0168] Please refer to Figure 8 The integrity measurement apparatus 80 can also be configured to perform the methods or steps described above in relation to the second measurement module 102. Here, the structure of the integrity measurement apparatus 80 can be the same as described above, and thus will not be repeated here. The transceiver 803 can be configured to support data transmission between the second measurement module 102 and the first measurement module 101 or the attestation module 103. For example, the transceiver 803 can be configured to perform the step of receiving the first measurement result information described in step S210, and also be configured to perform the step of sending the second measurement result to the first measurement module 101 described in step S220.

[0169] The processor 801 can be configured to control and manage the actions of the attestation module 103, and perform the processing described above in relation to the attestation module 103. For example, the processor 801 can be configured to perform the step of determining whether the object to be measured 104 passes the integrity verification according to the measurement result information described in step S240.

[0170] Optionally, the memory 802 can store programs, instructions or data for implementing the technical solutions of the present application. For example, the memory 802 can contain instructions sufficient to allow the integrity measurement apparatus 80 to perform the functions of the second measurement module 102 described in any of the above embodiments.

[0171] Optionally, the processor 802 can include processing circuitry and communication interface circuitry. The processing circuitry can be configured to perform the integrity measurement process on the object to be measured 104. The communication interface circuitry can be configured to output information generated by the processing circuitry, and also be configured to input information received by the second measurement module 102 or instructions in the memory to the processing circuitry for processing.

[0172] Optionally, the memory 802 can be an internal memory located inside the processor, or an external memory coupled to the processor.

[0173] It should be noted that when one or more of the first measurement module 101, the second measurement module 102, the attestation module 103 and the object to be measured 104 are implemented by the above-described integrity measurement apparatus 80, the processor 801, the memory 802 and the transceiver 803 can simultaneously perform the functions corresponding to the one or more modules, and the specific implementation process can be the same as described above, and thus will not be repeated here.

[0174] It can be understood that, Figure 8 It is to be understood that only a simplified design of the integrity measurement device 80 is shown, and in actual applications, the integrity measurement device 80 can include any number of transceivers, processors, memories, etc., and all possible implementations are within the protection scope of the integrity measurement device 80 of the present application.

[0175] It should be noted that the processor 801 of the integrity measurement device 80 described above can be a general-purpose processor, such as a general-purpose central processing unit, a network processor (NP), a microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of programs of the present application. It can also be a digital signal processor (DSP), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. The controller / processor can also be a combination of implementing computing functions, such as one or more microprocessor combinations, combinations of DSP and microprocessor, etc. The processor generally performs logical and arithmetic operations based on program instructions stored in memory.

[0176] The memory described above stores an operating system and other application programs. Specifically, the program can include program code including computer operation instructions. More specifically, the memory described above can be a read-only memory (ROM), other types of static storage devices that can store static information and instructions, a random access memory (RAM), other types of dynamic storage devices that can store information and instructions, a disk memory, etc. The memory 802 can also be a combination of the above storage types. And the above memory can be in the processor, also can be outside the processor, or distributed on multiple entities including the processor or processing circuit. The above memory can be embodied in a computer program product. For example, the computer program product can include a computer readable medium in a packaging material.

[0177] The embodiments of the present application also provide a computer readable medium having a computer program stored thereon, which, when executed by a computer, implements the method or steps performed by the first measurement module 101, the second measurement module 102 or the proof module 103 in the above embodiments.

[0178] The embodiments of the present application further provide a computer program product, which, when executed by a computer, implements the method or steps performed by the first measurement module 101, the second measurement module 102 or the proving module 103 in the above embodiments.

[0179] The embodiments of the present application further provide a chip or a chip system, which comprises a processor, and is configured to support the first measurement module 101, the second measurement module 102, the proving module 103 and the object to be measured 104 in the above embodiments to implement the functions involved in the above embodiments, such as generating or processing the data and / or information involved in the above method. In a possible design, the chip system can further comprise a memory, and the memory is configured to store necessary program instructions and data, and when the processor executes the program instructions, the device installed with the chip or the chip system implements the method involved in the above embodiments. The chip system can be composed of a chip, or can comprise a chip and other discrete devices.

[0180] The steps of the methods or algorithms described in connection with the present application disclosed can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium can be integral to the processor. The processor and the storage medium can reside in an ASIC. Alternatively, the processor and the storage medium can be located in a user device, such as a mobile terminal. Of course, the processor and the storage medium can be physical components of a device, or the processor and the storage medium can be components of a virtual device.

[0181] It should be understood that the terms "system" and "network" in the embodiments of the present application can be used interchangeably. In the embodiments of the present application, the term "and / or" is merely used to describe an associated relationship with the associated objects, and indicates that there can be three relationships, for example, A and / or B can indicate that there are three cases, i.e., A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in the present application generally indicates that the associated objects before and after the character " / " have an "or" relationship.

[0182] Those skilled in the art should be aware that, in the above one or more examples, the functions described in the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or code on the computer readable medium. The computer readable medium includes computer storage medium and communication medium, and the communication medium includes any medium that facilitates transfer of a computer program from one place to another. The storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

[0183] The above detailed description has further explained the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific implementation of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A method of integrity measurement, characterized by, The method comprises: The first measurement module performs integrity measurement on the second measurement module to obtain a first measurement result, wherein the credibility of the first measurement module is higher than that of the second measurement module; The first measurement module receives a second measurement result sent by the second measurement module, wherein the second measurement result is obtained by the second measurement module performing integrity measurement on the object to be measured; The first measurement module sends measurement result information to a proving module, wherein the measurement result information is determined by the first measurement result and the second measurement result, and the proving module is used to determine whether the object to be measured passes the integrity verification according to the measurement result information.

2. The method of claim 1, wherein, The first measurement module is a preset measurement trusted root.

3. The method of claim 2, wherein, The first measurement module is a dynamic integrity measurement (DIM) trusted execution environment (TEE) module or a hardware security module (HSM), and the second measurement module is a DIM module.

4. The method of claim 2, wherein, The second measurement module comprises a first measurement sub-module and a second measurement sub-module, the first measurement module is an HSM, the first measurement sub-module is a DIM TEE module, and the second measurement sub-module is a DIM module.

5. The method according to any one of claims 1 to 4, characterized in that, The object to be measured comprises a memory code segment or a static file.

6. The method according to any one of claims 1 to 4, characterized in that, Before the first measurement module performs integrity measurement on the second measurement module to obtain a first measurement result, the method further comprises: The first measurement module determines that a preset measurement trigger condition is met, wherein the measurement trigger condition is that a preset measurement period arrives, or the measurement trigger condition is that a preset system abnormal event occurs, or the measurement trigger condition is that a measurement trigger instruction from a user is received.

7. The method of claim 6, wherein, When the measurement trigger condition is that a preset system abnormal event occurs, the first measurement module determining that a preset trigger condition is met comprises: If the first measurement module receives a system abnormal message sent by an intrusion detection system (IDS), it is determined that the preset trigger condition is met, wherein the system abnormal message is sent by the IDS when the system abnormal event is detected to occur.

8. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: The proving module receives the measurement result information, wherein the measurement result information comprises the first measurement result and the second measurement result; If the proving module determines that the first measurement result is the same as a first baseline value corresponding to the second measurement module and the second measurement result is the same as a second baseline value corresponding to the object to be measured, it is determined that the object to be measured passes the integrity verification; If the proving module determines that the first measurement result is not the same as the first baseline value, or determines that the second measurement result is not the same as the second baseline value, it is determined that the object to be measured does not pass the integrity verification.

9. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: The proving module receives the measurement result information, wherein the measurement result information includes a first PCR value and a second PCR value, the first PCR value is obtained by the first measurement module performing PCR extension on the first measurement result through a trusted platform module (TPM), and the second PCR value is obtained by the first measurement module performing PCR extension on the second measurement result through the TPM; If the proving module determines that the first PCR value is equal to a first PCR check value and the second PCR value is equal to a second PCR check value, it is determined that the object to be measured passes integrity verification; If the proving module determines that the first PCR value is not equal to the first PCR check value, or determines that the second PCR value is not equal to the second PCR check value, it is determined that the object to be measured fails integrity verification.

10. The method of claim 4, wherein, The first measurement result includes a first measurement sub-result corresponding to the first measurement sub-module and a second measurement sub-result corresponding to the second measurement sub-module, and the method further includes: The proving module receives the measurement result information, wherein the measurement result information includes the first measurement sub-result, the second measurement sub-result, and the second measurement result; If the proving module determines that the first measurement sub-result is the same as a first sub-baseline value corresponding to the first measurement sub-module, the second measurement sub-result is the same as a second sub-baseline value corresponding to the second measurement sub-module, and the second measurement result is the same as a second baseline value corresponding to the object to be measured, it is determined that the object to be measured passes integrity verification; If the proving module determines that the first measurement sub-result is not the same as the first sub-baseline value corresponding to the first measurement sub-module, or the second measurement sub-result is not the same as the second sub-baseline value corresponding to the second measurement sub-module, or the second measurement result is the same as the second baseline value corresponding to the object to be measured, it is determined that the object to be measured fails integrity verification.

11. The method of claim 4, wherein, The first measurement result includes a first measurement sub-result corresponding to the first measurement sub-module and a second measurement sub-result corresponding to the second measurement sub-module, and the method further includes: The proving module receives the measurement result information, wherein the measurement result information includes a first sub-PCR value, a second sub-PCR value, and a second PCR value, the first sub-PCR value is obtained by the first measurement module performing PCR extension on the first measurement sub-result through a TPM, the second sub-PCR value is obtained by the first measurement module performing the PCR extension on the second measurement sub-result through the TPM, and the second PCR value is obtained by the first measurement module performing PCR extension on the second measurement result through the TPM; If the proving module determines that the first sub-PCR value is equal to a first sub-PCR check value, the second sub-PCR value is equal to a second sub-PCR check value, and the second PCR value is equal to a second PCR check value, it is determined that the object to be measured passes integrity verification; determining that the object to be measured fails the integrity verification if the first sub-PCR value is determined by the attestation module to be not equal to a first sub-PCR verification value, or the second sub-PCR value is determined by the attestation module to be not equal to a second sub-PCR verification value, or the second PCR value is determined by the attestation module to be not equal to a second PCR verification value. The first sub-PCR verification value is obtained by the attestation module performing PCR extension on a first baseline value corresponding to the first measurement sub-module and a first initial PCR value, the second sub-PCR verification value is obtained by the attestation module performing the PCR extension on a second baseline value corresponding to the second measurement sub-module and a second initial PCR threshold value, and the second PCR verification value is obtained by the attestation module performing the PCR extension on a second baseline value corresponding to the object to be measured and a third initial PCR value.

12. An integrity measurement device, characterized by The integrity measurement apparatus comprises a first measurement module: The first measurement module is configured to measure the integrity of a second measurement module to obtain a first measurement result, wherein the first measurement module has a higher trustworthiness than the second measurement module. The first measurement module is further configured to receive a second measurement result sent by the second measurement module, wherein the second measurement result is obtained by the second measurement module measuring the integrity of the object to be measured. The first measurement module is further configured to determine measurement result information according to the first measurement result and the second measurement result. The first measurement module is further configured to send the measurement result information to an attestation module, wherein the attestation module is configured to determine whether the object to be measured passes the integrity verification according to the measurement result information.

13. The integrity measurement apparatus of claim 12, wherein, The integrity measurement apparatus further comprises at least one of the attestation module, the second measurement module, and the object to be measured.

14. The integrity measurement apparatus of claim 13, wherein, The first measurement module is a measurement trusted root.

15. The integrity measuring device according to any of claims 12-14, characterized in that, The first measurement module is a DIM TEE or a HSM, and the second measurement module is a DIM module.

16. The integrity measuring device according to any of claims 12-14, characterized in that, The second measurement module comprises a first measurement sub-module and a second measurement sub-module, the first measurement module is a HSM, the first measurement sub-module is a DIM TEE module, and the second measurement sub-module is a DIM module.

17. The integrity measuring device according to any of claims 12-14, characterized in that, The integrity measurement apparatus is a chip or a chip system.

18. An integrity measurement device, characterized by The integrity measurement apparatus comprises a processor and a memory, the memory stores a code, and the processor executes the code to implement the integrity measurement method in any one of claims 1-11.

19. A computer-readable storage medium, characterized in that, The readable storage medium stores program instructions, and when the program instructions are executed, the integrity measurement method in any one of claims 1-11 is performed.

Images