Trusted computing environment-based database tamper-proofing method and system

Abstract

The invention relates to the technical field of information security, in particular to a database tamper-proofing method and system based on a trusted computing environment, and the method comprises the steps: S1, receiving data transmitted into the database by adopting a security protocol communication TLS, carrying out the preliminary verification and cleaning of the data, generating a verification key through a trusted computing module TPM, and storing the verification key in a secure storage area of the trusted computing module; s2, loading the verified data into a feasible computing environment TEE to generate an encryption key, and storing the encryption key in an internal storage area of the feasible computing environment TEE; s3, performing integrity verification on the encrypted data in the feasible computing environment TEE; and S4, leaving the checked data from the feasible computing environment TEE through the security protocol communication TLS, and transmitting the checked data to a tamper-proof database for storage. The data processing and storage operation is executed in the trusted computing environment, the integrity and non-tampering property of the operation record are ensured by using the tampering-proof database, and the credibility and safety of the whole data processing and storage system are improved in a combined mode.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a tamper-proof database method and system based on a trusted computing environment. Background Art

[0002] With the rapid development of information technology, data security and integrity have become important challenges faced by all walks of life. Data tampering and unauthorized access incidents occur frequently, which seriously affects the trust and security of enterprises and users. Although traditional security measures such as encryption and access control provide protection to a certain extent, these measures are often difficult to prevent data tampering by internal attackers or users with high-level permissions. Therefore, a more comprehensive and efficient technical solution is urgently needed to improve the security and credibility of data.

[0003] Traditional data protection technologies mainly rely on software-level measures, such as data encryption, access control, and firewalls. These technologies can prevent data from being illegally accessed and tampered with to a certain extent, but they are usually unable to completely protect against threats from internal attackers or high-level privileged users. For example, encryption keys are stolen by insiders and access control mechanisms are bypassed. In addition, traditional data storage technologies lack a continuous verification mechanism for data integrity, and once data is tampered with, it is difficult to detect and recover in a timely manner. These limitations make traditional technologies incapable of coping with increasingly complex network security threats.

[0004] Although existing technical solutions have been improved in some aspects, they still have many shortcomings. For example, some systems use hardware-assisted security measures, such as Trusted Platform Module (TPM), to enhance data security. However, these technologies often only provide limited protection and cannot completely prevent security threats during data storage and transmission. In addition, although existing tamper-proof database technologies can record unchangeable data logs, they rely on software-level measures and are difficult to solve hardware-level security vulnerabilities. These technologies are still at risk of being compromised when facing complex network attacks.

[0005] Therefore, this technical solution provides a comprehensive data protection solution by combining trusted computing technology and tamper-proof database technology. Summary of the invention

[0006] The present invention provides a tamper-proof database method based on a trusted computing environment, comprising the following steps:

[0007] S1, using the secure protocol communication TLS to receive the internal data, perform preliminary verification and cleaning of the data, generate a verification key through the trusted computing module TPM, and store it in the secure storage area of ​​the trusted computing module;

[0008] S2. Load the verified data into the feasible computing environment TEE to generate an encryption key, and the encryption key is stored in the internal storage area of ​​the feasible computing environment TEE;

[0009] S3. Perform integrity check on the data encrypted in the feasible computing environment TEE;

[0010] S4. The verified data leaves the feasible computing environment TEE through the secure protocol communication TLS and is transmitted to the tamper-proof database for storage.

[0011] Preferably, the trusted computing module TPM in S1 generates a verification key to verify the integrity of the data by comparing the hash value of the actual data with the expected hash value at the hardware level, and to verify whether the data in the key startup and running software has been tampered with.

[0012] Preferably, the TEE uses Intel Software Guard Extensions SGX to generate encryption keys, specifically including the following steps:

[0013] S2.1. Create a secure enclave in SGX and load data into the enclave.

[0014] S2.2. Generate a random initialization vector through the hardware random number generator RNG inside the Enclave;

[0015] S2.3. Use the strong encryption algorithm AES-256 to encrypt in the Enclave through the GCM encryption mode, generate an encryption key, and store it in the Enclave.

[0016] Preferably, the integrity check in S3 includes the following steps:

[0017] S3.1. Generate a hash value for the data through a hash algorithm, and store or attach the hash value to the data itself;

[0018] S3.2. Before data is accessed or transmitted, the hash value of the current data is recalculated and compared with the original hash value to ensure that the data has not been modified;

[0019] S3.3. Use digital signatures to verify the source and integrity of data. The data client signs the data or hash value with a private key and verifies the signature with the sender’s public key, indicating that the data has not been tampered with since it was signed.

[0020] Preferably, the tamper-proof database in S4 stores data, including the following steps:

[0021] S4.1. The tamper-proof database uses a symmetric encryption algorithm to encrypt data, generates a storage key through a hardware security module HSM, and uses the generated storage key to encrypt data;

[0022] S4.2. Calculate the data hash value and generate a unique key and value for each data through the KV pair storage model;

[0023] S4.3, link the hash value of the data to the hash value of the previous data, store each data together with the hash value calculated for each data, and form a hash chain;

[0024] S4.4. Through hash chain, the encrypted data is stored in a tamper-proof database.

[0025] A tamper-proof database system based on a trusted computing environment, including a trusted computing layer, a data processing layer, a data storage layer, and a system interaction layer;

[0026] The trusted computing layer includes TPM and SGX; the TPM generates a verification key through data, stores the verification key in a secure storage area, implements management access control on the data, identifies authorized applications and users based on the verification key to decrypt data and access sensitive data, and records operation logs;

[0027] The SGX creates a secure enclave, generates encryption keys through the data isolation execution environment of the enclave, and processes and stores sensitive data and encryption keys;

[0028] The data processing layer includes a data preliminary verification module, a data cleaning module and a data integrity verification module;

[0029] The preliminary verification module includes data type and structure verification, data size and value range verification, malicious content and replay attack prevention detection;

[0030] The data cleaning module includes identifying duplicate records and unifying data formats, field splitting and merging and logical error correction, outlier detection and processing, and validity and consistency checks;

[0031] The data integrity verification module generates a unique hash value for the data through a hash algorithm to verify the data integrity;

[0032] The data storage layer includes a data storage module and a data query module;

[0033] The data storage module stores data in a tamper-proof database through a KV pair storage model;

[0034] The data query module obtains data stored in the tamper-proof database through a query API;

[0035] The system interaction layer includes internal API, external API and security call module;

[0036] The internal API is used for data exchange between different structural layers, allowing each internal module to call specific functions through the API;

[0037] The external API provides an interface for external users to access and operate the internal data of the database, authenticates the caller through the API, and identifies authorized access;

[0038] The security calling module calls the Enclave interface of SGX from the outside, starts a specific security task inside the Enclave, and performs data encryption and decryption.

[0039] Preferably, the TPM also includes a TPM remote attestation module and an operation protection module. The TPM remote attestation module attests data integrity to a remote client or a third-party service through a server, and the client verifies the security status of the server to ensure that the data processing and storage environment meets the expected security standards. The operation protection module protects the software and hardware environment from being tampered with through TPM from startup to execution.

[0040] Preferably, the SGX further includes an SGX remote attestation function, allowing the database to prove its identity and integrity to a remote user or application, and by cryptographically signing the secure enclave, the verifier confirms that the data in the secure enclave is secure and has not been tampered with;

[0041] The secure enclave includes an outer portion of the secure enclave and an inner portion of the secure enclave. Data is automatically encrypted when stored outside the secure enclave and is decrypted inside the secure enclave.

[0042] Preferably, the data query module also includes a data verification mechanism. When a user queries, the tamper-proof database will verify the hash value of the query parameter to ensure the legitimacy of the query, and obtain the data stored in the tamper-proof database through the query. If the hash value of the query parameter matches the hash value stored in the tamper-proof database, the query operation is allowed; if they do not match, the query is rejected, and the time of the query attempt and the operator information are recorded.

[0043] Preferably, the system interaction layer adopts a two-way TLS protection mechanism, the transmitted data is encrypted through TLS, an encrypted communication channel is established, and the verified client can submit data processing or data retrieval; the two-way TLS protection mechanism records the information of all API calls through logs and sets a cache for frequently requested data.

[0044] Compared with the prior art, the technical solution of this application has the following technical effects:

[0045] The present invention adopts the security protocol communication TLS to receive the internal data passed in, and performs preliminary verification and cleaning of the data, thereby solving the problem that the data may be tampered with or injected with malicious content during the traditional data transmission process. The encryption and integrity of the data during the transmission process are ensured by the TLS protocol, while the preliminary verification and cleaning ensure the legitimacy and security of the data by checking the data type, structure, size and value range, and preventing replay attacks, thereby improving the security of data transmission and reducing the burden of TEE internal processing of invalid or malicious data, thereby improving the overall performance and reliability of the system.

[0046] The present invention solves the vulnerability problem of key management and data integrity verification in traditional systems by generating verification keys in a trusted computing module TPM and storing them in a secure storage area; TPM ensures the integrity of data during startup and operation by performing hash value comparison of data at the hardware level. This hardware-level verification mechanism is difficult to be destroyed by software-level attacks, thereby greatly enhancing the security and credibility of the system. In addition, TPM also supports remote attestation functions, enabling remote clients or third-party services to verify the integrity of system status and data, further improving the transparency and credibility of the system.

[0047] The present invention solves the potential security risks in key management and data processing in traditional encryption technology by creating a secure enclave in Intel Software Guard Extensions SGX and generating and managing encryption keys inside the enclave; the secure enclave provided by SGX ensures the isolation and confidentiality of data and code during execution. Even if the operating system is compromised, attackers cannot access sensitive data and execution logic in the enclave, which improves the security of data processing. The system's anti-attack capability is further enhanced by regularly updating keys and secure abandonment mechanisms. In addition, SGX also supports remote attestation functions, allowing remote users or applications to verify the identity and integrity of the secure enclave, thereby improving the credibility and security of the system.

[0048] The present invention solves the security and integrity issues in the data storage and transmission process in traditional database technology by using symmetric encryption algorithms and hash chain technology in the tamper-proof database. The tamper-proof database generates storage keys through the hardware security module HSM and uses the generated keys to encrypt data, ensuring the security of the data during storage. At the same time, by calculating the hash value of the data and forming a hash chain, the data is ensured to be tamper-proof and traceable. This technical solution not only improves the security of data storage, but also enhances the system's auditing and data recovery capabilities through detailed log records and data verification mechanisms, thereby providing a higher level of protection for data processing and storage.

[0049] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application so that it can be implemented in accordance with the contents of the specification, and to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following is a detailed description of the preferred embodiments of the present application in conjunction with the accompanying drawings as follows.

[0050] Based on the detailed description of the specific embodiments of the present application in combination with the accompanying drawings below, those skilled in the art will become more aware of the above and other objects, advantages and features of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings without creative work. In all drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, each element or part is not necessarily drawn according to the actual scale.

[0052] Figure 1 The figure is an overall flow chart of the tamper-proof database method based on a trusted computing environment of the present invention;

[0053] Figure 2 The figure is an overall module diagram of the tamper-proof database system based on a trusted computing environment of the present invention;

[0054] Figure 3 The overall module diagram of the strong encryption algorithm of the present invention for encrypting data;

[0055] Figure 4 Flowchart for generating encryption keys for the TEE of the present invention;

[0056] Figure 5 A verification flow chart for performing integrity verification on encrypted data of the present invention;

[0057] Figure 6 It is a data storage flow chart of the present invention. DETAILED DESCRIPTION

[0058] To make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the present application. Obviously, the described embodiment is a part of the embodiment of the present application, rather than all of the embodiments. In the following description, specific details such as specific configuration and components are provided only to help fully understand the embodiments of the present application. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. In addition, for clarity and brevity, the description of known functions and structures is omitted in the embodiment.

[0059] It should be understood that the references to "one embodiment" or "this embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present application. Therefore, the references to "one embodiment" or "this embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0060] In addition, the present application may repeat reference numerals and / or letters in different examples. This repetition is for the purpose of simplicity and clarity, and does not in itself indicate the relationship between the various embodiments and / or settings discussed.

[0061] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" in this article describes another type of association object relationship, indicating that there can be two relationships. For example, A / and B can mean: A exists alone, and A and B exist alone. In addition, the character " / " in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0062] The term "at least one" in this article is merely a description of the association relationship of associated objects, indicating that there may be three relationships. For example, at least one of A and B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0063] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusions.

[0064] Example 1

[0065] This embodiment mainly describes a tamper-proof database system based on a trusted computing environment, such as Figure 2 As shown, it includes a trusted computing layer, a data processing layer, a data storage layer, and a system interaction layer;

[0066] The trusted computing layer includes TPM and SGX;

[0067] The TPM is used as a secure cryptographic processor to securely store encryption keys, digital certificates and other sensitive data, and to provide hardware-level security functions, including encryption and signing operations;

[0068] The TPM securely stores and manages the keys used to encrypt the database, ensuring that the keys cannot be easily obtained by external software or attackers. The TPM can also manage access control to ensure that only authorized applications and users can decrypt and access sensitive data.

[0069] The TPM is used to ensure that the database file has not been tampered with. When the database is started, the integrity of the database file is verified. By comparing the hash value of the actual file with the expected hash value, it is detected whether the file has been illegally modified. Since this verification process is performed at the hardware level, it is difficult to be destroyed by software-level attacks;

[0070] Through TPM, database operation logs can be recorded for future security audits and post-analysis. TPM can ensure the integrity of log data and prevent log tampering, which is especially important for tracking potential security incidents and data leaks.

[0071] The TPM also includes a TPM remote attestation module and an operation protection module. The TPM remote attestation module attests data integrity to a remote client or a third-party service through a server. The client verifies the security status of the server and ensures that the data processing and storage environment meets the expected security standards. The operation protection module protects the software and hardware environment from tampering through TPM from startup to execution.

[0072] The SGX creates a secure enclave, which is a protected memory area where data and code are invisible even at the operating system level. The SGX allows applications to execute code in the enclave, providing an isolated execution environment for the database, protecting the execution logic of the database from external attacks.

[0073] In the isolated execution environment, even if the operating system is compromised, the attacker cannot access the sensitive data and execution logic of the enclave. In SGX, data is automatically encrypted when stored outside the enclave and can only be decrypted inside the enclave, which ensures the security of data during storage and transmission.

[0074] The database operations can be performed within the enclave to ensure the security and privacy of the data processing process;

[0075] The SGX can record the operation log of the database. The log is generated and encrypted in the enclave, thereby ensuring the integrity and confidentiality of the log. Even if other parts of the system are compromised, the database application can be securely started through SGX.

[0076] The SGX can verify whether the database application code has been tampered with before execution, ensuring that only verified code can run in the enclave.

[0077] The SGX also includes an SGX remote attestation function, which allows the database to prove its identity and integrity to a remote user or application. By cryptographically signing the secure enclave, the verifier confirms that the data in the secure enclave is secure and has not been tampered with.

[0078] The data processing layer includes a data preliminary verification module, a data cleaning module and a data integrity verification module;

[0079] The preliminary verification module includes data type and structure verification, data size and value range verification, malicious content and replay attack prevention detection;

[0080] The data type and structure verification: ensure that the type of each data field meets expectations, such as whether the date field meets the date format, whether the number field contains only numbers, and check whether the data meets the predefined structure, such as whether the structure of JSON or XML is complete and whether necessary fields are missing;

[0081] Data size and value range verification: Check whether the size of the data packet is within the allowed range to avoid processing too much data and causing system burden. Check the data value, for example, the age cannot be a negative number and the date cannot exceed the logical range.

[0082] Malicious content and replay attack prevention detection: Scan data for possible SQL injection code, script injection, or other malicious input, check received data for duplication, and prevent historical data from being resent to deceive the system;

[0083] The data cleaning module includes identifying duplicate records and unifying data formats, field splitting and merging and logical error correction, outlier detection and processing, and validity and consistency checks;

[0084] The purpose of data cleaning is to improve the quality of data, ensure the security of this sensitive process, remove or correct errors and incomplete records in the data, ensure the accuracy and consistency of the data, improve the quality of data and enhance the availability, reliability and effectiveness of data; mainly including but not limited to the following parts:

[0085] Identify duplicate records and unify data formats: Check whether there are duplicate entries in the data. These entries may be generated before the data enters the TEE. Ensure that all data fields follow the same format standard and convert inconsistent data types to consistent formats, such as converting string type numbers to numeric types.

[0086] Field splitting, merging and logic error correction: Adjust the data structure as needed to split a field into multiple fields, or merge multiple fields into one and correct the logic errors in the data;

[0087] Outlier detection and processing: Use statistical methods to identify outliers in the data, which may be caused by incorrect input or measurement errors, and correct, delete or retain the mark;

[0088] Validation and consistency checks: Ensure that data complies with validation rules and that data maintains logical consistency across fields, such as a person's date of birth should precede their date of employment.

[0089] The data integrity verification module generates a unique hash value for the data through a hash algorithm to verify the data integrity;

[0090] The data storage layer includes a data storage module and a data query module;

[0091] The data storage module stores data in a tamper-proof database through a KV pair storage model;

[0092] The data query module obtains data stored in the tamper-proof database through a query API;

[0093] The system interaction layer includes internal API, external API, and security call module, which constitutes a bridge for interaction between various layers of the system and with the outside world, ensuring the security and integrity of data;

[0094] The system's internal API is used for data exchange between different system layers, data transfer from the data processing module to the data storage module, allowing each module within the system to call specific functions through the API; the system's external API provides an interface for external users or systems to access and operate internal database data, such as obtaining, updating, and deleting data records, and authenticates system callers to ensure that only authorized users or systems can access the API;

[0095] The secure call module calls the Enclave interface of SGX from the outside to start a specific security task inside the Enclave and implement operations inside the TEE; the secure call module can also be used to start data processing tasks in the Enclave to encrypt and decrypt data; the external call to the Enclave interface of SGX specifically handles encryption operations before persisting data to the database, ensuring that all sensitive data has been securely encrypted before leaving the trusted execution environment;

[0096] The system interaction layer also includes API endpoints to support the decryption process after reading from the database, ensuring that the data is decrypted within the trusted environment, maintaining the confidentiality and integrity of the data, and decrypting the received data within the Enclave, processing it, and then encrypting it again to send it back to the client or other services without leaving the security boundary.

[0097] The system interaction layer adopts a two-way TLS protection mechanism. Both data submission and query requests are protected by the two-way TLS protection mechanism. The application of the two-way TLS protection mechanism in the present invention involves interactions at multiple levels, including user access, data processing, and secure communication with a trusted execution environment. From user terminals to backend services, from trusted computing layers to data storage layers, all transmitted data is encrypted by TLS to establish an encrypted communication channel, effectively preventing data from being stolen or tampered with during transmission. Once the channel of the two-way TLS protection mechanism is established, all data passing through this channel will be encrypted, which ensures that even if the data is intercepted during transmission, it cannot be read by unauthorized persons;

[0098] The two-way TLS protection mechanism ensures that only verified clients can submit data for processing or retrieve data from it when communicating with the trusted computing layer Enclave. Within the trusted computing layer, all keys used for TLS encryption must be securely managed. The sealing and unsealing functions of SGX can be used to securely store and recover these keys to prevent them from being accessed by malware. In addition, all TLS connection attempts, successful handshakes, and completion of key steps are recorded in the audit log for future security analysis and investigation.

[0099] This embodiment creates a secure execution environment through the trusted computing module TPM and Intel Software Guard Extensions SGX to ensure security and transparency in data processing and storage, solves the shortcomings of traditional technologies in data encryption and access control, and improves the overall security of data through dual protection of hardware and software. It introduces remote attestation function, enhances the trustworthiness of the system, and provides a higher level of protection for data processing and storage.

[0100] Example 2

[0101] This embodiment describes in detail a tamper-proof database method based on a trusted computing environment. Figure 1 As shown, the following steps are included:

[0102] S1, using the secure protocol communication TLS to receive the internal data, perform preliminary verification and cleaning of the data, generate a verification key through the trusted computing module TPM, and store it in the secure storage area of ​​the trusted computing module;

[0103] S2. Load the verified data into the feasible computing environment TEE to generate an encryption key, and the encryption key is stored in the internal storage area of ​​the feasible computing environment TEE;

[0104] S3. Perform integrity check on the data encrypted in the feasible computing environment TEE;

[0105] S4. The verified data leaves the feasible computing environment TEE through the secure protocol communication TLS and is transmitted to the tamper-proof database for storage.

[0106] Furthermore, the trusted computing module TPM in S1 generates a verification key to verify the integrity of the data by comparing the hash value of the actual data with the expected hash value at the hardware level, and to verify whether the data in the key startup and running software has been tampered with.

[0107] Further, if Figure 4 As shown, the TEE uses Intel Software Guard Extensions SGX to generate encryption keys, which specifically includes the following steps:

[0108] S2.1. Create a secure enclave in SGX and load data into the enclave.

[0109] S2.2. Generate a random initialization vector through the hardware random number generator RNG inside the Enclave;

[0110] S2.3. Use the strong encryption algorithm AES-256 to encrypt in the Enclave through the GCM encryption mode, generate an encryption key, and store it in the Enclave.

[0111] The initialization vector in S2.2 is a non-confidential binary sequence in the encryption algorithm. By introducing randomness and uniqueness in the encryption process, the initialization vector is used to assist the GCM encryption mode. The encryption of each data in the GCM encryption mode depends on the output of the previous data. Therefore, the initialization vector is used to encrypt the first data block;

[0112] like Figure 3As shown, by combining the randomly generated initialization vector with the plaintext data block, the same data will generate different ciphertexts in different encryption instances, preventing attackers from inferring the original data by comparing the patterns of encrypted messages; in addition, even if the same data is repeatedly encrypted, different ciphertexts can be generated using different initialization vectors, which increases the uniqueness of the encryption process and protects information with repeated or structured data;

[0113] In the GCM mode, for each encryption key, the initialization vector must be guaranteed to be unique and stored securely to prevent tampering during the encryption process.

[0114] The encryption key is generated and stored within the Enclave to ensure key security. The encryption key is securely stored using the sealing function provided by the Enclave, making it inaccessible even outside the Enclave. Each time the data is updated, the data is digitally signed using the private key generated by the Enclave, and the signature is then stored in a tamper-proof database. For each item of data retrieved from the database, the application within the Enclave will verify the validity of the signature to ensure that the data has not been tampered with.

[0115] The encryption key is generated in the trusted execution environment TEE, a strong random number generator is used to ensure the randomness and unpredictability of the key, an encryption key is generated according to an encryption algorithm, and the encryption key is stored in the internal storage area of ​​the TEE to prevent external access and leakage;

[0116] When storing the encryption key, other keys inside the TEE are further encrypted to ensure their security within the system; the access and use of the encryption key of the TEE are strictly controlled to ensure that only authorized processes or personnel can access the encryption key, and the use of the encryption key follows the principle of least privilege. The key can only be accessed when necessary, and the encryption key is regularly updated according to the security policy to resist potential attacks. When the encryption key is no longer in use, measures are taken to safely discard the key, such as using encryption technology to overwrite the encryption key data.

[0117] Before data encryption, the data is converted into an encoding form that can be effectively processed by the encryption algorithm, such as UTF-8. In the TEE, the data is encrypted using a pre-selected encryption algorithm and a generated encryption key. During the encryption process, all operations are ensured to be performed in the secure memory of the TEE to prevent any sensitive data from being leaked to the ordinary memory. The encrypted data is integrity checked to ensure that the data has not been tampered with or damaged during the encryption process.

[0118] The present invention will perform a decryption test on a small portion of data to ensure that the encryption process is correct. The encrypted data will be added with encryption algorithm identification and timestamp information and leave TEE through the TLS secure communication protocol and be transmitted to the tamper-proof database module. During the decryption and encryption process, the system will record the encryption details in the security log to provide data support for subsequent audits.

[0119] Further, if Figure 5 As shown, the integrity check in S3 includes the following steps:

[0120] S3.1. Generate a hash value for the data through a hash algorithm, and store or attach the hash value to the data itself;

[0121] S3.2. Before data is accessed or transmitted, the hash value of the current data is recalculated and compared with the original hash value to ensure that the data has not been modified;

[0122] S3.3. Use digital signatures to verify the source and integrity of data. The data client signs the data or hash value with a private key and verifies the signature with the sender’s public key, indicating that the data has not been tampered with since it was signed.

[0123] In S3.1, a hash algorithm is used to generate a unique hash value for the data to verify data integrity. When the data is generated for the first time, the system uses the hash algorithm to generate a hash value for the data content and stores or attaches the hash value to the data itself. Each time before the data is accessed or transmitted, the system recalculates the hash value of the current data and compares it with the original hash value to ensure that the data has not been modified.

[0124] The digital signature method is used to verify the source and integrity of the data. The data client uses its own private key to sign the data or its hash value. The system then uses the sender's public key to verify the signature, proving that the data was sent by the signer and that the data has not been tampered with since it was signed.

[0125] The integrity verification mechanism plays multiple roles of protection, monitoring and support in the present invention through the above implementation method, providing a necessary layer of security protection for the system. While protecting data and systems from unauthorized or malicious tampering, it also provides traceability and clarity of responsibility.

[0126] Further, if Figure 6 As shown, the tamper-proof database in S4 stores data, including the following steps:

[0127] S4.1. The tamper-proof database uses a symmetric encryption algorithm to encrypt data, generates a storage key through a hardware security module HSM, and uses the generated storage key to encrypt data;

[0128] S4.2. Calculate the data hash value and generate a unique key and value for each data through the KV pair storage model;

[0129] S4.3, link the hash value of the data to the hash value of the previous data, store each data together with the hash value calculated for each data, and form a hash chain;

[0130] S4.4. Through hash chain, the encrypted data is stored in a tamper-proof database.

[0131] The tamper-proof database in S4.2 uses a KV pair storage model. Each data item contains a unique key and a value. To ensure that the data cannot be tampered with, the value of each data item is encrypted and stored together with a hash value. The hash value is calculated using a hash algorithm based on the data value.

[0132] When the data is updated, the tamper-proof database will recalculate the hash value and compare it with the old hash value to ensure that the data has not been tampered with. If the hash value matches, the data has not changed; if the hash value does not match, the data has been tampered with, and the tamper-proof database will reject the update operation and record the time and operator information of the tampering attempt.

[0133] This embodiment describes in detail that a comprehensive data protection solution is provided by combining trusted computing technology and tamper-proof database technology. Through the comprehensive application of secure protocol communication TLS, trusted computing module TPM, Intel Software Guard Extensions SGX and tamper-proof database, the shortcomings of traditional technologies in data transmission, key management, data processing and storage are solved, and the overall security and credibility of data are significantly improved through dual protection of hardware and software.

[0134] The above are only preferred embodiments of the present invention, which do not limit the scope of protection of the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any changes, modifications, replacements, integrations and parameter changes to these embodiments within the spirit and principles of the present invention through conventional substitutions or without departing from the principles and spirit of the present invention fall within the scope of protection of the present invention.

Claims

1. A tamper-proof database method based on a trusted computing environment, characterized in that: The following steps are involved: S1, using the secure protocol communication TLS to receive the internal data, perform preliminary verification and cleaning of the data, generate a verification key through the trusted computing module TPM, and store it in the secure storage area of ​​the trusted computing module; S2. Load the verified data into the feasible computing environment TEE to generate an encryption key, and the encryption key is stored in the internal storage area of ​​the feasible computing environment TEE; S3. Perform integrity check on the data encrypted in the feasible computing environment TEE; S4. The verified data leaves the feasible computing environment TEE through the secure protocol communication TLS and is transmitted to the tamper-proof database for storage.

2. The tamper-proof database method based on a trusted computing environment according to claim 1, characterized in that: The trusted computing module TPM in S1 generates a verification key to verify the integrity of the data by comparing the hash value of the actual data with the expected hash value at the hardware level, and to verify whether the data in the key startup and running software has been tampered with.

3. The tamper-proof database method based on a trusted computing environment according to claim 2, characterized in that: The TEE uses Intel Software Guard Extensions SGX to generate encryption keys, which specifically includes the following steps: S2.

1. Create a secure enclave in SGX and load data into the enclave. S2.

2. Generate a random initialization vector through the hardware random number generator RNG inside the Enclave; S2.

3. Use the strong encryption algorithm AES-256 to encrypt in the Enclave through the GCM encryption mode, generate an encryption key, and store it in the Enclave.

4. The tamper-proof database method based on a trusted computing environment according to claim 1, characterized in that: The integrity check in S3 includes the following steps: S3.

1. Generate a hash value for the data through a hash algorithm, and store or attach the hash value to the data itself; S3.

2. Before data is accessed or transmitted, the hash value of the current data is recalculated and compared with the original hash value to ensure that the data has not been modified; S3.

3. Use digital signatures to verify the source and integrity of data. The data client signs the data or hash value with a private key and verifies the signature with the sender’s public key, indicating that the data has not been tampered with since it was signed.

5. The tamper-proof database method based on a trusted computing environment according to claim 1, characterized in that: The tamper-proof database in S4 stores data, including the following steps: S4.

1. The tamper-proof database uses a symmetric encryption algorithm to encrypt data, generates a storage key through a hardware security module HSM, and uses the generated storage key to encrypt data; S4.

2. Calculate the data hash value and generate a unique key and value for each data through the KV pair storage model; S4.3, link the hash value of the data to the hash value of the previous data, store each data together with the hash value calculated for each data, and form a hash chain; S4.

4. Through hash chain, the encrypted data is stored in a tamper-proof database. 6.Anti-tampering database system based on a trusted computing environment, characterized in that: It includes trusted computing layer, data processing layer, data storage layer and system interaction layer; The trusted computing layer includes TPM and SGX; the TPM generates verification keys through data, stores the verification keys in a secure storage area, implements management access control on data, identifies authorized applications and users based on verification keys to decrypt data and access sensitive data, and records operation logs; The SGX creates a secure enclave, generates encryption keys through the data isolation execution environment of the enclave, and processes and stores sensitive data and encryption keys; The data processing layer includes a data preliminary verification module, a data cleaning module and a data integrity verification module; The preliminary verification module includes data type and structure verification, data size and value range verification, malicious content and replay attack prevention detection; The data cleaning module includes identifying duplicate records and unifying data formats, field splitting and merging and logical error correction, outlier detection and processing, and validity and consistency checks; The data integrity verification module generates a unique hash value for the data through a hash algorithm to verify the data integrity; The data storage layer includes a data storage module and a data query module; The data storage module stores data in a tamper-proof database through a KV pair storage model; The data query module obtains data stored in the tamper-proof database through a query API; The system interaction layer includes internal API, external API and security call module; The internal API is used for data exchange between different structural layers, allowing each internal module to call specific functions through the API; The external API provides an interface for external users to access and operate the internal data of the database, authenticates the caller through the API, and identifies authorized access; The security calling module calls the Enclave interface of SGX from the outside, starts a specific security task inside the Enclave, and performs data encryption and decryption.

7. The tamper-proof database system based on a trusted computing environment according to claim 6, characterized in that: The TPM also includes a TPM remote attestation module and an operation protection module. The TPM remote attestation module attests data integrity to a remote client or a third-party service through a server. The client verifies the security status of the server and ensures that the data processing and storage environment meets the expected security standards. The operation protection module protects the software and hardware environment from tampering through TPM from startup to execution.

8. The tamper-proof database system based on a trusted computing environment according to claim 6, characterized in that: The SGX also includes an SGX remote attestation function, which allows the database to prove its identity and integrity to a remote user or application. By cryptographically signing the secure enclave, the verifier confirms that the data in the secure enclave is secure and has not been tampered with. The secure enclave includes an outer portion of the secure enclave and an inner portion of the secure enclave. Data is automatically encrypted when stored outside the secure enclave and is decrypted inside the secure enclave.

9. The tamper-proof database system based on a trusted computing environment according to claim 6, characterized in that: The data query module also includes a data verification mechanism. When a user queries, the tamper-proof database will verify the hash value of the query parameter to ensure the legitimacy of the query. The data stored in the tamper-proof database is obtained through the query. If the hash value of the query parameter matches the hash value stored in the tamper-proof database, the query operation is allowed; if not, the query is rejected, and the time of the query attempt and the operator information are recorded.

10. The tamper-proof database system based on a trusted computing environment according to claim 6, characterized in that: The system interaction layer adopts a two-way TLS protection mechanism. The transmitted data is encrypted through TLS to establish an encrypted communication channel. The verified client can submit data processing or data retrieval; the two-way TLS protection mechanism records the information of all API calls through logs and sets a cache for frequently requested data.

Images