Method, system and device for realizing collection control of credible static measurement elements

Abstract

The invention belongs to the field of information security, and discloses a method, a system and a device for realizing collection control of credible static measurement elements, and the method comprises the following steps: optimizing an analyzer to obtain a third-party analyzer; registering the third-party parser into the trusted software-based agent module; loading the trusted software-based agent module into a kernel of an operating system; when the kernel of the operating system executes the monitored kernel function, calling a custom processing function of an agent in the trusted software-based agent module to collect trusted static measurement elements of the operating system process; the collected credible static measurement elements are sent to a measurement engine of the credible software base, and the process of the operating system is controlled according to the comparison result of the reference value calculated by the measurement engine and the reference value in the reference library in combination with a credible software base agent control mechanism. The reliability and reentry problems of the first-party resolver are solved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method, system and device for realizing collection and control of trusted static measurement elements. Background Art

[0002] In order to realize the trusted measurement of executable files in the operating system, the trusted platform control module needs to rely on the operating system LSM framework (Linux Security Modules) to realize the collection and control functions of measurement elements.

[0003] Security Enhancement The Linux (an operating system) kernel often needs to control its critical execution paths, which requires the Linux kernel to be able to change the original execution process of the kernel during the enhancement process. For this purpose, the kernel has established the LSM framework, which presets security checkpoints on all critical execution paths of the kernel and achieves the purpose of controlling the original process by registering to these checkpoints. Although LSM covers all aspects of daily affairs and security as widely as possible, its fixed execution sites and number limit the flexibility of security functions. And with the iteration of technology and the response to existing security threats, the Linux kernel is increasingly inclined to restrict all security modules to the kernel rather than dynamically loadable modules, and restrict the initialization time of these codes, so that they can only be writable in the early stage of kernel initialization, and then they will be placed under read-only protection. As a security vendor who often needs to face the enhancement of existing stock systems, it is undoubtedly not flexible enough and has to overcome the obstacles caused by various inherent security of the kernel.

[0004] Under this situation, it is necessary to create a flexible measurement factor collection method that is not restricted by the rigid LSM system and is compatible with the inherent security mechanisms of modern kernels.

[0005] Existing related technologies include: 1. Trusted Software Base Agent (TSB Agent), based on the principle of Linux Security Module (LSM) implementation, involves the extension of the Linux kernel security framework to enhance the security and integrity of the system. LSM allows security policy developers to implement their own security policies without modifying the kernel code. These policies can control access to system resources and monitor system behavior.

[0006] Second, the first-party JProbe (parser) is implemented based on KProbe (a lightweight kernel debugging tool) and can only be used for function entry addresses. KProbe is a general probe mechanism used by the Linux kernel. By inserting architecture-related breakpoint instructions at the instruction address to be detected, the original execution flow is interrupted, and the system exception handling is trapped, so that the CPU register state and memory content before and after the instruction execution can be detected. It is also possible to affect the subsequent system state by intervening in the CPU register, including but not limited to modifying the instruction pointer register to change the execution path. These features can be used for kernel dynamic debugging, hot patching, and arbitrary kernel function hooks (most of them). JProbe was once part of the Kprobe system. Its feature is to use KProbe to insert a stub at a specific instruction (function entry), save the CPU register and stack content in the KProbe callback function, and then call the user-defined JProbe detection function. These functions have the same prototype definition as the detected function. Function parameters are either passed through the stack or through registers. With the protection and backup of the current scene, JProbe can not only allow the user function to detect all the actual parameters corresponding to the prototype, but also restore the CPU registers and stack contents that may have been changed after the detection function is executed. After that, the original execution flow (the function interrupted by the detection) is returned by calling a special return function.

[0007] The disadvantages of the above-mentioned existing related technologies are as follows: 1. TSB agent has a small scope of application and needs to be adapted to each operating system kernel version, which generates a lot of adaptation work. 2. In high-version operating systems, the export of kernel symbol tables is restricted for security reasons, which will affect LSM-based adaptation and TSB implementation. The kernel symbol table contains the addresses and information of all symbols in the kernel (such as functions, variables, etc.), which is crucial for developing and debugging kernel modules (including LSM modules). Without this information, it will be difficult for developers to determine the exact location to hook, which will affect the development and debugging of LSM modules.

[0008] 2. Although the first-party Jprobe can be used to redirect kernel functions, it has several obvious defects and limitations for security purposes: 1. The Linux kernel stopped supporting JProbe from version 4 and gradually removed it. 2. Although it can be used to insert a user-defined function before the kernel function, it is impossible to skip the execution of the original function after the user function is executed. Therefore, the control function of the trusted agent cannot be realized. 3. Since the first-party Jprobe implementation adopts the design of global variables, the relevant information is stored in the global variable kprobe_ctlblk. The new detection instance will cause competition problems because there is only one global variable. This is the fundamental reason why the first-party Jprobe cannot be reentered. When nested calls occur, the later calls will be ignored, and the security mechanism will be bypassed. Therefore, the first-party Jprobe cannot be used for security purposes and cannot realize the security check function of the trusted agent.

[0009] Therefore, how to provide a method, system and device for realizing the collection and control of reliable static measurement elements is a problem that needs to be solved urgently. Summary of the invention

[0010] The embodiments of the present invention provide a method, system and device for implementing trusted static measurement element collection control to solve the problem that the prior art is not flexible enough and needs to overcome the obstacles caused by various inherent security of the kernel.

[0011] In order to have a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not a general review, nor is it intended to identify key / important components or to describe the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0012] According to a first aspect of an embodiment of the present invention, a method for implementing trusted static metric element collection control is provided.

[0013] In one embodiment, a method for implementing trusted static metric element collection control includes: By optimizing the parser, a third-party parser is obtained; the third-party parser is registered in the trusted software base agent module, and the monitored kernel function and the custom processing function are determined; the trusted software base agent module is loaded into the kernel of the operating system, and the third-party parser is activated; When the kernel of the operating system executes the monitored kernel function, the third-party parser is triggered, and the custom processing function of the agent in the trusted software base agent module is called; the trusted static measurement elements of the operating system process are collected by using the called custom processing function; The collected trusted static measurement elements are sent to the measurement engine of the trusted software base. According to the comparison results between the benchmark values ​​calculated by the measurement engine and the benchmark values ​​in the benchmark library, and combined with the trusted software base agent control mechanism, the operating system process is controlled.

[0014] In one embodiment, optimizing the parser to obtain the third-party parser includes: Utilize the stack to pass context information to optimize the parser for reentrancy issues; The parser is optimized so that it cannot control whether it needs to return to the original execution thread.

[0015] In one embodiment, using the stack to pass context information mechanism, the parser is optimized for reentrancy issues including: At the beginning of the parser process, new stack space is allocated and the context information is placed at the bottom of the new stack space; When an exception occurs, the original stack is dynamically switched to the new stack space by modifying the content of the original stack pointer register; After the parser process ends, the new stack space is freed.

[0016] In one embodiment, when an abnormal interrupt occurs, dynamically switching the original stack to the new stack space by modifying the content of the original stack pointer register includes: Set the original stack pointer to the top of the new stack space and clean up the top of the new stack space; return to the handler and continue execution.

[0017] In one embodiment, the optimization of the problem that the parser cannot control whether to continue to return to the original execution thread includes: According to the user function, determine whether the parser needs to return to the original execution thread; When it is necessary to return to the original execution thread, the return processing function is called to return to the original execution thread; When there is no need to return to the original execution thread, the end processing function is called to end the current parser process.

[0018] In one embodiment, when it is necessary to return to the original execution thread, calling the return processing function to return to the original execution thread includes: Use the return processing function and inline assembly code to get the value of the register; according to the value of the register, get the current stack bottom address, and fetch the parser context information from the current stack bottom address; The inline assembly is used to call the breakpoint interrupt and enter the exception handling process. During the exception handling process, the current stack is switched back to the original stack space according to the parser context information, and the interrupted instruction is set as the single-step flag, and the original instruction is executed in a single-step manner. After the single-step execution of the original instruction is completed, the current CPU automatically enters the single-step debugging exception interrupt stage; In the single-step debugging abnormal interrupt stage, the global parser table is searched through the address of the interrupt priority register of the central processing unit to determine the current parser; The corresponding underlying kernel debugging tool structure is obtained through the current parser registration information, and the kernel debugging tool plug-in address is obtained through the kernel debugging tool structure; According to the stub address of the kernel debugging tool, a new IP register address is obtained, and the IP register is made to point to the new IP register address, so that the single-step exception interrupt processing ends and returns to the original execution thread.

[0019] In one embodiment, calling the end processing function to end the current parser process includes: After the parser processing function is executed, the end processing function is called, and the parser processing function execution completion information is sent to the operating system kernel; after completing the preset work, the current parser process is ended.

[0020] In one embodiment, the pre-set tasks include: Get the current stack pointer value through inline assembly; According to the parser context information, the CPU registers and stack are restored, and the parser monitor function is executed and correctly returns to the caller; Set the return value to the base register; free the temporary stack.

[0021] According to a second aspect of an embodiment of the present invention, a system for implementing trusted static metric element collection control is provided.

[0022] In one embodiment, the system for implementing trusted static metric element acquisition control includes: A third-party tool building module is used to obtain a third-party parser by optimizing the parser; register the third-party parser into the trusted software base agent module, and determine the monitored kernel function and the custom processing function; load the trusted software base agent module into the kernel of the operating system, and activate the third-party parser; The measurement element collection module is used to trigger the third-party parser when the kernel of the operating system executes the monitored kernel function, and call the custom processing function of the agent in the trusted software base agent module; collect the trusted static measurement elements of the operating system process by using the called custom processing function; The process control module is used to send the collected trusted static measurement elements to the measurement engine of the trusted software base, and control the process of the operating system based on the comparison results of the benchmark values ​​calculated by the measurement engine and the benchmark values ​​in the benchmark library, combined with the trusted software base agent control mechanism.

[0023] According to a third aspect of an embodiment of the present invention, a computer device is provided.

[0024] In some embodiments, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0025] According to a fourth aspect of embodiments of the present invention, a computer-readable storage medium is provided.

[0026] In one embodiment, the computer-readable storage medium stores a computer program, and the computer program implements the steps of the above method when executed by a processor.

[0027] The technical solution provided by the embodiment of the present invention may have the following beneficial effects: (1) The present invention solves the reliability and reentrancy problems of the first-party JProbe, making it applicable to the TSB (Trusted Software Base) agent module, thereby improving the measurement efficiency and accuracy.

[0028] (2) The present invention uses a third-party Jprobe to jump out of the constraints of LSM and hook any kernel function, including inline functions and even functions running in the interrupt context, which greatly reduces the dependence on the adapted kernel. The entire core function only relies on a few specific kernel export functions, which are supported and exported by default in most kernels. This reduces the dependence on the kernel version, solves the compatibility problem of trusted computing agents in multiple operating systems, and improves the scope of technical application.

[0029] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0031] Figure 1 is a flow chart showing a method for implementing trusted static measurement element collection control according to an exemplary embodiment; Figure 2 It is a principle block diagram of a system for realizing trusted static measurement element acquisition control according to an exemplary embodiment; Figure 3 is a schematic diagram of the structure of a computer device according to an exemplary embodiment; Figure 4 is a first-party Jprobe workflow diagram shown according to an exemplary embodiment; Figure 5 It is one of the third party Jprobe workflow diagrams shown according to an exemplary embodiment; Figure 6 This is a third party Jprobe workflow diagram 2 shown according to an exemplary embodiment; Figure 7 This is the third third-party Jprobe workflow diagram shown according to an exemplary embodiment. DETAILED DESCRIPTION

[0032] The following description and accompanying drawings fully illustrate the specific embodiments of this article so that those skilled in the art can practice them. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. The scope of the embodiments of this article includes the entire scope of the claims, as well as all available equivalents of the claims. Herein, the terms "first", "second", etc. are only used to distinguish one element from another, without requiring or implying any actual relationship or order between these elements. In fact, the first element can also be called the second element, and vice versa. Moreover, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the structure, device or equipment including a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also include elements inherent to such structure, device or equipment. In the absence of more restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the structure, device or equipment including the elements. Each embodiment is described in a progressive manner herein, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the embodiments can be referred to each other.

[0033] The terms "longitudinal", "lateral", "upper", "lower", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc. in this document indicate the orientation or position relationship based on the orientation or position relationship shown in the drawings, and are only for the convenience of describing this document and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as a limitation on the present invention. In the description of this document, unless otherwise specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a mechanical connection or an electrical connection, it can also be the internal communication of two elements, it can be a direct connection, or it can be an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0034] As used herein, the term "plurality" means two or more than two, unless otherwise specified.

[0035] In this document, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0036] In this article, the term "and / or" is a description of the association relationship between objects, indicating that three relationships may exist. For example, A and / or B means: A or B, or, A and B.

[0037] It should be understood that, although the various steps in the flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0038] Each module in the device or system of the present application can be implemented in whole or in part by software, hardware, or a combination thereof. The above modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to the above modules.

[0039] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0040] Figure 1An embodiment of a method for realizing trusted static measurement element collection control of the present invention is shown.

[0041] In this optional embodiment, the method for implementing trusted static measurement element collection control includes: S101, obtaining a third-party parser by optimizing the parser; registering the third-party parser into the trusted software base agent module, and determining the monitored kernel function and the custom processing function; loading the trusted software base agent module into the kernel of the operating system, and activating the third-party parser; S103, when the kernel of the operating system executes the monitored kernel function, the third-party parser is triggered, and the custom processing function of the agent in the trusted software base agent module is called; the trusted static measurement elements of the operating system process are collected by using the called custom processing function; S105, sending the collected trusted static measurement elements to the measurement engine of the trusted software base, and controlling the operating system process according to the comparison result between the benchmark value calculated by the measurement engine and the benchmark value in the benchmark library and in combination with the trusted software base agent control mechanism.

[0042] In this optional embodiment, by optimizing the parser, obtaining the third-party parser includes: The stack is used to pass context information to optimize the parser for reentrancy issues.

[0043] The parser is optimized so that it cannot control whether it needs to return to the original execution thread.

[0044] In this optional embodiment, the optimization of the parser regarding the reentry problem using the stack to pass context information includes: At the beginning of the parser process, new stack space is allocated and the context information is placed at the bottom of the new stack space.

[0045] When an exception occurs, the original stack is dynamically switched to the new stack space by modifying the content of the original stack pointer register.

[0046] After the parser process ends, the new stack space is freed.

[0047] In this optional embodiment, when an abnormal interrupt occurs, dynamically switching the original stack to the new stack space by modifying the content of the original stack pointer register includes: Set the original stack pointer to the top of the new stack space and clean up the top of the new stack space; return to the handler and continue execution.

[0048] In this optional embodiment, the optimization of the problem that the parser cannot control whether it needs to return to the original execution thread includes: According to the user function, determine whether the parser needs to return to the original execution thread.

[0049] When it is necessary to return to the original execution thread, the return processing function is called to return to the original execution thread.

[0050] When there is no need to return to the original execution thread, the end processing function is called to end the current parser process.

[0051] In this optional embodiment, when it is necessary to return to the original execution thread, calling the return processing function to return to the original execution thread includes: The return processing function is used to obtain the value of the register through inline assembly code; the current stack bottom address is obtained according to the register value, and the parser context information is taken out from the current stack bottom address.

[0052] The breakpoint interrupt is called through inline assembly to enter the exception handling process; during the exception handling process, the current stack is switched back to the original stack space according to the parser context information, and the interrupted instruction is set as a single-step flag, and the original instruction is executed in a single-step manner.

[0053] After the single-step execution of the original instruction is completed, the current central processing unit automatically enters the single-step debugging exception interrupt stage.

[0054] During the single-step debugging exception interrupt phase, the global resolver table is searched through the address of the interrupt priority register of the central processor to determine the current resolver.

[0055] The corresponding underlying kernel debugging tool structure is obtained through the current parser registration information, and the stub address of the kernel debugging tool is obtained through the kernel debugging tool structure.

[0056] According to the stub address of the kernel debugging tool, a new IP register address is obtained, and the IP register is made to point to the new IP register address, so that the single-step exception interrupt processing ends and returns to the original execution thread.

[0057] In this optional embodiment, calling the end processing function to end the current parser process includes: After the parser processing function is executed, the end processing function is called, and the parser processing function execution completion information is sent to the operating system kernel; after completing the preset work, the current parser process is ended.

[0058] In this optional embodiment, the pre-set tasks include: Get the current stack pointer value through inline assembly.

[0059] According to the parser context information, the registers and stack of the central processor are restored, and the parser monitors the execution of the function and returns to the caller correctly.

[0060] Set the return value to the base register; free the temporary stack.

[0061] Figure 2 An embodiment of a system for realizing trusted static measurement element collection control of the present invention is shown.

[0062] In this optional embodiment, the system for implementing trusted static measurement element acquisition control includes: The third-party tool construction module 201 is used to obtain the third-party parser by optimizing the parser; register the third-party parser into the trusted software base agent module, and determine the monitored kernel function and the custom processing function; load the trusted software base agent module into the kernel of the operating system, and activate the third-party parser; The metric element collection module 203 is used to trigger the third-party parser when the kernel of the operating system executes the monitored kernel function, and call the custom processing function of the agent in the trusted software base agent module; collect the trusted static metric elements of the operating system process by using the called custom processing function; The process control module 205 is used to send the collected trusted static measurement elements to the measurement engine of the trusted software base, and control the process of the operating system based on the comparison result between the benchmark value calculated by the measurement engine and the benchmark value in the benchmark library and in combination with the trusted software base agent control mechanism.

[0063] In order to facilitate understanding of the above technical solutions of the present invention, the above technical solutions of the present invention are further described below from the perspective of architecture and principle, as follows: LSM (Linux Security Modules) is a loadable framework for the Linux kernel that provides a common interface that allows security policies to be modularly integrated into the kernel. LSM enables administrators and developers to flexibly enhance the security of Linux systems without making extensive changes to the kernel code. LSM defines a series of security-related hooks that are called at key security decision points, such as file access, process creation, network communication, etc. TSB agents can register their own processing functions to these hooks to implement security checks and controls at these key points.

[0064] First-party JProbe: The version natively supported in the operating system. It is a tool for dynamic tracking and analysis of the Linux kernel. It allows users to dynamically insert or remove trace points (probes) to monitor the behavior of the kernel without modifying the kernel source code. Jprobe is implemented based on the kernel's kprobes framework. Kprobes is a kernel debugging tool provided by Linux. It allows breakpoints to be set while the kernel is running to capture the execution flow at a specific code location. The kernel has had a built-in probe system called KProbe since a long time ago. Since the work of debugging the kernel is complex and difficult, the original intention of establishing this probe system is to provide a general detection mechanism before / after the execution of any kernel function (almost any, with only a few restrictions) to view the CPU register status and stack content. Obviously, this mechanism is not only used for kernel debugging, but also can be used for hotpatching of kernel functions. Due to its powerful enough capabilities and flexibility, the earlier version of the kernel implemented another more user-friendly probe environment that is close to human attention, called JProbe. Jprobe can be used to parse the actual parameters of kernel function operation, which is more realistic for observing the operation of kernel functions. This type of Jprobe that is natively supported by an earlier version of the kernel is called a first-party Jprobe. First-party Jprobe is built on the basis of Kprobe, and implements the function redirection function by modifying the CPU's IP register during Kprobe. JProbe was once part of the Kprobe system. The Linux kernel stopped supporting JProbe from version 4 and gradually removed it. KProbe has been retained to this day. KProbe is designed not to hide the core members of its underlying data structure from the outside, which makes third-party support for JProbe possible.

[0065] TPCM: Trusted Platform Control Module; TSB: Trusted Software Base; TCM: Trusted Cryptographic Module; LSM: Linux Security Module; Hook: Hook function, a function pointer pre-buried on a specific execution path, in order to be triggered at a specific time in a specific scenario; JProbe: A special probe system that can obtain the parameters of the probed function and modify the kernel execution path; KProbe: A general probe mechanism used by the Linux kernel; SP register: Stack pointer register; EX register: A general 16-bit data register.

[0066] Autonomous trusted computing: Autonomous trusted computing refers to completely autonomous trusted computing technology, which is a safe and reliable network security foundation. Specifically, autonomous trusted computing is a technology that ensures the predictability of information systems. It involves security protection while computing, ensuring that the calculation results are always the same as the expected values, and ensuring that the entire calculation process is measurable and controllable without interference.

[0067] TSB: It is composed of multiple functional modules, including basic trust base, control mechanism, measurement mechanism, judgment mechanism, trusted reference library and support mechanism. As part of the dual system architecture, TSB, together with TPCM, forms a parallel structure of computing components and protection components, realizing trusted monitoring of the working process of general computing system hardware, operating system and application program.

[0068] TSB agent: Trusted Software Base agent, deployed in the operating system, as a third party responsible for obtaining the preset protection object related code and data from the computing component operating system. These data include but are not limited to system startup files, operating system kernel, initialization file system (initramfs), executable files, etc., and send the collected elements to TSB to ensure the trust measurement during the system startup and operation stages.

[0069] Third-party Jprobe: Upgraded Jprobe.

[0070] Reentry: Before the entire Jprobe process is completed, the Jprobe process is nested and executed due to hitting the breakpoint again.

[0071] The TSB agent in the present invention adopts the third-party Jprobe mechanism to realize the collection of trusted measurement elements. The third-party Jprobe mechanism provides a method for dynamically inserting tracking points without relying on the kernel symbol table, which is a means to solve the LSM adaptation problem. The third-party Jprobe allows the dynamic insertion or removal of tracking points without recompiling the kernel to monitor and analyze kernel behavior. The following is a detailed description of its principle and process.

[0072] principle: 1. Dynamic tracing: The third-party Jprobe allows dynamic insertion and removal of monitoring points without restarting the system. These monitoring points can be placed at the entry or exit points of kernel functions. First, determine the monitoring points, define the kernel functions to be monitored and the processing functions executed when these functions are called. Use the kernel build system to compile the Jpobe kernel module, which is automatically loaded when the system starts. After the module is loaded, it automatically starts monitoring the specified kernel function. If you need to stop monitoring, you can uninstall the Jprobe module and remove the monitoring points.

[0073] 2. Function interception: By setting up a third-party Jprobe at the entry and exit of key kernel functions, that is, adding the logic of collecting elements and recording logs required by the TSB agent in the entry function, and adding the logic of recording element execution result logs in the exit function, the TSB agent can intercept the execution of these functions and perform customized security checks.

[0074] 3. Event processing: When the kernel executes to the third-party Jprobe monitoring point, it will call the processing functions registered by the TSB agent. These processing functions can perform security checks, log records and other operations.

[0075] 4. No symbol table required: Third-party Jprobe does not rely on the kernel symbol table, so it can be used in systems that do not export the kernel symbol table, which helps solve the problem of symbol table not being exported in high-version operating systems.

[0076] 5. Flexibility and scalability: TSB agent can flexibly add or remove third-party Jprobes to adapt to different security requirements and monitoring strategies.

[0077] process: 1. Determine the monitoring points: Determine the kernel functions that need to be monitored. These functions may be security-sensitive operations, such as file access, network communication, etc.

[0078] 2. Write processing functions: Write custom processing functions that will be executed when the third-party Jprobe is triggered. These processing functions will contain security check logic.

[0079] 3. Register a third-party Jprobe: Register Jprobe in the TSB agent module, specify the monitored kernel function address and the custom processing function.

[0080] 4. Load TSB proxy module: Load the TSB proxy module into the kernel and the third-party Jprobe will be activated.

[0081] 5. Kernel execution monitoring function: When the kernel executes the monitored function, the third-party Jprobe is triggered.

[0082] 6. Execute TSB agent processing function: The processing function of TSB agent is called to perform operations such as security checks and logging.

[0083] 7. Decision and response: Based on the inspection results of the processing function, the TSB agent can decide whether to allow the operation to continue, or take other security response measures.

[0084] 8. Logging and auditing: TSB agent can record security-related events for post-audit and analysis.

[0085] By using the third-party Jprobe TSB agent, dynamic monitoring and security control of the operating system can be achieved without relying on the kernel symbol table. The present invention provides a flexible and effective way to enhance the security of the system, especially in operating system environments that do not export the kernel symbol table for security reasons.

[0086] In order to make Jprobe suitable for TSB proxy module and realize its functions, it is necessary to transform and optimize it based on the first-party Jprobe, which mainly includes the following two aspects.

[0087] 1. Solve the reentrancy problem Because the first party Jprobe and Kprobe are tightly coupled, their state information is stored in the global Kprobe control block. And this control block is exactly the root cause that Kprobe may cause reentry. The Kprobe control block provides context information for the Jprobe currently being processed, and Jprobe needs the guidance of these information to return to the track before the Jprobe user function is executed, and also needs these information to restore the stack and CPU registers. In order to solve the problem of high coupling and reentry simultaneously, the present invention transmits context information by stack. Therefore how to safely use the stack and restore the stack data afterwards is exactly the core problem of the present invention.

[0088] The new design of the present invention satisfies the following conditions at the same time: 1. Use the stack to transfer context information. 2. Do not destroy the original stack data. 3. Be able to calculate the address of the context information by a certain method.

[0089] In order to meet the above conditions at the same time, the third-party Jprobe will reallocate the entire stack space and align the new stack to the 16K address boundary. In this way, the new stack bottom address can always be obtained simply by masking the value of the SP register. The context information is fixedly stored here. The introduction of this solution will lead to three additional steps: 1. At the beginning of the Jprobe process, new stack space is allocated and the context information is placed at the bottom of the stack.

[0090] 2. In the context of the int3 exception interrupt, the contents of the original stack pointer register SP need to be modified to dynamically switch the stack to the newly allocated space. Save the current stack pointer; set the stack pointer to the top of the newly allocated stack; clean up the top of the new stack to ensure that there is no garbage data; return to the handler and continue execution.

[0091] 3. After the Jprobe process ends, the newly allocated space needs to be released, otherwise it will cause memory leaks.

[0092] 2. Solve the problem of being unable to control whether to continue executing the original function 1. Need to return to the original execution thread jprobe_return is a macro used to call in the return processing function (post_handler) of Jprob. The function of this macro is to process specific operations on the return path after the Jprobe monitoring function is executed. If you want to return to the original execution thread and continue to execute the interrupted function, you need to call the jprobe_return function, which is a special function implemented for this purpose. This function obtains the value of the SP register through inline assembly code, and then calculates the current stack bottom address through this value, takes out the Jprobe context information from this address, and determines whether it can continue safely based on whether the context information can be successfully parsed. If everything goes well, the int3 interrupt will be directly called through inline assembly, thereby entering the int3 exception handling process again.

[0093] In the process of int3 exception handling, it is still necessary to obtain the Jprobe context information through the value of the SP register, and restore the original stack content and CPU register content at this stage. Since the CPU register contains the SP register, the current stack is also switched back to the original stack space. After that, the single-step flag is set for the interrupted instruction, and the original instruction is ready to be executed in a single step.

[0094] After the single-step execution is completed, the current CPU automatically enters the single-step debugging exception interrupt. In the interrupt processing function, the global Jprobe table is searched through the address of the CPU's interrupt priority register (IP) to determine which Jprobe processing process is currently in. After confirming the current Jprobe, its underlying Kprobe structure is obtained through the Jprobe registration information, and the original Kprobe's plug-in address is obtained through the Kprobe structure. After calculating the new IP register address through the following formula, the IP register is set to point to this address, and the single-step exception interrupt processing is completed.

[0095] Kprobe->addr+IP+kprobe->copied_ip–1 Among them, Kprobe->addr is the starting address of the kernel function monitored by kprobe; IP is the address of the currently executed instruction; kprobe->copied_ip-1 is the exact address of the kprobe breakpoint.

[0096] 2. No need to return to the original execution thread If the user function determines that there is no need to return to the original execution thread, the newly added special function jprobe_done will complete it. jprobe_done is used to indicate the end of a Jprobe process. The jprobe_done macro is called after the Jprobe processing function (jprobe->entry or jprobe->exit) is executed. The function of this macro is to tell the kernel that the Jprobe processing function has been executed and the interrupted instructions can be resumed. It needs to complete the following 4 tasks to end the current Jprobe processing process and return to the caller of the original interrupted function.

[0097] 1. Get the value of the current stack pointer (SP) through inline assembly.

[0098] 2. Obtain Jprobe context information through calculation, and use the content saved in the context information to restore the original stack and CPU register values. Jprobe captures the current CPU register and stack information at the entry (pre_handler) of the monitoring function and saves it in a context structure. At the exit (post_handler) of the monitoring function, Jprobe uses the saved context information to restore the CPU register and stack to ensure that the function can be correctly returned to the caller after execution. This process allows Jprobe to monitor the execution of the function without affecting the original behavior of the function and the stability of the system.

[0099] 3. Set the return value for the base register (BX) to pass the data returned by the user function.

[0100] 4. Release the temporary stack.

[0101] This function uses assembly code to complete most of the work, especially modifying the stack frame and directly returning to the original caller. No matter what value the user function returns, the original interrupted function will not be called, thereby realizing the TSB proxy control function.

[0102] The technical problems solved by the present invention include: 1. In order to be applicable to TSB agents and realize the trusted measurement element collection and control functions, the present invention optimizes the first-party Jprobe: (1) It solves the problem that the first-party Jprobe cannot decide whether to continue to execute the original function. (2) It solves the problem that the first-party Jprobe cannot be reentrant.

[0103] 2. Reduce the dependence on kernel versions, solve the compatibility issues of TSB agents in multiple operating systems, and improve the scope of technical application.

[0104] In addition, in the accompanying drawings of the present invention, Figure 4 The first-party Jprobe workflow in includes: Hit the Kprobe detection point - call the Jprobe framework function to prepare the environment for executing the replacement function - save the original SP register content to the context information block - back up the last 64 bytes of the original stack content to the context information block - modify the IP register to point to the user-defined Jprobe replacement function - return 1 to inform Kprobe that the content of the IP register has changed - Kprobe remains in the enabled state and ends the current exception handling - the user Jprobe replacement function starts executing on the original stack - call the Jprobe_return function to return to the original execution thread - the Jprobe_return function The int3 interrupt is called - the breakpoint exception handling process is re-entered - the memory interval where the IP register value is located determines whether the exception is caused by Jprobe_return - all CPU registers are restored, including the SP register, and the stack address is restored to the state before the replacement function is executed - the last 64 bytes of the original stack are restored from the Kprobe global variable - the single-step execution flag is set for the first instruction of the original detection function, and the breakpoint exception handling is ended - Kprobe executes the original detection function as usual - Kprobe resets the global variable, releases the occupied flag, and can process the next Kprobe - the execution track returns to the original detection function.

[0105] Figure 5-Figure 7 The third-party Jprobe workflow in includes: Hitting the Kprobe detection point - calling the Jprobe framework function to prepare the environment for executing the replacement function - calculating the stack size required for the current context environment - allocating stack space - aligning the stack space to the 32K boundary - installing the context information block at the bottom of the new stack space - adding a magic number identifier to the context - copying the original stack information to the newly allocated stack space - saving the original SP register content to the context information block - modifying the SP register to point to the top of the new stack - modifying the IP register to point to the user-defined Jprobe replacement function - returning 1 to inform Kprobe that the content of the IP register has changed - Kprobe ends the exception handling process early and resets the current CPU's current_kprobe global variable - the user Jprobe replacement function starts running on the new stack space - after the replacement function is executed, determine whether the original detection function needs to be executed.

[0106] If the original detection function needs to be executed, call the jprobe_return function to return to the original execution clue - jprobe_return will call the int3 interrupt - re-enter the breakpoint exception handling process - perform a bitwise AND operation on the SP value in the CPU register snapshot and the result of the inversion of (32K-1) to obtain the stack address, and obtain the address of the context information based on this address - restore all CPU registers, including the SP register, and switch back to the original stack space - release the temporary stack space - set the single-step execution flag for the first instruction of the original detection function, and end the breakpoint exception handling - Kprobe executes the original detection function as usual - the execution track returns to the original detection function.

[0107] If the original detection function does not need to be executed, call the Jprobe_done function to end the current Jprobe process - perform a bitwise AND operation on the SP value in the CPU register snapshot and the result of the inversion of (32K-1) to obtain the stack address, and obtain the address of the context information based on this address - save the return value passed by the user replacement function in the AX register (x86 ABI) - if there is a backup in the context information block, restore the original stack content - restore the SP register content from the saved value of the context, and now the stack frame switches to the calling function of the detected function - restore other registers saved by the called function as specified by the ABI - release the temporary stack space - return like a normal function, the original detection function will not be executed.

[0108] Figure 5 The line segment ① and Figure 6 The line segment ① is connected, Figure 6 The line segments ② and ③ in Figure 7 Connect line segments ② and ③ in .

[0109] The present invention provides a trusted measurement element acquisition control method based on third-party Jprobe technology, including: The third-party Jprobe technology is used to implement the system call of the Trusted Software Base (TSB) agent to collect the measurement elements of the process; the system call behavior is intercepted by the third-party Jprobe technology, and sent to the measurement engine of TSB according to the intercepted subject / object information elements; the measurement engine calls specific measurement operations, calculates the baseline value, and compares it with the baseline value in the baseline library; the measurement results are returned to the TSB agent control mechanism to achieve control over the process.

[0110] The present invention provides a method for solving the problem that Jprobe cannot be reentered, comprising: Calculate the stack size required for the current context environment and dynamically allocate temporary stack space for each instance to solve the problem that Jprobe cannot be reentrant; install the context information block at the bottom of the new stack space; copy the original stack information to the newly allocated stack space; save the contents of the original SP register to the context information block; modify the SP register to point to the top of the new stack to switch the stack.

[0111] The present invention provides a method for preventing an interrupted function from resuming execution, comprising: Define a special function jprobe_done, which triggers a breakpoint exception by calling the int3 (to enhance compatibility with kernel versions, the third-party Jprobe is compatible with both int3 and int1 breakpoint exceptions) soft interrupt; obtain the address of the bottom of the stack based on the value of the stack pointer (SP) in the CPU register snapshot, and thus obtain the address of the context information; save the return value passed by the user replacement function in the AX register (in a 64-bit system, the AX register is used to store and pass function return values); restore the stack content; restore the stack pointer (SP) register content from the saved value of the context, so that the stack frame switches to the calling function of the probed function; restore all registers required by the called function to be saved by the application binary interface (ABI); release temporary stack space; after releasing the temporary stack space, call return to return to the parent function (the function that originally called the probed function and caused the Kprobe hit), thereby returning directly from the user replacement function to the parent function without executing the original probed function.

[0112] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store static information and dynamic information data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in the above method embodiment are implemented.

[0113] Those skilled in the art will understand that Figure 3The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present invention, and does not constitute a limitation on the computer device to which the scheme of the present invention is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0114] In addition, the present invention also provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiment when executing the computer program.

[0115] In addition, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the above method embodiment are implemented.

[0116] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0117] The present invention is not limited to the structures which have been described above and shown in the drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for realizing the collection and control of trusted static measurement elements, characterized in that: The method includes: By optimizing the parser, a third-party parser is obtained; the third-party parser is registered in the trusted software base agent module, and the monitored kernel function and the custom processing function are determined; the trusted software base agent module is loaded into the kernel of the operating system, and the third-party parser is activated; When the kernel of the operating system executes the monitored kernel function, the third-party parser is triggered, and the custom processing function of the agent in the trusted software base agent module is called; the trusted static measurement elements of the operating system process are collected by using the called custom processing function; The collected trusted static measurement elements are sent to the measurement engine of the trusted software base. According to the comparison results between the benchmark values ​​calculated by the measurement engine and the benchmark values ​​in the benchmark library, and combined with the trusted software base agent control mechanism, the operating system process is controlled.

2. A method for realizing collection and control of trusted static measurement elements according to claim 1, characterized in that: The third-party parser obtained by optimizing the parser includes: Utilize the stack to pass context information to optimize the parser for reentrancy issues; The parser is optimized so that it cannot control whether it needs to return to the original execution thread.

3. A method for realizing collection and control of trusted static measurement elements according to claim 2, characterized in that: The mechanism of using the stack to transfer context information to optimize the parser with respect to the reentrancy problem includes: At the beginning of the parser process, new stack space is allocated and the context information is placed at the bottom of the new stack space; When an exception occurs, the original stack is dynamically switched to the new stack space by modifying the content of the original stack pointer register; After the parser process ends, the new stack space is freed.

4. A method for realizing collection and control of trusted static measurement elements according to claim 3, characterized in that: When an abnormal interrupt occurs, dynamically switching the original stack to a new stack space by modifying the content of the original stack pointer register comprises: Set the original stack pointer to the top of the new stack space and clean up the top of the new stack space; return to the handler and continue execution.

5. The method for realizing the collection and control of trusted static measurement elements according to claim 2, characterized in that: The optimization of the problem that the parser cannot control whether it needs to return to the original execution thread further includes: According to the user function, determine whether the parser needs to return to the original execution thread; When it is necessary to return to the original execution thread, the return processing function is called to return to the original execution thread; When there is no need to return to the original execution thread, the end processing function is called to end the current parser process.

6. A method for realizing collection and control of trusted static measurement elements according to claim 5, characterized in that: When it is necessary to return to the original execution thread, calling the return processing function to return to the original execution thread includes: Use the return processing function and inline assembly code to get the value of the register; according to the value of the register, get the current stack bottom address, and fetch the parser context information from the current stack bottom address; The inline assembly is used to call the breakpoint interrupt and enter the exception handling process. During the exception handling process, the current stack is switched back to the original stack space according to the parser context information, and the interrupted instruction is set as the single-step flag, and the original instruction is executed in a single-step manner. After the single-step execution of the original instruction is completed, the current CPU automatically enters the single-step debugging exception interrupt stage; In the single-step debugging abnormal interrupt stage, the global parser table is searched through the address of the interrupt priority register of the central processing unit to determine the current parser; The corresponding underlying kernel debugging tool structure is obtained through the current parser registration information, and the kernel debugging tool plug-in address is obtained through the kernel debugging tool structure; According to the stub address of the kernel debugging tool, a new IP register address is obtained, and the IP register is made to point to the new IP register address, so that the single-step exception interrupt processing ends and returns to the original execution thread.

7. A method for realizing collection and control of trusted static measurement elements according to claim 5, characterized in that: The calling end processing function to end the current parser process includes: After the parser processing function is executed, the end processing function is called, and the parser processing function execution completion information is sent to the operating system kernel; after completing the preset work, the current parser process is ended.

8. The method for realizing collection and control of trusted static measurement elements according to claim 7, characterized in that: The pre-set tasks include: Get the current stack pointer value through inline assembly; According to the parser context information, the CPU registers and stack are restored, and the parser monitor function is executed and correctly returns to the caller; Set the return value to the base register; free the temporary stack.

9. A system for realizing the collection and control of trusted static measurement elements, characterized in that: The system includes: A third-party tool building module is used to obtain a third-party parser by optimizing the parser; register the third-party parser into the trusted software base agent module, and determine the monitored kernel function and the custom processing function; load the trusted software base agent module into the kernel of the operating system, and activate the third-party parser; The measurement element collection module is used to trigger the third-party parser when the kernel of the operating system executes the monitored kernel function, and call the custom processing function of the agent in the trusted software base agent module; collect the trusted static measurement elements of the operating system process by using the called custom processing function; The process control module is used to send the collected trusted static measurement elements to the measurement engine of the trusted software base, and control the process of the operating system based on the comparison results of the benchmark values ​​calculated by the measurement engine and the benchmark values ​​in the benchmark library, combined with the trusted software base agent control mechanism.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images