Program blocking method and system in dual-system trusted measurement structure in cloud environment

Abstract

The invention belongs to the field of computer security, and provides a program blocking method and system in a dual-system trusted measurement structure in a cloud environment, and the method comprises the steps: enabling virtual machines to carry out information registration on a trusted management platform, generating a white list, and transmitting the white list to the trusted management platform; the trusted management platform stores the white list on a high-speed storage device, generates virtual machine storage device mapping information and feeds back the virtual machine storage device mapping information to a corresponding virtual machine; after the virtual machine is started, the mapping information of the storage device of the virtual machine is read and loaded into the memory of the virtual machine, and the virtual machine continuously sends credible data to the credible management platform so as to continuously measure the virtual machine; when the file in the virtual machine requests to run from the trusted management platform, comparing the file with the content in the white list to determine whether to run or not; when the file in the virtual machine requests operation to the trusted management platform, comparing the file with the content in the white list to determine whether the file is managed and controlled or not; according to the method, the credibility measurement of the double systems is not influenced when the measurement fails.

Description

Technical Field

[0001] The present invention belongs to the field of computer security technology, and in particular relates to a program blocking method and system in a dual-system trusted measurement structure in a cloud environment. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In a cloud environment, a trusted management platform is deployed on the host and an agent is deployed on the virtual machine. The agent continuously sends trusted data to the trusted management platform, which performs measurements based on the information sent and the whitelist stored on the host. If the measurement fails, the log is written and the user is prompted. At the same time, the agent is notified for subsequent processing, such as shutting down, disconnecting from the network, deleting illegal files, etc. This is a common operation under the dual-system trusted structure. In the common dual-system trusted measurement structure, the measurement process occurs on the trusted management platform side, that is, the center side. When the center side measurement fails, the executable program on the agent side has been executed. If the agent side first measures the file on the center side before it is executed, it is not advisable in terms of time. Especially under the premise that the trusted management platform is implemented in the form of software. Then, when the program measurement fails, the execution of the program must be stopped immediately. In real scenarios, there are many such requirements. Generally, this scenario requires the whitelist to be placed in the agent system, but this brings about the security issue of whitelist tampering.

[0004] Because the whitelist is stored on the management platform, the subsequent processing of measurement failure (such as disconnecting the network and deleting illegal files) is delayed. In real life, illegal files are often not allowed to be executed. That is, when the program in the virtual machine is executed, it is necessary to check whether it has been tampered with. If it has been tampered with, it is not allowed to run. In this scenario, the whitelist needs to be placed in the virtual machine for inspection. However, storing the whitelist in the virtual machine has certain security issues and does not meet the requirements of the dual system. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a program blocking method and system in a dual-system trusted measurement structure in a cloud environment. The present invention proposes a new storage method for the whitelist. Since the trusted management platform is placed on the host, all whitelists can be placed in a high-speed storage device, and then the storage device is divided into multiple sub-devices, which are mounted to different virtual machines respectively; from the perspective of the virtual machine, there will be a storage device / dev / mem, which stores the whitelist of all its executable programs; this storage method is particularly suitable in a cloud environment. Through the new storage method of the whitelist and a series of operations based on this, the program in the virtual machine can be blocked from execution when the measurement fails, without affecting the trusted measurement of the dual system.

[0006] According to some embodiments, a first solution of the present invention provides a program blocking method in a dual-system trusted measurement structure in a cloud environment, using the following technical solutions: The program blocking method in the dual-system trusted measurement structure in the cloud environment includes: Each virtual machine registers information with the trusted management platform. During the registration process, a whitelist is generated and sent to the trusted management platform. The trusted management platform stores the whitelist of each virtual machine on a high-speed storage device, and generates virtual machine storage device mapping information and feeds it back to the corresponding virtual machine; After the virtual machine is started, the virtual machine storage device mapping information is read and loaded into the virtual machine memory, the virtual machine continuously sends trusted data to the trusted management platform, and the trusted management platform continuously measures the virtual machine; When a file in a virtual machine requests to run from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to run; When a file in a virtual machine requests an operation from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to control it.

[0007] Furthermore, the whitelist is a list of file names and hash values, wherein the hash value is a hash value of the file content and the file attribute, or the hash value is a hash value of the file content.

[0008] Furthermore, the virtual machine storage device mapping information includes a white list, a storage space location of a high-speed storage device, and other user permissions.

[0009] Furthermore, when a file in the virtual machine requests to run from the trusted management platform, the trusted management platform determines whether to run based on the comparison between the file and the content in the whitelist, specifically: When the file in the virtual machine requests to run from the trusted management platform, the hook function is triggered; The hook function accesses the whitelist, and if it finds that the file is not in the whitelist, it refuses to run; otherwise, it calculates the hash value of the file and compares it with the hash value in the whitelist; If the hash value of the file does not match the hash value in the whitelist, it will be rejected; otherwise, the file will be matched with other attributes in the whitelist; If the file does not match other attributes in the whitelist, it is refused to run.

[0010] Furthermore, when a file in the virtual machine requests an operation from the trusted management platform, the trusted management platform determines whether to control the file based on the comparison between the file and the content in the whitelist, specifically: Before the file in the virtual machine requests an operation from the trusted management platform, the hook function is triggered; The hook function accesses the whitelist. If it is found that the file is not in the whitelist, it will not be operated or controlled; otherwise, it will determine whether the whitelist allows the corresponding operation; If not allowed, no operation or control will be performed on it. Otherwise, it will be determined whether the file matches other attributes in the whitelist. If not, no operation or control will be performed on it.

[0011] Furthermore, when a single virtual machine is performing a software upgrade, a software package is installed in the virtual machine, and during the process of continuous measurement of the virtual machine by the trusted management platform, the measurement fails and a new file is discovered; The trusted management platform obtains the corresponding white list according to the new file and stores it on a high-speed storage device, and generates new virtual machine storage device mapping information and feeds it back to the corresponding virtual machine to complete the software upgrade.

[0012] Furthermore, when a batch of virtual machines are undergoing a software upgrade, the software package is loaded on the trusted management platform, and the trusted management platform continuously measures the virtual machines; The trusted management platform updates the whitelist according to the software package, and generates new virtual machine storage device mapping information and feeds it back to the corresponding virtual machine; The virtual machine installs the software package according to the new virtual machine storage device mapping information to complete the software upgrade.

[0013] According to some embodiments, a second solution of the present invention provides a program blocking system in a dual-system trusted measurement structure in a cloud environment, which adopts the following technical solutions: Program blocking system in dual-system trust measurement structure in cloud environment, including host and multiple virtual machines; The host includes a trusted management platform and a high-speed storage device; The virtual machine uses the agent to continuously send trusted data to the trusted management platform for trust measurement, and sends the whitelist to the host to be stored in a high-speed storage device; The trusted management platform generates virtual machine storage device mapping information based on the storage space location of the whitelist in the high-speed storage device and feeds it back to the corresponding virtual machine, so that the virtual machine and the host are mounted. When a virtual machine fails to measure, its execution can be blocked without affecting the trusted measurement of the dual system.

[0014] Furthermore, the high-speed storage device is divided into a plurality of sub-devices, which are mounted to different virtual machines respectively.

[0015] Furthermore, a mapping storage device is also provided on the virtual machine, for storing virtual machine storage device mapping information mapped by the trusted management platform according to the whitelist.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a compromise solution in a cloud computing environment. The trusted management platform as the center is deployed on a physical host, and an agent is deployed in a virtual machine. The agent provides trusted data to the center for measurement. At the same time, a whitelist is mapped to the virtual machine in the form of a storage component for the virtual machine to read and use. The virtual machine has only read permission on the whitelist. In this scenario, program blocking and continuous measurement of the virtual machine are relatively independent. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0018] Figure 1 This is a diagram of the program blocking system architecture in a dual-system trusted measurement structure in a cloud environment in the second embodiment of the present invention; Figure 2 It is a diagram of the interactive processing process when the trusted management platform and the virtual machine agent are deployed in the first embodiment of the present invention; Figure 3 This is an example diagram of the format of the whitelist in the first embodiment of the present invention; Figure 4 This is a schematic diagram of storage space of a high-speed storage device in Embodiment 1 of the present invention; Figure 5 is a schematic diagram of the execution process of the executable file in the first embodiment of the present invention; Figure 6 is a flowchart of a file being operated in Embodiment 1 of the present invention; Figure 7 This is a flowchart of upgrading a single virtual machine in Embodiment 1 of the present invention; Figure 8 This is a flow chart of batch virtual machine upgrade in Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0019] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0020] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0021] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0022] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0023] Embodiment 1 like Figure 2 As shown, this embodiment provides a method for blocking programs in a dual-system trusted measurement structure in a cloud environment. In this embodiment, the method includes the following steps: Each virtual machine registers information with the trusted management platform. During the registration process, a whitelist is generated and sent to the trusted management platform. The trusted management platform stores the whitelist of each virtual machine on a high-speed storage device, and generates virtual machine storage device mapping information and feeds it back to the corresponding virtual machine; After the virtual machine is started, the virtual machine storage device mapping information is read and loaded into the virtual machine memory, the virtual machine continuously sends trusted data to the trusted management platform, and the trusted management platform continuously measures the virtual machine; When a file in a virtual machine requests to run from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to run; When a file in a virtual machine requests an operation from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to control it.

[0024] The whitelist is a list of file names and hash values, wherein the hash value is a hash value of the file content and the file attribute, or the hash value is a hash value of the file content.

[0025] The virtual machine storage device mapping information includes a white list, a storage space location of a high-speed storage device, and other user permissions.

[0026] When a file in the virtual machine requests to run from the trusted management platform, the trusted management platform determines whether to run the file based on the comparison between the file and the content in the whitelist, specifically: When the file in the virtual machine requests to run from the trusted management platform, the hook function is triggered; The hook function accesses the whitelist, and if it finds that the file is not in the whitelist, it refuses to run; otherwise, it calculates the hash value of the file and compares it with the hash value in the whitelist; If the hash value of the file does not match the hash value in the whitelist, it will be rejected; otherwise, the file will be matched with other attributes in the whitelist; If the file does not match other attributes in the whitelist, it is refused to run.

[0027] When a file in the virtual machine requests an operation from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to control it, specifically: Before the file in the virtual machine requests an operation from the trusted management platform, the hook function is triggered; The hook function accesses the whitelist. If it is found that the file is not in the whitelist, it will not be operated or controlled; otherwise, it will determine whether the whitelist allows the corresponding operation; If not allowed, no operation or control will be performed on it. Otherwise, it will be determined whether the file matches other attributes in the whitelist. If not, no operation or control will be performed on it.

[0028] When a single virtual machine is performing a software upgrade, a software package is installed in the virtual machine, and the trusted management platform continuously measures the virtual machine, and the measurement fails and a new file is found; The trusted management platform obtains the corresponding white list according to the new file and stores it on a high-speed storage device, and generates new virtual machine storage device mapping information and feeds it back to the corresponding virtual machine to complete the software upgrade.

[0029] When a batch of virtual machines are undergoing software upgrades, the software package is loaded on the trusted management platform, and the trusted management platform continuously measures the virtual machines; The trusted management platform updates the whitelist according to the software package, and generates new virtual machine storage device mapping information and feeds it back to the corresponding virtual machine; The virtual machine installs the software package according to the new virtual machine storage device mapping information to complete the software upgrade.

[0030] like Figure 2 As shown in the figure, the interaction between the trusted management platform and the virtual machine agent during deployment is as follows: A trusted management platform is deployed on the host. By default, the host has higher security. An agent is deployed on the virtual machine.

[0031] The agent registers with the trusted management platform. During registration, the virtual machine must be in a secure state. During the registration process, a whitelist is generated in the virtual machine and submitted to the trusted management platform.

[0032] The format of the whitelist is as follows Figure 3 As shown, the whitelist is a list of file names and hash values. The hash value can be either the hash value of the file content or the hash value of the file content plus the file attributes. After receiving the whitelist, the trusted management platform configures the hardware management device and allocates a storage space on the high-speed storage device (hereinafter referred to as whitelist-space) to store the whitelist. This space is mapped to the corresponding virtual machine as a read-only device of the virtual machine. From the perspective of the virtual machine, a / dev / mem device is added.

[0033] Whitelist-space-virtual machine storage device mapping information can be read and written on the trusted management platform. However, the virtual machine can only read but not rewrite.

[0034] The trusted management platform sets other attributes of the Whitelist-space based on the user interface, that is, the user's operation permissions on the files in the virtual machine. For example, whether the file can be deleted. Other attributes can be set according to needs, such as Figure 4 As shown in the figure, the modification of the whitelist is done by the user on the trusted management platform.

[0035] That is, the virtual machine storage device mapping information includes a whitelist, a storage space location of a high-speed storage device, and other user permissions.

[0036] After that, the trusted management platform will continue to measure the virtual machine through the agent module.

[0037] Virtual machine execution file, scenario analysis.

[0038] When the virtual machine starts, it reads the whitelist content in the virtual machine storage device - / dev / mem and loads it into the memory. The virtual machine continues to send trusted data to the trusted management platform, and the trusted management platform continues to measure the virtual machine. When a file in the virtual machine (including drivers, dynamic libraries, executable files, configuration files, etc., here we take executable file A as an example) is tampered with and then run, the virtual machine will query the data in / dev / mem in the memory and perform corresponding processing according to the configuration of the whitelist.

[0039] like Figure 5 As shown, it is the execution process of an executable file.

[0040] Before the executable file is executed, it will fall into a hook function, which will access the whitelist. If the file is not in the whitelist, it will be refused to execute; if the calculated hash value is inconsistent with the hash value in the whitelist, it will be refused to execute; if it is found that it does not match other attributes, it will be refused to execute. For example, a certain user is not allowed to execute a certain program, but other users are allowed to execute it. This can be done through attribute configuration.

[0041] It should be noted that when other files in the virtual machine are tampered with and then run, the above process is followed, first triggering the hook function and then performing subsequent processing.

[0042] like Figure 6 As shown, it is the execution process when a file is read, modified, and deleted, that is, the specific process when a file operation is requested.

[0043] When a file is deleted / modified / read, the virtual machine first needs to determine whether the file is in the whitelist. Unlike executable files, executable files will be rejected if they are not in the whitelist. As for the editing of files, as long as they are not in the whitelist, they will not be controlled. In other words, as long as the trusted management platform does not perform special attribute control on the file, the default is to allow users to create, modify, read, and delete a normal file.

[0044] When the file is found in the whitelist, control is performed based on the attributes. For example, if the whitelist attributes do not allow deletion of the file, the user cannot delete it.

[0045] Set an exclusion list. When a user is doing development work in a directory and needs to frequently modify and execute files in it, he can set the "exclusion control" attribute. When it is 1, the file can be refused to be monitored. That is, the addition, deletion, editing, and execution of this file will no longer be paid attention to or processed.

[0046] Upgrading and updating the software in the virtual machine. When the software in the virtual machine needs to be upgraded, it can be upgraded in two ways.

[0047] As shown in Figure 7, when you install directly on a virtual machine, you will find new files on the trusted management platform. On the trusted management platform, perform the whitelist operation and add the corresponding files to the corresponding virtual machine. This upgrade method is suitable for upgrading a single virtual machine.

[0048] like Figure 8As shown in the figure, the software package is directly placed in the trusted management platform, the trusted management platform generates a whitelist, loads it into the corresponding virtual machine, and then installs it on the virtual machine. This upgrade method is suitable for batch upgrades. At the same time, during the upgrade process, continuous measurement will not fail.

[0049] That is to say, when the software in the virtual machine needs to be upgraded, the software package that needs to be upgraded is placed on the trusted management platform. The trusted management platform generates a corresponding upgrade whitelist based on the software package, merges the upgrade whitelist into the whitelist corresponding to each virtual machine that needs to be upgraded in batches to update the whitelist of the virtual machine, and then sends the software package to the corresponding virtual machine based on the updated whitelist, and installs the upgrade in the virtual machine.

[0050] Embodiment 2 like Figure 1 As shown, this embodiment provides a program blocking system in a dual-system trusted measurement structure in a cloud environment, including a host and multiple virtual machines; The host includes a trusted management platform and a high-speed storage device; The virtual machine uses the agent to continuously send trusted data to the trusted management platform for trust measurement, and sends the whitelist to the host to be stored in a high-speed storage device; The trusted management platform generates virtual machine storage device mapping information based on the storage space location of the whitelist in the high-speed storage device and feeds it back to the corresponding virtual machine, so that the virtual machine and the host are mounted. When a virtual machine fails to measure, its execution can be blocked without affecting the trusted measurement of the dual system.

[0051] In this embodiment, all whitelists are put into a high-speed storage device. The high-speed storage device is divided into multiple sub-devices, which are mounted to different virtual machines respectively.

[0052] The virtual machine is also provided with a mapping storage device, namely / dev / mem, which is used to store virtual machine storage device mapping information mapped by the trusted management platform according to the white list, that is, the white list of all executable programs of the virtual machine itself.

[0053] This storage method is particularly suitable in cloud environments. Through the new storage method of whitelist and a series of operations based on it, the program in the virtual machine can be blocked from execution when the measurement fails, while at the same time, the trust measurement of the dual system is not affected.

[0054] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A program blocking method in a dual-system trusted measurement structure under a cloud environment, characterized in that: include: Each virtual machine registers information with the trusted management platform. During the registration process, a whitelist is generated and sent to the trusted management platform. The trusted management platform stores the whitelist of each virtual machine on a high-speed storage device, and generates virtual machine storage device mapping information and feeds it back to the corresponding virtual machine; After the virtual machine is started, the virtual machine storage device mapping information is read and loaded into the virtual machine memory, the virtual machine continuously sends trusted data to the trusted management platform, and the trusted management platform continuously measures the virtual machine; When a file in a virtual machine requests to run from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to run; When a file in a virtual machine requests an operation from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to control it.

2. The program blocking method in the dual-system trust measurement structure under the cloud environment as claimed in claim 1 is characterized in that: The whitelist is a list of file names and hash values, wherein the hash value is a hash value of the file content and the file attribute, or the hash value is a hash value of the file content.

3. The program blocking method in the dual-system trust measurement structure under the cloud environment as claimed in claim 1 is characterized in that: The virtual machine storage device mapping information includes a white list, a storage space location of a high-speed storage device, and other user permissions.

4. The program blocking method in the dual-system trust measurement structure under the cloud environment as claimed in claim 1, characterized in that: When a file in the virtual machine requests to run from the trusted management platform, the trusted management platform determines whether to run the file based on the comparison between the file and the content in the whitelist, specifically: When the file in the virtual machine requests to run from the trusted management platform, the hook function is triggered; The hook function accesses the whitelist, and if it finds that the file is not in the whitelist, it refuses to run; otherwise, it calculates the hash value of the file and compares it with the hash value in the whitelist; If the hash value of the file does not match the hash value in the whitelist, it will be rejected; otherwise, the file will be matched with other attributes in the whitelist; If the file does not match other attributes in the whitelist, it is refused to run.

5. The method for blocking programs in a dual-system trusted measurement structure in a cloud environment as claimed in claim 1, characterized in that: When a file in the virtual machine requests an operation from the trusted management platform, the trusted management platform compares the file with the content in the whitelist to determine whether to control it, specifically: Before the file in the virtual machine requests an operation from the trusted management platform, the hook function is triggered; The hook function accesses the whitelist. If it is found that the file is not in the whitelist, it will not be operated or controlled; otherwise, it will determine whether the whitelist allows the corresponding operation; If not allowed, no operation or control will be performed on it. Otherwise, it will be determined whether the file matches other attributes in the whitelist. If not, no operation or control will be performed on it.

6. The method for blocking programs in a dual-system trusted measurement structure in a cloud environment as claimed in claim 1, characterized in that: When a single virtual machine is performing a software upgrade, a software package is installed in the virtual machine, and the trusted management platform continuously measures the virtual machine, and the measurement fails and a new file is found; The trusted management platform obtains the corresponding white list according to the new file and stores it on a high-speed storage device, and generates new virtual machine storage device mapping information and feeds it back to the corresponding virtual machine to complete the software upgrade.

7. The method for blocking programs in a dual-system trust measurement structure under a cloud environment as claimed in claim 1, characterized in that: When a batch of virtual machines are undergoing software upgrades, the software package is loaded on the trusted management platform, and the trusted management platform continuously measures the virtual machines; The trusted management platform updates the whitelist according to the software package, and generates new virtual machine storage device mapping information and feeds it back to the corresponding virtual machine; The virtual machine installs the software package according to the new virtual machine storage device mapping information to complete the software upgrade.

8. The program blocking system in the dual-system trusted measurement structure under the cloud environment is characterized by: Includes the host and multiple virtual machines; The host includes a trusted management platform and a high-speed storage device; The virtual machine uses the agent to continuously send trusted data to the trusted management platform for trust measurement, and sends the whitelist to the host to be stored in a high-speed storage device; The trusted management platform generates virtual machine storage device mapping information based on the storage space location of the whitelist in the high-speed storage device and feeds it back to the corresponding virtual machine, so that the virtual machine and the host are mounted. When a virtual machine fails to measure, its execution can be blocked without affecting the trusted measurement of the dual system.

9. The program blocking system in the dual-system trust measurement structure under the cloud environment as claimed in claim 8, characterized in that: The high-speed storage device is divided into a plurality of sub-devices, which are mounted to different virtual machines respectively.

10. The program blocking system in the dual-system trust measurement structure in the cloud environment as claimed in claim 8, characterized in that: The virtual machine is also provided with a mapping storage device for storing virtual machine storage device mapping information mapped by the trusted management platform according to the white list.

Images