A remote verification method and device based on append-only memory

Abstract

This invention provides a remote verification method and device based on append-only memory. The method may include: sending a memory initialization request to a high-security domain based on a received verification request, so that the high-security domain allocates a first storage area for a low-security domain; executing a target application and recording the control flow jump paths during the execution of the target application in the first storage area; and sending a data read request to the high-security domain based on the completion of the target application execution or a memory full exception occurring in the first storage area, so that the high-security domain reads multiple control flow jump paths from the first storage area and generates a verification report. By adding registers and related logic to the memory controller, the allocation of append-only memory from the high-security domain to the low-security domain is achieved. Storing data in append-only memory not only ensures data integrity and prevents attackers from tampering with it, but also reduces the number of context switches between the low-security domain and the high-security domain, improving the performance of remote control flow verification.

Description

Technical Field

[0001] This invention relates to the field of remote verification, and more particularly to a remote verification method and device based on append-only memory. Background Technology

[0002] The Internet of Things (IoT) is permeating many aspects of daily life, such as smart meters and traffic lights. These devices are deployed in automobiles, healthcare, industry, smart cities, factories, and some critical infrastructure. IoT systems are divided into front-end and back-end. The front-end is typically an embedded device deployed in a relatively open environment, making it vulnerable to attack. Although back-end devices in the IoT generally confirm their availability through heartbeat information emitted by the front-end embedded device, they still cannot determine the integrity of the front-end device. For example, they cannot determine whether an attacker has attempted to attack the front-end device or whether the attack was successful. Therefore, back-end devices need to remotely verify the front-end device to confirm its integrity.

[0003] Remote authentication is a mechanism that establishes trust between remote devices. The remote device records its operation and sends the recordings to a remote authenticator, who then determines whether the remote device is functioning correctly. Summary of the Invention

[0004] This application provides a remote verification method and device based on append-only memory. By adding registers and related logic to the memory controller, it enables the allocation of append-only memory from the high-security domain to the low-security domain, protecting the integrity of data stored in the append-only memory in the low-security domain and preventing attackers from tampering with it. Simultaneously, storing data in append-only memory reduces the number of context switches between the low-security and high-security domains, significantly improving the performance of remote control flow verification.

[0005] In a first aspect, embodiments of this application provide a remote verification method. This method is executed by a front-end device in an Internet of Things (IoT) system. The front-end device includes a low-security domain and a high-security domain, wherein the high-security domain has higher privileges than the low-security domain. The method includes: receiving a verification request sent by a remote device, the verification request being used to request verification of a target application in the low-security domain; sending a memory initialization request to the high-security domain to allocate a first storage area for the low-security domain, the first storage area being a storage area where only data can be added; executing the target application and recording the control flow jump paths during the execution of the target application in the first storage area; based on the completion of the target application execution or a memory full exception occurring in the first storage area, sending a data read request to the high-security domain to read multiple control flow jump paths from the first storage area and generating a verification report based on the multiple control flow jump paths; and sending the verification report to the remote device.

[0006] The remote verification method provided in this application involves the following steps: After the front-end device receives a verification request for a target application, the low-security domain requests a first storage area (Append-only Memory) from the high-security domain. The target application is then executed in the low-security domain, and the control flow jump paths generated during the execution of the target application are recorded in the Append-only Memory. Because the Append-only Memory has the attribute of allowing only data to be added, the integrity of the path information stored in the Append-only Memory is guaranteed, preventing attackers from tampering with it. Furthermore, the control flow jump paths of the target application are saved in the Append-only Memory. When the target application finishes execution or the Append-only Memory encounters a full exception, the high-security domain is triggered to read address information from the Append-only Memory, reducing the number of context switches between the low-security domain and the high-security domain and improving the performance of remote control flow verification.

[0007] In one possible implementation, the front-end device includes a memory controller, which includes a first register, a second register, and a third register. The high security domain allocates a first storage region to the low security domain, including: obtaining a continuous physical address segment through the high security domain as the physical address of the first storage region; initializing the first register, the second register, and the third register so that the value of the first register is the start address of the physical address, the value of the second register is the end address of the physical address, and the value of the third register is the currently writable address of the physical address.

[0008] In other words, registers and related logic are added to the memory controller to allocate a first storage area (Append-only Memory) for the lower security domain from the higher security domain. Specifically, registers in the memory controller record the start address, end address, and currently writable address of the Append-only Memory. When data is written to the Append-only Memory, the current writable address of the Append-only Memory is updated by changing the values ​​of the registers. This prevents attackers from tampering with the data stored in the Append-only Memory.

[0009] In one possible implementation, recording the control flow jump path during the execution of the target application into the first storage area includes: obtaining the start address, end address, and current writable address of the first storage area; obtaining the length of the control flow jump path that the target application needs to write to the first storage area and the write address of the target application to the first storage area; determining whether the write address is the same as the current writable address of the first storage area based on the fact that the write address is located between the start address and end address of the first storage area; generating a write exception and stopping the writing of the control flow jump path to the first storage area based on the fact that the write address is the same as the current writable address of the first storage area; writing the control flow jump path to the first storage area based on the fact that the write address is the same as the current writable address of the first storage area, and updating the current writable address of the first storage area according to the length of the control flow jump path.

[0010] In other words, when recording the control flow jump path generated during the execution of the target application to the first storage area (Append-only Memory), it is necessary to determine the write address of the jump path to ensure that the write address is located in Append-only Memory. Furthermore, when the write address is located in Append-only Memory, it is also necessary to compare the write address with the currently writable address of Append-only Memory. Only when the write address is the same as the currently writable address of Append-only Memory is the path written to Append-only Memory. This prevents users from modifying the data already written to Append-only Memory (when the write address is less than the currently writable address of Append-only Memory, it is assumed that the user needs to modify the data in Append-only Memory).

[0011] In one possible implementation, before executing the target application in the low-security domain, the method further includes: obtaining a code file of the target application, the code file including multiple branches; for each of the multiple branches in the code file, replacing the source instruction at that branch with a jump instruction, the jump instruction being used to cause the target application to execute jump code, the jump code including the source instruction at the branch; executing the source instruction in the jump code to obtain path information of the next instruction to jump to.

[0012] In other words, when verifying the integrity of the control flow of a target application, it is necessary to obtain the control flow jump path of the target program. Therefore, it is necessary to modify and instrument the target application. By using jump instructions at branches in the target application's code file, the source instructions at the branch are sent to the jump code for execution, and the jump address of the target application at the branch is obtained without changing the layout of the target application's code file.

[0013] In one possible implementation, after the high-security domain reads the control flow jump path from the first storage area, the method further includes: reconfiguring the first storage area to enable it to store the control flow jump path written by the low-security domain to the target application.

[0014] In other words, after the high-security region reads the control flow jump path from the first memory area (Append-only Memory), it needs to reconfigure the Append-only Memory. Specifically, the high-security region needs to initialize the values ​​of the registers (first register, second register, and third register) that store the start address, end address, and current writable address of the Append-only Memory, so that the value of the first register is the start address of the Append-only Memory, the value of the second register is the end address of the Append-only Memory, and the value of the third register is the current writable address of the Append-only Memory (after resetting, the current writable address of the Append-only Memory is the start address of the Append-only Memory).

[0015] In one possible implementation, generating a verification report based on multiple control flow jump paths includes: performing a hash calculation on each of the multiple control flow jump paths to obtain multiple hash values; wherein, performing a hash calculation on the nth path to obtain the hash value Measurement of the nth path. n for:

[0016] Measurement n=Hash(Measurment) n-1 Destination Address

[0017] Among them, Measurment n-1 The hash value is the (n-1)th path, and the Destination Address is the destination address that the target application needs to jump to when executing the nth path; the verification request and multiple hash values ​​are signed to obtain a verification report.

[0018] In other words, after the high-security domain obtains multiple control flow jump paths from the first storage area (Append-only Memory), it needs to perform hash calculations on each control flow jump path. When performing hash calculations on a control flow jump path, it needs to obtain the hash value of the previous jump path and the destination address of the current jump path. Then, it performs a hash operation on the hash value of the previous jump path and the destination address of the current jump path to obtain the hash value of the current control flow jump path.

[0019] Secondly, this application also provides a remote verification method, which is executed by a front-end device in an Internet of Things (IoT) system. The front-end device includes a low-security domain and a high-security domain, with the high-security domain having higher privileges than the low-security domain. The memory of the front-end device is divided into multiple sub-regions. The method includes: receiving multiple verification requests sent by a remote device, the multiple verification requests being used to request verification of multiple target applications in the low-security domain; allocating a sub-region for each of the multiple target applications; sending a memory initialization request to the high-security domain, so that the high-security domain allocates a first storage area for each sub-region, the first storage area being a storage area where only data can be added; executing the target application for each of the multiple target applications, and recording the control flow jump path during the execution of the target application in the first storage area of ​​the sub-region corresponding to the target application; based on the completion of the target application execution or the memory full exception of the first storage area, sending a data read request to the high-security domain, so that the high-security domain reads multiple control flow jump paths from the first storage area and generates a verification report based on the multiple control flow jump paths; and sending the verification report to the remote device.

[0020] The remote verification method provided in this application divides the memory of the front-end device into multiple sub-regions. Different sub-regions are allocated to different target applications in the front-end device system, and a corresponding first storage area (Append-only Memory) is allocated to each sub-region. In other words, multiple Append-only Memory segments are provided within the same device system to handle situations where multiple applications perform remote verification in parallel within the same device system.

[0021] In one possible implementation, the front-end device includes a memory controller, which includes a third memory and a fourth memory. The process involves sending a memory initialization request to a high-security domain to allocate a first storage region for each sub-region. This includes: for each of the multiple target applications, obtaining a first register and a second register of the sub-region, where the first register records the start address of the sub-region and the second register records the end address of the sub-region; obtaining a continuous physical address range through the high-security domain as the physical address of the first storage region; and initializing the first, second, third, and fourth registers such that the value of the first register is the start address of the physical address, the value of the second register is the end address of the physical address, the value of the third register is the currently writable address of the physical address, and the fourth register stores access permission information for the first storage region.

[0022] In other words, by adding registers and related logic to the memory controller, the high-security domain allocates a first storage area (Append-only Memory) to the low-security domain. Specifically, registers in the sub-region are reused to record the start and end addresses of the Append-only Memory, and registers are added to the memory controller to record the currently writable addresses and access permissions of the Append-only Memory. This ensures that only the kernel where the target application runs in the low-security domain can write to the Append-only Memory, and only the high-security domain can read from the Append-only Memory. This guarantees the security of the data in the Append-only Memory.

[0023] In one possible implementation, a sub-region is allocated for each of the multiple target applications, including: obtaining the code file of each target application; inserting an operation code file into the code file of the target application, so that the target application can perform read and write operations on one of the multiple sub-regions during execution.

[0024] In other words, when allocating a sub-region for the target application, operation code files for the sub-region are inserted into the target application's code file. This ensures that during the execution of the target application, the control flow jump path of the target application can be stored in the append-only memory of the sub-region.

[0025] Thirdly, embodiments of this application provide a terminal device that includes a low-security domain and a high-security domain, wherein the high-security domain has higher privileges than the low-security domain.

[0026] Low security domains include:

[0027] The communication module is used to receive authentication requests sent by remote devices. These authentication requests are used to request authentication of the target application in the low-security domain.

[0028] The communication module is also used to send memory initialization requests to the high-security domain;

[0029] The processing module is used to execute the target application and record the control flow jump path during the execution of the target application to the first storage area;

[0030] The exception handling module is used to send data read requests to the high-security domain;

[0031] The communication module is also used to receive the verification report sent by the high-security domain and send the verification report to the remote device;

[0032] High-security domains include:

[0033] The memory initialization module is used to allocate a first storage area to the low security domain according to the memory initialization request. The first storage area is a storage area where data can only be added. The data collection module is used to read multiple control flow jump paths in the first storage area.

[0034] The verification module is used to generate verification reports based on multiple control flow jump paths.

[0035] In one possible implementation, the front-end device includes a memory controller, which includes a first memory, a second memory, and a third memory. The memory initialization module is used for:

[0036] Obtain a contiguous range of physical addresses as the physical addresses of the first storage region;

[0037] Initialize the first register, the second register, and the third register so that the value of the first register is the starting address of the physical address, the value of the second register is the ending address of the physical address, and the value of the third register is the writable address of the current physical address.

[0038] In one possible implementation, the processing module is also used for

[0039] Get the start address, end address, and current writable address of the first storage region;

[0040] Obtain the length of the control flow jump path that the target application needs to write to the first storage area, and the write address of the target application to the first storage area;

[0041] Based on the fact that the write address is located between the start address and the end address of the first storage area, it is determined whether the write address is the same as the current writable address of the first storage area;

[0042] A write exception is generated because the write address is different from the current writable address of the first storage area, and writing the control flow jump path to the first storage area is stopped.

[0043] Since the write address is the same as the current writable address of the first storage area, the control flow jump path is written to the first storage area, and the current writable address of the first storage area is updated according to the length of the control flow jump path.

[0044] In one possible implementation, before executing the target application, the processing module is further configured to:

[0045] Obtain the target application's code file, which includes multiple branches;

[0046] For each of the multiple branches in the code file, replace the source instruction at the branch with a jump instruction. The jump instruction is used to cause the target application to execute the jump code, which includes the source instruction at the branch.

[0047] Execute the source instruction in the jump code to obtain the path information of the next instruction to jump to.

[0048] In one possible implementation, after reading the control flow jump path in the first storage area, the data collection module is also used for:

[0049] The first storage area is reconfigured to enable it to store control flow jump paths written to the target application in the low-security domain.

[0050] In one possible implementation, the verification module is used for:

[0051] For each of the multiple control flow jump paths, perform a hash calculation to obtain multiple hash values; specifically, perform a hash calculation on the nth path to obtain the hash value Measurement for the nth path. n for:

[0052] Measurement n =Hash(Measurment) n-1 Destination Address

[0053] Among them, Measurment n-1 The hash value is the (n-1)th path, and the Destination Address is the destination address that the target application needs to jump to when executing the nth path; the verification request and multiple hash values ​​are signed to obtain a verification report.

[0054] Fourthly, embodiments of this application provide a terminal device that includes a low-security domain and a high-security domain, wherein the high-security domain has higher privileges than the low-security domain, and the memory of the terminal device is divided into multiple sub-regions.

[0055] Low security domains include:

[0056] The communication module is used to receive multiple authentication requests sent by remote devices. These authentication requests are used to request authentication of multiple target applications in the low-security domain.

[0057] The processing module is used to allocate a sub-region for each of the multiple target applications;

[0058] The communication module is also used to send a memory initialization request to the high-security domain;

[0059] The processing module is also used to execute each of the multiple target applications, and record the control flow jump path during the execution of the target application to the first storage area of ​​the sub-region corresponding to the target application.

[0060] The exception handling module is used to send data read requests to the high-security domain;

[0061] The communication module is also used to receive the verification report sent by the high-security domain and send the verification report to the remote device;

[0062] The high-security domain includes:

[0063] The memory initialization module is used to allocate a first storage area for each sub-region according to the memory initialization request. The first storage area is a storage area where data can only be added.

[0064] The data collection module is used to read multiple control flow jump paths in the first storage area;

[0065] The verification module is used to generate verification reports based on multiple control flow jump paths.

[0066] In one possible implementation, the front-end device includes a memory controller, which comprises a first memory, a second memory, and a third memory. The memory initialization module is used for:

[0067] For each of the multiple target applications, obtain the first register and the second register of the sub-region. The first register records the start address of the sub-region, and the second register records the end address of the sub-region.

[0068] A contiguous range of physical addresses is obtained through the high-security domain and used as the physical address of the first storage region;

[0069] Initialize the first register, the second register, the third register, and the fourth register so that the value of the first register is the starting address of the physical address, the value of the second register is the ending address of the physical address, the value of the third register is the currently writable address of the physical address, and the fourth register is used to store the access permission information of the first storage area.

[0070] In one possible implementation, the processing module is used for:

[0071] For each of the multiple target applications, obtain the target application code file;

[0072] Insert an operation code file into the target application's code file, enabling the target application to perform read and write operations on one of multiple sub-regions during execution.

[0073] Fifthly, embodiments of this application provide an electronic device, which includes: at least one memory for storing a target application;

[0074] At least one processor can be time-multiplexed between a high security domain and a low security domain. When the processor is in the low security domain, it is used for:

[0075] Receive authentication requests sent by remote devices, which are used to request authentication of target applications in low-security domains;

[0076] Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area to the low security domain. The first storage area is a storage area where data can only be added.

[0077] Execute the target application and record the control flow jump path during the execution of the target application to the first storage area;

[0078] Based on the completion of the target application execution or the occurrence of a memory full exception in the first storage area, a data read request is sent to the high security domain so that the high security domain reads multiple control flow jump paths from the first storage area and generates a verification report based on the multiple control flow jump paths;

[0079] Send the verification report to the remote device.

[0080] In a sixth aspect, embodiments of this application provide an electronic device, the device comprising: at least one memory for storing a target application, wherein a memory region in the at least one memory is divided into multiple sub-regions;

[0081] At least one processor can be time-multiplexed between a high security domain and a low security domain. When the processor is in the low security domain, it is used for:

[0082] Receive multiple authentication requests from remote devices. These requests are used to request authentication for multiple target applications in a low-security domain.

[0083] Assign a sub-region to each of the multiple target applications;

[0084] Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area for each sub-region, wherein the first storage area is a storage area where only data can be added;

[0085] For each of the multiple target applications, execute the target application and record the control flow jump path during the execution of the target application in the first storage area of ​​the sub-region corresponding to the target application;

[0086] Based on the completion of the target application execution or the occurrence of a memory full exception in the first storage area, a data read request is sent to the high security domain so that the high security domain reads multiple control flow jump paths from the first storage area and generates a verification report based on the multiple control flow jump paths;

[0087] Send the verification report to the remote device.

[0088] In a seventh aspect, embodiments of this application provide a computer-readable medium storing instructions that, when executed on a computer, cause the computer to perform the method of the first aspect or the second aspect.

[0089] Eighthly, embodiments of this application provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform the method of the first aspect or the second aspect. Attached Figure Description

[0090] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0091] Figure 1 This is a diagram illustrating remote verification based on TPM.

[0092] Figure 2 A schematic diagram of the ARM TrustZone architecture;

[0093] Figure 3a This is a schematic diagram of remote verification of control flow integrity based on ARM Trustzone;

[0094] Figure 3b Another schematic diagram of remote verification of control flow integrity based on ARM Trustzone

[0095] Figure 4 This is a schematic diagram of the LO_FAT system architecture;

[0096] Figure 5 An application scenario diagram provided for an embodiment of this application;

[0097] Figure 6 This application provides a schematic diagram of the structure of a front-end device according to an embodiment of the present application.

[0098] Figure 7 A processor system architecture diagram provided for an embodiment of this application;

[0099] Figure 8 A flowchart illustrating a remote verification method based on append-only memory provided in this application embodiment;

[0100] Figure 9 This application provides a schematic diagram of a process for writing data to a first storage area according to an embodiment of the present application.

[0101] Figure 10 A flowchart illustrating yet another remote verification method based on append-only memory provided in this application embodiment;

[0102] Figure 11 A schematic diagram of the region division for TZC-400;

[0103] Figure 12 A diagram illustrating the configuration of append-only permissions for a region;

[0104] Figure 13 This is a schematic diagram of the structure of a front-end device provided in an embodiment of this application. Detailed Implementation

[0105] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be described below with reference to the accompanying drawings.

[0106] In the description of the embodiments in this application, any embodiment or design that is “exemplary,” “for example,” or “by way of example” should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as “exemplary,” “for example,” or “by way of example” is intended to present the relevant concepts in a concrete manner.

[0107] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and their variations all mean "including but not limited to," unless otherwise specifically emphasized.

[0108] Remote authentication is a mechanism that establishes trust between remote devices. The remote device records its operation and sends the recordings to a remote authenticator, who then determines whether the remote device is functioning correctly.

[0109] First, let's introduce remote authentication. A key component of remote authentication is trusted storage, used to record the operation of the device being authenticated, preventing attackers from tampering with the data generated during the device's operation. For example... Figure 1 As shown, in traditional remote authentication schemes for servers and desktops, trusted storage is provided by a Trusted Platform Module (TPM). However, deploying a TPM on low-end embedded devices is too complex and expensive. Therefore, academia also adopts some lightweight solutions to provide trusted storage, but these also incur significant performance overhead. Furthermore, traditional remote authentication only measures the initial state of the system by measuring static executable files at system startup, and cannot cope with runtime vulnerability exploitation attacks, such as ROP attacks.

[0110] Secondly, remote verification also involves the choice of granularity. For example, verification can be performed at the module level (coarse-grained) or at the code jump level (fine-grained). Coarser granularity generally results in lower security but lower performance overhead. Finer granularity, on the other hand, provides better security but incurs higher performance overhead.

[0111] Next, we will introduce the ARM processor architecture in remote devices. ARM is a processor architecture used in most IoT devices. ARM TrustZone is a hardware-based security feature. Figure 2 A schematic diagram of the ARM TrustZone architecture, as shown below. Figure 2 As shown, ARM TrustZone modifies the existing hardware architecture, introducing two protection domains with different permissions at the processor level—the secure world and the normal world. At any given time, the processor runs in only one of these environments. These two worlds are hardware isolated and have different permissions. Applications or operating systems running in the normal world face strict restrictions on accessing resources in the secure world. Conversely, programs running in the secure world can access resources in the normal world normally. The hardware isolation and different permission attributes between the secure and normal worlds provide an effective mechanism for protecting application code and data. Typically, the normal world is used to run commercial operating systems (e.g., Android, iOS). The commercial operating system running in the normal world provides a Rich Execution Environment (REE). The secure world always uses a secure TEE-kernel to provide a Trusted Execution Environment (TEE), where confidential data can be stored and accessed. This way, even if the operating system in the normal world is compromised or hacked (e.g., iOS is jailbroken or Android is rooted), hackers cannot access the confidential data stored in the TEE. Therefore, the secure world can provide trusted storage for the ordinary world (insecure world), ensuring the integrity of the data stored in the secure world even if the REE is compromised.

[0112] Several methods exist for verifying the control flow integrity of remote devices. The first method, such as... Figure 3a and Figure 3b As shown. Figure 3a and Figure 3b A schematic diagram of a control flow integrity verification architecture based on ARM TrustZone is provided.

[0113] Step 1: The verifier performs static analysis on the target application module on the remote device to obtain the control flow graph of the target application. This control flow graph covers all legal control flow paths of the target application.

[0114] Step 2: Measure each path in the control flow graph, i.e. calculate the hash value, and store the hash value in the Measurement DB.

[0115] Step 3: The verifier sends a verification request, i.e., Challenge c, to the target application on the remote device;

[0116] Step 4: Execute the target application on the remote device and record the control flow jump path of the target application during execution. This jump path includes the addresses of branches that may be attacked during the execution of the target application, including forward jumps and reverse jumps.

[0117] Because the target application generates a large number of branch jumps during execution, resulting in a significant amount of data, to reduce the amount of data transmitted over the network, branch jump addresses are typically recorded by calculating their hash values. Specifically, the hash value of the nth branch address is... n for:

[0118] Measurement n =Hash(Measurmemt) n-1 Destination Address

[0119] Among them, Measurment n-1 The hash value is the (n-1)th path, and the Destination Address is the destination address that the target application needs to jump to when executing the nth path.

[0120] Step 5: The remote device sends a verification request (Challenge c) and Measurement to the verifier. n Sign the document, generate a verification report, and send the verification report to the verifier.

[0121] During the execution of the target application, the application cannot record the jump addresses during execution. Therefore, it is necessary to modify and instrument the target application. (See reference...) Figure 3b According to the target application's original logic, the `branch_c` instruction executes first, followed by `ins_c`, but this fails to record the branch jump address. Therefore, instrumentation is needed to make the `branch_c` instruction jump to `trampolines`. `trampolines` sends the jump address to trusted storage provided by ArmTrustZone, and then jumps to the `ins_c` instruction. Figure 3b As shown, firstly, instrumentation is performed on the target application, inserting jump instructions at branch jump points to execute the jumper code. Figure 3b ② in the text. Then the jump code sends the branch jump address to the Hash Engine in the secure world, corresponding to... Figure 3b ③ in the middle.

[0122] In the secure world, the Hash Engine calculates the metric value of the branch jump address. If all branch jump addresses have been executed, an Attestation Report is generated. Figure 3b ④ in the code. Otherwise, return to the jumper code, corresponding to... Figure 3b In step ⑤, the jumper code then jumps to the next instruction, and the application continues execution. Figure 3b ⑥ in the middle.

[0123] Step 6: Verify the signature of the received verification report, and then, based on the Measurement in the verification report... n Search within the Measurement DB. If a result matching Measurement can be found in the Measurement DB... n If the same hash value is obtained, it indicates that the control flow path on the remote device is legitimate. Otherwise, the path has been compromised.

[0124] The first approach, while capable of verifying the integrity of the control flow on remote devices, requires three additional operations for each branch jump compared to the original program logic when executing the target application on the remote device: (1) jumping to trampolines; (2) switching the context from the normal world to the secure world; and (3) hashing in the secure world. Of these three operations, the context switch from the normal world to the secure world incurs the highest performance overhead. Therefore, in the first approach, the overall system performance overhead is linearly related to the number of branch jumps requiring verification; if the number of branch jumps requiring verification in the application is large, the performance overhead will be very high.

[0125] The second option, such as Figure 4 As shown, LO_FAT is a hardware-based remote control flow verification technology that modifies the processor's pipeline, utilizes widely available branch filters to trace control flow, and provides on-chip storage to store metrics of the control flow path.

[0126] The second approach requires modifying the processor's pipeline. It involves deep customization for the application of remote proof of control flow integrity and is implemented based on the open-source RISC-V microcontroller SoC (Pulpino). This is feasible for academic research, but for commercial processors, such modifications are too significant and unacceptable to commercial processor manufacturers.

[0127] The primary application scenario for this invention is the integrity verification of control flow for remote devices in an Internet of Things (IoT) system. The overall system architecture mainly includes: a verifier and a prover. The prover sends a remote verification report to the verifier to prove that the prover's current state is normal and has not been attacked. After confirming that the prover's state is normal based on the verification report sent by the prover, the verifier can send confidential data to the prover. Figure 5 This diagram illustrates an application scenario provided by an embodiment of this application. The remote verification scheme for control flow integrity based on append-only memory provided by this application is primarily applied to Internet of Things (IoT) systems. Figure 5 The IoT system architecture diagram shown includes: server 10 and front-end devices 11, 12, 13, and 14. Front-end devices 11, 12, 13, and 14 can all communicate with server 10. Each of front-end devices 11, 12, 13, and 14 contains both a low-security domain and a high-security domain. The high-security domain has higher privileges than the low-security domain. Specifically, the high-security domain can manage memory and control the low-security domain's access permissions to memory.

[0128] When server 10 needs to communicate with front-end device 11, server 10 needs to verify the availability of the target application communicating with server 10 on front-end device 11. In this verification process, server 10 acts as the verifier, and the front-end device 11 acts as the certifier. First, server 10 needs to obtain the control flow graph of the target application being verified on front-end device 11, which covers all legal control flow paths of the target application. Then, server 10 calculates a hash value for each path in the obtained control flow graph and stores the hash value in its database. Then, server 10 sends a verification request to the target application on remote device 11. After receiving the verification request from server 10, remote device 11 sends a memory initialization request from its low-security zone to its high-security zone, requesting the high-security zone to allocate an append-only memory (AOM) storage area for the low-security zone. After the high-security domain allocates append-only memory to the low-security domain, the target application is executed in the low-security domain, and the control flow path jump address information summarizing the target application's execution process is recorded in the append-only memory. When the target application finishes execution or the append-only memory generates a memory full exception, the low-security domain sends a data read request to the high-security domain. After receiving the data read request from the low-security domain, the high-security domain reads the target application's control flow jump path from the append-only memory and calculates the hash value of each control flow jump path. Then, based on the hash value of each control flow jump path and the verification request sent by the server, a verification report is generated in the high-security domain and sent to the low-security domain. After the low-security domain signs the verification report, it is sent to server 10. After receiving the verification report, server 10 verifies the signature of the verification report. Then, server 10 obtains the hash value of the control flow path in the verification report and searches its database for a hash value that is the same as the hash value in the verification report. If it exists, it means that the control flow path of the target application on the remote device 11 is valid. Otherwise, the target application on remote device 11 is under attack.

[0129] Figure 6 This is a schematic diagram of a front-end device provided in an embodiment of this application. See also... Figure 6The front-end device includes: a low-security domain 61, a high-security domain 62, firmware 63, an append-only memory (AOM) region 64, a storage region NW Memory corresponding to the low-security domain, and a storage region SW corresponding to the high-security domain. The low-security domain 61 is used to run a commercial operating system, which provides a normal execution environment (REE). The high-security domain 62 uses a secure small kernel (TEE-kernel) to provide a trusted execution environment (TEE), where confidential data can be stored and accessed.

[0130] The low security domain 61 includes: a communication initialization module 611, an exception handling module 612, and a target application 613. The high security domain 62 includes: a memory initialization module 621, a data collection module 622, and a remote verification module 623.

[0131] The communication initialization module 611 is used to receive remote verification requests from the verifier. After receiving the verification request, the communication initialization module 611 sends a memory initialization request to the memory initialization module 621 in the high security domain.

[0132] After receiving the memory initialization request sent by the communication initialization module 611, the memory initialization module 621 allocates append-only memory for the low security domain. Append-only memory is a storage area where data can only be added. When allocating append-only memory for the low security domain 61, the memory initialization module 621 mainly modifies the memory controller in the processor.

[0133] Figure 7 This is a processor system architecture diagram provided for an embodiment of this application. For example... Figure 7 As shown, the memory controller is located between the CPU Core and the Dynamic Random Access Memory (DRAM). The memory controller is used to implement access control from the CPU Core to the DRAM. In one example, the process by which the memory initialization module 621 allocates append-only memory to the low security domain 61 includes steps 1-2.

[0134] Step 1: Add three registers to the memory controller: ADDRESS_S Register, ADDRESS_E Register, and Cursor Register, representing the start address, end address, and currently writable location, respectively. Only the high security domain (62) of the newly added registers is writable; the low security domain (61) is not writable.

[0135] Step 2: The memory initialization module 621 acquires a contiguous block of physical addresses from memory. Then, the memory initialization module writes the starting address of this physical address block to the ADDRESS_S Register, the ending address to the ADDRESS_E Register, and the currently writable address to the Cursor Register. After the append-only memory initialization is complete, the initial address of the Cursor Register is the starting address of this physical address block.

[0136] After the memory initialization module 621 allocates append-only memory to the low security domain 61, the target application 613 is executed in the low security domain 61, and the CPU records the jump address information of the target application 613 at each branch into the append-only memory.

[0137] In one possible example, to obtain information about the target application's jumps in each branch, instrumentation of the target application is required. This includes steps 1-3.

[0138] Step 1: Obtain the target application's code file, which includes multiple branches.

[0139] When obtaining the code file of the target application, the obtained code file can be either the source code of the target application or the binary code of the target application.

[0140] Step 2: For each of the multiple branches in the code file, replace the source instruction at the branch with a jump instruction. The jump instruction is used to cause the target application to execute the jump code, which includes the source instruction at the branch.

[0141] Because the jump instruction is quite long, directly replacing the source instruction at a branch point with the jump instruction would disrupt the code file's layout. Therefore, at the branch point, a jump instruction of the same length as the source instruction is used to replace it. This ensures that when the code file reaches the jump instruction, it automatically jumps to the jump instruction, where the source instruction is executed. After executing the source instruction in the jump instruction, it automatically jumps to the next instruction.

[0142] Step 3: Execute the source instruction in the jump code to obtain the path information of the next instruction to jump to.

[0143] In one possible example, when the target application 613 finishes execution, the exception handling module 612 sends a data read request to the data collection module 622, so that the data collection module 622 can read the address information of the branch jump address of the target application 613 from the append-only memory. After the data collection module 622 reads the address information of the branch jump address of the target application 613 from the append-only memory, it also needs to reset the append-only memory so that the lower security domain can continue to store data.

[0144] In another possible example, when an exception occurs in the append-only memory, the exception handling module 612 determines the exception that occurred in the append-only memory. If the exception in the append-only memory is a memory full exception, the exception handling module 612 sends a data read request to the data collection module 622, so that the data collection module 622 reads the address information of the branch jump address of the target application 613 from the append-only memory. After reading the address information of the branch jump address of the target application 613 from the append-only memory, the data collection module 622 also needs to reset the append-only memory to ensure that the append-only memory stores the address information of the branch jump address of the target application.

[0145] After reading the branch jump address information of the target application 613 from the append-only memory, the data collection module 622 sends the acquired branch jump address information to the remote verification module 623. The remote verification module 623 calculates a hash value for each received address information. Then, after the target application 613 completes execution, it signs the calculated hash value and the received remote verification request to generate a verification report. The remote verification module 623 then sends the verification report to the communication and initialization module 611, so that the communication and initialization module 611 can send the verification report to a remote device for verification.

[0146] In this embodiment, registers and related logic are added to the memory controller to allocate append-only memory from the high-security domain to the low-security domain. Since append-only memory can only contain data, it prevents attackers from tampering with the data stored there, ensuring the integrity of the data stored in append-only memory within the low-security domain. Furthermore, during the execution of the target application, path information obtained from the low-security domain is saved to append-only memory. This ensures that data in append-only memory is only sent to the high-security domain after the target application finishes execution or when append-only memory experiences a memory full exception. This reduces the number of context switches between the low-security and high-security domains, significantly improving the performance of remote control flow verification.

[0147] Figure 8 This is a flowchart illustrating a remote verification method based on append-only memory, provided as an embodiment of this application. The method is... Figure 5 The illustrated IoT system is executed by a front-end device, which includes a low-security domain and a high-security domain, with the high-security domain having higher privileges than the low-security domain. See also... Figure 8 The method includes steps S801-S805.

[0148] Step S801: Receive a verification request sent by a remote device. This verification request is used to request verification of the target application in the low-security domain.

[0149] The communication and initialization module 611 in the front-end device receives a verification request from a remote device. This verification request includes information about the target application that needs to be verified.

[0150] Step S802: Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area for the low security domain, wherein the first storage area is a storage area where only data can be added.

[0151] After receiving the verification information from the remote device, the communication and initialization module sends a memory initialization request to the memory initialization module in the high-security domain. This memory initialization request instructs the high-security domain's memory initialization module to allocate a first storage area, namely Append-only Memory, for the low-security domain. This first storage area is a storage area where data can only be added.

[0152] In a possible example, the memory initialization module allocates a first storage region for the low-security domain. First, it needs to add three registers to the memory controller: ADDRESS_S Register, ADDRESS_E Register, and Cursor Register. ADDRESS_S Register represents the start address of the first storage region, ADDRESS_E Register represents the end address, and Cursor Register represents the current writable location of the first storage region. When the first storage region is initially initialized, its current writable location is its start address. Then, the memory initialization module retrieves a contiguous physical address from the front-end device's memory and writes this physical address into the three newly added registers in the memory controller. Specifically, the memory initialization module writes the start address of the physical address to ADDRESS_S Register, the end address to ADDRESS_E Register, and the current writable address to Cursor Register. The initial value of Cursor Register is the start address of the physical address.

[0153] In another possible embodiment, the ADDRESS_S Register and Memory_SizeRegister can be used to represent the starting address and size of the append-only memory, respectively. The ADDRESS_S Register and Memory_Size Register are used instead of the ADDRESS_S Register and ADDRESS_E Register in the above examples to identify the address range of the append-only memory.

[0154] Step S803: Execute the target application and record the control flow jump path during the execution of the target application to the first storage area.

[0155] Since the target application is directly executed in the low security domain, it is impossible to obtain the path information of the control flow jump during the execution of the target application. Therefore, it is necessary to transform and insert stubs into the target application. That is, before executing the target application, it is necessary to obtain the code file of the target application and insert jump instructions at each branch of the code file of the target application. In one example, the nth instruction of the target application is replaced with a jump instruction, and the nth instruction is placed in the trampoline code. When the target application executes to the nth instruction, the jump instruction inserted at the nth instruction is executed and jumps to the trampoline code. The target application executes the nth instruction in the trampoline code and automatically jumps to the nth + 1 instruction after the execution of the nth instruction is completed. At this time, the trampoline code obtains the address information of the nth + 1 instruction and sends the address information to the first storage area for storage.

[0156] When the CPU is in the low security domain and the path information of the control flow jump of the target application is written to the first storage area in the low security domain, the process is as Figure 9 shown. Refer to Figure 9 and includes steps S901 - step S909.

[0157] Step S901, obtain the starting address ADDRESS_S, the current writable address Cursor, and the termination address ADDRESS_E of the first storage area.

[0158] Step S902, obtain the current write address x and the data length y of the address to be written to the first storage area.

[0159] Step S903, determine whether the current write address x is between the starting address ADDRESS_S and the termination address ADDRESS_E of the first storage area. Based on x >= ADDRESS_S && x < ADDRESS_E, execute step S905, otherwise execute step S904.

[0160] Step S904, execute the original memory write processing logic.

[0161] Step S905, determine whether the current write address x is equal to the current writable address Cursor of the first storage area. Based on x = cursor, execute step S907, otherwise execute step S906.

[0162] Step S906, generate a write exception, and the CPU jumps to the exception handling module for handling by the exception handling module.

[0163] There are two scenarios where the current write address x is not equal to the current writable address Cursor of the first storage area. First, if x < cursor, it can be determined that the current operator intends to modify data already stored in the first storage area. In this case, a modification exception occurs in the first storage area, the CPU jumps to the exception handling module, and the exception handling module suspends the current program's modification operation on the first storage area. Second, if x > cursor, a non-contiguous write exception occurs in the first storage area, the CPU jumps to the exception handling module, and the exception handling module suspends the current program's write operation on the first storage area. This prevents attackers from modifying data already stored in the first storage area.

[0164] Step S907: Write address information into the first storage area. Update the current writable address (Cursor) of the first storage area. The updated Cursor = Cursor + y.

[0165] Step S908: Determine whether the updated current writable address Cursor is equal to the termination address ADDRESS_E of the first storage area. If the updated Cursor = ADDRESS_E, proceed to step S909; otherwise, proceed to step S902.

[0166] In step S909, a memory full exception is generated, and the CPU jumps to the exception handling module, which sends a data read request to the high security domain.

[0167] Step S804: Based on the completion of the target application execution or the occurrence of a memory full exception in the first storage area, a data read request is sent to the high security domain so that the high security domain reads the control flow jump path from the first storage area and generates a verification report based on the control flow jump path.

[0168] In this embodiment, the completion of the target application execution and the occurrence of a memory full exception in the first storage area will trigger the exception handling module to send a data read request to the high security domain.

[0169] In a possible example, if the storage space of the first storage area is small, a memory full exception might trigger the exception handling module 612 to send a data read request to the high-security domain before the target application finishes execution. Upon receiving the data read request, the high-security domain's data collection module 622 reads path information from the first storage area. Then, the data collection module 622 sends this path information to the remote verification module 623, and simultaneously initializes the first storage area by resetting the ADDRESS_S Register, ADRESS_E Register, and Cursor Register for subsequent use by the low-security domain. After the first storage area is initialized, the target application continues execution, and the control flow jump path of the target application is recorded in the first storage area. When the target application finishes execution, it triggers the memory handling module 612 to send a data read request to the data collection module 622. The data collection module 622 reads the path information from the first storage area and sends it to the remote verification module 623. The remote verification module 623 generates a verification report based on the received path information.

[0170] In one possible example, if the first storage area has a large storage space, then a memory full exception will not occur in the first storage area before the target application finishes execution. In this case, only after the target application finishes execution will the target application trigger the memory processing module 612 to send a data read request to the data collection module 622. The data collection module 622 reads the path information from the first storage area and sends the path information to the remote verification module 623. The remote verification module 623 generates a verification report based on the received path information.

[0171] The remote verification module 623 calculates a hash value for each control flow jump path of the receiving target application. Then, the remote verification module 623 signs the calculated hash values ​​and the verification request received by the communication and initialization module 611 to generate a verification report. This verification report is then sent to the communication and initialization module 611, which in turn sends the verification report to the remote device.

[0172] When calculating the hash value of the control flow jump path of the target application, the remote verification module 623 can calculate the hash value of the control flow jump path each time it receives it. Alternatively, the remote verification module 623 can save the received control flow jump path after receiving it, and then calculate the hash value of each received control flow jump path after the target application has finished executing.

[0173] In one example, when calculating the hash value of each path, it is also necessary to obtain the hash value of the previous path. Let's take calculating the hash value of the nth path as an example. The hash value of the nth path, Measurement, is obtained by performing a hash calculation on the nth path. n for:

[0174] Measurement n =Hash(Measurment) n-1 Destination Address

[0175] Among them, Measurment n-1 Here, is the hash value of the (n-1)th path, and Destination Address is the destination address that the target application needs to jump to when executing the nth path;

[0176] Step S805: Send the verification report to the remote device.

[0177] In this embodiment, the high-security domain allocates a first storage area (Append-only Memory) to the low-security domain, allowing only data to be added. This prevents attackers from tampering with the data stored in the Append-only Memory, ensuring the integrity of the data stored in the Append-only Memory under the low-security domain. Furthermore, during the execution of the target application, path information obtained in the low-security domain is saved to the Append-only Memory. This ensures that data in the Append-only Memory is only sent to the high-security domain when the target application finishes execution or when the Append-only Memory experiences a memory full exception. This reduces the number of context switches between the low-security and high-security domains, significantly improving the performance of remote control flow verification.

[0178] exist Figure 8In the remote verification scheme shown, only one segment of Append-only Memory exists in the system of the front-end device. However, this invention is not limited to having only one segment of Append-only Memory in the entire system. This application also provides a scheme for parallel remote verification of multiple applications within the same system. In this embodiment, multiple sets of registers can be configured in the memory controller of the front-end device to provide multiple segments of Append-only Memory for use by multiple processes in the front-end device system. Each segment of Append-only Memory corresponds to three registers, named ADDRESS_S Register, ADDRESS_E Register, and Cursor Register. The ADDRESS_S Register records the starting address of the Append-only Memory, the ADDRESS_E Register records the ending address of the Append-only Memory, and the Cursor Register records the currently writable position of the Append-only Memory.

[0179] Figure 10 A flowchart illustrating a remote verification method based on append-only memory provided in this application embodiment. This method can be... Figure 6 The illustrated IoT system is executed by a front-end device, which includes a low-security domain and a high-security domain. The high-security domain has higher privileges than the low-security domain, and the memory of the front-end device is divided into multiple sub-regions. See also... Figure 10 The method includes steps S1001-S1006.

[0180] Step S1001: Receive multiple verification requests sent by a remote device, the multiple verification requests being used to request verification of multiple target applications in the low security domain.

[0181] The communication and initialization module 611 in the front-end device receives a verification request from a remote device. This verification request includes information about the target application that needs to be verified.

[0182] Step S1002: Assign a sub-region to each of the plurality of target applications.

[0183] In one possible example, allocating a sub-region for each of multiple target applications requires obtaining the code file for each target application. Then, an operation code file is inserted into the obtained code file, enabling the target application to perform read and write operations on one of the sub-regions during execution.

[0184] It should be noted that there is a one-to-one correspondence between the target application and the sub-region.

[0185] Step S1003: Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area for each sub-region. The first storage area is a storage area where data can only be added.

[0186] Step S1004: For each of the multiple target applications, execute the target application and record the control flow jump path during the execution of the target application in the first storage area of ​​the sub-region corresponding to the target application.

[0187] Step S1005: For each of the multiple target applications, execute the target application and record the control flow jump path during the execution of the target application in the first storage area of ​​the sub-region corresponding to the target application.

[0188] Step S1006: Send the verification report to the remote device.

[0189] The execution process for each target application in steps S1003-S1006 is the same as in steps S802-S805, and will not be repeated here.

[0190] Furthermore, to illustrate in detail how to provide multiple append-only memory segments for use by multiple processes in the front-end device system, the ARM CoreLink TZC-400 TrustZone Address Space Controller can be used as an example. The TZC-400 supports a multi-region architecture. The region division of the TZC-400 is as follows: Figure 11 As shown, it supports 9 regions, where region 0 is the base region, containing all physical addresses. The other regions are divided on region 0 and do not overlap.

[0191] Each region in the TZC-400 has a set of registers that record the region's range and access permissions. The starting address of the region can be recorded by setting the Base address register. The ending address of the region can be recorded by setting the Top address register. The access permissions of the higher security domain to the region can be recorded by setting the Region attribute register. The access permissions of each core in the CPU to the region when the CPU is in the lower security domain can be recorded by setting the Region ID access register.

[0192] In one example, when implementing a remote control flow integrity verification scheme based on append-only memory on a multi-region architecture processor supported by the TZC-400, we will take region 1 on the TAC-400 as an example. In region 1, the starting address of region 1 is recorded by setting the Base address register. The ending address of region 1 is recorded by setting the Top address register. The access permissions of the higher security domain to region 1 are recorded by setting the Region attribute register. The access permissions of each core in the CPU to region 1 when the CPU is in the lower security domain are recorded by setting the Region ID access register. The implementation process of this scheme includes steps 1-4.

[0193] Step 1: For region1, add a first register and a second register to the memory controller. The first register is used to record the append-only attribute of region1, and the second register is used to record the current writable location of region1.

[0194] In one possible example, the first register, Region_Append, is added to the memory controller. <1> The register is used to record the append-only attribute of region1. A second register, Region_Cursor_, is added to the memory controller. <1> The register is used to record the current writable position of region1.

[0195] Step 2: The memory initialization module obtains a continuous physical address from the memory of the front-end device.

[0196] Step 3: The memory initialization module replaces the start and end addresses of region1 with the start and end addresses of the physical address obtained by the memory initialization module, and sets the current writable location of region1 to the start address of the physical address.

[0197] Specifically, the memory initialization module writes the starting address of the obtained physical address into the Base address register of region1 and the Region_Cursor_ register, respectively. <1> In the register, the ending address of the physical address is written into the Top address of region1.

[0198] Step 4: Set the attribute information of region1 through the memory initialization module. This attribute information includes the access permissions and write permissions of region1, as well as the append-only attribute of region1.

[0199] Specifically, the memory initialization module sets the Region attribute register of region1 to make the high-security region readable by region1, i.e., setting s_rd_en = 1. Then, the memory initialization module sets the write permissions of each core in the CPU for region1, so that the core in which the target application runs in region1 is writable, while other cores in the CPU are not writable for region1.

[0200] Furthermore, the memory initialization module uses Region_Append_ <1> The register configures the append-only permissions for the append-only memory of the kernel containing the target application running in region1. For example... Figure 12 As shown, when the target application running in region1 has append-only permissions for the append-only memory of region1, the append-only permission parameter nsaid_ap_en can be set to 1; otherwise, nsaid_ap_en is set to 0. Although the above embodiment only describes the settings for append-only memory in region1, the settings for append-only memory in other regions of TZC-400 are the same as those for append-only memory in region1. Therefore, they will not be repeated here.

[0201] After the memory initialization module has allocated append-only memory for each region, the process of remotely verifying the control flow of the target application on each region is the same as steps S801-S805, and will not be described again here.

[0202] In this embodiment, a scheme for parallel remote verification of multiple applications within the same system is provided based on a processor supporting a multi-region architecture. In this embodiment, different regions are allocated to different target applications to prevent confusion of control flow data between them. Furthermore, by adding multiple sets of registers to the memory controller, an append-only memory segment is provided for each region. This allows for the provision of remote verification services to different applications within the same system.

[0203] This application embodiment also provides a front-end device, which can be used to implement, for example... Figure 8 and Figure 9 The example shown is a remote verification method based on append-only memory. Figure 13 As shown, the front-end device includes a processor 1301, a network interface 1302, and a memory 1303. Optionally, the front-end device also includes an input device 1304. The processor 1301, network interface 1302, memory 1303, and input device 1304 can be connected via a bus or other means.

[0204] Memory 1303 is a memory device for the front-end device, used to store programs and data, such as authentication requests sent by the server. Memory 1303 provides storage space for the server's operating system and program instructions used to implement Webshell detection methods. The operating system includes, but is not limited to, Windows, Linux, HarmonyOS, etc., and is not limited here.

[0205] In this scheme, the processor 1301 (or central processing unit, CPU) is the computing and control core of the front-end device. The processor 1301 reads program instructions and data stored in the memory 1303 to execute the remote verification method. After reading the program instructions stored in the memory 1303, the processor 1301 stores the received suspected verification request and sends a memory initialization request to the high-security domain, so that the high-security domain allocates append-only memory to the low-security domain. Then, the processor 1301 executes the target application in the low-security region and records the control flow jump path during the execution of the target application in the append-only memory.

[0206] Network interface 1302 may include standard wired interfaces and wireless interfaces (such as Wi-Fi, mobile communication interfaces, etc.). Network interface 1302, controlled by processor 1301, is used to send and receive data. For example, it receives authentication requests sent by the server and sends authentication reports generated by the front-end device to the server. Input device 1304 is used to receive user input information.

[0207] The method steps in the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an ASIC.

[0208] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0209] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application.

Claims

1. A remote verification method, characterized in that, The method is executed by a front-end device in an Internet of Things (IoT) system. The front-end device includes a low-security domain and a high-security domain, where the high-security domain has higher privileges than the low-security domain. The method includes: Receive a verification request sent by a remote device, the verification request being used to request verification of the target application in the low security domain; Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area to the low security domain, the first storage area being a storage area where data can only be added; Execute the target application and record the control flow jump path during the execution of the target application in the first storage area; Based on the completion of the target application execution or the memory full exception of the first storage area, a data read request is sent to the high security domain so that the high security domain reads multiple control flow jump paths from the first storage area, and generates a verification report based on the multiple control flow jump paths after the target application execution is completed; The verification report is sent to the remote device.

2. The method according to claim 1, characterized in that, The front-end device includes a memory controller, which includes a first register, a second register, and a third register; the high-security domain allocates a first storage area for the low-security domain, including: A continuous range of physical addresses is obtained through the high-security domain and used as the physical address of the first storage area; Initialize the first register, the second register, and the third register such that the value of the first register is the starting address of the physical address, the value of the second register is the ending address of the physical address, and the value of the third register is the currently writable address of the physical address.

3. The method according to claim 2, characterized in that, The step of recording the control flow jump path during the execution of the target application into the first storage area includes: Obtain the start address, end address, and current writable address of the first storage region; Obtain the length of the control flow jump path that the target application needs to write to the first storage area, and the write address of the target application to the first storage area; Based on the fact that the write address is located between the start address and the end address of the first storage area, it is determined whether the write address is the same as the current writable address of the first storage area; A write exception occurs because the write address is different from the current writable address of the first storage area, and writing the control flow jump path into the first storage area is stopped. Based on the fact that the write address is the same as the current writable address of the first storage area, the control flow jump path is written to the first storage area, and the current writable address of the first storage area is updated according to the length of the control flow jump path.

4. The method according to any one of claims 1-3, characterized in that, Before executing the target application in the low-security domain, the method further includes: Obtain the code file of the target application, which includes multiple branches; For each of the multiple branches in the code file, the source instruction at the branch is replaced with a jump instruction, which is used to cause the target application to execute the jump code, which includes the source instruction at the branch. The source instruction is executed in the jump code to obtain path information for the next instruction to which the jump is needed.

5. The method according to claim 1, characterized in that, After the high-security domain reads the control flow jump path from the first storage area, the method further includes: The first storage area is reconfigured to enable it to store the control flow jump path written to the target application by the low-security domain.

6. The method according to claim 1, characterized in that, The step of generating a verification report based on the multiple control flow jump paths includes: A hash calculation is performed on each of the multiple control flow jump paths to obtain multiple hash values; wherein, a hash calculation is performed on the nth path to obtain the hash value of the nth path. for: in, The hash value of the (n-1)th path. The target application needs to jump to the destination address when executing the nth path; the multiple hash values ​​and the verification request are signed to obtain a verification report.

7. A remote verification method, characterized in that, The method is executed by a front-end device in an Internet of Things (IoT) system. The front-end device includes a low-security domain and a high-security domain, where the high-security domain has higher privileges than the low-security domain. The memory of the front-end device is divided into multiple sub-regions. The method includes: Receive multiple verification requests sent by a remote device, the multiple verification requests being used to request verification of multiple target applications in the low security domain; Assign a sub-region to each of the plurality of target applications; Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area for each sub-region, the first storage area being a storage area where only data can be added; For each of the multiple target applications, execute the target application and record the control flow jump path during the execution of the target application in the first storage area of ​​the sub-region corresponding to the target application; Based on the completion of the target application execution or the memory full exception of the first storage area, a data read request is sent to the high security domain, so that the high security domain reads multiple control flow jump paths from the first storage area and generates a verification report based on the multiple control flow jump paths; The verification report is sent to the remote device.

8. The method according to claim 7, characterized in that, The front-end device includes a memory controller, which includes a third register and a fourth register; the step of sending a memory initialization request to the high-security domain, so that the high-security domain allocates a first storage area for each sub-region, includes: For each of the multiple target applications, obtain the first register and the second register of the sub-region, where the first register records the start address of the sub-region and the second register records the end address of the sub-region. A continuous range of physical addresses is obtained through the high-security domain and used as the physical address of the first storage area; The first register, the second register, the third register, and the fourth register are initialized such that the value of the first register is the starting address of the physical address, the value of the second register is the ending address of the physical address, the value of the third register is the currently writable address of the physical address, and the fourth register is used to store access permission information of the first storage area.

9. The method according to claim 7 or 8, characterized in that, Assigning a sub-region to each of the plurality of target applications includes: For each of the multiple target applications, obtain the code file of that target application; An operation code file is inserted into the code file of the target application, enabling the target application to perform read and write operations on one of the multiple sub-regions during execution.

10. A terminal device, characterized in that, The device includes a low-security domain and a high-security domain, with the high-security domain having higher privileges than the low-security domain. The low security domain includes: A communication module is used to receive verification requests sent by remote devices, the verification requests being used to request verification of the target application in the low security domain; The communication module is also used to send a memory initialization request to the high security domain; The processing module is used to execute the target application and record the control flow jump path during the execution of the target application to the first storage area; The exception handling module is used to send a data read request to the high-security domain; The communication module is also used to receive the verification report sent by the high-security domain and send the verification report to the remote device; The high-security domain includes: A memory initialization module is used to allocate a first storage area to the low security domain according to the memory initialization request, wherein the first storage area is a storage area where only data can be added; a data collection module is used to read multiple control flow jump paths in the first storage area; The verification module is used to generate a verification report based on the multiple control flow jump paths.

11. The device according to claim 10, characterized in that, The terminal device includes a memory controller, which includes a first register, a second register, and a third register. The memory initialization module is used for: Obtain a contiguous range of physical addresses as the physical addresses of the first storage region; Initialize the first register, the second register, and the third register such that the value of the first register is the starting address of the physical address, the value of the second register is the ending address of the physical address, and the value of the third register is the writable address of the current physical address of the physical address.

12. The device according to claim 11, characterized in that, The processing module is also used for Obtain the start address, end address, and current writable address of the first storage region; Obtain the length of the control flow jump path that the target application needs to write to the first storage area, and the write address of the target application to the first storage area; Based on the fact that the write address is located between the start address and the end address of the first storage area, it is determined whether the write address is the same as the current writable address of the first storage area; A write exception occurs because the write address is different from the current writable address of the first storage area, and writing the control flow jump path into the first storage area is stopped. Based on the fact that the write address is the same as the current writable address of the first storage area, the control flow jump path is written to the first storage area, and the current writable address of the first storage area is updated according to the length of the control flow jump path.

13. The device according to any one of claims 10-12, characterized in that, Before executing the target application, the processing module is also used to: Obtain the code file of the target application, which includes multiple branches; For each of the multiple branches in the code file, the source instruction at the branch is replaced with a jump instruction, which is used to cause the target application to execute the jump code, which includes the source instruction at the branch. The source instruction is executed in the jump code to obtain path information for the next instruction to which the jump is needed.

14. The device according to claim 10, characterized in that, After reading the control flow jump path in the first storage area, the data collection module is further used for: The first storage area is reconfigured to enable it to store the control flow jump path written to the target application by the low-security domain.

15. The device according to claim 10, characterized in that, The verification module is used for: A hash calculation is performed on each of the multiple control flow jump paths to obtain multiple hash values; wherein, a hash calculation is performed on the nth path to obtain the hash value of the nth path. for: in, The hash value of the (n-1)th path. The target application needs to jump to the destination address when executing the nth path; the multiple hash values ​​and the verification request are signed to obtain a verification report.

16. A terminal device, characterized in that, The terminal device includes a low-security domain and a high-security domain, with the high-security domain having higher privileges than the low-security domain. The memory of the terminal device is divided into multiple sub-regions. The low security domain includes: A communication module is used to receive multiple verification requests sent by a remote device, the multiple verification requests being used to request verification of multiple target applications in the low security domain; The processing module is used to allocate a sub-region for each of the plurality of target applications; The communication module is also used to send a memory initialization request to the high-security domain; The processing module is also used to execute each of the multiple target applications, and record the control flow jump path during the execution of the target application in the first storage area of ​​the sub-region corresponding to the target application. The exception handling module is used to send a data read request to the high-security domain; The communication module is also used to receive the verification report sent by the high-security domain and send the verification report to the remote device; The high-security domain includes: The memory initialization module is used to allocate a first storage area to each sub-region according to the memory initialization request. The first storage area is a storage area where data can only be added. The data collection module is used to read multiple control flow jump paths in the first storage area; The verification module is used to generate a verification report based on the multiple control flow jump paths.

17. The device according to claim 16, characterized in that, The terminal device includes a memory controller, which includes a third register and a fourth register. The memory initialization module is used for: For each of the multiple target applications, obtain the first register and the second register of the sub-region, where the first register records the start address of the sub-region and the second register records the end address of the sub-region. A continuous range of physical addresses is obtained through the high-security domain and used as the physical address of the first storage area; The first register, the second register, the third register, and the fourth register are initialized such that the value of the first register is the starting address of the physical address, the value of the second register is the ending address of the physical address, the value of the third register is the currently writable address of the physical address, and the fourth register is used to store access permission information of the first storage area.

18. The device according to claim 16 or 17, characterized in that, The processing module is used for: For each of the multiple target applications, obtain the target application code file; An operation code file is inserted into the code file of the target application, enabling the target application to perform read and write operations on one of the multiple sub-regions during execution.

19. An electronic device, characterized in that, include: At least one memory is provided for storing the target application. At least one processor can be time-division multiplexed in a high-security domain and a low-security domain. When the processor is in the low-security domain, the processor is used for: Receive a verification request sent by a remote device, the verification request being used to request verification of the target application in the low security domain; Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area to the low security domain, the first storage area being a storage area where data can only be added; Execute the target application and record the control flow jump path during the execution of the target application in the first storage area; Based on the completion of the target application execution or the memory full exception of the first storage area, a data read request is sent to the high security domain, so that the high security domain reads multiple control flow jump paths from the first storage area and generates a verification report based on the multiple control flow jump paths; The verification report is sent to the remote device.

20. An electronic device, characterized in that, include: At least one memory for storing the target application, wherein a memory region in the at least one memory is divided into multiple sub-regions; At least one processor can be time-division multiplexed in a high-security domain and a low-security domain. When the processor is in the low-security domain, the processor is used for: Receive multiple verification requests sent by a remote device, the multiple verification requests being used to request verification of multiple target applications in the low security domain; Assign a sub-region to each of the plurality of target applications; Send a memory initialization request to the high security domain so that the high security domain allocates a first storage area for each sub-region, the first storage area being a storage area where only data can be added; For each of the multiple target applications, execute the target application and record the control flow jump path during the execution of the target application in the first storage area of ​​the sub-region corresponding to the target application; Based on the completion of the target application execution or the memory full exception of the first storage area, a data read request is sent to the high security domain, so that the high security domain reads multiple control flow jump paths from the first storage area and generates a verification report based on the multiple control flow jump paths; The verification report is sent to the remote device.

21. A computer-readable medium storing instructions that, when executed on a computer, cause the computer to perform the method as claimed in any one of claims 1-6 or 7-9.

22. A computer program product comprising instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-6 or 7-9.

Images