Kernel function credibility verification method and device, electronic equipment and storage medium

Abstract

The application provides a kernel function credibility verification method and device, electronic equipment and storage medium, and relates to the field of trusted computing. The method comprises the following steps: receiving signature information sent by a kernel, wherein the signature information comprises a first hash value of a preset function loaded in a memory calculated by the kernel through a preset hash algorithm, and is obtained by signing the first hash value through a preset private key; analyzing the signature information according to a preset public key, and determining the first hash value in the signature information and the function name of the preset function; searching for a second hash value corresponding to the function name in a pre-stored file; and if the first hash value and the second hash value are consistent, determining that the preset function loaded in the memory is credible. The application can realize that the terminal system can not depend on specific hardware equipment when checking resource integrity, and can improve the efficiency of system checking.

Description

Technical Field

[0001] This application relates to the field of trusted computing technology, and more specifically, to a method, apparatus, electronic device, and storage medium for verifying the trustworthiness of kernel functions. Background Technology

[0002] In the prior art, platforms equipped with TPM security chips can utilize the extended function of the PCR (Platform Configuration Register) in the TPM security chip to extend the summary value of the part to be executed to the PCR, thereby establishing a complete metric chain from BIOS to BootLoader and finally to OS to reflect the information of the current platform.

[0003] In the traditional integrity verification process, the user first establishes and stores complete information. Each time the system starts, it reads the value of the specified PCR to obtain the current platform information, and compares it with the complete information to complete the integrity verification.

[0004] However, performing integrity verification in this way usually requires the support of corresponding hardware devices, such as TPM security chips. Without such hardware, there is no highly reliable integrity verification method, and using such hardware for integrity verification also suffers from low efficiency. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and storage medium for verifying the trustworthiness of kernel functions. The technical solution is as follows:

[0006] According to one aspect of the embodiments of this application, a method for verifying the trustworthiness of a kernel function is provided, the method comprising:

[0007] Receive signature information sent by the kernel, the signature information including the first hash value of a preset function loaded in memory calculated by the kernel using a preset hash algorithm, and the first hash value signed by the preset private key;

[0008] The signature information is parsed using a preset public key to determine the first hash value and the function name of the preset function in the signature information;

[0009] In the pre-stored file, retrieve the second hash value corresponding to the function name;

[0010] If the first hash value and the second hash value are consistent, then the preset function loaded in memory is determined to be reliable.

[0011] In one possible implementation, the pre-stored file includes a first hash table, which includes the function name of a preset function and its corresponding second hash value;

[0012] The step of retrieving the second hash value corresponding to the function name in the pre-stored file includes:

[0013] Retrieve the second hash value corresponding to the function name from the first hash table based on the function name.

[0014] According to another aspect of the embodiments of this application, a method for verifying the trustworthiness of kernel functions is provided, applied to the kernel, the method comprising:

[0015] Retrieve the preset function loaded into memory and the function name of the preset function;

[0016] The first hash value of the preset function is calculated using a preset hash algorithm;

[0017] The first hash value is signed using a preset private key to obtain signature information;

[0018] The signature information and the function name of the preset function are sent to the preset verification module.

[0019] In one possible implementation, before obtaining the preset function loaded into memory and the function name of the preset function, the following steps are included:

[0020] If the current time node is detected as the start time node of a preset period, and the current CPU utilization is less than a preset threshold, then the preset function loaded into memory and the function name of the preset function are obtained.

[0021] In another possible implementation, the preset function includes a first function, which is a function loaded into memory when the kernel starts and / or a function corresponding to a kernel module in the kernel;

[0022] The method further includes:

[0023] Based on the first function name of the first function, retrieve the first address space corresponding to the first function name in the preset system call table;

[0024] Based on the first address space, retrieve the first function from the memory;

[0025] The first hash value of the preset function is calculated using a preset hash algorithm;

[0026] The first hash value is signed using a preset private key to obtain signature information;

[0027] The signature information and the function name of the first function are sent to the preset verification module.

[0028] In yet another possible implementation, the method further includes:

[0029] Get the name of the program loaded into memory;

[0030] The process space of the preset program is determined based on the program name in the preset process list;

[0031] Based on the process space, the program code of the preset program is determined, and the program code includes a preset process code segment, a preset program parameter segment, and a preset program environment variable segment;

[0032] The third hash value of the program code segment, the preset program parameter segment, and the preset program environment variable segment is calculated according to the preset hash algorithm, and a second hash table is generated based on the third hash value;

[0033] The fourth hash value of the second hash table is calculated according to the preset hash algorithm;

[0034] The fourth hash value is signed using a preset private key to obtain signature information, which is then sent to a preset verification module.

[0035] According to another aspect of the embodiments of this application, a kernel function trustworthiness verification apparatus is provided, the apparatus comprising:

[0036] The receiving unit is used to receive signature information sent by the kernel. The signature information includes a first hash value of a preset function loaded in memory calculated by the kernel using a preset hash algorithm, and the first hash value is signed by a preset private key.

[0037] The parsing unit is used to parse the signature information according to the preset public key, and determine the first hash value and the function name of the preset function in the signature information;

[0038] A retrieval unit is used to retrieve a second hash value corresponding to the function name from a pre-stored file;

[0039] The verification unit is used to determine that the preset function loaded in memory is trustworthy if the first hash value and the second hash value are consistent.

[0040] According to another aspect of the embodiments of this application, a kernel device is provided, the device comprising:

[0041] The acquisition unit is used to acquire the preset function loaded into memory and the function name of the preset function;

[0042] A calculation unit is used to calculate the first hash value of the preset function using a preset hash algorithm;

[0043] The signature unit is used to sign the first hash value according to a preset private key to obtain signature information;

[0044] The sending unit is used to send the signature information and the function name of the preset function to the preset verification module.

[0045] According to another aspect of the embodiments of this application, an electronic device is provided, the electronic device comprising:

[0046] The method includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the trustworthiness verification method for the kernel function.

[0047] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the trustworthiness verification method of the kernel function are implemented.

[0048] According to one aspect of the embodiments of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the trustworthiness verification method for the kernel function.

[0049] The beneficial effects of the technical solution provided in this application are: electronic devices such as terminals can verify resource integrity without relying on specific hardware devices, and can improve the efficiency of system verification. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below.

[0051] Figure 1 A flowchart illustrating a method for verifying the trustworthiness of a kernel function provided in an embodiment of this application;

[0052] Figure 2 A flowchart illustrating another method for verifying the trustworthiness of a kernel function provided in this application embodiment;

[0053] Figure 3 A schematic diagram of the structure of a kernel function trustworthiness verification device provided in an embodiment of this application;

[0054] Figure 4 This application provides a schematic diagram of the structure of a kernel device according to an embodiment of the present application.

[0055] Figure 5This is a schematic diagram of the structure of an electronic device for verifying the credibility of kernel functions, provided in an embodiment of this application. Detailed Implementation

[0056] The embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the embodiments described below with reference to the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions of the embodiments of this application.

[0057] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the terms “comprising” and “including” as used in embodiments of this application mean that the corresponding feature can be implemented as the presented feature, information, data, step, operation, element, and / or component, but do not exclude implementation as other features, information, data, step, operation, element, component, and / or combinations thereof supported by the art. It should be understood that when we say that an element is “connected” or “coupled” to another element, the one element can be directly connected or coupled to the other element, or it can mean that the one element and the other element establish a connection relationship through an intermediate element. Furthermore, “connected” or “coupled” as used herein can include wireless connection or wireless coupling. The term “and / or” as used herein indicates at least one of the items defined by the term; for example, “A and / or B” can be implemented as “A,” or as “B,” or as “A and B.”

[0058] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0059] It should be noted that the following embodiments can be referenced, learned from or combined with each other. The same terms, similar features and similar implementation steps in different embodiments will not be described again.

[0060] First, let's introduce and explain several terms used in this application:

[0061] Integrity verification, also known as credibility verification, is actually a one-to-one comparison process. It compares the current information with the provided information that is considered complete. If they match, the current information is considered complete; otherwise, the current information is considered to have been tampered with.

[0062] TEE (Trusted Execution Environment): A secure and trusted area within the processor that guarantees the security, confidentiality, and integrity of the code and data placed within it. TEE provides an isolated execution environment where code and data can run without interference from the operating system or other external systems, ensuring the confidentiality and integrity of the code and data.

[0063] The methods, apparatus, electronic devices, computer-readable storage media, and computer program products for verifying the trustworthiness of kernel functions provided in this application are intended to solve the technical problems existing in the prior art.

[0064] like Figure 1 As shown, this application provides a method for verifying the trustworthiness of kernel functions. This method can be based on a TEE (Trusted Execution Environment) and may include:

[0065] S101. Receive signature information sent by the kernel. The signature information includes a first hash value of a preset function loaded in memory calculated by the kernel using a preset hash algorithm, and a signature of the first hash value obtained by using a preset private key.

[0066] In this embodiment of the application, the TEE of an electronic device such as a terminal can receive signature information sent by the kernel. The signature information can be the first hash value of a preset function loaded into memory by the kernel through a preset hash algorithm, and the first hash value is signed by the private key built into the kernel.

[0067] S102. Parse the signature information according to the preset public key to determine the first hash value and the function name of the preset function in the signature information.

[0068] In this embodiment of the application, the TEE of an electronic product such as a terminal parses the signature information using its built-in public key to determine the first hash value in the signature information and the corresponding function name of the preset function.

[0069] S103. In the pre-stored file, retrieve the second hash value corresponding to the function name.

[0070] In this embodiment of the application, a pre-stored file can be set, which may include hash values ​​corresponding to each function. A second hash value corresponding to the function name can be retrieved from the pre-stored file based on the function name.

[0071] S104. If it is determined that the first hash value and the second hash value are consistent, then the preset function loaded in memory is determined to be reliable.

[0072] In this embodiment of the application, if it is determined that the first hash value and the second hash value are consistent, it can be determined that the preset function loaded in memory is real and complete, and thus it can be determined that the preset function loaded in memory is trustworthy.

[0073] Based on the above embodiments, the TEE can record the comparison result of the first hash value and the second hash value, and can send the comparison result to the security operation and maintenance module of the electronic device. The security operation and maintenance module can then issue different operation instructions based on different comparison results. If necessary, the security operation and maintenance module can also upload the comparison result to the server for further analysis and processing.

[0074] Specifically, the pre-stored file includes a preset hash table, which includes the function name of a preset function and its corresponding second hash value.

[0075] The step of retrieving the second hash value corresponding to the function name in the pre-stored file includes:

[0076] The second hash value corresponding to the function name is retrieved from the preset hash table based on the function name.

[0077] In this embodiment, during firmware generation for the electronic device, hash values ​​of kernel key code segments, system call tables, file system key data structures, and network system key data structures can be calculated using a preset hash algorithm, and corresponding hash tables are generated based on these hash values. The hash values ​​of the hash tables are then calculated using the preset hash algorithm, and the hash values ​​are signed using a preset private key. Subsequently, the hash tables and their signatures are stored in a benchmark file, and this benchmark file is stored as a pre-stored file in the TEE. Simultaneously, the preset public key corresponding to the preset private key is written into the TEE. When the TEE receives the signature information sent by the kernel, it can also receive the function names of relevant preset functions; based on the function name, it retrieves the second hash value corresponding to the function name from the preset hash table. For example, the benchmark file can be in the form of a header file (.h file) in C language, which facilitates reading data from the benchmark file.

[0078] Furthermore, such as Figure 2 As shown, this application also provides a method for verifying the trustworthiness of kernel functions, characterized in that it is applied to the kernel, and the method may include:

[0079] S201. Obtain the preset function loaded into memory and the function name of the preset function.

[0080] In this embodiment, the kernel can obtain preset functions loaded into memory and their corresponding function names. For example, the preset functions loaded into memory may include: functions loaded into memory when the kernel starts; or functions corresponding to kernel modules within the kernel.

[0081] S202. Calculate the first hash value of the preset function using a preset hash algorithm.

[0082] In this embodiment, the kernel can calculate the first hash value of a preset function according to a preset hash algorithm. The specific hash algorithm is not specifically limited in this application, as long as the same hash algorithm is used throughout the entire method process.

[0083] S203. Sign the first hash value according to the preset private key to obtain signature information.

[0084] In this embodiment of the application, the kernel signs the first hash value according to its built-in preset private key to obtain the signature information of the preset function.

[0085] S204. Send the signature information and the function name of the preset function to the preset verification module.

[0086] In this embodiment, the kernel can package the function name and signature information of a preset function and send them to a preset verification module. The preset verification module is used to verify the integrity of functions in the kernel, and can be a TEE (Transmission Equipment) of an electronic device such as a terminal.

[0087] Furthermore, before obtaining the preset function loaded into memory and the function name of the preset function, the following may be included:

[0088] If the current time node is detected as the start time node of a preset period, and the current CPU utilization is less than a preset threshold, then the preset function loaded into memory and the function name of the preset function are obtained.

[0089] In this embodiment, if the current time point is the start time point of a preset period, and the current CPU utilization is less than a preset threshold, the kernel needs to obtain the preset function loaded into memory and the function name corresponding to the preset function. The duration of the preset period and the value of the threshold can be set manually, and this application does not impose specific limitations on them.

[0090] Based on the above embodiments, as an optional embodiment, if the CPU utilization rate is detected to be greater than a preset threshold for a long period of time, for example, if the terminal detects that the CPU utilization rate of the system is not less than the preset threshold for 24 hours, then the preset function loaded into memory and the function name corresponding to the preset function are forcibly obtained, that is, the function trustworthiness verification method of this application is executed.

[0091] Specifically, the preset function includes a first function, which is a function loaded into memory when the kernel starts, and / or a function corresponding to a kernel module in the kernel.

[0092] In the embodiments of this application, the preset function may include a first function, which may be a function loaded into memory when the kernel starts, or the first function may be a function corresponding to a kernel module in the kernel.

[0093] The method further includes:

[0094] Based on the first function name of the first function, the first address space corresponding to the first function name is retrieved from the preset system call table.

[0095] In this embodiment of the application, a first address space corresponding to the first function name can be retrieved from a preset system call table based on the first function name of the first function. The first address space is used to characterize the specific location where the first function is loaded into memory.

[0096] The first function is retrieved from the memory according to the first address space.

[0097] In this embodiment of the application, the corresponding first function is obtained from memory according to the first address space.

[0098] The first hash value of the first function is calculated using a preset hash algorithm; the first hash value is signed using a preset private key to obtain signature information; and the signature information and the function name of the first function are sent to a preset verification module.

[0099] In this embodiment of the application, the first hash value of the first function is calculated by a preset hash algorithm, and the first hash value is signed according to a preset private key to obtain the signature information of the first function. The signature information of the first function and the corresponding function name are sent to a preset verification module, wherein the preset verification module may be a TEE of an electronic device such as a terminal.

[0100] Based on the above embodiments, if the first function is a function corresponding to a kernel module, it is necessary to obtain the signature information of the kernel module and send the signature information of the kernel module and the signature information of the first function to the TEE. After receiving these two signature information, the TEE parses the signature information of the kernel module according to the preset public key to obtain the hash value of the kernel module. Then, it parses the signature information of the first function according to the preset public key to obtain the hash value of the first function. The hash value of the first function is compared with the hash value of the kernel module to determine whether the first function loaded into memory is a function in the kernel module. After that, the hash value of the first function is compared with the hash value in the pre-stored file to determine whether the first function loaded into memory is complete.

[0101] Specifically, the trustworthiness verification method for the kernel function may further include:

[0102] Get the name of the preset program loaded into memory.

[0103] In this embodiment, the kernel can obtain the program name or corresponding ID information of the preset program loaded in memory.

[0104] The process space of the preset program is determined based on the program name in the preset process list.

[0105] In this embodiment, based on the program name or ID information, the process corresponding to the program name and the process space of that process are determined in a preset process list. The process space represents the specific location of the preset program in memory.

[0106] Based on the process space, the program code of the preset program is determined, and the program code includes a preset process code segment, a preset program parameter segment, and a preset program environment variable segment.

[0107] In this embodiment of the application, the program code of a preset program loaded in the process is determined according to the process space. The program code may include a preset program code segment, a preset program parameter segment, and a preset program environment variable segment. The preset program code segment may include multiple functions.

[0108] The third hash value of the program code segment, the preset program parameter segment, and the preset program environment variable segment is calculated according to the preset hash algorithm, and a second hash table is generated based on the third hash value.

[0109] In this embodiment of the application, the third hash values ​​of the program code segment, program parameter segment and program environment variable segment are calculated according to a preset hash algorithm, and a second hash table is generated based on these third hash values.

[0110] The fourth hash value of the second hash table is calculated according to the preset hash algorithm; the fourth hash value is signed according to the preset private key to obtain signature information, and the signature information is sent to the preset verification module.

[0111] In this embodiment of the application, the kernel calculates the fourth hash value of the second hash table according to the preset hash algorithm, signs the fourth hash value according to its built-in preset private key, obtains the corresponding signature information, and sends the signature information to the preset verification module, wherein the preset verification module may be the TEE of an electronic device such as a terminal.

[0112] Based on the above embodiments, as an optional embodiment, after receiving the signature information of the second hash table, the TEE of this application decrypts the second hash table according to the preset public key to obtain the fourth hash value; decrypts the signature information of the first hash table in the pre-stored file using the preset public key to obtain the fifth hash value; and compares the fourth hash value and the fifth hash value to verify the integrity of the code segment, parameter segment and environment variable segment corresponding to the program code loaded into memory.

[0113] Based on the above embodiments, as an optional embodiment, the following functions, mechanisms, and settings in the Linux kernel can be used to implement the technical solution of this application: kthread, used to create, start, and wake up threads; kallsyms_lookup_name, used to receive a kernel function name and return the address of that kernel function; kernel_crypto, which can use existing crypto algorithms to convert data and can also extend and add algorithms to implement symmetric encryption and decryption, asymmetric encryption and decryption, etc.; "CONFIG_MODULE_SIG_ALL=y", setting the kernel to actively sign the module; ko, used to load kernel modules; and so on.

[0114] This application provides a kernel function trustworthiness verification device, such as... Figure 3 As shown, the kernel function trustworthiness verification device 30 may include: a receiving unit 301, a parsing unit 302, a retrieval unit 303, and a verification unit 304, wherein,

[0115] The receiving unit 301 is used to receive signature information sent by the kernel. The signature information includes a first hash value of a preset function loaded in memory calculated by the kernel using a preset hash algorithm, and the first hash value is signed by a preset private key.

[0116] The parsing unit 302 is used to parse the signature information according to the preset public key and determine the first hash value and the function name of the preset function in the signature information;

[0117] The retrieval unit 303 is used to retrieve a second hash value corresponding to the function name in a pre-stored file;

[0118] Verification unit 304 is used to determine that the preset function loaded in memory is trustworthy if the first hash value and the second hash value are consistent.

[0119] This application also provides a kernel device, such as... Figure 4 As shown, the kernel device 40 may include: an acquisition unit 401, a calculation unit 402, a signature unit 403, and a sending unit 404, wherein,

[0120] The acquisition unit 401 is used to acquire a preset function loaded into memory and the function name of the preset function;

[0121] The calculation unit 402 is used to calculate the first hash value of the preset function using a preset hash algorithm;

[0122] The signature unit 403 is used to sign the first hash value according to a preset private key to obtain signature information;

[0123] The sending unit 404 is used to send the signature information and the function name of the preset function to the preset verification module.

[0124] Compared with existing technologies, this technology enables terminal systems to verify resource integrity without relying on specific hardware devices and improves the efficiency of system verification.

[0125] The apparatus in this application embodiment can execute the method provided in this application embodiment, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of each embodiment of this application. For detailed functional descriptions of each module of the apparatus, please refer to the descriptions in the corresponding methods shown above, which will not be repeated here.

[0126] This application provides an electronic device including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps of the method. Compared with related technologies, this device enables the terminal system to verify resource integrity without relying on specific hardware devices and improves the efficiency of system verification.

[0127] In one alternative embodiment, an electronic device is provided, such as Figure 5 As shown, Figure 5 The illustrated electronic device 5000 includes a processor 5001 and a memory 5003. The processor 5001 and the memory 5003 are connected, for example, via a bus 5002. Optionally, the electronic device 5000 may further include a transceiver 5004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 5004 is not limited to one type, and the structure of the electronic device 5000 does not constitute a limitation on the embodiments of this application.

[0128] Processor 5001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 5001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0129] Bus 5002 may include a path for transmitting information between the aforementioned components. Bus 5002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 5002 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0130] The memory 5003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium capable of carrying or storing computer programs and capable of being read by a computer, without limitation herein.

[0131] The memory 5003 is used to store computer programs that execute the embodiments of this application, and its execution is controlled by the processor 5001. The processor 5001 is used to execute the computer programs stored in the memory 5003 to implement the steps shown in the foregoing method embodiments.

[0132] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the steps and corresponding content of the aforementioned method embodiments.

[0133] This application also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0134] The terms "first," "second," "third," "fourth," "1," "2," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than that shown in the figures or text.

[0135] It should be understood that although arrows indicate various operation steps in the flowcharts of this application's embodiments, the order in which these steps are implemented is not limited to the order indicated by the arrows. Unless explicitly stated herein, in some implementation scenarios of this application's embodiments, the implementation steps in each flowchart can be executed in other orders as required. Furthermore, some or all steps in each flowchart, based on the actual implementation scenario, may include multiple sub-steps or multiple stages. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage can also be executed at different times. In scenarios where execution times differ, the execution order of these sub-steps or stages can be flexibly configured according to requirements, and this application's embodiments do not limit this.

[0136] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application without departing from the technical concept of this application also fall within the protection scope of the embodiments of this application.

Claims

1. A method for verifying the credibility of kernel functions, characterized in that, The method, applied to a preset verification module, wherein the preset verification module is a Trusted Execution Environment (TEE) of an electronic device, includes: The kernel receives signature information and the name of a preset function. The signature information includes a first hash value of the preset function loaded in memory, which is calculated by the kernel using a preset hash algorithm, and the first hash value is signed using a preset private key. The signature information is parsed using the preset public key stored in the TEE to determine the first hash value in the signature information; In the pre-stored file of the TEE storage, a second hash value corresponding to the function name is retrieved. The pre-stored file includes a first hash table, which includes the function name of the preset function and the corresponding second hash value. If the first hash value and the second hash value are the same, then the preset function loaded in memory is determined to be reliable; The method further includes: The kernel sends a signature information for a second hash table. The second hash table includes a third hash value calculated by a preset hash algorithm for a preset program code segment, a preset program parameter segment, and a preset program environment variable segment corresponding to the program code loaded into memory. The preset program code segment includes multiple functions. The signature information of the second hash table is parsed using the preset public key stored in the TEE to obtain the fourth hash value; The signature information of the first hash table in the pre-stored file is parsed using the preset public key to obtain the fifth hash value; If the fourth hash value and the fifth hash value are the same, then it is determined that the preset program code segment, preset program parameter segment and preset program environment variable segment corresponding to the program code loaded into memory are complete.

2. The method according to claim 1, characterized in that, In the pre-stored file, the second hash value corresponding to the function name is retrieved, including: Retrieve the second hash value corresponding to the function name from the first hash table based on the function name.

3. A method for verifying the credibility of kernel functions, characterized in that, Applied to the kernel, the method includes: Retrieve the preset function loaded into memory and the function name of the preset function; The first hash value of the preset function is calculated using a preset hash algorithm; The first hash value is signed using a preset private key to obtain signature information; The signature information and the function name of the preset function are sent to the preset verification module, which is the Trusted Execution Environment (TEE) of the electronic device, so that the preset verification module performs the following steps: The signature information is parsed using the preset public key stored in the TEE to obtain and determine the first hash value in the signature information; In the pre-stored file of the TEE storage, a second hash value corresponding to the function name is retrieved. The pre-stored file includes a first hash table, which includes the function name of the preset function and the corresponding second hash value. If the first hash value and the second hash value are the same, then the preset function loaded in memory is determined to be reliable; The method further includes: Get the name of the program loaded into memory; The process space of the preset program is determined based on the program name in the preset process list; Based on the process space, the program code of the preset program is determined. The program code includes a preset process code segment, a preset program parameter segment, and a preset program environment variable segment. The preset program code segment includes multiple functions. The third hash value of the program code segment, the preset program parameter segment, and the preset program environment variable segment are calculated according to the preset hash algorithm, and a second hash table is generated based on each third hash value; The fourth hash value of the second hash table is calculated according to the preset hash algorithm; The fourth hash value is signed according to the preset private key to obtain signature information, and the signature information is sent to the preset verification module so that the preset verification module receives the signature information of the second hash table, parses the signature information of the second hash table to obtain the fourth hash value, and verifies whether the preset program code segment, preset program parameter segment and preset program environment variable segment corresponding to the program code loaded into memory are complete according to the fourth hash value.

4. The method according to claim 3, characterized in that, Before obtaining the preset function loaded into memory and the function name of the preset function, the following steps are included: If the current time node is detected as the start time node of a preset period, and the current CPU utilization is less than a preset threshold, then the preset function loaded into memory and the function name of the preset function are obtained.

5. The method according to claim 3, characterized in that, The preset function includes a first function, which is a function loaded into memory when the kernel starts, and / or a function corresponding to a kernel module in the kernel; The method further includes: Based on the first function name of the first function, retrieve the first address space corresponding to the first function name in the preset system call table; Based on the first address space, retrieve the first function from the memory; The first hash value of the preset function is calculated using a preset hash algorithm; The first hash value is signed using a preset private key to obtain signature information; The signature information and the function name of the first function are sent to the preset verification module.

6. A kernel function credibility verification device, characterized in that, The trustworthiness verification device for the kernel function is a Trusted Execution Environment (TEE) of an electronic device, comprising: The receiving unit is used to receive signature information and the function name of a preset function sent by the kernel. The signature information includes the first hash value of the preset function loaded in memory calculated by the kernel using a preset hash algorithm, and the first hash value is signed by a preset private key. The parsing unit is used to parse the signature information according to the preset public key stored in the TEE, and determine the first hash value and the function name of the preset function in the signature information; The retrieval unit is used to retrieve a second hash value corresponding to the function name in a pre-stored file stored in the TEE. The pre-stored file includes a first hash table, which includes the function name of a preset function and the corresponding second hash value. A verification unit is used to determine that the preset function loaded in memory is trustworthy if the first hash value and the second hash value are consistent. It also includes a program verification unit, used for: The kernel sends a signature information for a second hash table. The second hash table includes a third hash value calculated by a preset hash algorithm for a preset program code segment, a preset program parameter segment, and a preset program environment variable segment corresponding to the program code loaded into memory. The preset program code segment includes multiple functions. The signature information of the second hash table is parsed using the preset public key stored in the TEE to obtain the fourth hash value; The signature information of the first hash table in the pre-stored file is parsed using the preset public key to obtain the fifth hash value; If the fourth hash value and the fifth hash value are the same, then it is determined that the preset program code segment, preset program parameter segment and preset program environment variable segment corresponding to the program code loaded into memory are complete.

7. A kernel device, characterized in that, include: The acquisition unit is used to acquire the preset function loaded into memory and the function name of the preset function; A calculation unit is used to calculate the first hash value of the preset function using a preset hash algorithm; The signature unit is used to sign the first hash value according to a preset private key to obtain signature information; A sending unit is configured to send the signature information and the function name of the preset function to a preset verification module, wherein the preset verification module is a Trusted Execution Environment (TEE) of an electronic device, so that the preset verification module performs the following steps: The signature information is parsed using the preset public key stored in the TEE to obtain and determine the first hash value in the signature information; In the pre-stored file of the TEE storage, a second hash value corresponding to the function name is retrieved. The pre-stored file includes a first hash table, which includes the function name of the preset function and the corresponding second hash value. If the first hash value and the second hash value are the same, then the preset function loaded in memory is determined to be reliable; It also includes a program signing unit, used for: Get the name of the program loaded into memory; The process space of the preset program is determined based on the program name in the preset process list; Based on the process space, the program code of the preset program is determined. The program code includes a preset process code segment, a preset program parameter segment, and a preset program environment variable segment. The preset program code segment includes multiple functions. The third hash value of the program code segment, the preset program parameter segment, and the preset program environment variable segment are calculated according to the preset hash algorithm, and a second hash table is generated based on each third hash value; The fourth hash value of the second hash table is calculated according to the preset hash algorithm; The fourth hash value is signed according to the preset private key to obtain signature information, and the signature information is sent to the preset verification module so that the preset verification module receives the signature information of the second hash table, parses the signature information of the second hash table to obtain the fourth hash value, and verifies whether the preset program code segment, preset program parameter segment and preset program environment variable segment corresponding to the program code loaded into memory are complete according to the fourth hash value.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-5.

Images