Terminal hardware platform security measurement method and storage medium for zero-trust environment

Abstract

The present invention discloses a terminal hardware platform security measurement method and storage medium for a zero-trust environment. According to the different states of the current terminal system, the measurement method for hot-swappable hardware is determined; when the terminal system is before the operating system is started, the terminal hardware device is measured based on the firmware layer; when the terminal system is after the operating system is started, the terminal hardware device is measured based on the service, the message queue is monitored at the system kernel layer, and the hot-swappable hardware device is measured after the hot-swappable hardware device is inserted into the terminal. The terminal hardware device security measurement method and storage medium provided by the present invention can reduce the security risks caused by operating system vulnerabilities, thereby improving the hardware device security in a zero-trust network.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a terminal hardware platform security measurement method and storage medium for a zero-trust environment. Background Art

[0002] Zero Trust Network (ZTN) is a set of evolving network security paradigms that shifts the focus of network defense from static, network-based boundaries to users, devices, and resources. The central idea of ​​the zero-trust security model is that enterprises should not automatically trust anyone, anything, or anything inside or outside the enterprise, should not grant fully trusted permissions to systems based on physical or network locations, should verify anyone, anything, or anything attempting to access enterprise systems before authorization, and grant access to data resources only when resources are needed. Typical zero trust focuses on data protection, including devices, infrastructure components, applications, virtualization, cloud components, and resource request subjects, which include all entity objects that request data, including human users.

[0003] In ZTN, with the globalization of hardware design and supply chain, hardware trustworthiness becomes increasingly important. Establishing device security is the cornerstone of zero trust and directly affects the success or failure of zero trust network architecture. Device trust can be divided into two steps. The first is the establishment of initial trust. The degree of trust depends on the trust of the purchaser in the manufacturer and supplier. This trust inherited from the supplier is a kind of social trust. This real trust that shows the society needs to be injected into the device itself to form initial trust. The second is device inventory management, which involves cataloging and managing devices and their attributes to form an inventory, and based on this, authenticating and checking the integrity of the device to ensure the security of the device.

[0004] At present, the existing technology often measures the security of terminal hardware platforms in the operating system application layer, which cannot resist the security risks caused by operating system vulnerabilities; in addition, the existing measurement methods often only have one initial measurement and cannot perform continuous measurement. Therefore, how to improve the security of terminal hardware platforms in zero-trust networks is an important issue that the industry needs to solve urgently. Summary of the invention

[0005] The present invention is aimed at the problem that the security of the terminal hardware platform in the zero-trust network in the prior art needs to be improved, and provides a terminal hardware platform security measurement method and storage medium for a zero-trust environment. According to the different states of the current terminal system, the measurement method of hot-swappable hardware is determined; when the terminal system is before the operating system is started, the terminal hardware device is measured based on the firmware layer; when the terminal system is after the operating system is started, the terminal hardware device is measured based on the service, the message queue is monitored at the system kernel layer, and the hot-swappable hardware device is measured after the hot-swappable hardware device is inserted into the terminal. The terminal hardware device security measurement method provided by the present invention can reduce the security risks caused by operating system vulnerabilities, thereby improving the security of hardware devices in a zero-trust network.

[0006] In order to achieve the above object, the technical solution adopted by the present invention is: a terminal hardware platform security measurement method for a zero-trust environment, comprising the following steps:

[0007] S1, state determination: determine the state of the current terminal system, and determine the measurement method for hot and cold plug hardware according to the different states; if the current terminal system is before the operating system is started, go to step S2; otherwise, go to step S3;

[0008] S2, before the operating system is started: When the terminal system is before the operating system is started, the terminal hardware device is measured based on the firmware layer, and the measurement includes at least:

[0009] S21: extracting terminal hardware device information based on the SMBIOS mechanism;

[0010] S22: Based on the PCIE standard, the terminal hardware device information is expanded;

[0011] S23: Perform dual-end identity authentication on the security server and the terminal based on the firmware layer;

[0012] S24: securely encrypting the communication between the security server and the terminal based on the firmware layer;

[0013] S3, after the operating system is started: When the terminal system is in the process of starting the operating system, the terminal hardware devices are measured based on the service, the message queue is monitored at the system kernel layer, and the hot-pluggable hardware devices are measured after the hot-pluggable hardware devices are inserted into the terminal.

[0014] In order to achieve the above-mentioned purpose, the technical solution also adopted by the present invention is: a computer-readable storage medium, characterized in that: a computer program is stored thereon, and the computer program is executed by a processor to implement the above-mentioned terminal hardware platform security measurement method for a zero-trust environment, which can reduce the security risks caused by operating system vulnerabilities and improve the security of hardware devices in a zero-trust network.

[0015] Compared with the prior art: the present invention proposes a terminal hardware platform security measurement method for a zero-trust environment, which has the following technical advantages: security measurement of the terminal hardware platform at the firmware layer can avoid security risks caused by operating system vulnerabilities; after the operating system is started, the terminal hardware platform is measured in the form of a service at the kernel layer, which can avoid attacks on the operating system user state to a certain extent and continuously monitor the terminal hardware platform; based on the encryption algorithm design of the entire communication process, the confidentiality and integrity of the data message are guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of the steps of the terminal hardware platform security measurement method for a zero-trust environment provided by the present invention;

[0017] Figure 2 It is a terminal hardware device measurement architecture diagram before the operating system is started in step S2 of the present invention;

[0018] Figure 3 It is a flow chart of terminal hardware device measurement before the operating system is started in step S2 of the present invention;

[0019] Figure 4 It is a flow chart of the communication of the terminal hardware device measurement before the operating system is started in step S2 of the present invention;

[0020] Figure 5 It is the terminal hardware device measurement model diagram after the operating system is started in step S3 of the present invention;

[0021] Figure 6 It is a Windows service model diagram used in the present invention;

[0022] Figure 7 This is a technical structure diagram of the terminal hardware measurement system after the operating system is started in step S3 of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0024] Example 1

[0025] Terminal hardware platform security measurement methods for zero-trust environments, such as Figure 1 As shown, the method comprises the following steps:

[0026] Step S1: Determine which stage of system startup is currently in. In different stages of system startup, the terminal hardware device measurement method is different. According to the different states, determine the measurement method for hot and cold plug hardware. The measurement method aims to reduce the security risks caused by operating system vulnerabilities and improve the terminal hardware security.

[0027] Step S2: Before the operating system of the terminal system is started, the terminal hardware device is measured based on the firmware layer.

[0028] like Figure 2 As shown, Figure 2 This is an architecture diagram for measuring terminal hardware devices before the operating system is started. It consists of two parts: client and server. The client's functions are stored in the firmware layer as independent modules, reducing the attack surface; while the server's functions are stored in the application layer of the operating system as independent modules, which is more convenient to use without losing security. The information exchange between the server and the client uses the communication module, so that the measurement value of the information does not need to be stored locally, but is directly passed to the server through the communication layer. The server performs load balancing and high concurrency processing on the client's requests. The functions of each part of the system are as follows:

[0029] The client consists of four modules: hardware information collection, communication, information processing, and measurement. The hardware information collection module is responsible for collecting and storing hardware information after the system hardware is powered on and self-checked; the measurement module is responsible for summarizing the collected hardware information and generating a summary value; the information processing module is responsible for encapsulating the error information generated by the verification error to ensure the integrity and confidentiality of the information, and is also responsible for decrypting and authenticating the information sent by the server; the last communication module is responsible for calling the network card driver to communicate with the server.

[0030] The server consists of four modules: communication, host security management, information processing, and database management. There is also a security database that stores the security hardware information of all terminal hosts. The communication module is responsible for calling the network card driver to communicate with the client; the information processing module is responsible for decrypting and authenticating the encapsulated information sent by the client, and is also responsible for encapsulating the verification results to ensure the integrity and confidentiality of the information; the database management module is responsible for responding to the administrator's request to add, delete, modify, and query security data, and responding to the host security management module's query request for the corresponding host hardware information; the host security management module is responsible for verifying the client's hardware information and displaying the verification results.

[0031] Figure 3The flowchart of the present invention for measuring the terminal hardware device before the operating system is started is described in detail below:

[0032] (1) The client system is powered on and enters the BIOS stage

[0033] (2) After POST, physical hardware information is collected and stored

[0034] (3) Use the digest algorithm to calculate the hardware information

[0035] (4) Establish a connection with the server for identity authentication and key negotiation

[0036] (5) Encapsulate the hardware information and release it to the server for verification

[0037] (6) The remote server unpacks the information and then remotely verifies the transmitted hardware information

[0038] (7) Display the verification results, encapsulate the results, and send them back to the client

[0039] (8) After receiving the data, the client first authenticates the server.

[0040] (9) After authentication, the information is decrypted. If the return value is true, the operating system is started; if the return value is false, the operating system is exited.

[0041] That is, the terminal hardware device is measured before the operating system is started, including at least:

[0042] S21: extracting terminal hardware device information based on the SMBIOS mechanism;

[0043] This embodiment uses SMBIOS (System Management BIOS) to obtain basic information about computer hardware. The SMBIOS reference specification describes how motherboards and other system hardware vendors present the management information of their products in a standard format. For computers that comply with the SMBIOS specification, the SMBIOS information is accessed through a table structure. The process of accessing SMBIOS based on the table structure is to first find the Entry Point Structure (EPS) table, and then find the SMBIOS structure table through the data in the EPS table. By searching for the SMBIOS GUID (SMBIOS_TABLE_GUID) in the EFI configuration table, the EPS table is located using a pointer to the SMBIOS. The data table length and data table address are obtained at 16H and 18H in the EPS table structure, and the SMBIOS data structure table can be accessed through the address. The total number of data table structures can be obtained from 1CH in the EPS table. Each SMBIOS data structure describes a physical hardware information. The data structure can be divided into a format area and a string area. The format area is some information about this structure, and the first 3 bytes of each format area must be used to describe the TYPE number, length, and handle. The string area is an area immediately following the format area.

[0044] S22: Based on the PCIE standard, the terminal hardware device information is expanded;

[0045] This embodiment adopts the PCIE (Peripheral Component Interconnect Express, Peripheral Component Interconnect Express) mechanism to expand the terminal hardware device information. A general terminal system has only one PCIEHostBus (PCI host bus) to complete the data exchange between the CPU and the PCIE device. There is generally only one PCIERootBridge (PCIE root bridge), which manages a local bus and hangs a PCIE bus tree. The PCIE devices we want to access are hung on this bus tree, and they belong to the same bus space. The system encodes the bus device through BusNumber (bus number), Device Number (device number), and Function Number (function number). This encoding is generally called BDF code. The EFI_ROOT_BRIDGE_IO_PROTOCOL of UEFI (Unified Extensible Firmware Interface) provides a way to access PEIC devices. It provides an abstract IO function for the PCIE root bridge, which is generated by the PCIE main bus driver. UEFI applications can be used to enumerate device information.

[0046] S23: Perform dual-end identity authentication on the security server and the terminal based on the firmware layer;

[0047] In order to measure the terminal hardware information, the present invention stores the terminal hardware equipment list in the server. Before communicating with the server, in order to ensure confidentiality, the session key must be negotiated with the server. In order to prevent man-in-the-middle attacks, both parties must perform identity authentication. If the identity authentication is passed, the communicating parties use the session key to communicate. The pseudo-algorithm flow of this part is as follows:

[0048] (1) The client registers the server. Here, the server public key certificate registration method is adopted, and the server public key Server_pub is preset in the client.

[0049] (2) The client prompts the user to enter the password passwd

[0050] (3) Generate a 128-bit random number as the symmetric key SMS4KEY, use the key as the session key, and use the symmetric algorithm SMS4_Encrypt to encrypt passwd

[0051] ID=SMS4_Encrypt(SMS4Key,passwd)

[0052] (4) Generate a random number C and a message type M = "login". Connect ID, C, S, and M to form Message

[0053] Message=ID|C|S|M

[0054] (5) Use SM3 to perform hash operation on Connect_msg to obtain H.

[0055] H=SM3(Connect_msg)

[0056] (6) Connect ID, C, S, M, and Hash to form Connect_msg

[0057] Message=ID|C|S|M|H

[0058] (7) Use the server's public key Server_pub to encrypt Connect_msg to form Enc_connect_msg, and then send it to the server.

[0059] Enc_connect_msg=SM2_Encrypt(Server_pub,Connect_msg)

[0060] (8) After receiving Enc_connect_msg, the server uses the private key to decrypt it and obtain Connect_msg.

[0061] Connect_msg=SM2_Decrypt(Server_pri,Enc_connect_msg)

[0062] Connest_msg = ID | C | S | M

[0063] (9) The server verifies the ID. If it fails, it returns to step 1. If it passes, the server uses the S session key to encrypt the communication content.

[0064] S24: securely encrypting the communication between the security server and the terminal based on the firmware layer;

[0065] In order to realize the communication between the client and the server at the firmware layer, the present invention uses the network protocol stack provided by UEFI for communication.

[0066] Specifically, communication is performed through the TCP4 protocol provided by UEFI. The specific process is as follows: Figure 4 As shown, first generate the EFI_TCP4_PROTOCOL object, then configure the EFI_TCP4_PROTOCOL object generated in the previous step. Only after the configuration is completed can the connection request be sent; thirdly, after the connection is completed, transmit the data to be transmitted to the server; finally, close the EFI_TCP4_PROTOCOL object after the data is transmitted. Before starting the communication, you must first configure the network connection. The local end uses the DHCP service to obtain the IP address and bind the address in one communication. Then configure the transmission type to TCP4, and the remote IP address and port are the addresses opened by the server. Finally, configure the events and event functions related to the network connection, and define the priority of the triggering event. Whenever the data is sent and received from the server, the event will be triggered to process the data.

[0067] Step S3: After the terminal system is in the operating system startup, the terminal hardware device is measured based on the service, the message queue is monitored at the system kernel layer, and the hot-pluggable hardware device is measured after the hot-pluggable hardware device is inserted into the terminal.

[0068] This embodiment measures the terminal hardware device through the service mechanism provided by Windows after the operating system is started. Figure 5The following figure shows that three components are provided: Service Application, Service Control Program and Service Configuration Manager to realize the execution, loading and control functions of services. The service program resides in the system to provide service functions for the system or users, and the service control manager feedbacks its execution status; the service control program is used to control the start, pause, stop and other functions of the service application; the service control manager manages the services in the system and provides a programming interface for the service control program to realize the control function of the service application.

[0069] The Windows operating system uses the callback messages reserved for device events to measure the terminal hardware devices after the operating system is started. The Windows system provides a message processing mechanism for service programs, such as Figure 6 When a hot-swappable device such as a USB flash drive is connected to the host, the system detects that the hardware has been inserted, thereby triggering a system message SERVICE_CONTROL_DEVICEEVENT to the system service program. After the service program control function provided by the system service program when registering the service with the system receives the SERVICE_CONTROL_DEVICEEVENT message, it calls the message processing function defined by the service program itself to complete the measurement operation.

[0070] This embodiment uses the WMI (Windows Management Instrumentation) mechanism to extract the terminal hardware device information after the operating system is started. WMI provides an object database that describes the operating system and the hardware and software components. The database is a tree structure containing multiple data branches, each of which is divided into a namespace, providing users with a public interface for accessing system hardware and software resources, so that users can access and obtain descriptions of various system resources through script programs.

[0071] The method of the present invention develops a background terminal hardware device management mechanism through Springboot technology to manage the background database, and at the same time, verifies the terminal hardware device according to the information in the database. The specific technical architecture is as follows Figure 7As shown, the access layer is the technology that users need to use when accessing the system. It embeds jquery and ajax plug-ins, which can provide support for component output and dynamic loading. The business layer is the relevant technology used by the system for business processing. Among them, SpringBoot technology integrates various business logic processing components, which can respond in time and make corresponding execution actions after receiving the request sent by the user, and call the processing method to complete a certain task to achieve the set goal. The SpringBoot framework provides aspect-oriented programming AOP, which can use its own service components for management and improve the utilization rate of data resources based on the SOA service system. The data layer is responsible for storing data and can provide original content for external requests. The present invention uses free mySQL for data management. It can write JDBC program code to realize data access and access functions. In addition, the database is relatively small, can be flexibly configured, and can provide different service APIs. In order to improve data retrieval efficiency, relevant algorithms and data source configurations can be used to achieve the purpose of managing and retrieving related data.

[0072] The method of the present invention displays the terminal hardware security status in a zero-trust network through Vue+El-admin-UI technology.

[0073] Example 2

[0074] This embodiment also provides a computer-readable storage medium on which a computer program is stored. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the steps of the method provided in the above embodiment 1.

[0075] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on this understanding, the above technical solution, in essence or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, and includes several instructions for a computer device to execute the methods described in each embodiment or some parts of the embodiment.

[0076] It should be noted that the above content only illustrates the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. For ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications all fall within the protection scope of the claims of the present invention.

Claims

1. A terminal hardware platform security measurement method for a zero-trust environment, characterized in that: The steps include: S1, state determination: determine the state of the current terminal system, and determine the measurement method for hot and cold plug hardware according to the different states; if the current terminal system is before the operating system is started, go to step S2; otherwise, go to step S3; S2, before the operating system is started: When the terminal system is before the operating system is started, the terminal hardware device is measured based on the firmware layer, and the measurement includes at least: S21: extracting terminal hardware device information based on the SMBIOS mechanism; S22: Based on the PCIE standard, the terminal hardware device information is expanded; S23: Perform dual-end identity authentication on the security server and the terminal based on the firmware layer; S24: securely encrypting the communication between the security server and the terminal based on the firmware layer; S3, after the operating system is started: When the terminal system is in the process of starting the operating system, the terminal hardware devices are measured based on the service, the message queue is monitored at the system kernel layer, and the hot-pluggable hardware devices are measured after the hot-pluggable hardware devices are inserted into the terminal; in this step, the terminal hot-pluggable hardware device information is extracted based on the WMI mechanism of the resource management system; the terminal hardware security status in the zero-trust network is displayed based on the Vue+El-admin-UI technology.

2. The terminal hardware platform security measurement method for a zero-trust environment according to claim 1, characterized in that: The two-end identity authentication in step S23 includes: (1) authenticating the terminal to the security server based on the security server public key preset by the terminal; and (2) authenticating the security server to the terminal user based on the user name and password entered by the terminal user using the keyboard.

3. The terminal hardware platform security measurement method for a zero-trust environment as claimed in claim 2, characterized in that: The security encryption in step S24 specifically includes: when the terminal sends identity information to the security server, a random SMS4 session key S is generated, and the key is used to encrypt the identity information to form an encrypted identity information ID; when the terminal sends identity information to the security server, a random number C is generated and sent to the security server to prevent replay attacks; when the terminal sends identity information to the security server, a message type M is generated for the security server to identify the type of message; when the terminal sends identity information to the security server, ID, C, S, and M are connected to form connection information, and then the SM3 algorithm is used to perform hash operation to obtain a hash value H; when the terminal sends identity information to the security server, the preset security server public key is used to encrypt the information after the connection of ID, C, S, M, and H.

4. The terminal hardware platform security measurement method for a zero-trust environment according to claim 2 or 3, characterized in that: In step S24, two-end network communication is achieved based on the TCP protocol in the IPv4 network.

5. The terminal hardware platform security measurement method for a zero-trust environment according to claim 1, characterized in that: The security server in the measurement method is displayed to the outside in the form of a Web, and a security administrator is set up to manage the terminal device list; the hardware information sent by the terminal is checked for consistency based on the Springboot+Mybatis technology; and the background terminal hardware device database is managed based on the Springboot+Mybatis technology.

6. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is executed by a processor to implement a terminal hardware platform security measurement method for a zero-trust environment as described in any one of claims 1-5.

Images