Trusted computing method and device based on security agent

Abstract

The invention discloses a trusted computing method based on a security agent. The method comprises the steps that a server carries out identity verification and terminal hardware information verification on a to-be-connected terminal; after the verification is passed, establishing an encrypted communication channel based on a secure communication protocol between the terminal and the server; and based on the established encrypted communication channel, the terminal and the server carry out encrypted communication, and regularly carry out integrity verification on a security agent program and hardware information of the terminal. Therefore, confidentiality and integrity verification can be carried out on the terminal hardware, the operating system and the security agent program after the terminal is started, and continuous confidentiality and integrity verification is carried out by the security agent program when the terminal runs so as to ensure the confidentiality and integrity of the terminal software and hardware. Therefore, the method has higher security and operability, and is suitable for the scenes of Internet of Things, financial payment, passenger ticket security and the like with higher security levels.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a trusted computing method and device based on a security agent. Background Art

[0002] Trusted Computing (TC) is a computer security technology based on the collaboration of hardware and software, which aims to improve the trustworthiness of computer systems in terms of security, privacy protection, data integrity, etc. It ensures that the operation and storage process of computer systems meet security standards and prevent the impact of malicious software and attack behaviors by introducing Trusted Platform Module (TPM) and related technologies.

[0003] Existing trusted computing methods mainly include TPM (Trusted Platform Module), Secure Boot, Remote Attestation, Digital Rights Management (DRM), and the combination of trusted computing and cloud computing. Among them, TPM is a hardware security module used to store encryption keys and ensure the security of the system startup process, providing hardware-level security, but the disadvantage is that there are compatibility and security vulnerabilities; controlled boot can ensure that only certified software runs at startup to prevent malware from infecting the system. It can protect the startup process, but may limit user freedom and has poor compatibility with old devices; remote attestation allows devices to prove their trusted status to remote servers and is widely used in cloud computing. It can enhance system security, but may lead to privacy leakage, and trust depends on the security of remote servers; digital rights management protects the copyright of digital content by combining hardware and software to prevent illegal copying and distribution. Although it effectively protects copyright, it may limit users' legal use and is vulnerable to cracking attacks; the combination of trusted computing and cloud computing can ensure that the interaction between the cloud platform and users is secure and can verify the security of the cloud platform. However, data privacy issues, implementation complexity and cost are its main challenges.

[0004] Based on this, a new solution is needed. Summary of the invention

[0005] The main purpose of the present invention is to provide a trusted computing method and system based on a security agent.

[0006] To achieve the above object, the present invention provides a trusted computing method based on a security agent, comprising the following steps: The server authenticates the terminal to be connected and verifies the terminal hardware information; After the verification is passed, an encrypted communication channel based on a secure communication protocol is established between the terminal and the server; Based on the established encrypted communication channel, the terminal performs encrypted communication with the server and periodically performs integrity verification on the security agent program and hardware information of the terminal.

[0007] In the trusted computing method based on security agent provided by the present invention, the step of the server performing identity authentication on the terminal user includes: After detecting that the terminal has inserted the smart password key, the server initiates an identity authentication request to the terminal and generates a random challenge code and sends it to the terminal; The terminal signs the random challenge code using the private key stored in the smart password key, and returns the signature result to the server; The server verifies the signature result using the public key pre-stored in the server cryptographic machine.

[0008] In the trusted computing method based on security agent provided by the present invention, the server verifies the terminal hardware information of the terminal including: The server automatically extracts the terminal's IP and network card MAC address and compares them with the saved information. If they match, the verification is successful. If they do not match, the terminal connection is rejected. The terminal reports the terminal disk serial number, operating system version, and hash value of the security agent program to the server in a specified manner. The server receives the information and compares it with the saved information. If it matches, the verification is passed. If it does not match, the connection is rejected.

[0009] In the trusted computing method based on a security agent provided by the present invention, after verification, the steps of establishing an encrypted communication channel based on a secure communication protocol between the terminal and the server include: Initializing a connection for an encrypted communication channel between the terminal and the server; After the initial connection is established, a challenge-response verification is performed between the terminal and the server through the WireGuard protocol.

[0010] In the secure agent-based trusted computing method provided by the present invention, the step of initializing the connection of the encrypted communication channel between the terminal and the server includes: The terminal and the server generate a wireguard public and private key pair respectively to establish a wireguard tunnel; The terminal initiates a connection request to the server, wherein the connection request includes a national secret certificate and a wireguard private key read by a smart password key; After receiving the connection request, the server verifies whether the national encryption certificate is legal and authenticates the wireguard private key through the SM2 algorithm and the wireguard public key.

[0011] In the trusted computing method based on security agent provided by the present invention, based on the established encrypted communication channel, the terminal and the server perform encrypted communication. During the encrypted communication process, the terminal and the server encrypt the communication data using the SM4 algorithm and generate a data digest by using the SM3 algorithm to perform data integrity verification on the communication data.

[0012] In the trusted computing method based on security agent provided by the present invention, the step of performing integrity verification on the security agent program of the terminal includes: After receiving the security agent self-integrity check request from the terminal, the server generates a random number of a specified length and encrypts the random number using an SM2 algorithm to obtain first encrypted information; After receiving the first encrypted information, the terminal verifies the signature and decrypts the first encrypted information to obtain the random number; Solving a first digest value of the security agent program of the terminal, and digesting the first digest value and the random number again to obtain a second digest value; Encrypting the second digest value by using the SM2 algorithm to obtain second encrypted information; After receiving the second encrypted information, the server verifies the signature and decrypts the second encrypted information to obtain the second digest value; The digest value of the security agent program stored in the server is matched with the second digest value, and if the match is successful, it is determined that the security agent program passes the integrity check.

[0013] In the trusted computing method based on a security agent provided by the present invention, the step of performing integrity verification on the hardware information of the terminal includes: After the security agent program passes the integrity check, the information and operation log of the terminal collected by the security agent program are reported to the server, wherein the information includes one or more of the terminal computer IP, disk serial number, network card MAC, operating system version, checksum value of the monitoring program, version of the monitoring program, terminal CPU usage, memory usage, and disk usage; The server uses depth-first search to perform integrity checks on the reported information in sequence and audits all operation logs. When an abnormality is found, the server disconnects the terminal.

[0014] The present invention also provides a trusted computing device based on a security agent, comprising a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the trusted computing method based on the security agent as described above are implemented.

[0015] The present invention also provides a storage medium storing one or more programs, wherein the one or more programs can be executed by one or more processors to implement the steps of the trusted computing method based on a security agent as described above.

[0016] The trusted computing system and method based on secure agent provided by the present invention have the following beneficial effects: the trusted computing method based on secure agent provided by the present invention uses UKey and digital certificates to authenticate the terminal device to ensure that only legitimate users can access; encrypts communication data through national secret algorithms such as SM2, SM4 and SM3 to ensure data security and integrity during transmission; performs static verification and continuous integrity check on the hardware and software of the terminal device to prevent the device from being tampered with or maliciously attacked; uses the WireGuard protocol to establish an encrypted tunnel to ensure the security of the information transmission process, and supports session logging and auditing. Identity forgery and data leakage are effectively prevented through multiple identity authentication and encryption algorithms; the integrity check of terminal devices and software ensures the security of devices and data and prevents devices from being maliciously tampered with; uses strong encryption means and hash algorithms to ensure the confidentiality and integrity of data during transmission. Therefore, through technical means such as identity authentication, encrypted communication, data integrity check, and hardware and software integrity check, a highly secure communication framework is constructed to prevent unauthorized access, data tampering and leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work: Figure 1 Shown is a flow chart of a trusted computing method based on a security agent provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to facilitate understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Typical embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0019] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0020] Figure 1 FIG. 1 is a flow chart of a trusted computing method based on a security agent provided by an embodiment of the present invention. Figure 1 As shown, the trusted computing method based on the security agent includes the following steps: Step S1: The server performs identity authentication and terminal hardware information verification on the terminal to be connected; Specifically, in one embodiment of the present invention, before the terminal and the server establish an encrypted communication channel, it is necessary to verify the terminal to be connected, that is, to perform confidentiality and integrity verification on the terminal's important information through the intelligent password key UKey and TCP protocol, and to perform confidentiality and integrity verification on the terminal security agent program to ensure the legitimacy of the terminal to be connected.

[0021] Furthermore, in one embodiment of the present invention, after the terminal user inserts the UKey, the system accesses the UKey through the corresponding standard interface; the server initiates an identity authentication request to the terminal, and generates a random challenge code and sends it to the terminal; the terminal uses the private key stored in the UKey to verify the challenge code and returns the signature result to the server; the server uses the public key pre-stored in the cipher machine to verify the signature result to ensure that the identity of the terminal user is legal. Therefore, the steps of using the server to authenticate the identity of the terminal user include: After detecting that the terminal has inserted the smart password key, the server initiates an identity authentication request to the terminal and generates a random challenge code and sends it to the terminal; the terminal uses the private key stored in the smart password key to sign the random challenge code and returns the signature result to the server; the server uses the public key pre-stored in the server cryptographic machine to verify the signature result.

[0022] Furthermore, in one embodiment of the present invention, after the terminal passes the identity authentication, the terminal and the server establish communication through the TCP protocol to perform terminal software and hardware information verification, which mainly includes two parts: after the connection is established, the server automatically extracts the IP address and network card MAC address of the terminal, and compares them with the trusted information pre-stored in the server. If the match is successful, the verification is passed, and if it does not match, the terminal connection is rejected; the terminal collects the terminal disk serial number, operating system version, and hash value of the security agent program to the server through the TCP protocol in a specified manner (system command or script), and the server receives the information and compares it with the saved information. If it matches, it is considered that the terminal's related hardware and security agent program have not been tampered with, and the verification is passed; otherwise, the connection is rejected. Therefore, the server verifies the terminal hardware information of the terminal, including: The server automatically extracts the terminal's IP and network card MAC address and compares them with the saved information. If they match, the verification is successful. If they do not match, the terminal connection is rejected. The terminal reports the terminal disk serial number, operating system version, and hash value of the security agent program to the server in a specified manner. The server receives the information and compares it with the saved information. If they match, the verification is successful. If they do not match, the connection is rejected.

[0023] In this embodiment, before establishing an encrypted communication channel, a multiple authentication mechanism is provided by combining identity authentication (using UKey) and hardware information verification (IP address, MAC address, hardware ID, etc.). Even if an attacker obtains the user's password or credentials, he still needs to have a legitimate hardware device to pass the verification, which greatly improves security. By combining hardware authentication and identity authentication, the security and reliability of the system are effectively enhanced. The combination of multiple authentication and hardware information verification can ensure that only legitimate users and devices can access the system, thereby reducing the risk of unauthorized access and improving the ability to prevent tampering, counterfeiting and attacks.

[0024] Step S2: after the verification is passed, an encrypted communication channel based on a secure communication protocol is established between the terminal and the server; Specifically, in one embodiment of the present invention, after completing identity authentication and hardware information verification, an encrypted communication channel is established between the terminal and the server using the intelligent password key UKey, the national secret certificate, the national secret algorithm and the secure communication protocol wireguard to ensure that the interaction between the terminal and the server is safe and reliable. In this way, it can be ensured that both parties in the communication are trustworthy and that all communications are carried out in an encrypted tunnel, thereby ensuring the confidentiality and integrity of the data. Specifically, step S2 includes: initializing the connection of the encrypted communication channel between the terminal and the server; after the initial connection is established, performing a challenge response verification between the terminal and the server through the WireGuard protocol.

[0025] Furthermore, in one embodiment of the present invention, initializing the connection means that the terminal and the server generate a wireguard public and private key pair respectively, establish a wireguard tunnel, and read the national encryption certificate and private key from the device through UKey, and initiate a connection request to the server; after receiving the request, the server will verify the national encryption certificate of the terminal (whether it is issued by a trusted CA, whether it is within the validity period, and whether the certificate has been revoked), perform identity authentication through the SM2 algorithm, and confirm whether the terminal is a legal connection device. Therefore, the steps of initializing the connection of the encrypted communication channel between the terminal and the server include: The terminal and the server generate a wireguard public and private key pair respectively to establish a wireguard tunnel; the terminal initiates a connection request to the server, and the connection request includes a national secret certificate and a wireguard private key read by a smart password key; after receiving the connection request, the server verifies whether the national secret certificate is legal and authenticates the wireguard private key through an SM2 algorithm and a wireguard public key.

[0026] Furthermore, in one embodiment of the present invention, after the connection is initialized, the challenge response verification between the terminal and the server is implemented through the WireGuard protocol and UKey, and the specific process is as follows: the server generates a challenge code: when the terminal requests to establish a connection with the server, the server first generates a random "challenge code", which can generate a random number of a specified length by calling the random number generation function of the server cryptographic machine. The server sends the challenge code to the terminal; after receiving the challenge code, the terminal uses the private key stored in UKey to sign the challenge code; the terminal sends the signature result to the server; the server verifies the signature: after receiving the signature of the terminal, the server uses the public key of the terminal UKey to verify whether the signature is correct.

[0027] After the challenge response verification is successful, the encrypted communication tunnel between the terminal and the server is officially established, and both parties can exchange encrypted data through the WireGuard protocol. The WireGuard protocol provides an efficient and concise encryption solution to ensure the security of communication. Through this process, all transmitted data is ensured in an encrypted tunnel, thereby ensuring the confidentiality and integrity of the data and preventing the data from being tampered with or stolen.

[0028] In this embodiment, UKey, the national encryption algorithm and the WireGuard protocol are combined to ensure secure communication between the terminal and the server. Specifically, identity authentication and key exchange are performed through the SM2 algorithm and the WireGuard protocol, and the reliability of identity authentication is increased by using the hardware security of UKey, ultimately ensuring the credibility of both parties in communication and the encryption protection of data. This mechanism not only strengthens the security of communication, but also improves the system's anti-tampering capabilities, effectively protecting users and systems from various network attacks.

[0029] Step S3: Based on the established encrypted communication channel, the terminal performs encrypted communication with the server and periodically performs integrity verification on the security agent program and hardware information of the terminal; Specifically, in one embodiment of the present invention, the terminal and the server transmit data through a secure tunnel established by WireGuard. In this process, both parties use the SM4 algorithm to encrypt the actual communication data. Through SM4 encryption, even if the data is intercepted during transmission, it cannot be easily decrypted and its content cannot be obtained. At the same time, in order to ensure that the data has not been tampered with during transmission, the terminal and the server use the SM3 algorithm. SM3 is a Chinese national cryptographic algorithm, which is mainly used to generate a hash value of data to verify the integrity of the data. During the communication process, the terminal and the server will generate an SM3 hash digest based on the transmitted data, and then compare the digest value. If the hash values ​​generated by the terminal and the server are consistent, it means that the data has not been tampered with and the communication can continue. If data inconsistency (i.e., different hash values) is detected at any link, the communication will be terminated immediately and a security warning mechanism will be triggered to remind the user or system administrator of potential security risks to prevent attacks or data leaks. Therefore, based on the established encrypted communication channel, the terminal and the server perform encrypted communication. During the encrypted communication process, the terminal and the server use the SM4 algorithm to encrypt the communication data and generate a data digest using the SM3 algorithm to perform data integrity verification on the communication data.

[0030] Furthermore, during the encrypted communication between the terminal and the server, it is necessary to perform integrity verification through regular interaction between the terminal and the server to ensure that the security agent program and hardware have not been tampered with during the operation of the terminal. Among them, the specific characteristics of the security agent program not being tampered with during the operation of the terminal are as follows: the terminal sends a security agent self-integrity verification request to the server through an encrypted tunnel; the server receives the request information, verifies the signature of the information, and if the signature is verified, calls the random number generation module of the terminal cryptographic machine to generate a random number num of a specified length; the server uses the private key stored in the server cryptographic machine to call the SM2 algorithm to encrypt the random number num, and the encrypted information is recorded as En(num). The server sends the encrypted information En(num) to the terminal through the encrypted tunnel; the terminal verifies the signature of the information received using the server public key. If the signature is verified, the terminal obtains the random number num generated by the server, and the terminal solves the summary value of the security agent program file, recorded as hash1, then hash1=hash(security agent file), and compares the summary value hash1 with the random number num Then find the summary value, record it as hash2, then hash2=hash(num+hash1); use the private key stored in the terminal UKey to encrypt hash2 using the SM2 algorithm, and transmit the encrypted information En(hash2) to the server through an encrypted tunnel; the server uses the terminal public key to verify the signature of the received information, and the signature verification obtains the summary value hash2 transmitted by the terminal. The server calculates the summary value of the stored security agent and the summary value of the random number, that is, hash2'=hash(num+hash(security agent program file)), the security agent program file refers to the security agent program file stored by the server, and the two hash functions are consistent with the hash function of the terminal to calculate the summary value; if hash2 and hash2' match successfully, the terminal security agent program has not been tampered with. Therefore, the steps of performing integrity verification on the security agent program of the terminal include: After receiving the security agent's own integrity check request from the terminal, the server generates a random number of a specified length and encrypts the random number through the SM2 algorithm to obtain first encrypted information; after the terminal receives the first encrypted information, the first encrypted information is verified and decrypted to obtain the random number; a first digest value of the security agent program of the terminal is solved, and the first digest value and the random number are digested again to obtain a second digest value; the second digest value is encrypting through the SM2 algorithm to obtain second encrypted information; after the server receives the second encrypted information, the second encrypted information is verified and decrypted to obtain the second digest value; the digest value of the security agent program stored in the server is matched with the second digest value, and if the match is successful, it is determined that the security agent program has passed the integrity check.

[0031] Furthermore, in one embodiment of the present invention, the hardware has not been tampered with during the operation of the terminal means that, under the premise that the integrity of the security agent itself has been verified, the security agent program is run, and the program will periodically collect information such as the terminal computer IP, disk serial number, network card MAC, operating system version, monitoring program check value, version, etc. and report them to the server. The server uses a depth-first search method to perform integrity checks on the reported information in sequence, and all information integrity checks are passed; the security agent program monitors the use of the terminal CPU, memory, and disk, and audits all operation logs. Once an abnormality is found, the terminal connection is rejected; the server forms an information chain for the information reported by the terminal, audits the information chain of each information, and refuses the terminal connection if an abnormality is found. Therefore, the steps of performing integrity checks on the hardware information of the terminal include: After the security agent program passes the integrity check, the information and operation log of the terminal collected by the security agent program are reported to the server, wherein the information includes one or more of the terminal computer IP, disk serial number, network card MAC, operating system version, monitoring program check value, monitoring program version, terminal CPU usage, memory usage, and disk usage; the server uses depth-first search to perform integrity checks on the reported information in turn and audits all operation logs, and disconnects the terminal when an abnormality is found.

[0032] Further, in one embodiment of the present invention, calling the random number generation module of the terminal cryptographic machine to generate a random number num of a specified length includes: traversing the server files, with the total number of files recorded as n; establishing a mapping relationship between the file directory and the integer (1~n), recorded as file_mapping, then file_mapping={1: file directory 1, 2: file directory 2, ..., n: file directory n}; generating m random integers of 1~n, where m<n, recorded as random_num, then random_num=[num1,num2, ...,numm]; reading the specified byte contents of the file directory files corresponding to the m random numbers in sequence; solving the hash value of the read content and outputting it.

[0033] In this embodiment, through multi-level integrity verification, it is ensured that the terminal's security agent program and hardware are not tampered with during communication and operation, ensuring the security and integrity of the data, and preventing security threats such as malicious tampering and injection attacks. Through timed verification and multiple verification mechanisms, the system can effectively detect and prevent the terminal from being tampered with by malware or attackers. Both the security agent program and the hardware information on the terminal must undergo strict integrity verification, and abnormalities can be discovered and disconnected in time, thereby preventing potential security vulnerabilities from being exploited. In terms of hardware, in addition to program integrity verification, the system will also regularly collect and verify the terminal's hardware information (such as IP, disk serial number, network card MAC address, etc.) to ensure that the terminal hardware itself has not been modified or replaced. The dual verification of software and hardware makes the protection of the entire system more solid. At the same time, the system can monitor the operation of the terminal in real time, including CPU, memory, disk usage, etc., and report all operation logs to the server for auditing. If any abnormality is found, the system can immediately reject the terminal's connection. This real-time audit mechanism ensures that the system responds quickly to potential problems. The server verifies the reported information in sequence through a depth-first search method to ensure that the information is checked in multiple dimensions. This strategy helps to more precisely discover and eliminate anomalies and reduce the possibility of missed detection. Therefore, through a comprehensive and multi-dimensional security verification and monitoring mechanism, the security of terminal devices is guaranteed to the greatest extent, preventing risks such as tampering, malicious attacks and hardware replacement.

[0034] Furthermore, at the end of the communication, WireGuard's stateless design allows the terminal and server to safely disconnect after the transmission is completed. USBKEY continues to protect keys and certificates to ensure that they are not abused, and all communication records and security events (such as authentication failures, key exchange anomalies, etc.) are recorded for auditing and subsequent analysis.

[0035] The trusted computing method based on secure agent provided by the present invention uses UKey and digital certificates to authenticate terminal devices to ensure that only legitimate users can access; encrypts communication data through national secret algorithms such as SM2, SM4 and SM3 to ensure data security and integrity during transmission; performs static verification and continuous integrity check on the hardware and software of the terminal device to prevent the device from being tampered with or maliciously attacked; uses the WireGuard protocol to establish an encrypted tunnel to ensure the security of the information transmission process, and supports session logging and auditing. Multiple identity authentication and encryption algorithms are used to effectively prevent identity forgery and data leakage; the integrity check of terminal devices and software ensures the security of devices and data and prevents devices from being maliciously tampered with; strong encryption means and hash algorithms are used to ensure the confidentiality and integrity of data during transmission. Therefore, through technical means such as identity authentication, encrypted communication, data integrity check, and hardware and software integrity check, a high-security communication framework is constructed to prevent unauthorized access, data tampering and leakage.

[0036] The embodiment of the present invention further provides a trusted computing device based on a security agent, which may include: Memory for storing computer programs; The processor can implement the following steps when executing the computer program stored in the above memory: The server authenticates the identity of the terminal to be connected and verifies the terminal's hardware information; after the verification is passed, an encrypted communication channel based on a secure communication protocol is established between the terminal and the server; based on the established encrypted communication channel, the terminal and the server perform encrypted communication and periodically perform integrity checks on the terminal's security agent program and hardware information.

[0037] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps can be implemented; The server authenticates the identity of the terminal to be connected and verifies the terminal's hardware information; after the verification is passed, an encrypted communication channel based on a secure communication protocol is established between the terminal and the server; based on the established encrypted communication channel, the terminal and the server perform encrypted communication and periodically perform integrity checks on the terminal's security agent program and hardware information.

[0038] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM) > a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0039] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0040] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0041] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0042] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A trusted computing method based on a security agent, characterized in that: The following steps are involved: The server authenticates the terminal to be connected and verifies the terminal hardware information; After the verification is passed, an encrypted communication channel based on a secure communication protocol is established between the terminal and the server; Based on the established encrypted communication channel, the terminal performs encrypted communication with the server and periodically performs integrity verification on the security agent program and hardware information of the terminal.

2. The trusted computing method based on a security agent as claimed in claim 1, characterized in that: The steps for the server to authenticate the end user include: After detecting that the terminal has inserted the smart password key, the server initiates an identity authentication request to the terminal and generates a random challenge code and sends it to the terminal; The terminal signs the random challenge code using the private key stored in the smart password key, and returns the signature result to the server; The server verifies the signature result using the public key pre-stored in the server cryptographic machine.

3. The trusted computing method based on security agent according to claim 1, characterized in that: The server verifies the terminal hardware information including: The server automatically extracts the terminal's IP and network card MAC address and compares them with the saved information. If they match, the verification is successful. If they do not match, the terminal connection is rejected. The terminal reports the terminal disk serial number, operating system version, and hash value of the security agent program to the server in a specified manner. The server receives the information and compares it with the saved information. If it matches, the verification is passed. If it does not match, the connection is rejected.

4. The secure agent-based trusted computing method according to claim 1, wherein: After the verification is passed, the steps of establishing an encrypted communication channel based on a secure communication protocol between the terminal and the server include: Initializing a connection for an encrypted communication channel between the terminal and the server; After the initial connection is established, a challenge-response verification is performed between the terminal and the server through the WireGuard protocol.

5. The secure agent-based trusted computing method according to claim 4, wherein: The step of initializing a connection to an encrypted communication channel between the terminal and the server includes: The terminal and the server generate a wireguard public and private key pair respectively to establish a wireguard tunnel; The terminal initiates a connection request to the server, wherein the connection request includes a national secret certificate and a wireguard private key read by a smart password key; After receiving the connection request, the server verifies whether the national encryption certificate is legal and authenticates the wireguard private key through the SM2 algorithm and the wireguard public key.

6. The trusted computing method based on security agent according to claim 1, characterized in that: Based on the established encrypted communication channel, the terminal and the server perform encrypted communication. During the encrypted communication process, the terminal and the server encrypt the communication data using the SM4 algorithm to ensure confidentiality, and generate a data summary by using the SM3 algorithm to perform data integrity verification on the communication data.

7. The secure agent-based trusted computing method according to claim 1, wherein: The step of performing integrity check on the security agent program of the terminal includes: After receiving the security agent self-integrity check request from the terminal, the server generates a random number of a specified length and encrypts the random number using an SM2 algorithm to obtain first encrypted information; After receiving the first encrypted information, the terminal verifies the signature and decrypts the first encrypted information to obtain the random number; Solving a first digest value of the security agent program of the terminal, and digesting the first digest value and the random number again to obtain a second digest value; Encrypting the second digest value by using the SM2 algorithm to obtain second encrypted information; After receiving the second encrypted information, the server verifies the signature and decrypts the second encrypted information to obtain the second digest value; The digest value of the security agent program stored in the server is matched with the second digest value, and if the match is successful, it is determined that the security agent program passes the integrity check.

8. The secure agent-based trusted computing method according to claim 1, wherein: The step of performing integrity check on the hardware information of the terminal includes: After the security agent program passes the integrity check, the information and operation log of the terminal collected by the security agent program are reported to the server, wherein the information includes one or more of the terminal computer IP, disk serial number, network card MAC, operating system version, checksum value of the monitoring program, version of the monitoring program, terminal CPU usage, memory usage, and disk usage; The server uses depth-first search to perform integrity checks on the reported information in sequence and audits all operation logs. When an abnormality is found, the server disconnects the terminal.

9. A trusted computing device based on a security agent, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the secure agent-based trusted computing method according to any one of claims 1 to 8 are implemented.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the secure agent-based trusted computing method of any one of claims 1 to 8.

Images