A method and device for starting an application on a target platform

Abstract

An embodiment of the specification provides a method and device for starting an application on a target platform, wherein the target platform includes at least a verifiable startup chip and a trusted execution environment. The method includes: starting multiple system startup items in sequence according to a preset startup order, wherein starting a first startup item included in the multiple system startup items includes measuring its next startup item and recording the measurement result in the verifiable startup chip; starting a verification agent program based on the trusted execution environment; starting a first user application based on the trusted execution environment, and the verification agent program determines first verification information corresponding to the first user application based on local verification in the trusted execution environment.

Description

[0001] This application is a divisional application of the invention patent application with application number 202110176522.7 filed on February 9, 2021, and entitled “A method and device for launching an application on a target platform”. Technical Field

[0002] One or more embodiments of this specification relate to the field of data security, and more particularly, to a method and apparatus for launching an application on a target platform. Background Art

[0003] Currently, in scenarios such as multi-party computing, data outsourcing, and sensitive data processing, protecting program code and data from theft or corruption on computing platforms has become a technical imperative. While existing solutions exist to ensure the security of program code and data, these solutions still suffer from vulnerabilities and reliance on remote verification services.

[0004] Therefore, protecting the code / data of programs on computing platforms is an urgent problem that needs to be solved. Summary of the Invention

[0005] The embodiments in this specification are intended to provide a method for more effectively protecting the code / data of programs on a computing platform, thereby addressing deficiencies in the prior art.

[0006] According to a first aspect, a method for launching an application on a target platform, wherein the target platform includes at least a verifiable launch chip and a trusted execution environment, the method comprising:

[0007] Starting a plurality of system startup items in sequence according to a preset startup order, wherein starting a first startup item included in the plurality of system startup items includes measuring a next startup item thereof and recording the measurement result in a verifiable startup chip;

[0008] Starting the verification agent program based on the trusted execution environment;

[0009] A first user application is started based on the trusted execution environment, and the verification agent determines first verification information corresponding to the first user application based on local verification in the trusted execution environment.

[0010] In one embodiment, the method further includes recording the first verification information into a verifiable startup chip.

[0011] In one embodiment, the method further includes, in response to a remote user of the target platform's access request to the verifiable boot chip, providing the remote user with a first record generated by the verifiable boot chip based on the first verification information; allowing the remote user to determine the security of the first user application and / or the security of the target platform based on the first record.

[0012] In one embodiment, the first authentication information is maintained by the authentication agent; the method further comprises:

[0013] In response to a remote user's request for access to the verifiable boot chip, providing a second record to the remote user, where the second record is generated by the verifiable boot chip according to a first measurement result recorded when the last boot item among the multiple system boot items is started;

[0014] The verification agent program establishes a trust channel with the remote user in response to the connection request of the remote user based on the first measurement result, and provides the first verification information to the remote user through the trust channel.

[0015] In one embodiment, the second record is used by a remote user to determine the security of the target platform based on the second record.

[0016] In one embodiment, the first verification information is used by a remote user to determine the security of the first user application based on the first verification information.

[0017] In one embodiment, determining the security of the target platform based on the second record includes verifying whether the version of the operating system OS and / or virtual machine monitor VMM started by the target platform is a predetermined version based on the second record, and determining the security of the target platform based on the verification result.

[0018] In one embodiment, the verifiable startup chip includes one of a trusted platform module TPM chip, a trusted cryptographic module TCM chip, a trusted platform control module TPCM chip, and a Titan chip.

[0019] In one embodiment, the method further includes, after launching the first user application:

[0020] Launching a second user application based on the trusted execution environment,

[0021] The authentication agent program determines second authentication information corresponding to the second user application based on local authentication in the trusted execution environment.

[0022] In one embodiment, the first one of the plurality of system startup items is a root of trusted measurement (CRTM).

[0023] In one embodiment, the plurality of system startup items further include several items of a boot loader BootLoader, an operating system OS, and a virtual machine monitor VMM.

[0024] In one embodiment, the authentication agent includes at least a trusted portion;

[0025] Said launching of the verification agent program at least comprises executing said trusted part in a trusted execution environment;

[0026] Starting the last one of the multiple system startup items includes measuring the trusted part and recording the measurement result in a verifiable startup chip.

[0027] In one embodiment, the first user application includes at least a trusted portion;

[0028] Starting a first user application based on the trusted execution environment includes at least executing the trusted part in the trusted execution environment;

[0029] The authentication agent determines first authentication information of the first user application based on local authentication in the trusted execution environment, including:

[0030] The authentication agent determines first authentication information corresponding to the first user application according to the trusted part based on local authentication in the trusted execution environment.

[0031] In one embodiment, the verification agent determines the first verification information corresponding to the first user application based on local verification in the trusted execution environment, including the verification agent calling the local verification instruction of the software protection extension SGX to obtain the first verification information corresponding to the first user application.

[0032] According to a second aspect, a device for launching an application on a target platform is provided, wherein the target platform includes at least a verifiable launch chip and a trusted execution environment, and the device includes:

[0033] A system startup unit is configured to start a plurality of system startup items in sequence according to a preset startup order, wherein starting a first startup item included in the plurality of system startup items includes measuring a next startup item and recording the measurement result in a verifiable startup chip;

[0034] The verification agent starting unit is configured to start the verification agent program based on the trusted execution environment;

[0035] The user application startup unit is configured to start a first user application based on a trusted execution environment, and determine, by the verification agent program, first verification information corresponding to the first user application based on local verification in the trusted execution environment.

[0036] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0037] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the first method described is implemented.

[0038] By utilizing one or more of the methods, apparatuses, computing devices, and storage media in the above aspects, the problem of protecting the code / data of programs on the computing platform can be solved more effectively. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0040] Figure 1 A schematic diagram illustrating a method for starting an application on a target platform according to an embodiment of this specification;

[0041] Figure 2 A flowchart illustrating a method for starting an application on a target platform according to an embodiment of this specification;

[0042] Figure 3 A flowchart illustrating an implementation of a method for launching an application on a target platform according to an embodiment of this specification;

[0043] Figure 4 A flowchart illustrating another implementation of a method for launching an application on a target platform according to an embodiment of this specification;

[0044] Figure 5 A structural diagram showing a device for launching an application on a target platform according to an embodiment of this specification; DETAILED DESCRIPTION

[0045] The solution provided in this invention will be described below with reference to the accompanying drawings.

[0046] As mentioned above, current methods for securing program code / data still have shortcomings such as security loopholes and reliance on remote authentication services. The inventors have studied existing methods for securing startup program code / data and have reached the following conclusions.

[0047] Currently, commonly used methods for securing program code and data on computing platforms primarily rely on verified boot and trusted execution environments. Verified boot refers to a system boot process with step-by-step integrity verification. The principle behind a verified boot approach is that the system starts from a root of trust and boots to the user program step by step. At each boot step, the next boot item is measured and verified, and a trusted record is written to the verified boot chip. For example, using TPM (Trusted Platform Module) technology, the hash value of the next boot item is written to the platform configuration register (PCR) in the TPM chip. Users can remotely access the trusted boot record (which is signed to ensure integrity and authenticity) to determine whether the system maintains the expected boot items and boot order. However, a disadvantage of verified boot is that it only ensures security during boot. Dynamic attacks that occur after boot are difficult to detect and defend against.

[0048] A Trusted Execution Environment (TEE) is an encrypted or isolated execution environment that is considered secure and trustworthy. Therefore, code and data within this encrypted or isolated environment are less vulnerable to attacks from outside the environment. Solutions based on a Trusted Execution Environment (TEE) operate by excluding the highly privileged operating system (OS) or virtual machine manager (VMM) from the Trusted Computing Base (TCB), allowing users to confidently run protected code and data on untrusted OSes or VMMs while providing remote verification capabilities. However, a primary drawback of TEE-based solutions is that they only protect against direct attacks from malicious OSes or VMMs, but lack protection against side-channel attacks. Furthermore, TEE-based solutions often rely on remote verification services provided by third-party vendors, creating a dependency on external availability and assuming these third-party vendors will not engage in malicious activity (for example, assuming collusion or insider attacks).

[0049] In order to solve the problems existing in the above technical solutions, the inventors propose a method and device for launching an application on a target platform in the embodiments of this specification. In this solution, on the one hand, the trusted logic of the user application is placed in a trusted execution environment for isolated execution, thereby preventing direct attacks (non-side channel) by malicious VMM / operating systems; on the other hand, when verifying the program, the user can obtain the verification information of the startup chain and the platform at the same time, so as to verify that the launched VMM / operating system is in the expected state (for example, a trusted version with a very small TCB and side channel attack monitoring), thereby improving the defense capability against side channel attacks. On the other hand, program verification is based on a mechanism that combines verifiable startup and local verification, and does not need to rely on external trusted execution environment verification services such as IAS, which greatly improves the reliability and security of program verification.

[0050] The basic idea of ​​this method is further explained below.

[0051] Figure 1 FIG. 1 is a schematic diagram showing a method for starting an application on a target platform according to an embodiment of the present specification. Figure 1 As shown, the target platform includes at least a verifiable boot chip, a trusted execution environment (TEE), and multiple boot items. These include, in order of startup, multiple system boot items (as shown in Figure 1: CRTM, Bootloader / OS, with the first system boot item being the trusted measurement root core (CRTM)), a verification agent, and several user applications (User Application 1 and User Application 2). First, multiple system boot items are started sequentially. During the startup of any system boot item, the next boot item is measured, and the measurement results are recorded in the verifiable boot chip. Then, the verification agent (or its trusted portion) is started in the TEE. Finally, the user application is started. The verification agent obtains verification information corresponding to the user application by at least invoking local verification in the trusted execution environment. The verification agent can maintain the verification information corresponding to the user application or record it in the verifiable boot chip.

[0052] Using this method, applications are launched on the target platform and executed within a trusted execution environment (TEE). This prevents attacks from malicious VMMs and operating systems. Furthermore, the TEE verifies the application through local verification via a verification agent, eliminating reliance on external TEE verification services. The verified boot chip can also generate trusted records based on the measurement and verification information stored within it to verify that the launched program and VMM / OS are in the expected state, thereby providing protection against side-channel attacks based on the verification results.

[0053] The specific process of this method is further explained below.

[0054] Figure 2 A flowchart of a method for starting an application on a target platform according to an embodiment of the present specification is shown. The target platform at least includes a verifiable startup chip and a trusted execution environment, and the method at least includes the following steps.

[0055] In step 21, multiple system startup items are started in sequence according to a preset startup order, wherein starting the first startup item included in the multiple system startup items includes measuring the next startup item and recording the measurement result in the verifiable startup chip.

[0056] As previously mentioned, a verified boot refers to a system boot process with a step-by-step integrity check. The principle behind this is to maintain a trusted record of the boot items against which step-by-step integrity checks can be performed. This trusted record is typically implemented using an independent verified boot chip. In different embodiments, the verified boot chip can utilize different types of verified boot chips, and this specification does not limit the specific type of verified boot chip used. In one embodiment, the verified boot chip can include one of a Trusted Platform Module (TPM) chip, a Trusted Cryptographic Module (TCM) chip, a Trusted Platform Control Module (TPCM) chip, or a Titan chip.

[0057] The measurement of the startup item may include the summary, characterization, or identification of the startup item content. According to one embodiment, a hash calculation may be performed on the next startup item to obtain its measurement result. In another example, the result of the hash calculation of the next startup item may be hash-extended to obtain the measurement result and record it. The so-called hash extension refers to the process of performing more than one nested hash operation based on the hash calculation result obtained first and the added calculation items to obtain the calculation result.

[0058] In one embodiment, in this step, the system startup sequence is as follows: Figure 1As shown in the figure, the Core Root of Trust Measurement (CRTM) is the initial boot component of the target platform and the root of trust for the entire system. After the CRTM is booted, it will start the next boot item (for example, the Basic Input and Output System (BIOS), which will then start further boot items (for example, the boot loader, VMM, operating system, etc.), and so on, until the user-mode program is started. During this process, to establish a trust chain for the boot relationship, like a conventional verified boot, after the CRTM is booted, it will measure the next boot item (for example, the BIOS), which will then measure further boot items (for example, the boot loader), until the user-mode program is measured. Each measurement result is written to the corresponding trusted record (in the verifiable chip) and can be presented to remote users later.

[0059] In one embodiment, the first boot item in a plurality of system boot items is a trusted root of measurement core CRTM. In another embodiment, a plurality of system boot items may also include several items in a boot loader BootLoader, an operating system OS, and a virtual machine monitor VMM. In yet another embodiment, a dynamic CRTM (D-CRTM, DynamicCRTM) scheme may also be adopted. In the D-CRTM (Dynamic CRTM) scheme, the BIOS is started before the D-CRTM, and a dynamic launch event DL Event (dynamic launch event) is stimulated during the BIOS startup to thereby start the D-CRTM. However, during the BIOS startup, the measurement of the next boot item will not be performed, and the measurement will not be recorded in the bootable verification chip. In other words, whether conventional CRTM (or static CRTM, S-CRTM, Static CRTM) or D-CRTM is adopted, the measurement of the next boot item and the measurement will be recorded in the bootable verification chip, all started by the CRTM (S-CRTM or D-CRTM).

[0060] In one embodiment, during the startup of the last system startup item, the verification agent is measured and the measurement result is recorded in the verifiable startup chip. The details of this embodiment will be described later in this specification.

[0061] In step 22, the authentication agent program is started based on the trusted execution environment.

[0062] A Trusted Execution Environment (TEE) is a secure area within the main processor (CPU). As an isolated execution environment, it ensures the confidentiality and integrity of the code and data loaded within it. For example, the TEE ensures the integrity of applications executed through TEE isolation and the confidentiality of their resources. In other words, the TEE provides an execution space that offers higher security than the operating system (OS) for trusted applications running on the device.

[0063] In different embodiments, TEE can be implemented on different host processors, and the specific implementations of TEE on different host processors may vary. For example, the SGX solution for TEE may be implemented on one CPU, while the TrustZone solution for TEE may be implemented on another CPU. This specification does not limit the specific implementation of TEE.

[0064] Unlike conventional verified boot, this step involves launching an authentication agent before launching user apps. Like future user apps, the authentication agent runs using the same trusted execution environment (TEE) technology. In one example, the trusted logic of the authentication agent can be loaded into the TEE for isolated, encrypted execution.

[0065] Another difference from the conventional verifiable startup method is that the conventional verifiable startup method directly measures the user program Apps during the startup process of the system startup item. In the embodiment of this specification, as described above, during the startup of the last item among multiple system startup items, the verification agent program is measured and the measurement results are recorded in the verifiable startup chip. That is to say, the objects of the last measurement and the recording results of the system items are different. In one embodiment, the verification agent program may include at least a trusted part. In this embodiment, in step 21, for the startup of the last item among multiple system startup items, its specific implementation method may be to measure the trusted part and record the measurement results in the verifiable startup chip.

[0066] In step 23, the first user application is started based on the trusted execution environment, and the verification agent determines first verification information corresponding to the first user application based on local verification in the trusted execution environment.

[0067] In this step, the user application launched after the verification agent obtains its verification information by the verification agent at least by calling the local verification in the trusted execution environment. For example, in one example, the local verification (Local Attestation) of SGX can be called on the SGX platform to obtain the verification information of the application. In another example, the verification agent can also obtain the verification information of the application by superimposing other data items on the information obtained by calling the local verification in the trusted execution environment to verify the user program, such as after hash extension calculation. In essence, since the verification agent and the user application run in the TEE on the same target platform, the verification agent can realize the identity authentication of the user application by calling the local verification (Local Attestation) in the TEE, without resorting to remote verification by a third party.

[0068] In one embodiment, a first user application may include at least a trusted portion; the trusted portion is executed in a trusted execution environment; and a verification agent program, based on local verification in the trusted execution environment, determines corresponding first verification information based on the trusted portion of the first user application. In a specific embodiment, the verification agent program may invoke a local verification instruction of a software protection extension (SGX) to obtain the first verification information corresponding to the first user application.

[0069] In one embodiment, after launching the first user application, a second user application can be launched based on the trusted execution environment. The verification agent determines the second verification information corresponding to the second user application based on local verification in the trusted execution environment. In other words, each user application launched after the verification agent is launched will have its verification information determined by the verification agent based on local verification in the TEE. This is different from the chained verification method in verified startup.

[0070] In different implementations, the verification information corresponding to the user application can be written into a verifiable startup chip, or it can not be written into the chip and only maintained by the verification agent program, thereby providing different remote verification methods for users who remotely verify the above startup program.

[0071] Therefore, according to one embodiment, Figure 3As shown, the first verification information can be recorded in the verifiable boot chip. In one embodiment, when a remote user of the target platform wishes to remotely verify the security of the target platform, the user can issue an access request to the verifiable boot chip in the target platform. In response to the access request, the target platform can provide the remote user with a first record generated by the verifiable boot chip based on the first verification information. In this way, the remote user can determine the security of the first user's application and / or the security of the target platform based on the first record.

[0072] In one example of this embodiment, a remote user can build the same operating environment as the target platform on his or her own platform based on the program version number of the startup item on the target platform, and thereby obtain the corresponding value of the first record, and determine the security of each startup item (including system startup items and user application startup items) on the startup chain of the target platform based on the corresponding value of the first record and the first record. In one example, if the corresponding value of the first record matches the first record, it means that each startup item on the startup chain of the target platform is complete and correct, that is, the target platform and the applications started thereon are all safe; if the corresponding value of the first record does not match the first record, it means that at least one of the startup items on the startup chain of the target platform is incomplete or incorrect, that is, one or more of the target platform and the applications started thereon are unsafe.

[0073] In another example of this embodiment, the remote user may also obtain the corresponding value of the first record from, for example, a trusted third party. The rest of the execution process is the same as the corresponding part of the execution process in the previous example and will not be repeated here.

[0074] According to another embodiment, Figure 4 As shown, the first verification information can be maintained by the verification agent. In one embodiment, when a remote user of the target platform wants to remotely verify the security of the target platform, the user can still issue an access request to the verifiable startup chip in the target platform. In response to the access request, the target platform provides a second record to the remote user, and the second record is generated by the verifiable startup chip according to the first measurement result recorded when the last startup item in the multiple system startup items is started. It should be understood that the last startup item is the last system startup item, and the program started after it is the verification agent. Therefore, the first measurement result recorded when the last startup item is started corresponds to the measurement result of the verification agent. Therefore, the remote user can issue a connection request to the verification agent based on the first measurement result. In response to the connection request, the verification agent can establish a trust channel with the remote user and provide it with the first verification information through the trust channel.

[0075] In one example, the first verification information can be used by a remote user to determine the security of the first user's application based on the first verification information. In another example, the second record can be used by the first remote user to determine the security of the target platform based on the second record. In a specific example, the second record can be used by the first remote user to verify whether the version of the operating system (OS) and / or virtual machine monitor (VMM) started by the target platform is a predetermined version based on the second record, and determine the security of the target platform based on the verification result.

[0076] Specifically, the remote user can build the same operating environment as the target platform on his own platform based on the program version number of each startup item on the target platform, thereby obtaining the corresponding value of the second record and the first verification information on his own platform, and determine the security of the system startup items and verification agent programs on the startup chain on the target platform based on the corresponding value of the second record and the second record. In one example, if the corresponding value of the second record matches the second record, it can be determined that the various system startup items and verification agent programs on the startup chain on the target platform are complete and correct, that is, it can be determined that the system running on the target platform is safe. Then, in another example, the integrity and correctness of the first user's application can also be determined based on the corresponding value of the first verification information and the first verification information. If the corresponding value of the first verification information matches the first verification information, it can be determined that the first user's application is safe.

[0077] In another example, the remote user may also obtain the corresponding values ​​of the second record and the first verification information from, for example, a trusted third party. The rest of the execution process is the same as the corresponding part in the execution process in the previous example and will not be repeated here.

[0078] Figure 5 The target platform at least includes a verifiable startup chip and a trusted execution environment, such as Figure 5 As shown, the apparatus 500 includes:

[0079] The system startup unit 51 is configured to start a plurality of system startup items in sequence according to a preset startup order, wherein starting a first startup item included in the plurality of system startup items includes measuring a next startup item and recording the measurement result in a verifiable startup chip;

[0080] The verification agent starting unit 52 is configured to start the verification agent program based on the trusted execution environment;

[0081] The user application starting unit 53 is configured to start a first user application based on the trusted execution environment, and determine first verification information corresponding to the first user application based on local verification in the trusted execution environment by the verification agent.

[0082] In one embodiment, the apparatus 500 may further include a recording unit configured to record the first verification information into a verifiable startup chip.

[0083] In one example, the device 500 may also include a first response unit configured to, in response to a remote user of the target platform's access request to the verifiable boot chip, provide the remote user with a first record generated by the verifiable boot chip based on the first verification information; so that the remote user determines the security of the first user application and / or the security of the target platform based on the first record.

[0084] In one embodiment, the user application starting unit 53 may be further configured such that the first verification information is maintained by the verification agent program;

[0085] The apparatus 500 may further include a second response unit configured to, in response to a remote user's request for access to the verifiable boot chip, provide a second record to the remote user, where the second record is generated by the verifiable boot chip according to a first measurement result recorded when the last boot item among the multiple system boot items is started;

[0086] The third response unit is configured to: establish a trust channel with the remote user in response to the connection request of the remote user based on the first measurement result, and provide the first verification information to the remote user through the trust channel.

[0087] In one example, the second record is used by a remote user to determine the security of the target platform based on the second record.

[0088] In one example, the first verification information can be used by a remote user to determine the security of the first user application based on the first verification information.

[0089] The second response unit can be further configured to determine the security of the target platform based on the second record, including verifying whether the version of the operating system OS and / or virtual machine monitor VMM started by the target platform is a predetermined version based on the second record, and determining the security of the target platform based on the verification result.

[0090] In one embodiment, the verifiable startup chip may include one of a trusted platform module TPM chip, a trusted cryptographic module TCM chip, a trusted platform control module TPCM chip, and a Titan chip.

[0091] In one embodiment, the user application launching unit may be further configured to, after launching the first user application: launch the second user application based on the trusted execution environment,

[0092] The user application starting unit may be further configured to determine, by the verification agent program, second verification information corresponding to the second user application program based on local verification in the trusted execution environment.

[0093] In one embodiment, the first one of the plurality of system startup items may be a root of trust measurement (CRTM). In another example, the plurality of system startup items may further include several items of a boot loader (BootLoader), an operating system (OS), and a virtual machine monitor (VMM).

[0094] In one embodiment, the authentication agent may include at least a trusted portion;

[0095] The verification agent startup unit may be further configured to execute the trusted part in a trusted execution environment;

[0096] The system startup unit may be further configured to measure the trusted part and record the measurement result in the verifiable startup chip.

[0097] In one embodiment, the first user application includes at least a trusted portion;

[0098] The user application startup unit may be further configured to execute the trusted part in a trusted execution environment; the verification agent program determines the first verification information corresponding to the first user application according to the trusted part based on local verification in the trusted execution environment.

[0099] In one embodiment, the user application startup unit may be further configured to, via the verification agent program, call a local verification instruction of the software protection extension SGX to obtain first verification information corresponding to the first user application.

[0100] On the other hand, the present specification provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to perform any one of the above methods.

[0101] On the other hand, the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, any one of the above methods is implemented.

[0102] It should be understood that the descriptions such as “first” and “second” in this article are only used to distinguish similar concepts for the sake of simplicity of description and do not have any other limiting effect.

[0103] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0104] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for launching an application on a target platform, wherein the target platform comprises at least a verifiable boot chip and a trusted execution environment (TEE), the method comprising: Using the verifiable startup chip, multiple system startup items are started in sequence according to a preset startup order in a verifiable startup manner; After starting the multiple system startup items, starting the verification agent program based on the trusted execution environment TEE; A first user application is started based on the TEE, and the authentication agent program implements identity authentication for the first user application based on local authentication in the TEE.

2. The method according to claim 1, wherein Implementing authentication for the first user application, Including determining first verification information corresponding to the first user application. 3 . The method according to claim 2 , further comprising recording the first verification information into the verifiable boot chip.

4. The method according to claim 3, further comprising: In response to a remote user of the target platform's access request to the verifiable boot chip, a first record generated by the verifiable boot chip based on the first verification information is provided to the remote user; allowing the remote user to determine the security of the first user's application and / or the security of the target platform based on the first record.

5. The method according to claim 1, wherein The verifiable startup chip includes one of a trusted platform module TPM chip, a trusted cryptographic module TCM chip, a trusted platform control module TPCM chip, and a Titan chip.

6. The method of claim 1 , further comprising, after launching the first user application: Launch a second user application based on the TEE, The authentication agent program implements authentication of the second user application based on local authentication in the TEE.

7. The method according to claim 1, wherein The first one of the plurality of system startup items is a root of trusted measurement CRTM.

8. The method according to claim 7, wherein: The multiple system startup items also include several items of a boot loader BootLoader, an operating system OS, and a virtual machine monitor VMM.

9. The method according to claim 1, wherein: The authentication agent comprises at least a trusted part; Said launching of the verification agent program at least comprises executing said trusted part in a trusted execution environment; Starting the last one of the multiple system startup items includes measuring the trusted part and recording the measurement result in a verifiable startup chip.

10. The method according to claim 1, wherein The first user application includes at least a trusted portion; Launching a first user application based on the TEE at least includes executing the trusted part in the trusted execution environment; The verification agent implements authentication of the first user application based on local verification in the TEE, including: The verification agent determines first verification information corresponding to the first user application based on the local verification in the TEE and according to the trusted part.

11. The method according to claim 1, wherein the verification agent program implements identity authentication of the first user application based on local verification in the TEE, including the verification agent program calling the local verification instruction of the software protection extension SGX to obtain first verification information corresponding to the first user application.

12. A device for launching an application on a target platform, the target platform comprising at least a verifiable launch chip and a trusted execution environment (TEE), the device comprising: A system startup unit is configured to use the verifiable startup chip to start multiple system startup items in a verifiable startup manner in a preset startup order; A verification agent startup unit is configured to, after starting the multiple system startup items, start the verification agent program based on the trusted execution environment TEE; The user application startup unit is configured to start a first user application based on TEE, and the verification agent program implements identity authentication of the first user application based on local verification in TEE.

13. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 11.

14. A computing device comprising a memory and a processor, characterized in that: The memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 11 is implemented.

Images