Camera trusted computing method and device, computer equipment and storage medium

Abstract

The invention relates to a camera trusted computing method and device, computer equipment and a storage medium. The method comprises the following steps: carrying out static measurement on a camera before the camera is started, carrying out dynamic measurement on each camera application in the running process of the camera, and carrying out credibility measurement on the camera according to a preset measurement parameter, the credible state of the camera is comprehensively determined according to the dynamic measurement result and the parameter measurement result of each preset measurement parameter, and the operation state of the camera is controlled according to the credible judgment result issued by the credible server, so that the camera is ensured to operate in the credible state. Potential safety hazards caused by operation of the camera in an untrusted state are avoided, so that the problem of potential safety hazards caused by use of the untrusted camera is solved.

Description

Technical Field

[0001] The present application relates to the field of trusted security technology, and in particular to a camera trusted computing method, apparatus, computer equipment and storage medium. Background Art

[0002] As the number of cameras grows rapidly, security incidents such as vulnerability exploits, hacker intrusions, abuse of permissions, and data leaks occur frequently, leading to serious consequences such as privacy leaks, commercial secrets leaks, and monitoring system crashes, resulting in huge economic losses. Camera software products have many security risks such as installing malicious applications, being easily tampered with, having vulnerabilities, abuse of permissions, sensitive operations, untimely updates, and illegal calls. Summary of the invention

[0003] The present application provides a camera trusted computing method, apparatus, computer equipment and storage medium to address the security risks caused by using untrusted cameras.

[0004] In a first aspect, the present application provides a camera trusted computing method, the method comprising:

[0005] When receiving a camera startup instruction, statically measuring each camera application supporting the startup of the camera to obtain startup measurement results of each camera application, wherein the camera is installed in a trusted terminal;

[0006] When the startup measurement results of each camera application are credible, start the camera;

[0007] When the camera is in operation, each camera application is dynamically measured, and the camera is trusted according to preset measurement parameters to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter;

[0008] Outputting a camera trust report to a trusted server according to the dynamic measurement results of each of the camera applications and the parameter measurement results of each of the preset measurement parameters;

[0009] When receiving the trustworthy judgment result fed back by the trusted server in response to the trustworthy report of the camera, the operating state of the camera is controlled according to the trustworthy judgment result.

[0010] In a second aspect, the present application provides a camera trusted computing device, the device comprising:

[0011] A static measurement module, configured to perform static measurement on each camera application supporting the camera startup operation upon receiving a camera startup instruction, and obtain startup measurement results of each camera application, wherein the camera is installed in a trusted terminal;

[0012] A startup module, used for starting the camera when the startup measurement result of each camera application is credible;

[0013] A dynamic measurement module, used to dynamically measure each camera application when the camera is in operation, and to perform trustworthy measurement on the camera according to preset measurement parameters, so as to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter;

[0014] A reporting module, configured to output a camera trust report to a trusted server according to the dynamic measurement results of each of the camera applications and the parameter measurement results of each of the preset measurement parameters;

[0015] The control module is used to control the operating state of the camera according to the trusted judgment result when receiving the trusted judgment result fed back by the trusted server for the trusted report of the camera.

[0016] In a third aspect, the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned camera trusted computing method when executing the computer program.

[0017] In a fourth aspect, the present application also provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the above-mentioned camera trusted computing method.

[0018] The above-mentioned technical solution provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application, when receiving a camera startup instruction, statically measures each camera application that supports the startup and operation of the camera, and obtains a startup measurement result of each camera application, wherein the camera is installed in a trusted terminal; when the startup measurement result of each camera application is trusted, the camera is started; when the camera is in operation, dynamically measures each camera application, and performs trusted measurement on the camera according to preset measurement parameters, and obtains a dynamic measurement result of each camera application and a parameter measurement result of each preset measurement parameter; outputs a camera trusted report to a trusted server according to the dynamic measurement result of each camera application and the parameter measurement result of each preset measurement parameter; when receiving a trusted judgment result fed back by the trusted server for the camera trusted report, the operating state of the camera is controlled according to the trusted judgment result.

[0019] Based on the above method, static measurement is performed on the camera before it is started, and dynamic measurement is performed on each camera application during the operation of the camera. The camera is trusted according to preset measurement parameters. The trusted state of the camera is comprehensively determined based on the dynamic measurement results and the parameter measurement results of each preset measurement parameter. The operating state of the camera is controlled based on the trusted judgment result issued by the trusted server to ensure that the camera runs in a trusted state and avoid the security risks caused by the camera running in an untrusted state. This solves the problem of security risks caused by using untrusted cameras. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0022] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0023] Figure 1 An application environment diagram of a camera trusted computing method provided in an embodiment of the present application;

[0024] Figure 2 An application environment diagram of a camera trusted computing method provided in an embodiment of the present application;

[0025] Figure 3 A schematic diagram of the structure of a trusted terminal provided in an embodiment of the present application;

[0026] Figure 4 A flowchart of a camera trusted computing method provided in an embodiment of the present application;

[0027] Figure 5 A flowchart of a camera trusted computing method provided in an embodiment of the present application;

[0028] Figure 6 A flowchart of a camera trusted computing method provided in an embodiment of the present application;

[0029] Figure 7 A flowchart of a camera trusted computing method provided in an embodiment of the present application;

[0030] Figure 8 A flowchart of a camera trusted computing method provided in an embodiment of the present application;

[0031] Fig. 9 A flowchart of a reference value acquisition method provided in an embodiment of the present application;

[0032] Fig.10 A flowchart of a reference value acquisition method provided in an embodiment of the present application;

[0033] Fig.11 A flowchart of a camera trusted computing method provided in an embodiment of the present application;

[0034] Fig.12 A flowchart of a camera trusted computing method provided in an embodiment of the present application;

[0035] Fig.13 A structural block diagram of a camera trusted computing device provided in an embodiment of the present application;

[0036] Fig.14 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0038] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0039] Figure 1 FIG. 1 is an application environment diagram of a camera trusted computing method in an embodiment. Figure 1 The camera trusted computing method is applied to a camera trusted computing system. The camera trusted computing system includes a trusted terminal 110 and a server 120. The trusted terminal 110 and the server 120 are connected via a network. The trusted terminal 110 may be a desktop terminal or a mobile terminal, and the mobile terminal may be at least one of a mobile phone, a tablet computer, a laptop computer, etc. The server 120 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0040] like Figure 2 and Figure 3 As shown, the trusted terminal 110 includes a trusted component, an interface status monitoring module, a version status monitoring module, a vulnerability status monitoring module, and a permission status monitoring module. The trusted component includes a measurement judgment module, a dynamic measurement module 330, a static measurement module 310, an expected value acquisition module, a network communication agent module, an operation control module 350 (including a judgment module), a cryptographic algorithm interface library, and a data file. The trusted component and the camera terminal are deeply integrated and customized, and are preset in the bottom layer of the camera system when leaving the factory. It has the functions of self-starting, self-protection, keeping alive, and anti-unloading, and has system permissions. It is the actual execution component that realizes the monitoring system, monitoring application, trusted measurement, trusted report, and function during the operation of the system. By linking with the trusted root and the server, the terminal security and the integrity of its own security mechanism are guaranteed, and the trust is passed to the application.

[0041] like Figure 2As shown, the trusted service end 120 performs unified management of detection, strategy, benchmark, log, etc. for cameras, trusted roots, applications, etc. It includes a signature system, a key management system, a benchmark collection system, a benchmark library, a vulnerability detection and management system, an interface detection and management system, a permission detection and management system, a trusted measurement judgment system, and a trusted comprehensive management system. Through the analysis of the detection results and measurement results in the trusted report reported by the camera, the trusted measurement judgment service calls the corresponding relevant benchmark information in the benchmark library for comparison, and through a horizontal comprehensive judgment, determines the comprehensive status of the application trusted state, the camera system trusted state, the interface state, the vulnerability state, the permission state, the version state, etc., and obtains the comprehensive security state of the camera, which provides basic data for the comprehensive analysis of the camera security state and ensures the security of the camera in accordance with the security policy.

[0042] In one embodiment, Figure 4 FIG. 1 is a flow chart of a camera trusted computing method in an embodiment, referring to FIG. Figure 4 , provides a camera trusted computing method. This embodiment mainly applies this method to the above Figure 1 Taking the trusted terminal 110 in the example as an example, the camera trusted computing method specifically includes the following steps:

[0043] Step S210, when a camera startup instruction is received, static measurement is performed on each camera application that supports the startup and operation of the camera to obtain a startup measurement result of each camera application, wherein the camera is installed in the trusted terminal 110.

[0044] Specifically, the camera startup instruction is used to request to start the camera in the trusted terminal 110. The camera startup instruction can be a command generated by a user trigger, or it can be a command generated by the installed software in the trusted terminal 110 when the camera needs to be called. The startup operation of the camera depends on the camera application at the bottom of the camera, that is, the camera application is used to support the normal activation of the camera. In order to ensure the trusted state of the camera, each camera application is first subjected to a trusted static measurement before starting the camera, so as to obtain the startup measurement result of each camera application. The startup measurement result is trusted or untrusted, which is used to indicate the trusted state of each camera application.

[0045] Among them, refer to Figure 5Static measurement is to perform trusted calculation on the preset measurement objects corresponding to each camera application, and compare the trusted calculation results with the corresponding preset benchmark values. If the comparison is consistent, the trusted state is determined to be trusted. Otherwise, if the comparison is inconsistent, the trusted state is determined to be untrustworthy. When the trusted state of at least one preset measurement object among the multiple preset measurement objects corresponding to each camera application is untrustworthy, the camera application is determined to be untrustworthy. Before the camera application runs, static trusted measurement is performed, and trusted verification is performed based on the trusted root. The measurement results are compared with the application benchmark, including the comparison of measurement values ​​such as application information, integrity status, version status, vulnerability status, interface status, and permission status with the application benchmark. According to the comparison results, the execution of the program that does not meet the expectations is blocked and reported, effectively preventing the operation of applications with damaged integrity and availability and illegal status. Only programs with the same measurement value as the expected value (application measurement benchmark) in the benchmark library can be executed normally.

[0046] Step S220: when the startup measurement result of each camera application is credible, start the camera.

[0047] Specifically, the camera is started only when the startup measurement results of each camera application are all credible, that is, the camera is refused to be started when at least one camera application startup measurement result is untrustworthy, thereby avoiding using an untrustworthy camera application to start the camera, resulting in the activation of an untrustworthy camera, and avoiding starting the untrustworthy camera.

[0048] Step S230, while the camera is in operation, dynamically measure each of the camera applications, and perform trustworthy measurement on the camera according to preset measurement parameters to obtain dynamic measurement results of each of the camera applications and parameter measurement results of each of the preset measurement parameters.

[0049] Specifically, after the camera is successfully started, it is necessary to dynamically measure the camera application in real time to detect the trusted state of each camera application during the operation of the camera. Dynamic measurement is similar to static measurement, which is to collect the trusted calculation results of the preset measurement objects of the camera application during operation, and compare the trusted calculation results with the corresponding preset reference values. If the comparison is consistent, the trusted state is determined to be trusted, and if the comparison is inconsistent, the trusted state is determined to be untrustworthy. Figure 6, dynamic trust measurement during the operation of the camera application, trust verification based on the trusted root, through the dynamic measurement module 330, at the preset time interval, the operating system execution environment and the application execution environment are trusted and verified in the key execution link of the business program, and sensitive operations, unauthorized operations, illegal calls, illegal attacks and other operations that do not meet expectations during the application operation process are prevented and reported, effectively preventing illegal operations, attacks, access, etc. of the application. By monitoring the application running status in real time and the system status when the application is running, the application can be measured and controlled throughout the process, and the security performance is improved.

[0050] After the static measurement passes, the dynamic measurement collects the benchmark information of the measurement object when the camera application is legally loaded, stores it in the dynamic measurement benchmark strategy, and actively verifies the key information in the memory in real time based on the benchmark. By collecting the status information of the measurement object in the memory, the measurement result is compared with the dynamic measurement benchmark strategy to make a legality judgment. The dynamic measurement module 330 monitors all key processes, modules, execution codes, data structures, important jump tables, etc. in the system in real time, measures and controls the resource access behavior of the process in real time, prevents the business process from being illegally destroyed, and ensures the safe operation of the application, the safe operation of the system, and the security mechanism is not bypassed or tampered with.

[0051] The camera is also trusted by the preset measurement parameters to obtain parameter measurement results of each preset measurement parameter. The preset measurement parameters are different from the measurement objects of static measurement and dynamic measurement, thereby enriching the measurement scope of the camera to facilitate more accurate detection of the trusted state of the camera.

[0052] Step S240 , outputting a camera trust report to the trusted server 120 according to the dynamic measurement results of each of the camera applications and the parameter measurement results of each of the preset measurement parameters.

[0053] Specifically, the dynamic measurement results of each camera application and the parameter measurement results of each preset measurement parameter are summarized to form a camera trust report, and the camera trust report is uploaded to the trusted server 120. The trusted server 120 makes a trusted judgment on it and generates a trusted judgment result. The trusted judgment result indicates the trusted state of the camera during operation.

[0054] Step S250: upon receiving the trustworthy judgment result fed back by the trusted server 120 with respect to the trustworthy report of the camera, controlling the operating state of the camera according to the trustworthy judgment result.

[0055] Specifically, the trusted terminal 110 receives the trusted decision result fed back by the trusted server 120, and controls the operating state of the camera according to the trusted decision result, that is, when the trusted decision result is untrustworthy, the camera is controlled to stop running; when the trusted decision result is trustworthy, the camera is controlled to maintain the original operating state.

[0056] Based on the above method, a static measurement is performed on the camera before it is started, and a dynamic measurement is performed on each camera application during the operation of the camera, and a trustworthy measurement is performed on the camera according to preset measurement parameters. The trustworthy state of the camera is comprehensively determined based on the dynamic measurement results and the parameter measurement results of each preset measurement parameter, and the operating state of the camera is controlled based on the trusted judgment result issued by the trusted server 120 to ensure that the camera operates in a trusted state and avoid the security risks caused by the camera operating in an untrustworthy state, thereby solving the problem of security risks caused by using an untrustworthy camera.

[0057] In one embodiment, when a camera startup instruction is received, static measurement is performed on each camera application that supports the startup of the camera, and before obtaining the startup measurement results of each camera application, the method includes:

[0058] When receiving an installation request of a target camera application, performing a trustworthy verification on the installation package of the target camera application to obtain a trustworthy verification result;

[0059] When the verification result is successful, performing a legal verification on the target camera application to obtain a legal verification result;

[0060] When the legal verification result is successful, the installation package of the target camera application is loaded and installed.

[0061] Specifically, refer to Figure 7 Before determining the trusted state of the camera application, the camera application needs to be installed in the trusted terminal 110, and before installing the camera application, the camera application needs to be tested for trustworthiness to avoid installing untrusted camera applications. The installation request can be an application installation request or application update request initiated by the camera developer or camera maintenance background to the trusted terminal 110, that is, it is used to request to install or update the target camera application on the trusted terminal 110, and the target camera application is any camera application that supports camera operation.

[0062] When the trusted terminal 110 receives the installation request, the installation package of the target camera application is first decrypted and trusted to verify the trustworthiness, and a trusted verification result is obtained. Only when the trusted verification result is a successful verification, can the target camera application be legally verified, that is, to determine whether the target camera application exists in the application whitelist in the application benchmark library. If it exists, it indicates that the legal verification result is a successful verification; if it does not exist, it indicates that the legal verification result is a failed verification. That is, to determine whether the target camera application is a legal application, the application whitelist is used to record all legally authorized camera applications. Only when the legal verification result is a successful verification is allowed to install the installation package of the target camera application. In this way, it is ensured that only legal and safe camera applications can be installed on the trusted terminal 110, and the installation behavior of illegal applications is strictly controlled to effectively prevent the installation of illegal and malicious applications.

[0063] The installation request carries the corresponding installation package, and in the case where the installation package is specifically an upgrade package for application update, the trusted server 120 needs to perform trusted calculation on the installation package before sending the installation package to the trusted terminal 110 to ensure that the trusted installation package is sent to the trusted terminal 110. The trusted server 120 specifically performs benchmark collection and security checks on the installation package, calculates the hash value of the installation package, saves the installation package information and the hash value in the benchmark library, digitally signs the installation package, and sends it to the trusted terminal 110 through the network proxy to ensure the trusted state of the installation package sent to the trusted terminal 110.

[0064] For newly installed applications, we use cryptographic technology, application signature verification, and trusted verification technology, and adopt a trusted whitelist mechanism based on benchmark collection to ensure that applications included in the application whitelist are safe and reliable, and prohibit the operation and installation of non-whitelisted applications. Before the application is installed, we conduct trusted verification based on the trusted root, and strictly control the installation behavior based on the verification results, effectively preventing the installation of illegal and malicious applications. Only legal and safe applications can be installed.

[0065] In one embodiment, before outputting the camera trust report to the trusted server 120 according to the dynamic measurement results of each camera application and the parameter measurement results of each preset measurement parameter, the method further includes:

[0066] Obtaining a third-party trusted measurement result of the third-party trusted security software for the trusted terminal 110 through a trusted interface;

[0067] Outputting a camera trust report to the trusted server 120 according to the dynamic measurement results of each camera application and the parameter measurement results of each preset measurement parameter includes:

[0068] According to the dynamic measurement results of each of the camera applications, the parameter measurement results of each of the preset measurement parameters and the third-party trusted measurement results, a camera trusted report is output to the trusted server 120 .

[0069] Specifically, refer to Figure 8 The trusted terminal 110 may also be installed with a third-party trusted security software, which is used to perform security maintenance on the trusted terminal 110. The camera can access the third-party trusted security software through a trusted interface to obtain the trusted measurement results of the third-party trusted security software on the trusted terminal 110, that is, the third-party trusted measurement results. The trusted terminal 110 can also combine the third-party trusted measurement results, the dynamic measurement results of the camera application, and the parameter measurement results of each of the preset measurement parameters to comprehensively generate a camera trusted report and output it to the trusted server 120, that is, by summarizing different trusted measurement results to generate a camera trusted report, thereby improving the accuracy of the camera trusted report.

[0070] That is, the camera has a horizontal comprehensive trusted protection capability. The trusted system is linked with other security mechanisms to monitor the security status of all components in the large system, conduct a comprehensive judgment of the security status, obtain the overall comprehensive trusted status, and report it to the management system in a timely manner to ensure the comprehensive security and trustworthiness of the camera system. For example, the system works in conjunction with virus detection, anti-DoS / DdoS, vulnerability protection and other systems to conduct a comprehensive assessment of the overall security defense system, bringing the measurement and control of the trusted security mechanism to a deeper level of breadth and depth, providing effective support for the security service of comprehensive data analysis, and helping managers to make comprehensive judgments and processing from a global perspective.

[0071] In one embodiment, when the camera is in operation, each camera application is dynamically measured, and the camera is trusted according to preset measurement parameters to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter, including:

[0072] When the camera is in operation, each camera application is dynamically measured, and the interface status, version status, vulnerability status, and permission status of the camera are respectively trustedly measured to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter, wherein each preset measurement parameter is interface status, version status, vulnerability status, and permission status.

[0073] Specifically, refer to Figure 8While dynamically measuring the camera application, the camera's interface status, version status, vulnerability status, and permission status are also measured for trustworthiness, and the interface status is used to indicate the calling status of the trusted interface, that is, the trusted interface can not only be used to establish communication between the camera and other installed applications on the trusted terminal 110, but also be used to implement the calling of the camera by other installed applications. That is, the interface status is used to reflect the calling status of the camera and the interface communication status.

[0074] The version status is used to indicate whether the application version of each camera application of the camera is the expected version, the vulnerability status is used to indicate whether there are vulnerabilities in each camera application of the camera, and the permission status is used to indicate whether the operation permissions applied for by each camera application meet the corresponding permission benchmark. By monitoring the interface status, version status, vulnerability status, and permission status of the camera, the security and reliability of the camera can be fully ensured, and problems such as illegal camera calls and camera interface abnormalities can be solved. The security status of the application is comprehensively judged from the aspects of software source, installation, operation, maintenance, etc. to ensure the reliable security of the camera.

[0075] Reference Fig. 9 The system expected value strategy is the basis of the entire trusted measurement, mainly providing measurement standards for the trusted measurement module, including information such as the complete file path required for file access control and the file hash value required for integrity measurement. The expected value acquisition module runs when the software is deployed. When the system is initialized, it scans and analyzes all files in the system to generate an initial benchmark, and uses the national secret algorithm to encrypt and protect the files to form the system expected value (system benchmark), which is synchronized to the server benchmark library. Only programs with the same measurement value as the expected value in the benchmark library can be executed normally, dynamic libraries can be linked normally, and driver modules can be loaded normally, achieving the protective effect of preventing malicious code and unauthorized software from running.

[0076] Reference Fig.10, the camera application is signed by the signature system before being put on the shelf. Before the digital signature, the benchmark collection system extracts the security benchmark, integrates the detection benchmark information of each detection service, and uses the national secret algorithm to sign the file. The signature information includes: signing unit, software manufacturer, software version, permission strategy, interface strategy, vulnerability strategy, signature algorithm, signature value, etc., to form an application benchmark. The application benchmark collection system collects applications, collects their security benchmarks, integrity information, version information, etc., to form an application measurement benchmark, and the measurement benchmark includes the version benchmark of the application. The vulnerability detection and management system performs vulnerability detection on applications. Only applications that are determined to be safe through system detection can be included in the benchmark library. The application detection results and detection information form the leak information benchmark of the application. The permission detection and management system performs permission detection on applications, obtains the permission list through the detection module, and checks, analyzes, and determines all permission-related information. Only applications that are determined to be safe through system detection can be included in the benchmark library. The application detection results and detection information form the permission information benchmark of the application. The interface detection and management system performs interface detection on the application, obtains relevant call information, call permissions and other related information of the interface through the detection module, and performs inspection, analysis and judgment. Only applications that are judged to be safe through system detection can be included in the benchmark library. The application detection results and detection information form the interface information benchmark of the application.

[0077] In one embodiment, while the camera is in operation, the method further includes:

[0078] If an application operation request is received, determining a request type of the application operation request;

[0079] Determine a corresponding target measurement object according to the request type of the application operation request;

[0080] Determining a request trustworthy state of the application operation request according to a comparison result between the target measurement object and the corresponding measurement reference value;

[0081] When the request trust status is trustworthy, respond to the application operation request.

[0082] Specifically, refer to Fig.11When receiving an application operation request for a camera application, it is necessary to first perform a trust measurement on the application operation request, and then determine whether to respond to the application operation request based on the measurement result. The target measurement object is determined according to the request type of the application operation request, that is, different request types correspond to different measurement objects. The request trust status of the application operation request is determined based on the comparison result between the target measurement object and the corresponding measurement reference value. The application operation request is responded to only when the request trust status is trustworthy. This can prevent unauthorized and illegal execution operations, ensure that the camera application and its related data are not illegally tampered with or injected, and ensure the security of its configuration files, dynamic libraries, and business data to prevent illegal destruction. It can prevent tampering operations on important files, perform permission control and integrity protection on files, and ensure that files are not illegally tampered with, such as preventing illegal writing, modification, and deletion. It can achieve active defense against known / unknown malicious code and reduce the risk of damage to the integrity and availability of the operating system.

[0083] In one embodiment, determining a corresponding target metric object according to the request type of the application operation request includes:

[0084] When the request type of the application operation request is a request to execute a program, a hash value of the program to be executed corresponding to the application operation request is used as a target measurement object;

[0085] When the request type of the application operation request is a request to modify a file, the file name of the to-be-modified file corresponding to the application operation request is used as a target measurement object.

[0086] Specifically, refer to Fig.11 , the request type of the application operation request can be a request to execute a program or a request to modify a file. When the request type of the application operation request is a request to execute a program, that is, the application operation request is used to request the execution of the program to be executed, and the hash value of the program to be executed is used as the target measurement object to participate in the trusted calculation, that is, to determine whether the hash value matches the corresponding reference value successfully. If the match is successful, it is determined to be trusted, and if the match fails, it is determined to be untrustworthy. Fig.12 When the request type of the application operation request is a request to modify a file, that is, the application operation request is used to request to perform a modification operation on the file to be modified, and the modification operation includes modification, deletion, addition and other operations. The file name of the file to be modified is used as the target measurement object, that is, to determine whether the file name matches the corresponding benchmark value successfully. If the match is successful, it is determined to be credible, and if the match fails, it is determined to be untrustworthy.

[0087] In one embodiment, controlling the operating state of the camera according to the credible decision result includes:

[0088] When the trusted decision result indicates that the camera is not trusted, the network communication of the camera is intercepted and the camera is turned off.

[0089] Specifically, when the camera is determined to be untrustworthy based on the trusted judgment result fed back by the trusted server 120, and / or when the camera is determined to be untrustworthy based on the dynamic measurement result, the network communication of the camera is intercepted to prevent the camera from continuing to be illegally intruded and controlled, and the camera is turned off, and the continued use of illegal and untrustworthy cameras is prohibited to avoid the security risks caused by the use of untrustworthy cameras. The camera has independent security judgment capabilities based on the trusted root and has security protection capabilities. The camera comprehensively monitors the legality, integrity, vulnerability status, sensitive operations, permission status, version status, interface status, and real-time operation status of the software, and performs trusted verification through comprehensive measurement judgments to block abnormal behaviors in a timely manner.

[0090] The trusted terminal 110 monitors the camera application status in real time through the trusted mechanism. The trusted component obtains the system trusted status of the terminal by using trusted measurement, trusted report, measurement judgment and other functions. The detection results are obtained through the version status monitoring module, interface status monitoring module, vulnerability status monitoring module, permission status monitoring module / other security mechanisms. According to the detection results and measurement results of each module, a comprehensive trusted report is formed, and the status is reported in time. After receiving the trusted report, the security monitoring service end makes a comprehensive judgment on the trusted report according to the benchmark strategy, wherein the trusted report contains terminal basic information, system basic information, system version status, trusted boot information, measurement value, policy status, system trusted status, application information, version status, vulnerability status, interface status, permission status, security information of other security mechanisms and other related fields. The measurement judgment service calls the relevant benchmarks and the trusted report for comprehensive comparison, judges the comprehensive security status of the camera, makes a comprehensive judgment on the security status, obtains the overall comprehensive trusted status, issues the strategy to take disposal measures, and the client executes the disposal strategy.

[0091] Figure 4-Figure 12 FIG. 1 is a flow chart of a camera trusted computing method in one embodiment. It should be understood that although Figure 4-Figure 12 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 4-Figure 12 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0092] In one embodiment, Fig.13 As shown, a camera trusted computing device is provided, comprising:

[0093] The static measurement module 310 is used to perform static measurement on each camera application supporting the camera startup and operation when receiving the camera startup instruction, and obtain the startup measurement result of each camera application, wherein the camera is installed in the trusted terminal 110;

[0094] A starting module 320, configured to start the camera when the start measurement result of each camera application is credible;

[0095] The dynamic measurement module 330 is used to dynamically measure each camera application when the camera is in operation, and to perform trust measurement on the camera according to preset measurement parameters to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter;

[0096] A reporting module 340, configured to output a camera trust report to the trusted server 120 according to the dynamic measurement results of each of the camera applications and the parameter measurement results of each of the preset measurement parameters;

[0097] The control module 350 is configured to control the operating state of the camera according to the trusted decision result when receiving the trusted decision result fed back by the trusted server 120 with respect to the trusted report of the camera.

[0098] In one embodiment, the device further comprises an installation module, configured to:

[0099] When receiving an installation request of a target camera application, performing a trustworthy verification on the installation package of the target camera application to obtain a trustworthy verification result;

[0100] When the verification result is successful, performing a legal verification on the target camera application to obtain a legal verification result;

[0101] When the legal verification result is successful, the installation package of the target camera application is loaded and installed.

[0102] In one embodiment, the device further comprises an acquisition module, configured to:

[0103] Obtaining a third-party trusted measurement result of the third-party trusted security software for the trusted terminal 110 through a trusted interface;

[0104] The reporting module 340 is also used to:

[0105] According to the dynamic measurement results of each of the camera applications, the parameter measurement results of each of the preset measurement parameters and the third-party trusted measurement results, a camera trusted report is output to the trusted server 120 .

[0106] In one embodiment, the dynamic metric module 330 is further configured to:

[0107] When the camera is in operation, each camera application is dynamically measured, and the interface status, version status, vulnerability status, and permission status of the camera are respectively trustedly measured to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter, wherein each preset measurement parameter is interface status, version status, vulnerability status, and permission status.

[0108] In one embodiment, the dynamic metric module 330 is further configured to:

[0109] If an application operation request is received, determining a request type of the application operation request;

[0110] Determine a corresponding target measurement object according to the request type of the application operation request;

[0111] Determining a request trustworthy state of the application operation request according to a comparison result between the target measurement object and the corresponding measurement reference value;

[0112] When the request trust status is trustworthy, respond to the application operation request.

[0113] In one embodiment, the dynamic metric module 330 is further configured to:

[0114] When the request type of the application operation request is a request to execute a program, a hash value of the program to be executed corresponding to the application operation request is used as a target measurement object;

[0115] When the request type of the application operation request is a request to modify a file, the file name of the to-be-modified file corresponding to the application operation request is used as a target measurement object.

[0116] In one embodiment, the control module 350 is further configured to:

[0117] When the trusted decision result indicates that the camera is not trusted, the network communication of the camera is intercepted and the camera is turned off.

[0118] like Fig.14As shown, an embodiment of the present application provides a computer device, including a processor 711, a communication interface 712, a memory 713 and a communication bus 714, wherein the processor 711, the communication interface 712, and the memory 713 communicate with each other through the communication bus 714;

[0119] Memory 713, used for storing computer programs;

[0120] The processor 711 is used to implement the camera trusted computing method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 713.

[0121] Those skilled in the art will understand that Fig.14 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0122] In one embodiment, the camera trusted computing device provided by the present application can be implemented in the form of a computer program. The computer program can be Fig.14 The computer device shown in the figure is run on the computer device. The memory of the computer device can store various program modules that constitute the camera trusted computing device, such as: Fig.13 The static measurement module 310, the startup module 320, the dynamic measurement module 330, the reporting module 340 and the control module 350 are shown. The computer program composed of each program module enables the processor to execute the camera trusted computing method of each embodiment of the present application described in this specification.

[0123] Fig.14 The computer device shown can be Fig.13The static measurement module 310 in the camera trusted computing device shown in the figure performs static measurement on each camera application that supports the camera startup and operation when receiving the camera startup instruction, and obtains the startup measurement results of each camera application, wherein the camera is installed in the trusted terminal 110. The computer device can execute the startup module 320 to start the camera when the startup measurement results of each camera application are trusted. The computer device can execute the dynamic measurement of each camera application and the trusted measurement of the camera according to the preset measurement parameters when the camera is in operation through the dynamic measurement module 330, and obtain the dynamic measurement results of each camera application and the parameter measurement results of each preset measurement parameter. The computer device can execute the report module 340 to output the camera trusted report to the trusted server 120 according to the dynamic measurement results of each camera application and the parameter measurement results of each preset measurement parameter. The computer device can execute the control module 350 to control the operation state of the camera according to the trusted judgment result when receiving the trusted judgment result fed back by the trusted server 120 for the camera trusted report.

[0124] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the camera trusted computing method provided by any of the aforementioned method embodiments is implemented.

[0125] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0126] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0127] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative can be used.

[0128] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A camera trusted computing method, characterized in that: The method comprises: When receiving a camera startup instruction, statically measuring each camera application supporting the startup of the camera to obtain startup measurement results of each camera application, wherein the camera is installed in a trusted terminal; When the startup measurement results of each camera application are credible, start the camera; When the camera is in operation, each camera application is dynamically measured, and the camera is trusted according to preset measurement parameters to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter; Outputting a camera trust report to a trusted server according to the dynamic measurement results of each of the camera applications and the parameter measurement results of each of the preset measurement parameters; When receiving the trustworthy judgment result fed back by the trusted server in response to the trustworthy report of the camera, the operating state of the camera is controlled according to the trustworthy judgment result.

2. The method according to claim 1, characterized in that When receiving a camera startup instruction, static measurement is performed on each camera application that supports the startup of the camera, and before obtaining the startup measurement results of each camera application, the method includes: When receiving an installation request of a target camera application, performing a trustworthy verification on the installation package of the target camera application to obtain a trustworthy verification result; When the verification result is successful, performing a legal verification on the target camera application to obtain a legal verification result; When the legal verification result is successful, the installation package of the target camera application is loaded and installed.

3. The method according to claim 1, characterized in that Before outputting the camera trust report to the trusted server according to the dynamic measurement results of each camera application and the parameter measurement results of each preset measurement parameter, the method further includes: Obtaining a third-party trusted measurement result of the third-party trusted security software for the trusted terminal through a trusted interface; Outputting a camera trust report to a trusted server according to the dynamic measurement results of each camera application and the parameter measurement results of each preset measurement parameter includes: According to the dynamic measurement results of each of the camera applications, the parameter measurement results of each of the preset measurement parameters and the third-party trusted measurement results, a camera trusted report is output to a trusted server.

4. The method according to claim 1, characterized in that: When the camera is in operation, each camera application is dynamically measured, and the camera is trusted according to preset measurement parameters to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter, including: When the camera is in operation, each camera application is dynamically measured, and the interface status, version status, vulnerability status, and permission status of the camera are respectively trustedly measured to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter, wherein each preset measurement parameter is interface status, version status, vulnerability status, and permission status.

5. The method according to claim 1, characterized in that When the camera is in operation, the method further includes: If an application operation request is received, determining a request type of the application operation request; Determine a corresponding target measurement object according to the request type of the application operation request; Determining a request trustworthy state of the application operation request according to a comparison result between the target measurement object and the corresponding measurement reference value; When the request trust status is trustworthy, respond to the application operation request.

6. The method according to claim 5, characterized in that Determining a corresponding target measurement object according to the request type of the application operation request includes: When the request type of the application operation request is a request to execute a program, a hash value of the program to be executed corresponding to the application operation request is used as a target measurement object; When the request type of the application operation request is a request to modify a file, the file name of the to-be-modified file corresponding to the application operation request is used as a target measurement object.

7. The method according to claim 1, characterized in that Controlling the operating state of the camera according to the credible judgment result includes: When the trusted decision result indicates that the camera is not trusted, the network communication of the camera is intercepted and the camera is turned off.

8. A camera trusted computing device, characterized in that: The device comprises: A static measurement module, configured to perform static measurement on each camera application supporting the camera startup operation upon receiving a camera startup instruction, and obtain startup measurement results of each camera application, wherein the camera is installed in a trusted terminal; A startup module, used for starting the camera when the startup measurement result of each camera application is credible; A dynamic measurement module, used to dynamically measure each camera application when the camera is in operation, and to perform trustworthy measurement on the camera according to preset measurement parameters, so as to obtain dynamic measurement results of each camera application and parameter measurement results of each preset measurement parameter; A reporting module, configured to output a camera trust report to a trusted server according to the dynamic measurement results of each of the camera applications and the parameter measurement results of each of the preset measurement parameters; The control module is used to control the operating state of the camera according to the trusted judgment result when receiving the trusted judgment result fed back by the trusted server for the trusted report of the camera.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images