Domestic operating system kernel backup and recovery method based on domestic computing platform

Abstract

The invention relates to a domestic operating system kernel backup and recovery method based on a domestic computing platform, and belongs to the technical field of trusted computing. According to the method, the design of domestic BIOS firmware is optimized, a temporary operating system in a current general solution in the industry is removed, and functions such as kernel measurement, acquisition backup and kernel recovery after measurement failure of the operating system are all submitted to the BIOS firmware to be responsible for, so that unbinding with the operating system is realized. And after the BIOS firmware finishes the kernel recovery of the operating system, the operating system does not need to be restarted, so that the execution time of the kernel recovery process is greatly shortened.

Description

Technical Field

[0001] The present invention belongs to the technical field of trusted computing, and in particular relates to a method for backing up and restoring a kernel of a domestic operating system based on a domestic computing platform. Background Art

[0002] Trusted computing technology is a computer security architecture technology. Its essence is to use a trusted computing platform supported by hardware security modules in computing and communication systems. One of its core goals is to ensure the integrity of the systems and applications running on it by building a trusted protection environment. The specific implementation method is: using the trusted platform control module (TPCM for short) as the trusted measurement root. On the computing platform, the trusted measurement root provides measurement of the hardware platform, the hardware platform provides measurement of the operating system, and the operating system provides measurement of the upper-layer applications, such as Figure 1 shown.

[0003] This method is to measure one level at a time, with the upper level providing trusted authentication for the lower level nodes, building a trust chain from the trusted platform control module to the mainboard BIOS firmware, operating system, and upper-level applications, providing a trusted basic software and hardware computing environment, and providing underlying support for the system's security protection measures.

[0004] In the process of building a trust chain, for the functional scenario of measuring the operating system kernel, the current common solution in the industry is: the BIOS firmware measures the operating system kernel. If the measurement is successful, the BIOS firmware loads grub1 and boots the operating system. When the kernel measurement fails, since the current domestic BIOS firmware cannot overwrite, modify, or perform other write operations on a specific file on the file system, the operating system needs to complete the kernel recovery. The specific process is: the BIOS firmware loads grub2, starts the temporary operating system, and the temporary operating system background service program completes the recovery of the operating system kernel. After the recovery is successful, restart the system, such as Figure 2 shown.

[0005] This solution has the following two problems:

[0006] 1. The operating system needs to be customized, so the system must be bound to a specific operating system. If the operating system is upgraded or replaced with another manufacturer's operating system, it needs to be re-customized and adapted to the BIOS firmware. Therefore, this solution greatly increases the cost of using trusted computing technology and limits the application and promotion of trusted devices.

[0007] 2. This solution requires restarting the device and loading the correct operating system kernel after kernel recovery, which is extremely time-consuming. Especially for server devices, each restart may take more than 10 minutes, which seriously affects the user experience. Summary of the invention

[0008] 1. Technical issues to be resolved

[0009] The technical problem to be solved by the present invention is to provide a universal trusted measurement, backup and recovery method for the operating system kernel, unbinding the kernel measurement solution from the operating system itself; improving the performance of the kernel backup and recovery process and reducing the execution time.

[0010] (II) Technical solution

[0011] In order to solve the above technical problems, the present invention provides a method for backing up and restoring the kernel of a domestic operating system based on a domestic computing platform. The operating system kernel backup process is designed as follows:

[0012] 1) When the device is powered on for the first time, during the initialization phase, the BIOS firmware turns off the trusted measurement and collection backup functions and directly boots the operating system for installation. After the operating system is installed, the BIOS firmware reserves a space at a specified location on the disk and creates a hidden partition there.

[0013] 2) Restart the system, enter the BIOS firmware, and enable active measurement; the BIOS firmware begins to collect the characteristic values ​​of key hardware and the operating system kernel, and records them in the trusted platform control module TPCM; after completing the characteristic value collection, the BIOS firmware backs up the entire / boot partition where the operating system kernel is located to the hidden partition by reading and writing sectors;

[0014] The operating system kernel measurement and kernel recovery process after measurement failure are designed as follows:

[0015] 1) Start the system and enter the BIOS firmware. The BIOS firmware starts to measure key hardware and the operating system kernel. If all the measurements pass, the BIOS firmware loads grub normally and boots the operating system to start, entering the normal startup process. If the operating system kernel has been illegally tampered with at this time, its characteristic value will change and will not match the characteristic value saved in TPCM, so the measurement will fail. After the measurement fails, the BIOS firmware enters the next step of the kernel recovery process.

[0016] 2) The BIOS firmware uses the contents of the hidden backup partition to overwrite the entire / boot partition in a read-write sector manner to complete the recovery of the operating system kernel.

[0017] Preferably, after the operating system kernel is restored, the BIOS firmware re-measures, and after the measurement passes, the operating system kernel is booted and loaded to enter a normal startup process.

[0018] Preferably, the key hardware includes peripherals such as a hard disk, a graphics card, a network card, and an optical drive.

[0019] Preferably, the operating system kernel measurement, collection backup, and kernel recovery after measurement failure are all implemented by the BIOS firmware.

[0020] The present invention also provides a system for implementing the method.

[0021] The present invention also provides a trusted computing method implemented based on the method.

[0022] The invention also provides a trusted computing platform implemented based on the method.

[0023] The present invention also provides a trust chain construction method implemented based on the method.

[0024] The invention also provides a communication system implemented based on the method.

[0025] The invention also provides a communication method implemented based on the method.

[0026] (III) Beneficial effects

[0027] The present invention optimizes the design of domestic BIOS firmware, removes the temporary operating system in the above-mentioned general solution in the industry, and transfers all functions such as operating system kernel measurement, collection backup, and kernel recovery after measurement failure to the BIOS firmware, thereby realizing the unbinding from the operating system. And after the BIOS firmware completes the operating system kernel recovery, there is no need to restart the operating system, thereby greatly reducing the execution time of the kernel recovery process. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of the trust chain transmission direction;

[0029] Figure 2 A flowchart for recovering the operating system kernel in traditional solutions;

[0030] Figure 3 A comparison diagram of the kernel backup solution of the present invention and the traditional solution;

[0031] Figure 4 It is a flow chart of the operating system kernel measurement and recovery process of the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0033] The specific scheme of the method for backing up and restoring the kernel of a domestic operating system based on a domestic computing platform provided by the present invention is as follows:

[0034] 1. Operating system kernel backup process:

[0035] 1) When the device is powered on for the first time, during the initialization phase, the BIOS firmware turns off functions such as trust measurement and collection backup, and directly guides the installation of the operating system. After the operating system is installed, the BIOS firmware reserves a space at a specified location on the disk and creates a hidden partition there.

[0036] 2) Restart the system, enter the BIOS firmware, and enable active measurement; the BIOS firmware then begins to collect feature values ​​of key hardware (hard disk, graphics card, network card, optical drive and other peripherals) and the operating system kernel, and records them in the trusted platform control module TPCM; after completing the feature value collection, the BIOS firmware backs up the entire / boot partition where the operating system kernel is located to the hidden partition by reading and writing sectors.

[0037] The comparison between the solution of the present invention and the traditional solution is as follows: Figure 3 As shown. The operating system kernel related files are organized in a relatively compact manner in the same partition, so the operating system backup can be completed by copying the entire partition. This method is essentially another more direct and efficient way to read and write files that are logically and physically organized together, which can solve the problem that the BIOS firmware cannot back up the operating system kernel because the domestic BIOS firmware cannot read and write specific files. And because the entire partition is backed up directly by reading and writing sectors, the file system can be bypassed. Compared with the traditional solution, the solution of the present invention has three advantages:

[0038] 1) Because the file system is bypassed, the overhead of file system operations such as inodes can be avoided;

[0039] 2) It can make full use of the fact that the data in the sector is physically adjacent, and use sequential read and write instead of random read and write to complete the backup, avoiding the overhead of repeated hard disk seeks and speeding up the backup;

[0040] 3) An independent hidden partition is used for backup purposes. Special permission settings and other protection measures can be taken for this partition to prevent the backup files in this partition from being damaged or tampered with. Compared with the ordinary way of using file backup, it is more secure and stable.

[0041] 2. Operating system kernel measurement and kernel recovery process after measurement failure:

[0042] 1) Start the system and enter the BIOS firmware. The BIOS firmware starts to measure key hardware and the operating system kernel. If all the measurements pass, the BIOS firmware loads grub normally and boots the operating system to start, entering the normal startup process. If the operating system kernel has been illegally tampered with at this time, its characteristic value will change and will not match the characteristic value saved in TPCM, so the measurement will fail. After the measurement fails, the BIOS firmware enters the next kernel recovery process.

[0043] 2) The BIOS firmware uses the hidden backup partition to overwrite the entire / boot partition in a sector-by-sector manner to restore the operating system kernel;

[0044] 3) After the kernel recovery is completed, the BIOS firmware re-measures, and after the measurement passes, it boots and loads the operating system kernel and enters the normal startup process.

[0045] The operating system kernel measurement and recovery process of the present invention is as follows Figure 4 In this way, the BIOS firmware will load grub and start the operating system kernel only after the measurement is passed normally or the operating system kernel is restored and passed the measurement. Figure 2 By comparing with the traditional kernel recovery scheme in , it can be found that the scheme of the present invention eliminates the process of loading a temporary operating system -> performing read and write operations at the operating system level to restore the kernel file -> restarting the device after the kernel is restored, which greatly improves the performance of the kernel recovery process.

[0046] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for backing up and restoring the kernel of a domestic operating system based on a domestic computing platform, characterized in that: The operating system kernel backup process is designed as follows: 1) When the device is powered on for the first time, during the initialization phase, the BIOS firmware turns off the trusted measurement and collection backup functions and directly boots the operating system for installation. After the operating system is installed, the BIOS firmware reserves a space at a specified location on the disk and creates a hidden partition there. 2) Restart the system, enter the BIOS firmware, and enable active measurement; the BIOS firmware begins to collect the characteristic values ​​of key hardware and the operating system kernel, and records them in the trusted platform control module TPCM; after completing the characteristic value collection, the BIOS firmware backs up the entire / boot partition where the operating system kernel is located to the hidden partition by reading and writing sectors; The operating system kernel measurement and kernel recovery process after measurement failure are designed as follows: 1) Start the system and enter the BIOS firmware. The BIOS firmware starts to measure key hardware and the operating system kernel. If all the measurements pass, the BIOS firmware loads grub normally and guides the operating system to start, entering the normal startup process. If the operating system kernel has been illegally tampered with, its characteristic value will change and will not match the characteristic value stored in TPCM, so the measurement will fail. After the measurement fails, the BIOS firmware enters the next kernel recovery process; 2) The BIOS firmware uses the contents of the hidden backup partition to overwrite the entire / boot partition in a read-write sector manner to complete the recovery of the operating system kernel.

2. The method according to claim 1, characterized in that After the operating system kernel is restored, the BIOS firmware re-measures. If the measurement passes, it boots and loads the operating system kernel and enters the normal startup process.

3. The method according to claim 1, characterized in that The key hardware includes peripherals such as hard disk, graphics card, network card, and optical drive.

4. The method according to claim 1, characterized in that The BIOS firmware is responsible for the measurement of the operating system kernel, collection backup, and kernel recovery after measurement failure.

5. A system for implementing the method according to any one of claims 1 to 4.

6. A trusted computing method implemented based on the method according to any one of claims 1 to 4.

7. A trusted computing platform implemented based on the method according to any one of claims 1 to 4.

8. A method for building a trust chain based on the method as described in any one of claims 1 to 4.

9. A communication system implemented based on the method according to any one of claims 1 to 4.

10. A communication method implemented based on the method according to any one of claims 1 to 4.

Images