TEE-based trusted detection method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of information security, and discloses a trusted detection method and device based on a TEE (Trusted Execution Environment), an electronic device and a storage medium, the method comprising the following steps: obtaining a detection tool software package, installing the detection tool software in detection platform management software to obtain initial detection platform management software; after the initial detection platform management software is installed in the TEE, extracting a digital certificate in the detection tool software package; performing public key operation on the digital signature according to a signature public key to obtain a first hash value; extracting a file in the detection tool software according to a running state and calculating a second hash value corresponding to the file; and performing numerical verification on the first hash value and the second hash value to obtain a numerical verification result. The application can ensure that the detection result of the initial detection tool software is more accurate, thereby ensuring the impartiality and legality of the detection result.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a trusted detection method, apparatus, electronic device, and storage medium based on TEE. Background Technology

[0002] With the continuous improvement of intelligence and networking, and the gradual development of industrialization, the quality testing and certification of industrial products are becoming increasingly standardized. In the testing process for each type of product, regulatory agencies uniformly manage the testing platforms of testing institutions. However, most of these are offline, local area network testing environments, lacking substantial and effective supervision. The software environment within these testing platforms is extremely vulnerable to decompilation or tampering, affecting the authority and credibility of the testing quality system. The testing software tools in open testing platforms are highly susceptible to attacks such as decompilation and tampering, thus affecting the accuracy of test results. In summary, existing technologies suffer from inconsistencies between the testing tool software used during platform operation and the initial authorization, resulting in low security and susceptibility to tampering. Summary of the Invention

[0003] This invention provides a trusted testing method, apparatus, electronic device, and storage medium based on TEE. Its main purpose is to solve the problem that the testing tool software is inconsistent with the initial authorization during the use of the testing platform, resulting in low security of the testing platform during use and making it susceptible to tampering.

[0004] To achieve the above objectives, the present invention provides a trusted detection method based on a TEE, comprising: acquiring a detection tool package; installing the detection tool software corresponding to the detection tool package in a preset detection platform management software to obtain initial detection platform management software; after installing the initial detection platform management software in a preset trusted execution environment, extracting a digital certificate from the detection tool package, wherein the digital certificate contains a digital signature and a signing public key; performing public key operations on the digital signature based on the signing public key to obtain a first hash value; acquiring the running status of the detection tool software; extracting a target file from the detection tool software based on the running status; calculating a second hash value corresponding to the target file; and performing numerical verification on the first hash value and the second hash value to obtain a numerical verification result.

[0005] This invention also provides a trusted testing device based on a TEE, comprising: a testing tool software installation module for acquiring a testing tool software package and installing the testing tool software corresponding to the testing tool software package into a preset testing platform management software to obtain initial testing platform management software; a digital certificate extraction module for extracting the digital certificate from the testing tool software package after installing the initial testing platform management software into a preset trusted execution environment, wherein the digital certificate contains a digital signature and a signing public key; a first hash value calculation module for performing public key operations on the digital signature based on the signing public key to obtain a first hash value; a second hash value calculation module for acquiring the running status of the testing tool software, extracting the target file in the testing tool software based on the running status, and calculating the second hash value corresponding to the target file; and a numerical verification module for performing numerical verification on the first hash value and the second hash value to obtain the numerical verification result.

[0006] The present invention also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the aforementioned trusted detection method based on TEE.

[0007] The present invention also provides a storage medium storing at least one computer program, which is executed by a processor in an electronic device to implement the aforementioned TEE-based trusted detection method.

[0008] Compared with the prior art, the beneficial effects of the present invention are as follows: By installing the detection tool software in the detection platform management software, the detection platform management software can verify the integrity and legality of the detection tool software; by installing the initial detection platform management software in a trusted execution environment, the trusted execution environment can guarantee the integrity of the detection platform management software; by extracting the digital certificate in the detection tool software package and using the public key of the digital certificate to perform public key calculation on the digital signature, the obtained first hash value is more accurate; by extracting the files in the detection tool software through the running status of the detection tool software and calculating the second hash value corresponding to the files, the second hash value can be more accurate, thereby accelerating the calculation efficiency; by numerically verifying the first hash value and the second hash value, the detection tool software can be prevented from being tampered with during use, ensuring that the detection results of the initial detection platform management software are more accurate, thereby ensuring the fairness and legality of the detection results. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating a trusted detection method based on TEE provided in an embodiment of the present invention.

[0010] Figure 2 This is a flowchart illustrating the process of installing the detection tool software corresponding to the detection tool software package into a preset detection platform management software to obtain the initial detection platform management software, according to an embodiment of the present invention.

[0011] Figure 3 This is a functional block diagram of a TEE-based trusted detection device provided in an embodiment of the present invention.

[0012] Figure 4 A schematic diagram of the structure of an electronic device implementing a trusted detection method based on TEE is provided in one embodiment of the present invention. Detailed Implementation

[0013] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0014] To address the issue that existing trusted detection methods based on TEE (Trusted Execution Environment) suffer from inconsistencies between the detection tool software and the initial authorization during platform use, leading to lower security and susceptibility to tampering, an embodiment of this invention provides a trusted detection method based on TEE. This method installs the detection tool software corresponding to the detection tool package within the detection platform management software, and installs the initial detection platform management software within a trusted execution environment. This ensures the security of the initial detection platform management software during use and guarantees that the detection tool software remains consistent with the initial authorization, preventing tampering.

[0015] Figure 1 This is a flowchart illustrating a trusted detection method based on TEE provided in an embodiment of the present invention.

[0016] In this embodiment, the trusted detection method based on TEE includes:

[0017] S1. Obtain the testing tool package and install the corresponding testing tool software in the preset testing platform management software to obtain the initial testing platform management software.

[0018] In one embodiment, the testing tool software package includes testing tool software and a digital certificate. The testing tool software may be performance testing software, white-box testing software, black-box testing software, and server-side stress performance testing software, etc.

[0019] Please see Figure 2As shown, in one embodiment, the detection tool software corresponding to the detection tool package is installed in a preset detection platform management software to obtain the initial detection platform management software, including: S21, obtaining the installation request of the detection tool software, parsing the detection tool software according to the installation request to obtain parameter information and configuration path; S22, querying the information area corresponding to the parameter information from the detection platform management software according to the parameter information, and saving the parameter information to the information area; S23, configuring the detection tool software into the environment variables corresponding to the detection platform management software according to the configuration path; S24, updating the detection platform management software using the information area and environment variables to obtain the initial detection platform management software.

[0020] In one embodiment, the detection platform management software can be a management system, such as a LIMS management system. It can locate the corresponding parameter tags in the detection platform management software based on the parameter information, obtain the information area corresponding to the parameter tags, and store the parameter information in the corresponding information area in the detection platform management software according to the parameter tags. Then, it can configure the detection tool software into the environment variables corresponding to the detection platform management software according to the configuration path, thereby updating the detection platform management software and obtaining the initial detection platform management software.

[0021] S2. After installing the initial detection platform management software in the preset trusted execution environment, extract the digital certificate from the detection tool package. The digital certificate contains a digital signature and a signature public key.

[0022] In one embodiment, the trusted execution environment refers to the TEE trusted execution environment.

[0023] In one embodiment, installing the initial detection platform management software in a preset trusted execution environment is similar to the step in S1 above of installing the detection tool software corresponding to the detection tool package in the preset detection platform management software, and will not be described in detail here.

[0024] In one embodiment, extracting a digital certificate from a detection tool software package includes: using a preset search command to locate the location information of the digital certificate in the detection tool software package; extracting the public key from the digital certificate based on the location information; and using the public key to decrypt the detection tool software package to obtain the digital certificate.

[0025] In one embodiment, after extracting the digital certificate, the method further includes importing the digital certificate into the initial testing platform management software.

[0026] In one embodiment, the search command can be the certmgr.msc command; select the path information corresponding to the public key from the location information, obtain the corresponding public key based on the path information; after decrypting the tool package with the public key to obtain the digital certificate, save it to the initial testing platform management software.

[0027] S3. Perform public key operations on the digital signature based on the public key to obtain the first hash value.

[0028] In one embodiment, performing public key operations on the digital signature based on the signing public key to obtain a first hash value includes: decrypting the digital signature using the signing public key to obtain a digital digest; and performing hash calculation on the digital digest using a preset hash function to obtain the first hash value.

[0029] In one embodiment, the hash function is represented as:

[0030] h = H(M)

[0031] Where h represents the first hash value, H represents the hash function, and M represents the digital digest.

[0032] In one embodiment, a hash function, also known as a hashing function, can transform an input of arbitrary length into an output of fixed length.

[0033] S4. Obtain the running status of the detection tool software, extract the target file from the detection tool software based on the running status, and calculate the second hash value corresponding to the target file.

[0034] In one embodiment, the running state of the detection tool software can be divided into not running and running; when the detection tool software is started and running, the file directory in the detection tool software is obtained, and the files are extracted in order according to the file directory to obtain the target file.

[0035] In one embodiment, calculating the second hash value corresponding to the target file includes: performing binary conversion on the target file to obtain a message file; padding the message file with data to obtain message file groups; dividing the message file groups into blocks to obtain message blocks; obtaining a word register, setting the initial variable of the word register, and expanding the message block with data; and performing iterative compression calculation on the expanded message block and the initial variable using a preset compression function to obtain the second hash value.

[0036] In one embodiment, the compression function is expressed as:

[0037] V = CF(A, B) i )

[0038] Where V represents the second hash value, A represents the initial variable, and B represents the initial variable. iLet represent the i-th message block, and CF represent the compression function.

[0039] In one embodiment, the target file is converted to binary to obtain a message file of length L bits. The message file can be padded and iteratively compressed using a preset SM3 algorithm, specifically as follows: A bit "1" is added to the end of the message file, followed by k zeros, where k is the smallest negative integer satisfying L+1+k=448mod512. Finally, a 64-bit string is added to the end of the message file to obtain message file groups. These message file groups are then divided into blocks, for example, each group can be divided into 512-bit blocks, resulting in n message blocks. Each message block is then expanded to 132 words to achieve data expansion and improve the accuracy of the calculated data. The word register can be set to ABCDEFGH, and the initial variable for the word register iteration value is set. Iterative compression calculations are then performed on the expanded message blocks and the initial variable to obtain the second hash value.

[0040] S5. Perform numerical verification on the first and second hash values ​​to obtain the results of the numerical verification.

[0041] In one embodiment, numerical verification of the first hash value and the second hash value includes: determining whether the first hash value and the second hash value are equal; when the first hash value and the second hash value are equal, the numerical verification passes; when the first hash value and the second hash value are not equal, the numerical verification fails.

[0042] In one embodiment, verification is performed based on the magnitude of a first hash value and a second hash value. The first hash value refers to the initial digital signature value of the detection tool software, and the second hash value refers to the updated value after a period of time during the operation cycle of the detection tool software. When the first hash value and the second hash value are inconsistent, the numerical verification fails, that is, the detection tool software has been tampered with.

[0043] In one embodiment, after the numerical verification fails, the method further includes, during the upgrade and maintenance of the detection tool software, the initial detection platform management software re-extracts the digital certificate from the detection tool software package, wherein the digital certificate contains a digital signature and a signing public key, thereby updating the first hash value.

[0044] In one embodiment, this invention installs the detection tool software within the detection platform management software, enabling the management software to verify the integrity and legitimacy of the detection tool software. By installing the initial detection platform management software in a trusted execution environment (TEE), the TEE ensures the integrity of the management software. Extracting the digital certificate from the detection tool software package and using the public key of the digital certificate to perform public-key computation on the digital signature results in a more accurate first hash value. Extracting files from the detection tool software based on its running state and calculating the corresponding second hash value ensures greater accuracy of the second hash value, thereby accelerating computation efficiency. Numerical verification of the first and second hash values ​​prevents tampering with the detection tool software during use, ensuring more accurate detection results from the initial TEE management software, thus guaranteeing the fairness and legitimacy of the detection results. Therefore, the TEE-based trusted detection method proposed in this invention maintains consistency between the detection tool software and its initial authorization during platform use, thereby improving the security of the detection platform during use and preventing tampering.

[0045] Figure 3 This is a functional block diagram of a TEE-based trusted detection device according to an embodiment of the present invention. Depending on the functions implemented, the TEE-based trusted detection device 300 may include a detection tool software installation module 301, a digital certificate extraction module 302, a first hash value calculation module 303, a second hash value calculation module 304, and a numerical verification module 305. The module of the present invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by a processor, such as a processor in a door lock system, and can perform a fixed function. These segments can be stored in memory or directly executed by a processor.

[0046] In one embodiment, the functions of each module / unit are as follows: Detection tool software installation module 301, used to obtain a detection tool software package, install the detection tool software corresponding to the detection tool software package in a preset detection platform management software, and obtain initial detection platform management software; digital certificate extraction module 302, used to extract the digital certificate from the detection tool software package after installing the initial detection platform management software in a preset trusted execution environment, wherein the digital certificate contains a digital signature and a signature public key; first hash value calculation module 303, used to perform public key calculation on the digital signature based on the signature public key to obtain a first hash value; second hash value calculation module 304, used to obtain the running status of the detection tool software, extract the target file in the detection tool software based on the running status, and calculate the second hash value corresponding to the target file; numerical verification module 305, used to perform numerical verification on the first hash value and the second hash value to obtain the numerical verification result.

[0047] In detail, in one embodiment, each module in the TEE-based trusted detection device 300 uses the same technical means as the TEE-based trusted detection method in the accompanying drawings and can produce the same technical effect, which will not be repeated here.

[0048] like Figure 4 The diagram shown is a schematic representation of an electronic device that implements a trusted detection method based on TEE according to an embodiment of the present invention.

[0049] Electronic device 400 may include processor 401, memory 402, communication bus 403 and communication interface 404, and may also include computer programs stored in memory 402 and capable of running on processor 401, such as a TEE-based trusted detection program.

[0050] In some embodiments, the processor 401 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 401 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 402 (e.g., executing a TEE-based trusted detection program) and calls data stored in the memory 402 to perform various functions of the electronic device and process data.

[0051] The memory 402 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 402 can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the memory 402 can be an external storage device of the electronic device, such as a plug-in portable hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc. Furthermore, the memory 402 can include both internal and external storage units of the electronic device. The memory 402 can be used not only to store application software and various types of data installed on the electronic device, such as code for a product recommendation program based on user profiles, but also to temporarily store data that has been output or will be output.

[0052] The communication bus 403 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to implement communication between the memory 402 and at least one processor 401.

[0053] Communication interface 404 is used for communication between the aforementioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, Bluetooth interface, etc.), typically used to establish communication connections between the electronic device and other electronic devices. The user interface may be a display, an input unit (such as a keyboard), and optionally, the user interface may also be a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device and to display a visual user interface.

[0054] Figure 4 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 4 The structure shown does not constitute a limitation on the electronic device 400, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0055] For example, although not shown, the electronic device may also include a power supply (such as a battery) to power various components. Preferably, the power supply can be logically connected to at least one processor 401 via a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power sources, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0056] It should be understood that the embodiments are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0057] The present invention also provides a storage medium storing a computer program, which, when executed by a processor, can implement the trusted detection method based on TEE according to any of the above embodiments. It should be noted that the storage medium can be volatile or non-volatile. For example, the medium may include: any entity or device capable of carrying computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0058] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0059] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0060] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0061] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0062] Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the invention. No appended diagram markings in the claims should be construed as limiting the scope of the claims.

[0063] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0064] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in a system claim may also be implemented by a single unit or device through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any specific order.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A reliable detection method based on TEE, characterized in that, include: Obtain the detection tool software package, and install the detection tool software corresponding to the detection tool software package into the preset detection platform management software to obtain the initial detection platform management software; After installing the initial detection platform management software in a preset trusted execution environment, the digital certificate in the detection tool software package is extracted, wherein the digital certificate contains a digital signature and a signature public key; The digital signature is processed using the public key to obtain a first hash value. The running status of the detection tool software is obtained, the target file in the detection tool software is extracted according to the running status, and the second hash value corresponding to the target file is calculated; Numerical verification is performed on the first hash value and the second hash value to obtain the numerical verification result; The step of installing the detection tool software corresponding to the detection tool software package into the preset detection platform management software to obtain the initial detection platform management software includes: Obtain the installation request of the detection tool software, parse the detection tool software according to the installation request, and obtain parameter information and configuration path; Based on the parameter information, query the information area corresponding to the parameter information from the detection platform management software, and save the parameter information to the information area; Configure the detection tool software into the environment variables corresponding to the detection platform management software according to the configuration path; The detection platform management software is updated using the information area and the environmental variables to obtain the initial detection platform management software.

2. The trusted detection method based on TEE as described in claim 1, characterized in that, The extraction of the digital certificate from the detection tool software package includes: The location information of the digital certificate is located from the detection tool software package using a preset search command; The public key in the digital certificate is extracted based on the location information, and the detection tool software package is decrypted using the public key to obtain the digital certificate.

3. The trusted detection method based on TEE as described in claim 1, characterized in that, The step of performing public key operations on the digital signature based on the signature public key to obtain the first hash value includes: The digital signature is decrypted using the public key to obtain a digital digest; The digital digest is hashed using a preset hash function to obtain the first hash value.

4. The trusted detection method based on TEE as described in claim 1, characterized in that, The calculation of the second hash value corresponding to the target file includes: The target file is converted into binary form to obtain a message file; The message files are populated with data to obtain message file groups; The message file is divided into groups and blocks to obtain message blocks; Obtain the word register, set the initial variables of the word register, and expand the data of the message block; The message block after data expansion and the initial variables are iteratively compressed using a preset compression function to obtain a second hash value.

5. The trusted detection method based on TEE as described in claim 1, characterized in that, The numerical verification of the first hash value and the second hash value includes: Determine whether the first hash value and the second hash value are equal; The numerical verification passes when the first hash value is equal to the second hash value. The numerical verification fails when the first hash value is not equal to the second hash value.

6. A reliable detection device based on TEE, characterized in that, The device includes: The detection tool software installation module is used to obtain the detection tool software package and install the detection tool software corresponding to the detection tool software package into the preset detection platform management software to obtain the initial detection platform management software. The digital certificate extraction module is used to extract the digital certificate from the detection tool software package after the initial detection platform management software is installed in a preset trusted execution environment. The digital certificate contains a digital signature and a signing public key. The first hash value calculation module is used to perform public key operations on the digital signature based on the signature public key to obtain the first hash value; The second hash value calculation module is used to obtain the running status of the detection tool software, extract the target file in the detection tool software according to the running status, and calculate the second hash value corresponding to the target file. The numerical verification module is used to perform numerical verification on the first hash value and the second hash value to obtain the numerical verification result; The step of installing the detection tool software corresponding to the detection tool software package into the preset detection platform management software to obtain the initial detection platform management software includes: Obtain the installation request of the detection tool software, parse the detection tool software according to the installation request, and obtain parameter information and configuration path; Based on the parameter information, query the information area corresponding to the parameter information from the detection platform management software, and save the parameter information to the information area; Configure the detection tool software into the environment variables corresponding to the detection platform management software according to the configuration path; The detection platform management software is updated using the information area and the environmental variables to obtain the initial detection platform management software.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the TEE-based trusted detection method as described in any one of claims 1 to 5.

8. A storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the trusted detection method based on TEE as described in any one of claims 1 to 5.

Images