Trusted operation control method and system based on storage security access

Abstract

The invention discloses a trusted operation control method and system based on storage security access, and the method is characterized in that a storage security access device is connected in series between a peripheral storage interface and a memory of a computer system, and the storage security access device intercepts and filters IO requests between the peripheral storage interface and the memory; hardware-level file read-only protection is provided to prevent the computer system from external tampering, and integrity protection is carried out on the sector of the marked file in combination with a credible integrity measurement method; the storage security access equipment configures and manages trusted measurement and storage access through an independent management port, namely, positions of sectors where executable files and key files are stored are marked by installing host matching management software in a computer system; the storage security access device implements hardware-level access control and trusted operation control. The method is higher in security and better in compatibility.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a trusted operation control method and system based on storage security access. Background Art

[0002] With the large-scale application of trusted technology, trusted operation control software, as an important barrier for terminal security protection, plays a very important role in preventing viruses and Trojans. After an in-depth analysis of the working principles and implementation methods of existing trusted operation control software, it is found that the current trusted operation control technology mostly uses kernel plug-ins, Linux Security Modules (LSM), kernel hooks and other technologies to measure integrity and load control by capturing application events. The specific principles are as follows: Figure 1 As shown. In form, control codes are inserted into the kernel and the extended code outside the kernel to prevent the loading and running of untrusted software. If there are some defects in the kernel and the code of the operation control part of the system, they are exploited by the outside world and attack the interception point, which will cause the operation control software function to fail. In addition, if the interception function of the operation control is bypassed by tampering with the memory entry address, the malicious program can avoid the measurement check of the operation control and be executed normally.

[0003] Trusted operation control is usually installed in the operating system in the form of kernel-mode software, which consumes system resources and introduces unstable factors. Its own abnormalities will cause protection failure or system crash. In the Linux system, the implementation basis of operation control is LSM. For security reasons, native LSM requires the code to be compiled together with the kernel source code, does not support dynamic loading in KO mode, requires large investment in the development and adaptation process, and has limited business cooperation models. In addition, although the limitations of dynamic loading can be solved through technical methods such as kernel customization or hook mapping, the measurement point is far behind, the trust chain is obviously missing, and there may be security risks.

[0004] In summary, after in-depth research on the implementation principle of trusted operation control software, pure software solutions are used in current trusted operation control applications to implement trusted operation control functions. However, since trusted operation control software may have vulnerabilities or be subject to external attacks, a trusted operation control solution combining software and hardware is proposed, which has higher security and better compatibility than pure software implementation solutions. Summary of the invention

[0005] In view of this, the present invention provides a trusted operation control method and system based on storage security access.

[0006] The present invention discloses a trusted operation control method based on storage security access, which includes:

[0007] A storage security access device is connected in series between the peripheral storage interface and the memory of the computer system. The storage security access device intercepts and filters the IO requests between the peripheral storage interface and the memory, provides hardware-level file read-only protection to prevent the computer system itself from being tampered with externally, and implements integrity protection for the sectors of the marked files in combination with the trusted integrity measurement method;

[0008] The storage security access device configures and manages the trust measurement and storage access through a separate management port, that is, by installing the host supporting management software in the computer system to mark the location of the sectors where executable files and key files are stored, the storage security access device implements hardware-level access control and trusted operation control.

[0009] Furthermore, through the supporting software running in the computer system, a whitelist is collected for the executable files in the computer system, the physical locations of the whitelist files on the storage are extracted, and the storage sectors corresponding to the whitelist files are marked one by one. The marking types can be divided into two categories: measurement and read-only. The storage security access device implements access control based on the marking information and type.

[0010] Furthermore, the read requests initiated by the computer system are intercepted and filtered through the storage security access device to implement hardware-level trusted operation control; the storage sectors corresponding to the files in the whitelist are marked, and integrity measurement is implemented when the software in the whitelist is read and loaded from the storage, and the measurement does not return the security zone instruction code through IO redirection, thereby preventing the tampered software from being loaded and executed; when the executable files outside the whitelist that are not stored in the marked area are read and loaded, IO redirection returns the security zone instruction code, thereby preventing the illegal software outside the whitelist from running, loading and executing.

[0011] Furthermore, the host supporting management software on the computer system is used to measure and mark the specified file as read-only, and the specific implementation steps include:

[0012] The host supporting management software obtains the cluster table information of the file to be marked from the file system;

[0013] The host supporting management software obtains the sector location information of the file to be marked on the storage device from the cluster table, and extracts the storage location information of multiple sectors of the file to be marked;

[0014] The host supporting management software sends the file path and sector location information to the storage security access device through the management port;

[0015] The storage security access device stores the file path and sector location information inside the device to achieve file measurement and read-only protection marking.

[0016] Furthermore, the integrity measurement of the file is realized through the algorithm service provided by the host supporting management software and the storage security access device, and the specific implementation steps include:

[0017] The host supporting management software sends a measurement mark command to mark the target file through the management dedicated interface, and sends the sector location information of the target file to the storage security access device;

[0018] The storage security access device reads the sector position data to collect the expected value, and stores the file mark information and the expected value in the internal memory;

[0019] When the storage security access device receives an IO read request on the storage interface, it determines whether the sector position of the IO read request is marked as a metric. If it is not marked as a metric, it reads the memory data and detects whether it is an executable file. If it is marked as a metric and is not an executable file, it allows a normal return, otherwise the returned data content is redirected to the instruction code of the security zone;

[0020] If the sector location has been marked as measurement, the integrity measurement is performed on the data block of the IO read request. If the measurement is successful, the data is returned normally. Otherwise, the reading is blocked and the security zone code data is returned.

[0021] Furthermore, read-only protection of files is implemented through the host supporting management software and storage security access equipment, and the specific implementation steps include:

[0022] The host supporting management software sends a read-only mark command to mark the target file through the management dedicated interface, and sends the sector location information of the file storage mark to the storage security access device;

[0023] The storage security access device stores the tag information in an internal memory;

[0024] When the storage security access device receives an IO write request on the storage interface, it determines whether the sector location of the write request is marked as read-only. If not, writing to the memory is allowed; otherwise, the operation of writing to the memory is rejected and corresponding IO response information is returned.

[0025] Furthermore, the storage security access device encrypts and decrypts the data. When the encryption and decryption function is turned on, the data written into the disk block is encrypted, and the data is decrypted when the disk block reads the data.

[0026] Furthermore, the storage security access device is managed and maintained during operation through a dedicated management interface.

[0027] The present invention also discloses a trusted operation control system based on storage security access, which implements any of the above-mentioned trusted operation control methods based on storage security access, and includes a computer system, a storage security access device and a memory; the storage security access device includes a storage protocol stack unit, a cryptographic operation unit and a security access management unit; the storage protocol stack unit is used for protocol parsing, protocol forwarding and IO request filtering; the security access management unit is used for measurement management, tag management, access control and data caching; the cryptographic operation unit is used to implement encryption algorithms, hash algorithms and expected value storage.

[0028] Furthermore, the computer system is connected to the storage protocol stack unit via the mainboard storage interface; the computer system is connected to the security access management unit via the management-specific interface; the storage protocol stack unit is respectively connected to the cryptographic operation unit and the security access management unit; the memory is connected to the cryptographic operation unit via the storage interface.

[0029] Due to the adoption of the above technical solution, the present invention has the following advantages:

[0030] 1. Trusted operation control technology based on storage security access is a function that implements trusted operation control and access control at the hardware level. Different from traditional operation control software, it uses the physical bottom layer of storage access to implement access control, which cannot be shielded or circumvented by software means. In addition, the algorithms and expected values ​​required for trusted measurement are stored inside the hardware and are difficult to be cracked from the outside. In terms of compatibility, it can be used for transfer control of the most widely used storage interfaces of the host at this stage (including: IDE, SATA, SAS, SCSI, MSATA, M.2, SIDO, etc.), without the need for strong correlation binding with the running operating system, nor does it require customization and modification of the operating system kernel.

[0031] 2. As an alternative to software trusted operation control, the trust chain expands in the direction of data integrity protection technology, providing technical increments for the trusted product series. This solution continues to use the trusted dual system architecture. Under the premise of keeping the original computer platform framework basically unchanged, a logically relatively independent (it can be implemented in the form of discrete modules) trusted subsystem is hosted in the original system. This trusted foundation supports the basic software standard. There is no need to make large-scale changes to the computer platform system. Trusted control is implemented on the host operating system and application software by connecting the operation control hardware card in series on the storage interface. It provides a hardware-level solution for the trusted measurement of the trusted computing system in a high-security environment, and also provides hardware-level read-only protection for key system files. In addition, the operation control function of this solution is not strongly coupled with the host operating system, and has good compatibility. It can adapt to various operating systems on terminal devices without making major changes. It has strong versatility and significant security improvements, and has extremely high commercial application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0033] Figure 1 It is a schematic diagram of a software-based trusted operation control system in the prior art;

[0034] Figure 2 It is a schematic diagram of a trusted operation control system based on storage security access according to an embodiment of the present invention;

[0035] Figure 3 A diagram showing the internal working principle of a storage security access device according to an embodiment of the present invention;

[0036] Figure 4 This is a functional block diagram of a trusted operation control system based on storage security access according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0038] See also Figure 2 and Figure 3 The present invention provides an embodiment of a trusted operation control method based on storage security access, which includes:

[0039] A storage security access device is connected in series between the peripheral storage interface and the memory of the computer system. The device has storage access control and trusted integrity measurement functions. Hardware-level storage access control is implemented by intercepting IO requests between the peripheral storage interface and the memory, and integrity protection of the sectors of the marked files is achieved in combination with the trusted integrity measurement method.

[0040] The embodiment of the present invention is applicable to general computing devices and embedded computing devices with external storage interfaces (including: IDE, SATA, SAS, SCSI, MSATA, M.2, SIDO, etc.), and can work independently without relying on the host computing device. The storage security access device can configure and manage the trust measurement and storage access through a separate management port, that is, by installing the supporting upper-layer software to mark the location of the sectors where the executable files and key files are stored, the storage security access device implements hardware-level access control and trusted operation control. The trusted operation control implemented by this solution can be widely used in scenarios with high security requirements, replacing the trusted operation control software function implemented by the traditional pure software solution.

[0041] The embodiment of the present invention provides hardware-level access control capability for trusted operation control. Through the supporting software running in the computer system, a whitelist is collected for the executable files in the system, the physical locations of the whitelist files on the storage device are extracted, and the storage sectors corresponding to the files are marked one by one. The marking types can be divided into two categories: measurement and read-only. The switching device implements access control based on the marking information and type.

[0042] The system intercepts and filters the read requests initiated by the storage security access device to realize the hardware-level trusted operation control function. The storage sectors corresponding to the files in the whitelist are marked, and the integrity measurement is implemented when the software in the whitelist is read and loaded from the storage. The measurement does not return the instruction code of the security zone through IO redirection, preventing the tampered software from being loaded and executed; when the executable files outside the whitelist that are not stored in the marked area are read and loaded, IO redirection returns the instruction code of the security zone, preventing the illegal software outside the whitelist from running, loading and executing.

[0043] The write requests initiated by the system are intercepted and filtered through the storage security access device, providing hardware-level read-only protection for files and preventing the operating system itself from being tampered with externally.

[0044] In one embodiment, the host supporting management software on the computer system performs measurement and read-only marking operations on the specified file, and the specific implementation steps include:

[0045] The host supporting management software obtains the cluster table information of the file to be marked from the file system;

[0046] The host supporting management software obtains the sector location information of the file to be marked on the storage device from the cluster table, and extracts the storage location information of multiple sectors of the file to be marked;

[0047] The host supporting management software sends the file path and sector location information to the storage security access device through the management port;

[0048] The storage security access device stores the file path and sector location information inside the device to achieve file measurement and read-only protection marking.

[0049] In one embodiment, the integrity measurement of the file is implemented through the host supporting management software and the algorithm service provided by the storage security access device, and the specific implementation steps include:

[0050] The host supporting management software sends a measurement mark command to mark the target file through the management dedicated interface, and sends the sector location information of the target file to the storage security access device;

[0051] The storage security access device reads the sector position data to collect the expected value, and stores the file mark information and the expected value in the internal memory;

[0052] When the storage security access device receives an IO read request on the storage interface, it determines whether the sector position of the IO read request is marked as a metric. If it is not marked as a metric, it reads the memory data and detects whether it is an executable file. If it is marked as a metric and is not an executable file, it allows a normal return, otherwise the returned data content is redirected to the instruction code of the security zone;

[0053] If the sector location has been marked as measurement, the integrity measurement is performed on the data block of the IO read request. If the measurement is successful, the data is returned normally. Otherwise, the reading is blocked and the security zone code data is returned.

[0054] In one embodiment, read-only protection of files is implemented through host supporting management software and storage security access devices, and the specific implementation steps include:

[0055] The host supporting management software sends a read-only mark command to mark the target file through the management dedicated interface, and sends the sector location information of the file storage mark to the storage security access device;

[0056] The storage security access device stores the tag information in an internal memory;

[0057] When the storage security access device receives an IO write request on the storage interface, it determines whether the sector location of the write request is marked as read-only. If not, writing to the memory is allowed; otherwise, the operation of writing to the memory is rejected and corresponding IO response information is returned.

[0058] In one embodiment, the storage security access device encrypts and decrypts data. When the encryption and decryption function is turned on, the data written into the disk block is encrypted, and the data is decrypted when the disk block is read.

[0059] In one embodiment, the storage security access device is managed and maintained during operation through a dedicated management interface.

[0060] The present invention also provides an embodiment of a trusted operation control system based on storage security access, which implements the trusted operation control method based on storage security access described in the above embodiment, which includes a computer system, a storage security access device and a memory; the storage security access device includes a storage protocol stack unit, a cryptographic operation unit and a security access management unit; the storage protocol stack unit is used for protocol parsing, protocol forwarding and IO request filtering; the security access management unit is used for measurement management, tag management, access control and data caching; the cryptographic operation unit is used to implement encryption algorithms, hash algorithms and expected value storage.

[0061] This embodiment replaces the traditional pure software trusted operation control solution by combining software and hardware, see Figure 2 The storage security access device provides a one-in-one-out storage I / O interface (including IDE, SATA, SAS, SCSI, etc.). This storage security access device is connected between the computer motherboard and the storage to implement hardware-level trusted integrity measurement, file read-only protection control, storage encryption and decryption and other functions; to support these functions, the storage security access device comes with a trusted cryptographic algorithm, and the hardware implements file tag management and expected value collection and measurement functions; in addition, the storage security access device provides a dedicated management interface to connect to the computer motherboard, and uses the supporting management software installed in the computer system to send management commands through this interface to configure and manage the storage security access device. The main management functions include: file tag management, storage security access device management and other functions.

[0062] (1) File tag management function

[0063] The host management software on the computer system can be used to measure and mark the specified files as read-only. Figure 3 The specific steps are as follows:

[0064] a) The host supporting management software obtains the cluster table information of the file to be marked from the file system;

[0065] b) The host supporting management software obtains the sector location information of the file to be marked on the storage device from the cluster table, and extracts the storage location information of multiple sectors of the file to be marked;

[0066] c) The host supporting management software sends the file path and sector location information to the storage security access device through the management port;

[0067] d) The storage security access device stores the information in step c) inside the device to implement the file measurement and read-only protection marking functions.

[0068] (2) Trusted integrity measurement function

[0069] The integrity measurement function of files can be realized through the host supporting management software and the algorithm service provided by the storage security access device. Figure 3 The specific steps are as follows:

[0070] A1) The host supporting management software sends a measurement mark command to mark the target file through the management dedicated interface, and sends the sector location information of the target file storage to the storage security access device;

[0071] B1) The storage security access device reads the position data to collect the expected value, and stores the file mark information and the expected value in the internal memory;

[0072] C1) when the storage security access device receives an IO read request on the storage interface, it determines whether the sector position of the read request is marked as a metric, if not marked, reads the memory data and detects whether it is an executable file, if it is marked and not an executable file, allows normal return, otherwise redirects the returned data content to the instruction code of the security zone;

[0073] D1) If the sector position has been marked in step C1), integrity measurement is performed on the requested data block. If the measurement is successful, the data is returned normally. Otherwise, the reading is blocked and the security area code data is returned.

[0074] (3) Read-only protection control function

[0075] The read-only protection function of files can also be realized through the host supporting management software and storage security access equipment. Figure 3 As shown, the specific steps are as follows:

[0076] A2) The host supporting management software sends a read-only mark command to mark the target file through the management dedicated interface, and sends the sector location information of the file storage mark to the storage security access device;

[0077] B2) The storage security access device stores the tag information in an internal memory;

[0078] C2) When the storage security access device receives an IO write request on the storage interface, it determines whether the sector location of the write request is marked as read-only. If it is not marked, writing to the memory is allowed; otherwise, the operation of writing to the memory is rejected and the corresponding IO response information is returned.

[0079] (4) Storage encryption function

[0080] The storage security access device can also encrypt and decrypt data to further improve the security of storage data. When the encryption and decryption function is turned on, the data written to the disk block is encrypted, and the data is decrypted when the disk block is read. The working principle is as follows: Figure 3 shown.

[0081] (5) Storage security access device management function

[0082] Storage security access devices can be managed and maintained during operation through a dedicated management interface. They should generally have the functions of measurement protection and read-only protection marking; as well as parameter configuration functions, such as: start / stop data encryption function; in addition, they should have encryption algorithm management functions to configure encryption algorithm parameters, keys, modes and other information.

[0083] The storage security access device consists of a storage protocol unit, a security access management unit, a cryptographic algorithm unit, and an interface adapter unit. Its typical design is as follows: Figure 4 The storage protocol unit mainly implements functions such as protocol parsing, protocol forwarding, and IO filtering; the security access management unit consists of measurement management, tag management, access control, and data cache; the cryptographic operation unit has encryption algorithms, hash algorithms, and expected value storage functions.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A trusted operation control method based on storage security access, characterized in that: include: A storage security access device is connected in series between the peripheral storage interface and the memory of the computer system. The storage security access device intercepts and filters the IO requests between the peripheral storage interface and the memory, provides hardware-level file read-only protection to prevent the computer system itself from being tampered with externally, and implements integrity protection for the sectors of the marked files in combination with the trusted integrity measurement method; The storage security access device configures and manages the trust measurement and storage access through a separate management port, that is, by installing the host supporting management software in the computer system to mark the location of the sectors where executable files and key files are stored, the storage security access device implements hardware-level access control and trusted operation control.

2. The trusted operation control method based on storage security access according to claim 1 is characterized in that: Through the supporting software running in the computer system, a whitelist is collected for the executable files in the computer system, the physical locations of the whitelist files on the storage are extracted, and the storage sectors corresponding to the whitelist files are marked one by one. The marking types can be divided into two categories: measurement and read-only. The storage security access device implements access control based on the marking information and type.

3. The trusted operation control method based on storage security access according to claim 1 is characterized in that: The read requests initiated by the upper-level software system of the computer are intercepted and filtered through the storage security access device to realize hardware-level trusted operation control; the storage sectors corresponding to the files in the whitelist are marked, and the integrity measurement is implemented when the software in the whitelist is read and loaded from the storage. The measurement does not return the instruction code of the security zone through IO redirection, so as to prevent the tampered software from being loaded and executed; when the executable files outside the whitelist that are not stored in the marked area are read and loaded, IO redirection returns the instruction code of the security zone, so as to prevent the illegal software outside the whitelist from running, loading and executing.

4. The trusted operation control method based on storage security access according to claim 1 is characterized in that: The host supporting management software on the computer system is used to measure and mark the specified file as read-only. The specific implementation steps include: The host supporting management software obtains the cluster table information of the file to be marked from the file system; The host supporting management software obtains the sector location information of the file to be marked on the storage device from the cluster table, and extracts the storage location information of multiple sectors of the file to be marked; The host supporting management software sends the file path and sector location information to the storage security access device through the management port; The storage security access device stores the file path and sector location information inside the device to achieve file measurement and read-only protection marking.

5. The trusted operation control method based on storage security access according to claim 1 is characterized in that: The integrity measurement of files is achieved through the algorithm services provided by the host supporting management software and the storage security access device. The specific implementation steps include: The host supporting management software sends a measurement mark command to mark the target file through the management dedicated interface, and sends the sector location information of the target file to the storage security access device; The storage security access device reads the sector position data to collect the expected value, and stores the file mark information and the expected value inside the device; When the storage security access device receives an IO read request on the storage interface, it determines whether the sector position of the IO read request is marked as a metric. If it is not marked as a metric, it reads the memory data and detects whether it is an executable file. If it is marked as a metric and is not an executable file, it allows a normal return, otherwise the returned data content is redirected to the instruction code of the security zone; If the sector location has been marked as measurement, the integrity measurement is performed on the data block of the IO read request. If the measurement is successful, the data is returned normally. Otherwise, the reading is blocked and the security zone code data is returned.

6. The trusted operation control method based on storage security access according to claim 1 is characterized in that: The read-only protection of files is achieved through the host supporting management software and storage security access devices. The specific implementation steps include: The host supporting management software sends a read-only mark command to mark the target file through the management dedicated interface, and sends the sector location information of the file storage mark to the storage security access device; The storage security access device stores the tag information inside the device; When the storage security access device receives an IO write request on the storage interface, it determines whether the sector location of the write request is marked as read-only. If not, writing to the memory is allowed; otherwise, the operation of writing to the memory is rejected and corresponding IO response information is returned.

7. The trusted operation control method based on storage security access according to claim 1 is characterized in that: The storage security access device encrypts and decrypts data. When the encryption and decryption function is turned on, the data written to the disk block is encrypted, and the data is decrypted when the disk block is read.

8. The trusted operation control method based on storage security access according to claim 1 is characterized in that: The storage security access device is managed and maintained during operation through a dedicated management interface.

9. A trusted operation control system based on storage security access, implementing the trusted operation control method based on storage security access according to any one of claims 1 to 8, characterized in that: It includes a computer system, a storage security access device and a memory; the storage security access device includes a storage protocol stack unit, a cryptographic operation unit and a security access management unit; the storage protocol stack unit is used for protocol parsing, protocol forwarding and IO request filtering; the security access management unit is used for measurement management, tag management, access control and data caching; The cryptographic operation unit is used to implement encryption algorithms, hash algorithms and expected value storage.

10. The trusted operation control system based on storage security access according to claim 9, characterized in that: The computer system is connected to the storage protocol stack unit through the mainboard storage interface; the computer system is connected to the security access management unit through the management dedicated interface; the storage protocol stack unit is connected to the cryptographic operation unit and the security access management unit respectively; the memory is connected to the cryptographic operation unit through the storage interface.

Images