Remote attestation method and device and related equipment

Abstract

The invention provides a remote attestation method and device and related device.First computing equipment has a trusted execution environment, a registration agent component and an application are deployed in the trusted execution environment, and the first computing equipment runs the registration agent component in the trusted execution environment before loading the application. Acquiring a certificate provided by a challenge direction registration agent component; the certificate is generated by the challenger after the remote certification report provided by the registration agent component passes the verification of the challenger; a first computing device configures a certificate and a private key for an application through a registration proxy component, the certificate and the private key being used to establish an encrypted channel between the application and a client. According to the method, the remote certification and the logic for acquiring the certificate and the private key are completed by the independent registration agent component, and the remote certification of the application can be realized under the condition that the existing application is not modified.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a remote certification method, device and related equipment. Background Art

[0002] In confidential computing technology, confidential virtual machines serve as carriers of trusted execution environments (TEEs), allowing users to publish existing applications to confidential virtual machines without modification. However, applications still need to be able to implement remote attestation in trusted execution environments to support clients in checking the trusted state of trusted execution environments and establishing encrypted secure channels between clients and applications. However, currently, when applications are deployed to trusted execution environments without modification, they cannot implement the above-mentioned remote attestation and establish encrypted channels with clients. Summary of the invention

[0003] The present application provides a remote attestation method, apparatus and related equipment, which can complete the logic of remote attestation and obtaining certificates and private keys in confidential computing with a separate registration agent component, thereby realizing remote attestation of applications without modifying existing applications.

[0004] In a first aspect, the present application provides a remote attestation method, which is applied to a first computing device, the first computing device having a trusted execution environment, in which a registration agent component and an application are deployed, the method comprising: before loading the application deployed in the trusted execution environment, the first computing device runs the registration agent component to obtain a certificate provided by the challenging party to the registration agent component; the certificate is generated after the challenging party verifies that a remote attestation report provided by the registration agent component has passed; the first computing device configures the above-mentioned certificate and private key for the application through the registration agent component, and the certificate and private key are used to establish an encrypted channel between the application and the client.

[0005] By executing the above method, in confidential computing, the logic of remote attestation and obtaining certificates and private keys can be completed with a separate registration agent component, thereby realizing remote attestation of applications without modifying existing applications.

[0006] In a possible implementation, after the registration agent component configures the certificate and private key for the above application, the first computing device loads the above application in the trusted execution environment, and establishes an encrypted channel between the above application and the client based on the certificate and private key. After the encrypted channel between the application and the client is established based on the certificate and private key, the application and the client can support the client to check the trusted state of the trusted execution environment and the client and the application to communicate through the channel.

[0007] In a possible implementation, it also includes: the first computing device runs a registration agent component in a trusted execution environment, obtains a remote attestation challenge sent by a challenger, and the remote attestation challenge includes a random number (numberonce, nonce); the first computing device runs the above-mentioned registration agent component, obtains a remote attestation report of the registration agent component based on the random number in the remote attestation component, and provides the remote attestation report of the registration agent component to the challenger.

[0008] After the first computing device runs the registration agent component in the trusted execution environment, the registration agent component will receive a remote attestation challenge from the challenger. For example, the registration agent component initiates a registration request to the challenger, and the challenger sends a remote attestation challenge to the registration agent component to obtain the remote attestation report of the registration agent component to verify the registration agent component. Adding random numbers to the remote attestation challenge can improve the security of the remote attestation.

[0009] In one possible implementation, the above-mentioned method of obtaining a remote attestation report of a registration agent component based on a random number includes: a first computing device runs a registration agent component to generate a first asymmetric key pair, and obtains a remote attestation report of the registration agent component based on the above-mentioned random number and a first public key in the first asymmetric key pair, wherein the above-mentioned first asymmetric key pair includes a first public key and a first private key.

[0010] In one possible implementation, the above-mentioned remote attestation report of the registration agent component based on the random number includes: the first computing device runs the registration agent component to generate a first asymmetric key pair, the first asymmetric key pair includes a first public key and a first private key; the first computing device runs the registration agent component, and generates a certificate signing request (certificate signing request, CSR) of the registration agent component based on the first asymmetric key pair; the first computing device runs the registration agent component, and obtains the remote attestation report of the registration agent component based on the random number and the CSR.

[0011] In a possible implementation, the private key is the first private key of the first asymmetric key pair; or, the private key is generated and provided to the registration agent component after the challenger verifies that the remote attestation report of the registration agent component is passed.

[0012] In one possible implementation, the challenger is a certificate service component run by a first computing device, and the certificate service component is deployed in the normal world of the first computing device. The method further includes: the first computing device runs the certificate service component, and generates the certificate and private key when verifying that the remote attestation report of the registration agent component passes; the first computing device runs the certificate service component to generate a symmetric key, and obtains the first public key of the first asymmetric key pair carried in the remote attestation report of the registration agent component; the first computing device runs the certificate service component, and encrypts the certificate and private key using the symmetric key to obtain a first summary; then the first computing device runs the certificate service component, and encrypts the symmetric key using the first public key to obtain a second summary; the first computing device runs the certificate service component, and provides the first summary and the second summary to the registration agent component.

[0013] In a possible implementation, the method further includes: the first computing device runs a registration agent component to decrypt the second summary using the first private key to obtain the symmetric key, and then decrypts the first summary using the symmetric key to obtain the certificate and private key.

[0014] In a possible implementation, it also includes: the first computing device runs the certificate service component and sends the CSR of the certificate service component to the verification party; the first computing device runs the certificate service component and receives the certificate issued by the verification party to the certificate service component, and the certificate of the certificate service component is generated by the verification party when the CSR of the certificate service component is verified to be passed.

[0015] In one possible implementation, the challenging party is a verifier, for example, the Verifier may be a certificate authority (CA); or the challenging party is a second computing device, which can implement the function of the certificate service component, that is, the second computing device can pass the verification of the verifier by executing the function of the certificate service component.

[0016] In a second aspect, the present application provides a remote attestation method, including: the challenger initiates a remote attestation challenge to a registration agent component running in a trusted execution environment of a first computing device; wherein the registration agent component and an application are deployed in the trusted execution environment of the first computing device; after verifying that the remote attestation report of the registration agent component has passed, the challenger provides a certificate to the registration agent component so that the registration agent component configures the certificate for the above-mentioned application; the above-mentioned remote attestation report is provided to the challenger by the registration agent component in response to the above-mentioned remote attestation challenge, and the certificate is used to establish an encrypted channel between the application and the client based on the certificate and private key when the first computing device loads the application in the trusted execution environment.

[0017] In a possible implementation, the method further includes: the challenger provides a private key to the registration agent component, where the private key is generated by the challenger after verifying that the remote attestation report of the registration agent component is passed.

[0018] In a possible implementation, the method further includes: when verifying that the remote attestation report is passed, the challenger generates the certificate and the private key; and generates a symmetric key to obtain the first public key in the remote attestation report of the registration agent component; then the challenger uses the symmetric key to encrypt the certificate and the private key to obtain a first summary; uses the first public key to encrypt the symmetric key to obtain a second summary; the challenger provides the private key to the registration agent component of the first computing device, including: the challenger provides the first summary and the second summary to the registration agent component.

[0019] In one possible implementation, before the challenger initiates a remote attestation challenge from a registration agent component running in a trusted execution environment of a first computing device, the method further includes: the challenger sends a certificate signing request CSR of the challenger to the verifier; the challenger receives the certificate of the challenger issued by the verifier, wherein the certificate of the challenger is generated by the verifier when the CSR of the challenger is verified to be successful.

[0020] In a third aspect, the present application provides a remote verification method, which is applied to a system including a registration agent component and a challenger, wherein a first computing device has a trusted execution environment, and an application and the above-mentioned registration agent component are deployed in the trusted execution environment of the first computing device, the method comprising: the challenger initiates a remote attestation challenge to the registration agent component running in the trusted execution environment of the first computing device; the first computing device obtains a certificate provided by the challenger to the registration agent component, and then configures a certificate and a private key for the application through the registration agent component, wherein the certificate is generated after the challenger verifies that a remote attestation report provided by the registration agent component is passed; wherein the above-mentioned certificate and private key are used to establish an encrypted channel between the application and the client when the computing device loads the application in the trusted execution environment.

[0021] In a possible implementation, the method further includes: the first computing device loads the application in a trusted execution environment, and establishes an encrypted channel between the application and the client based on the certificate and the private key.

[0022] In a possible implementation, the above method also includes: the challenger initiates a remote attestation challenge to the registration agent component; the remote attestation challenge includes a random number; the registration agent component obtains a remote attestation report of the registration agent component based on the above random number, and provides the remote attestation report of the registration agent component to the challenger.

[0023] In one possible implementation, the first computing device obtains a remote attestation report using the random number, including: the first computing device runs a registration agent component to generate a first asymmetric key pair, the first asymmetric key pair includes a first public key and a first private key; the first computing device runs the registration agent component, and obtains a remote attestation report based on the random number and the first public key.

[0024] In one possible implementation, the first computing device obtains a remote attestation report based on a random number, including: the first computing device runs a registration agent component to generate a first asymmetric key pair, the first asymmetric key pair includes a first public key and a first private key; the first computing device runs a registration agent component to generate a certificate signing request CSR for the computing device based on the first asymmetric key pair; the first computing device runs the registration agent component to obtain a remote attestation report based on the random number and the CSR.

[0025] In a possible implementation, the private key is the first private key; or, the private key is generated and provided to the registration agent component after the challenger verifies the remote attestation report.

[0026] In a possible implementation, when the private key is generated by the challenging party, the method further includes: when verifying that the remote attestation report is passed, the challenging party generates the certificate and the private key; and generates a symmetric key to obtain the first public key in the remote attestation report of the registration agent component; then the challenging party uses the symmetric key to encrypt the certificate and the private key to obtain a first summary; uses the first public key to encrypt the symmetric key to obtain a second summary; the challenging party provides the private key to the registration agent component of the first computing device, including: the challenging party provides the first summary and the second summary to the registration agent component.

[0027] In a possible implementation, the method further includes: the registration agent component decrypts the second summary using the first private key to obtain the symmetric key; the registration agent component decrypts the first summary using the symmetric key to obtain the certificate and the private key.

[0028] In a possible implementation, the challenging party is a verifying party.

[0029] In one possible implementation, the challenger is a certificate service component, and the certificate service component and the registration agent component are located on the same computing device, or the certificate service component and the registration agent component are located on different computing devices; wherein, when the certificate service component and the registration agent component are located on the same computing device, the certificate service component is deployed in the regular world of the first computing device.

[0030] In a possible implementation, before the challenger initiates a remote attestation challenge to the registration agent component, the method further includes: the challenger sends the challenger's remote attestation report to the verifier; the challenger receives the certificate sent by the verifier to the challenger, and the certificate sent by the verifier to the challenger is generated by the verifier when the remote attestation report of the challenger is verified to be passed.

[0031] In a fourth aspect, the present application provides a remote attestation device, including an application and a registration agent component, wherein the registration agent component and the application are deployed in a trusted execution environment, and the registration agent component is used to: obtain the certificate provided by the challenging party to the registration agent component before the application is started; the certificate is generated after the challenging party verifies the remote attestation report provided by the registration agent component; configure the certificate and private key for the application, and the certificate and private key are used to establish an encrypted channel between the application and the client.

[0032] In a possible implementation, the application is used to establish an encrypted channel between the application and the client based on the certificate and the private key.

[0033] In one possible implementation, the registration agent component is also used to: obtain a remote attestation challenge sent by a challenger, the remote attestation challenge including a random number, obtain a remote attestation report of the registration agent component based on the random number in the remote attestation challenge, and provide the remote attestation report of the registration agent component to the challenger.

[0034] In a possible implementation, the above-mentioned registration agent component is specifically used to: generate a first asymmetric key pair, and obtain a remote attestation report of the registration agent component based on the above-mentioned random number and the first public key in the first asymmetric key pair, wherein the above-mentioned first asymmetric key pair includes a first public key and a first private key.

[0035] In one possible implementation, the above-mentioned registration agent component is specifically used to: generate a first asymmetric key pair, generate a CSR of the registration agent component based on the first asymmetric key pair, and obtain a remote attestation report of the registration agent component based on a random number and the CSR, wherein the first asymmetric key pair includes a first public key and a first private key.

[0036] In a possible implementation, the private key is the first private key of the first asymmetric key pair; or, the private key is generated and provided to the registration agent component after the challenger verifies that the remote attestation report of the registration agent component is passed.

[0037] In a possible implementation, the remote attestation device further includes a certificate service component, which is used to: generate a certificate and a private key when the remote attestation report of the registration agent component is verified to be passed; generate a symmetric key to obtain the first public key in the remote attestation report of the registration agent component; encrypt the certificate and the private key using the symmetric key to obtain a first summary; encrypt the symmetric key using the first public key to obtain a second summary; and provide the first summary and the second summary to the registration agent component.

[0038] In a possible implementation, the registration agent component is further used to: use the first private key to decrypt the second digest to obtain the symmetric key, and then use the symmetric key to decrypt the first digest to obtain the certificate and the private key.

[0039] In one possible implementation, the remote attestation device further includes a communication module, which is used to: send the CSR of the certificate service component to the verification party; receive the certificate issued by the verification party to the certificate service component; wherein the certificate of the certificate service component is generated by the verification party when the CSR of the certificate service component is verified to be passed.

[0040] In one possible implementation, the challenging party is a verifier, for example, the Verifier may be a certificate authority (CA); or the challenging party is a second computing device, which can implement the function of the certificate service component, that is, the second computing device can pass the verification of the verifier by executing the function of the certificate service component.

[0041] In a fifth aspect, the present application provides a remote attestation device, comprising:

[0042] A processing module, configured to initiate a remote attestation challenge to a registration agent component running in a trusted execution environment of a first computing device; the registration agent component and an application are deployed in the trusted execution environment of the first computing device;

[0043] a communication module for sending a remote attestation challenge to the first computing device;

[0044] The processing module is further used to generate a certificate of the registration agent component when verifying that the remote attestation report of the registration agent component passes, so that the registration agent component configures the above certificate for the application, the above remote attestation report is provided to the challenger by the registration agent component in response to the remote attestation challenge, and the certificate is used to establish an encrypted channel between the application and the client based on the certificate and the private key when the first computing device loads the application in the trusted execution environment;

[0045] The communication module is further configured to send the certificate to the first computing device.

[0046] In a sixth aspect, the present application provides a computing device comprising a processor and a memory, wherein the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, the method described in the first aspect or any possible implementation of the first aspect is implemented.

[0047] In a seventh aspect, the present application provides another computing device, comprising a processor and a memory, wherein the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, it implements the method described in the second aspect or any possible implementation of the second aspect.

[0048] In an eighth aspect, the present application provides a computer program product, which, when running on a server, enables a computing device to execute the method described in the first aspect or any possible implementation of the first aspect; or, execute the method described in the second aspect or any possible implementation of the second aspect.

[0049] In the ninth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a computing device, the computing device executes the method described in the first aspect or any possible implementation of the first aspect; or, executes the method described in the second aspect or any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0051] Figure 1 is a schematic diagram of a system for implementing remote verification provided by an embodiment of the present application;

[0052] Figure 2 is a schematic diagram of another system for implementing remote verification provided by an embodiment of the present application;

[0053] Figure 3 It is an interactive schematic diagram of a remote verification method provided by an embodiment of the present application;

[0054] Figure 4 is a schematic diagram of another system for implementing remote verification provided by an embodiment of the present application;

[0055] Figure 5 is a schematic diagram of another system for implementing remote verification provided by an embodiment of the present application;

[0056] Figure 6 is a schematic diagram of a remote certification device provided in an embodiment of the present application;

[0057] Figure 7 is a schematic diagram of another remote certification device provided in an embodiment of the present application;

[0058] Figure 8 It is a schematic diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0060] Confidential computing can make the security of applications independent of the underlying software stack by separating resource management and resource access control. Currently, confidential computing technology is mainly developed in the direction of compatibility with existing applications. For example, using confidential virtual machines as the carrier of trusted execution environment (TEE), it can support users to publish existing applications to confidential virtual machines without modification and run them.

[0061] Although confidential virtual machines support the running of existing applications in a trusted execution environment without modification, applications still need to be able to implement remote verification in a trusted execution environment to support clients to check the trusted state of the trusted execution environment and to establish an encrypted secure channel between the client and the application. However, currently, when an application is deployed to a trusted execution environment without modification, the application cannot implement the above remote verification and establish an encrypted channel with the client.

[0062] The embodiment of the present application provides a remote attestation method, which can implement remote verification of an existing application after it is deployed to a trusted execution environment without modification, and establish an encrypted channel between the existing application and a client based on the result of the remote verification.

[0063] like Figure 1 As shown, Figure 1This is a schematic diagram of a system for implementing remote attestation provided by an embodiment of the present application. The system includes a first computing device and a challenger. The first computing device has a trusted execution environment. For example, a confidential virtual machine is used as a carrier of the trusted execution environment. In the case where an application needs to be loaded in a trusted execution environment, the first computing device first runs a registration agent component in the trusted execution environment, and obtains a certificate from the challenger through the registration agent component. The first computing device then configures the certificate and private key for the application through the registration agent component, thereby completing the remote attestation of the application. The private key can be a private key in an asymmetric key pair generated by the first computing device running the registration agent component, or it can be a private key provided to the registration agent component after the challenger generates the private key. It should be noted that the application needs to be packaged and released together with the registration agent component.

[0064] After implementing remote attestation through the registration agent component, the first computing device loads the above application in the TEE and establishes an encrypted channel between the application and the client based on the above certificate and private key. For example, an encrypted channel between the application and the client is established through the standard Transport Layer Security (TLS) protocol and the above certificate and private key.

[0065] The above-mentioned challenger may be a Verifier, for example, the Verifier may be a Certificate Authority (CA). The above-mentioned challenger may also be a component running in a computing device, which is referred to as a certificate service component in the embodiment of the present application. The computing device has the function of verifying and issuing certificates by running the certificate service component. It should be noted that before acting as a challenger, the certificate service component needs to apply for registration with the Verifier, and can only act as a challenger after obtaining a certificate issued by the Verifier.

[0066] The computing device running the certificate service component may be the first computing device mentioned above, or a computing device different from the first computing device mentioned above. In the case where the computing device running the certificate service component is the first computing device mentioned above, the registration agent component runs in the TEE, and the certificate service component runs in the normal world.

[0067] Through the above method, the logic of remote attestation and obtaining certificates and private keys is completed in a separate registration agent component, which can realize remote attestation and establish an encrypted channel with the client without modifying the existing application.

[0068] The following takes the above-mentioned challenger as a computing device that can run the above-mentioned certificate service component and is a second computing device different from the above-mentioned first computing device as an example to describe in detail the remote attestation method provided by the embodiment of the present application. Figure 2 As shown, Figure 2 It is a schematic diagram of another system for implementing remote verification provided by an embodiment of the present application, the system comprising a first computing device, a second computing device and a verifier. The first computing device has a TEE, and the above-mentioned registration agent component and application can run in the TEE; the above-mentioned second computing device can run the above-mentioned certificate service component.

[0069] The following is combined with the above Figure 2 The remote certification method provided by the embodiment of the present application is described in detail. Figure 3 As shown, Figure 3 1 is an interactive diagram of a remote attestation method provided in an embodiment of the present application. The remote attestation method includes the following S301 to S307.

[0070] S301. The second computing device sends a message for applying for a certificate to the verification party.

[0071] The second computing device runs the above-mentioned certificate service component, generates a second asymmetric key pair, and generates a certificate signing request (CSR) of the second computing device based on the second asymmetric key pair, and sends a message carrying the CSR of the second computing device to the verifier, which is used to apply for a certificate from the Verifier.

[0072] S302. Upon approval of the application of the second computing device, the verifier generates a certificate for the second computing device and sends it to the second computing device.

[0073] The verifier verifies the CSR carried in the message sent by the second computing device. If the CSR passes the verification, the verifier generates a certificate for the second computing device and sends the certificate of the second computing device to the second computing device. After receiving the certificate sent by the verifier, the second computing device has the function and authority of remote verification and certificate issuance.

[0074] S303. The first computing device runs a registration agent component in the TEE and sends a registration request to the second computing device.

[0075] Before running the application in the TEE, the first computing device needs to run the registration agent component in the TEE, generate a registration request, and send the registration request to the second computing device. The registration request is used to request the second computing device to obtain the certificate of the registration agent component. The registration request includes the universally unique identifier (UUID) of the above application, TEE type and other information.

[0076] S304. After receiving the registration request sent by the first computing device, the second computing device initiates a remote attestation challenge to the registration proxy component.

[0077] After receiving the registration request sent by the first computing device, the second computing device sends a remote attestation challenge to the registration proxy component, where the remote attestation challenge includes a random number (number once, nonce).

[0078] S305. After receiving the remote attestation challenge, the first computing device runs the registration agent component to obtain a remote attestation report, and sends the remote attestation report to the second computing device.

[0079] After the first computing device receives the remote attestation challenge, it generates a first asymmetric key pair through the registration agent component, and the first asymmetric key pair includes a first private key and a first public key. Then, based on the above random number and the first public key in the first asymmetric key pair generated by the registration agent component, the interface function for obtaining the remote attestation report is called to obtain the remote attestation report of the registration agent component. For example, the registration agent component calls the interface function for obtaining the remote attestation report, takes the above random number and the first public key as inputs of the interface function, or takes the hash value of the string composed of the above random number and the first public key as inputs of the interface function, to obtain the remote attestation report of the registration agent component.

[0080] In a possible implementation, the first computing device can also generate a CSR of the registration agent component, and the registration agent component can also obtain a remote attestation report of the registration agent component based on the random number and the CSR of the registration agent component as inputs of the interface function, and then send the remote attestation report of the registration agent component and the CSR of the registration agent component to the second computing device.

[0081] S306. When the remote attestation report passes verification, the second computing device generates a certificate of the registration agent component and sends the certificate of the registration agent component to the first computing device.

[0082] After receiving the remote attestation report of the registration agent component sent by the first computing device, the second computing device verifies the remote attestation report of the registration agent component. If the remote attestation report of the registration agent component passes the verification, the second computing device issues a certificate for the registration agent component, that is, generates a certificate of the registration agent component, and sends the certificate of the registration agent component to the first computing device.

[0083] It should be understood that if in the above S305, the first computing device also sends the CSR of the registration agent component to the second computing device, then the second computing device also needs to verify the integrity of the CSR of the registration agent component, and issue a certificate to the registration agent component if both the remote attestation report and the CSR of the registration agent component pass the verification.

[0084] In a possible implementation, the second computing device may also generate a symmetric key and a third asymmetric key pair, the third asymmetric key pair including a third public key and a third private key. The second computing device then encrypts the certificate of the registration agent component and the third private key in the third asymmetric key pair generated by the second device with the symmetric key to obtain the first digest; and encrypts the symmetric key generated by the second computing device with the first public key carried in the remote attestation report to obtain the second digest. Finally, the second computing device sends the first digest and the second digest to the first computing device.

[0085] S307. After the first computing device obtains the certificate of the registration agent component, it configures the certificate and private key of the registration agent component for the application.

[0086] After the first computing device obtains the certificate of the registration agent component sent by the second computing device, the registration agent component is configured to the above-mentioned application that needs to run in the TEE through the registration agent component, and a private key is configured for the application, thereby completing the remote certification of the application. If the second computing device does not send a private key to the first computing device, the private key configured for the application is the private key in the asymmetric key pair generated by the first computing device running the registration agent component in S305, that is, the above-mentioned first private key.

[0087] In a possible implementation, if the second computing device sends the certificate of the registration agent component to the first computing device in the form of the first digest and the second digest in S306. The first computing device decrypts the second digest using the first private key in the first asymmetric key pair generated in S305 to obtain the symmetric key generated by the second computing device; then uses the symmetric key to decrypt the first digest to obtain the certificate of the registration agent component and the private key in the asymmetric key pair generated by the second device, i.e., the third private key. Then, the private key configured for the application is the private key obtained from the first digest, i.e., the third private key.

[0088] Through the above method, the logic of remote attestation and obtaining certificates and private keys is completed in a separate registration agent component, so that remote attestation of applications can be achieved without modifying existing applications.

[0089] After implementing remote attestation of the application through the registration agent component, the first computing device loads the above application in the TEE and establishes an encrypted channel between the application and the client based on the above certificate and private key. For example, an encrypted channel between the application and the client is established through the standard secure transport layer TLS protocol and the above certificate and private key. It should be understood that before the client establishes an encrypted channel with the application, the client needs to download the CA root certificate from the Verifier.

[0090] The above is an example of introducing the remote attestation method provided by the present application embodiment, taking the challenger as a certificate service component, and the certificate service component and the registration agent component are not on the same computing device. In a possible implementation, the certificate service component and the registration agent component may also be located on the same computing device, for example, the certificate service component and the registration agent component may also be located on the first computing device. Figure 4 As shown, Figure 4 1 is a schematic diagram of another system for implementing remote attestation provided by an embodiment of the present application. In the case where both the certificate service component and the registration agent component are located in the first computing device, the registration agent component runs in the TEE of the first computing device, and the certificate service component runs in the normal world of the first computing device.

[0091] When the certificate service component and the registration agent component are running on the first computing device, the process of implementing remote certification includes the interaction process between the certificate service component running on the first computing device and the Verifier, and the interaction process between the certificate service component running on the first computing device and the registration agent component. The interaction process between the certificate service component running on the first computing device and the Verifier can refer to the above Figure 3 The interaction process between the second computing device and the Verifier in the corresponding embodiment. It should be understood that when the first computing device runs the certificate service component and sends a message to the Verifier for applying for a certificate, it carries the CSR of the certificate service component. After the CSR of the certificate service component is verified, the Verifier issues a certificate to the certificate service component.

[0092] The interaction process between the certificate service component and the registration agent component running in the first computing device can refer to the above Figure 3 The corresponding embodiment is the interaction process between the second computing device running the certificate service component and the first computing device. After the first computing device runs the registration agent component in the TEE, the registration agent component will send a registration request to the certificate service component. After obtaining the registration request, the certificate service component will initiate a remote attestation challenge to the registration agent component. The registration agent component obtains the remote report of the registration agent component and provides it to the certificate service component. After verifying that the remote attestation report is passed, the certificate service component generates a certificate for the registration agent component and issues it to the registration agent component. The specific implementation will not be repeated here. It should be understood that since both the certificate service component and the registration agent component are running on the first computing device, there are no related operations such as sending and receiving between the first computing device and the second computing device mentioned above.

[0093] In a possible implementation, the challenger may also be a Verifier. That is, the system implementing remote attestation does not have the certificate service component. Figure 5 As shown, Figure 5 FIG. 1 is a schematic diagram of another system for implementing remote certification provided by an embodiment of the present application. Figure 5 In the system shown in the figure, the first computing device runs the registration agent component in the TEE, and then interacts with the Verifier to implement the remote attestation process. The first computing device runs the registration agent component to interact with the Verifier to implement the remote attestation process. Figure 3 In the corresponding embodiment, the first computing device runs the registration agent component and the second computing device runs the certificate service component. That is, in the process of the first computing device running the registration agent component and interacting with the Verifier to realize remote certification, the above-mentioned S301 and S302 operations do not exist. In the process of the first computing device running the registration agent component and interacting with the Verifier to realize remote certification, the Verifier is used to realize the above-mentioned Figure 3 The operations implemented by the second computing device running the certificate service component in the corresponding embodiment will not be repeated here.

[0094] For the above method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present invention is not limited by the order of the actions described. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the present invention. Based on the above description, other reasonable step combinations that can be thought of by those skilled in the art also fall within the scope of protection of the present invention. For example, the above Figure 3 In the illustrated embodiment, the first computing device may not actively send a registration request to the second computing device, but the second computing device may actively initiate a remote attestation challenge to the first computing device when running the certificate service component.

[0095] The present application also provides a remote certification device, such as Figure 6 As shown, Figure 6 It is a schematic diagram of a remote attestation device provided in an embodiment of the present application, wherein the remote attestation device 600 includes an application 610 and a registration agent component 620, wherein the application 610 and the registration agent component 620 are deployed in a trusted execution environment, wherein the registration agent component 620 is used to: before the application is started, obtain a certificate provided by the challenger to the registration agent component; wherein the certificate is generated after the challenger verifies that a remote attestation report provided by the registration agent component 620 has passed; and after obtaining the certificate, the registration agent component 620 configures a certificate and a private key for the application 610, wherein the certificate and the private key are used to establish an encrypted channel between the application 610 and the client.

[0096] In a possible implementation, the application 610 is used to establish an encrypted channel between the application and the client based on the certificate and the private key.

[0097] In one possible implementation, the registration agent component 620 is also used to obtain a remote attestation challenge sent by a challenger, the remote attestation challenge including a random number, obtain a remote attestation report of the registration agent component based on the random number in the remote attestation challenge, and provide the remote attestation report of the registration agent component to the challenger.

[0098] In a possible implementation, the remote attestation device 600 further includes a certificate service component 630, which is used to: generate a certificate and a private key when the remote attestation report of the registration agent component is verified to be passed; generate a symmetric key to obtain the first public key in the remote attestation report of the registration agent component; encrypt the certificate and the private key using the symmetric key to obtain a first summary; encrypt the symmetric key using the first public key to obtain a second summary; and provide the first summary and the second summary to the registration agent component.

[0099] In a possible implementation, the registration agent component 620 is further configured to: use the first private key to decrypt the second digest to obtain the symmetric key, and then use the symmetric key to decrypt the first digest to obtain the certificate and the private key.

[0100] In one possible implementation, the remote attestation device 600 further includes a communication module 640, which is used to: send the CSR of the certificate service component to the verification party; receive the certificate issued by the verification party to the certificate service component; wherein the certificate of the certificate service component is generated by the verification party when the CSR of the certificate service component is verified to be passed.

[0101] In one possible implementation, the challenging party is a verifier, for example, Verifier may be a certificate authority (CA); or the challenging party may be a second computing device, which may implement the function of the certificate service component, that is, the second computing device may pass the verification of the verifier by executing the function of the certificate service component.

[0102] Specifically, the remote certification device 600 is used to implement the above Figure 3 In the embodiment shown, the first computing device implements the operation. When the remote certification device 600 includes the certificate service component 630, the remote certification device 600 is also used to implement the above Figure 3 The operations implemented by the second computing device in the illustrated embodiment.

[0103] The present application also provides a remote certification device, such as Figure 7 As shown, Figure 7It is a schematic diagram of another remote attestation device provided in an embodiment of the present application. The remote attestation device 700 includes a processing module 710 and a communication module 720.

[0104] The processing module 710 is used to initiate a remote attestation challenge to a registration agent component running in a trusted execution environment of a first computing device; the trusted execution environment of the first computing device has a registration agent component and an application deployed therein. The communication module 720 is used to send a remote attestation challenge to the first computing device;

[0105] The processing module 710 is also used to generate a certificate of the registration agent component when the remote attestation report of the registration agent component is verified to be passed, so that the registration agent component configures the above certificate for the application. The above remote attestation report is provided to the challenger by the registration agent component in response to the remote attestation challenge. The certificate is used to establish an encrypted channel between the application and the client based on the certificate and the private key when the first computing device loads the application in a trusted execution environment; the communication module 720 is also used to send the certificate to the first computing device.

[0106] Specifically, the remote certification device 700 is used to implement the above Figure 3 The operations implemented by the second computing device in the illustrated embodiment will not be described in detail here.

[0107] The present application also provides a computing device, such as Figure 8 As shown, Figure 8 5 is a schematic diagram of a computing device provided in an embodiment of the present application. The computing device 500 includes one or more processors 510, a communication interface 520, and a memory 530, wherein the one or more processors 510, the communication interface 520, and the memory 530 are interconnected via a bus 540, wherein:

[0108] The processor 510 may be used to implement operations corresponding to those performed by the first computing device in the method embodiment. The method for implementing the first computing device by the processor 510 may refer to the introduction in the method embodiment, which will not be described in detail herein.

[0109] The communication interface 520 may be a wired interface or a wireless interface for communicating with other modules or devices. The wired interface may be an Ethernet interface, a local interconnect network (LIN), etc., and the wireless interface may be a cellular network interface or a wireless local area network interface.

[0110] The memory 530 may be a non-volatile memory, such as a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The memory 530 may also be a volatile memory, which may be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0111] The memory 530 may also be used to store program instructions and data, so that the processor 510 calls the program instructions stored in the memory 530 to execute the operation steps of the first computing device in the above method embodiment. Figure 5 Show more or fewer components, or have different component configurations.

[0112] The bus 540 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus 540 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0113] It should be noted that the above-mentioned processor 510 can be a central processing unit (CPU), and can also include a CPU and other hardware chips. The above-mentioned hardware chips can be of various types. For example, the accelerator card can be a co-processing unit including a graphics processing unit (GPU), a tensor processing unit (TPU), a programmable logic device (PLD), a complex programmable logic device (CPLD), a field programmable gate array (FPGA) or a digital signal processor (DSP). Any one of the chips, the computing device 500 can include one or more of any of the above-mentioned types of hardware chips, and can also include multiple types of the above-mentioned hardware chips, which is not specifically limited in the embodiments of the present application.

[0114] Specifically, the specific implementation of various operations performed by the computing device 500 may refer to the specific operations performed by the first computing device in the above method embodiment, which will not be described in detail here.

[0115] It should be noted that if the management module and the evaluation module are deployed on different devices, that is, the management device and the evaluation device are not the same device. Then the embodiment of the present application also provides another computing device, the structural diagram of the computing device is similar to the above Figure 5 The structural schematic diagram of the computing device 500 shown in FIG. 1 is the same as that of the computing device 500 shown in FIG. 1 , and is used to execute the operations completed by the above-mentioned management device, which will not be repeated here.

[0116] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is executed on a processor, the method steps implemented by the evaluation device in the above method embodiment can be implemented. The specific implementation of the processor of the computer-readable storage medium in executing the above method steps can refer to the specific operations of the above method embodiment, which will not be repeated here.

[0117] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is executed on a processor, the method steps implemented by the management device in the above method embodiment can be implemented. The specific implementation of the processor of the computer-readable storage medium in executing the above method steps can refer to the specific operations of the above method embodiment, which will not be repeated here.

[0118] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0119] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium. The semiconductor medium can be a solid state drive (SSD).

[0120] The steps in the method of the embodiment of the present application can be adjusted in order, combined or deleted according to actual needs; the modules in the device of the embodiment of the present application can be divided, combined or deleted according to actual needs.

[0121] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A remote attestation method, characterized in that: The first computing device has a trusted execution environment, wherein the trusted execution environment is deployed with a registration agent component and an application, including: Before loading the application, the first computing device obtains, through the registration agent component, a certificate provided by the challenger to the registration agent component; The first computing device configures the certificate and the private key for the application through the registration agent component, and the certificate and the private key are used to establish an encrypted channel between the application and the client.

2. The method according to claim 1, characterized in that Also includes: The first computing device loads the application in the trusted execution environment, and establishes an encrypted channel between the application and a client based on the certificate and the private key.

3. The method according to claim 1 or 2, characterized in that: Also includes: The first computing device runs the registration agent component to obtain a remote attestation challenge initiated by a challenger, wherein the remote attestation challenge includes a random number; The first computing device runs the registration agent component, obtains a remote attestation report of the registration agent component based on the random number, and provides the remote attestation report of the registration agent component to the challenger.

4. The method according to claim 3, characterized in that The step of obtaining a remote attestation report of the registration agent component based on the random number includes: The first computing device runs the registration agent component to generate a first asymmetric key pair, the first asymmetric key pair comprising a first public key and a first private key; The first computing device runs the registration agent component and obtains a remote attestation report of the registration agent component based on the random number and the first public key.

5. The method according to claim 3, characterized in that: The step of obtaining a remote attestation report of the registration agent component based on the random number includes: The first computing device runs the registration agent component to generate a first asymmetric key pair, the first asymmetric key pair comprising a first public key and a first private key; The first computing device runs the registration agent component and generates a certificate signing request CSR of the registration agent component based on the first asymmetric key pair; The first computing device runs the registration agent component and obtains a remote attestation report of the registration agent component based on the random number and the CSR.

6. The method according to claim 4 or 5, characterized in that: The private key is the first private key.

7. The method according to claim 4 or 5, characterized in that: The private key is generated and provided to the registration agent component after the challenger verifies that the remote attestation report of the registration agent component is passed.

8. The method according to claim 7, characterized in that The challenger is a certificate service component running on the first computing device, and the certificate service component is deployed in a regular world of the first computing device. The method further includes: The first computing device runs the certificate service component, and generates the certificate and the private key when verifying that the remote attestation report of the registration agent component passes; The first computing device runs the certificate service component, generates a symmetric key, and obtains the first public key in the remote attestation report of the registration agent component; The first computing device runs the certificate service component, encrypts the certificate and the private key using the symmetric key, and obtains a first digest; The first computing device runs the certificate service component and uses the first public key to encrypt the symmetric key to obtain a second digest; The first computing device runs the certificate service component and provides the first digest and the second digest to the enrollment agent component.

9. The method according to claim 8, characterized in that The method further comprises: The first computing device runs the registration agent component to decrypt the second digest using the first private key to obtain the symmetric key; The first computing device runs the registration agent component to decrypt the first digest using the symmetric key to obtain the certificate and the private key.

10. The method according to claim 8 or 9, characterized in that: Also includes: The first computing device runs the certificate service component and sends the CSR of the certificate service component to the verification party; The first computing device runs the certificate service component and receives a certificate issued by the verification party to the certificate service component. The certificate of the certificate service component is generated by the verification party when the CSR of the certificate service component is verified to be passed.

11. The method according to any one of claims 1 to 6, characterized in that: The challenger is a verifier, or the challenger is a second computing device, and the second computing device is verified by the verifier.

12. A remote attestation method, characterized in that: include: The challenge direction initiates a remote attestation challenge to a registration agent component running in a trusted execution environment of a first computing device; wherein the registration agent component and the application are deployed in the trusted execution environment; The challenging party provides a certificate to the registration agent component so that the registration agent component configures the certificate for the application. The remote attestation report is provided to the challenging party by the registration agent component in response to the remote attestation challenge. The certificate is used to establish an encrypted channel between the application and the client based on the certificate and the private key when the first computing device loads the application in the trusted execution environment.

13. The method according to claim 12, characterized in that Also includes: The challenger provides the private key to the registration agent component, where the private key is generated by the challenger after verifying that the remote attestation report of the registration agent component is passed.

14. The method according to claim 13, characterized in that Said include: The challenging party generates the certificate and the private key when verifying that the remote attestation report is passed; The challenger generates a symmetric key and obtains the first public key in the remote attestation report of the registration agent component; The challenging party encrypts the certificate and the private key using the symmetric key to obtain a first digest; The challenging party encrypts the symmetric key using the first public key to obtain a second digest; The challenger provides the private key to the registration agent component, including: The challenging party provides the first digest and the second digest to the registration agent component.

15. The method according to any one of claims 12 to 14, characterized in that: Before the challenge is directed to a registration agent component running in a trusted execution environment of the first computing device to initiate a remote attestation challenge, the method further includes: The challenger sends a certificate signing request (CSR) to the verifier; The challenger receives the challenger's certificate issued by the verifier, where the challenger's certificate is generated by the verifier when the CSR of the challenger is verified to be successful.

16. A remote certification device, characterized in that: The invention comprises an application and a registration agent component, wherein the application and the registration agent component are deployed in a trusted execution environment, and the registration agent component is used for: Before the application is started, obtaining a certificate provided by the challenger to the registration agent component; The certificate and the private key are configured for the application, and the certificate and the private key are used to establish an encrypted channel between the application and the client.

17. The device according to claim 16, characterized in that The application is used to establish an encrypted channel between the application and a client based on the certificate and the private key.

18. The device according to claim 16 or 17, characterized in that The remote certification device further includes a certificate service component, wherein the certificate service component is used to: In the case of verifying that the remote attestation report of the registration agent component passes, generating the certificate and the private key; Generate a symmetric key and obtain the first public key in the remote attestation report of the registration agent component; Encrypt the certificate and the private key using the symmetric key to obtain a first digest; Encrypt the symmetric key using the first public key to obtain a second digest; The first digest and the second digest are provided to the registration agent component.

19. A remote certification device, characterized in that: include: A processing module for initiating a remote attestation challenge to a registration agent component running in a trusted execution environment of a first computing device; The registration agent component and the application are deployed in the trusted execution environment of the first computing device; a communication module for sending the remote attestation challenge to the first computing device; The processing module is further configured to generate a certificate of the registration agent component when verifying that a remote attestation report of the registration agent component passes, so that the registration agent component configures the certificate for the application, wherein the remote attestation report is provided by the registration agent component to the challenger in response to the remote attestation challenge, and the certificate is used for establishing an encrypted channel between the application and the client based on the certificate and the private key when the first computing device loads the application in the trusted execution environment; The communication module is further configured to send the certificate to the first computing device.

20. A computing device, characterized in that The method comprises a processor and a memory, wherein the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, the method according to any one of claims 1 to 11 is implemented.

21. A computing device, characterized in that The method comprises a processor and a memory, wherein the memory is used to store instructions, and the processor is used to execute the instructions. When the processor executes the instructions, the method according to any one of claims 12 to 15 is implemented.

22. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device, the computing device implements the method as claimed in any one of claims 1 to 11.

23. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, which, when executed by a computing device, implement the method as claimed in any one of claims 12 to 15.

Images