Remote diagnosis method based on trusted module

Abstract

The invention discloses a remote diagnosis method based on a trusted module, and aims to improve the safety of remote connection, the method relates to terminal equipment, a server and a remote debugging host, the terminal equipment is provided with the trusted module, and a white list and a VPN group are preset in the server; the terminal equipment sends an equipment activation request to the server; the server verifies whether the terminal device is in a white list after receiving the device activation request; if verification is not passed, an illegal request is replied, and remote diagnosis cannot be carried out on the terminal equipment; if the verification is passed, VPN connection configuration information is sent to the terminal equipment; the terminal equipment encrypts and stores the VPN connection configuration information by using the trusted module, and the terminal equipment analyzes the VPN connection configuration information and loads the VPN connection configuration information in a memory; the server sends a VPN client starting command to the terminal equipment, the terminal equipment starts the VPN client, and the VPN client and the server establish a secure tunnel; belongs to the technical field of remote connection.

Description

Technical Field

[0001] The present invention belongs to the technical field of remote connection, and more specifically, relates to a remote diagnosis method based on a trusted module. Background Art

[0002] During the operation of the equipment, various faults are inevitable. Due to the limitations of the on-site environment and the skill level of the personnel, it is not realistic to invite experts to the site for debugging every time a fault occurs. Therefore, remote diagnosis technology is increasingly used. Remote diagnosis, that is, accessing the device through the network and then debugging it to achieve the purpose of remotely troubleshooting equipment failures; currently, VPN is a relatively common method. From the perspective of the currently implemented VPN remote diagnosis, although VPN itself has a certain degree of security, it ignores security considerations when establishing and revoking remote connections, causing security risks to the equipment, including:

[0003] First, VPN connections cannot be established securely, which introduces eavesdropping threats and poses hidden dangers.

[0004] Second: There is no restriction on when to use the VPN, such as on which device to start it and when to start it, which increases the attack surface of the device;

[0005] Third: If the relevant information of the connection is not cleared, private data may be exposed. Summary of the invention

[0006] The main purpose of the present invention is to provide a remote diagnosis method based on a trusted module, aiming to improve the security of remote connection.

[0007] According to a first aspect of the present invention, a remote diagnosis method based on a trusted module is provided, involving a terminal device, a server and a remote debugging host, wherein the terminal device has a trusted module, and the server is preset with a whitelist and a VPN group; the method comprises the following steps:

[0008] Step 1: The terminal device sends a device activation request to the server;

[0009] Step 2: After receiving the device activation request, the server verifies whether the terminal device is in the whitelist; if the verification fails, it replies that the request is illegal and cannot perform remote diagnosis on the terminal device; if the verification passes, it sends the VPN connection configuration information to the terminal device;

[0010] Step 3: The terminal device uses a trusted module to encrypt and store the VPN connection configuration information, and the terminal device parses the VPN connection configuration information and loads it into a memory;

[0011] Step 4: The server sends a command to start the VPN client to the terminal device, the terminal device starts the VPN client, and the VPN client establishes a secure tunnel with the server;

[0012] Step 5: The remote debugging host starts the VPN client and sends a connection request to the specified VPN group, and the VPN client establishes a secure tunnel with the server; a virtual private network is established through two secure tunnels, allowing the remote debugging host to remotely diagnose the terminal device.

[0013] In the above-mentioned remote diagnosis method based on the trusted module, it also includes step 6: after completing the remote diagnosis, the server removes the terminal device from the whitelist;

[0014] The server turns off the remote connection function of the terminal device, and the terminal device deletes the VPN connection configuration information.

[0015] In the above-mentioned remote diagnosis method based on a trusted module, in step 6, the terminal device deletes temporary files and fills relevant memory areas with random values.

[0016] In the above-mentioned remote diagnosis method based on a trusted module, before step 1, it is necessary to import the PSK into the terminal device, encrypt the PSK through the trusted module and store it persistently, and calculate activation information for activating the terminal device, the activation information including the identification information of the terminal device.

[0017] In the above-mentioned remote diagnosis method based on the trusted module, the identification information of the terminal device is pre-entered into the white list and the VPN group respectively;

[0018] The device activation request includes activation information. The server obtains the activation information and verifies whether the terminal device is in the whitelist according to the activation information.

[0019] In the above-mentioned remote diagnosis method based on a trusted module, in step 2, after the server is verified, the server encrypts the connection information and sends the connection information to the terminal device;

[0020] The terminal device decrypts the connection information, encrypts the sensitive information in the connection information using a trusted module, and then stores it; the terminal device loads the encrypted sensitive information, and then reports the basic information of the device to the server;

[0021] The server sends VPN connection configuration information to the terminal device.

[0022] In the above-mentioned remote diagnosis method based on the trusted module, the connection information includes the MQTT proxy address, port number, password, device certificate, and encrypted device private key;

[0023] The sensitive information includes the device private key, address and port number;

[0024] The basic device information includes device type and firmware version;

[0025] The VPN connection configuration information includes a VPN server address, a port number, and a cipher suite type.

[0026] In the above-mentioned remote diagnosis method based on the trusted module, the terminal device and the server communicate with each other through https, MQTT and TLS.

[0027] In the above-mentioned remote diagnosis method based on a trusted module, the VPN client and the server establish a secure tunnel based on two-way TLS authentication.

[0028] In the above-mentioned remote diagnosis method based on a trusted module, in step 5, the remote debugging host uses a password to authenticate and log in to the VPN client, and the VPN client sends a connection request through https; the VPN client and the server establish a secure tunnel based on two-way TLS authentication.

[0029] One of the above technical solutions of the present invention has at least one of the following advantages or beneficial effects:

[0030] In the present invention, a trusted module is used for key protection and identity authentication, so that a VPN connection can be securely established to prevent eavesdropping; at the same time, a whitelist and VPN group are used for management to limit the use time and scope of VPN and reduce the attack surface of the device; after each remote diagnosis, the relevant memory data is cleared and filled with random values ​​to avoid exposure of private data, thereby improving the security of remote diagnosis. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The present invention is further described below in conjunction with the accompanying drawings and embodiments;

[0032] Figure 1 It is a flow chart of the remote diagnosis method based on the trusted module of the present invention. DETAILED DESCRIPTION

[0033] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions from beginning to end. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0034] Remote diagnosis is to access the device through the network and then debug it to achieve the purpose of remotely troubleshooting device failures. Currently, VPN is a relatively common method. From the perspective of the currently implemented VPN remote diagnosis, although VPN itself has a certain degree of security, security considerations are ignored when establishing and revoking remote connections, causing security risks to the device, including the inability to safely establish VPN connections, introducing eavesdropping threats and hidden dangers; there is no restriction on the use of VPN, such as not restricting which device to start it on and when to enable it, which increases the attack surface of the device; there is no clearing of relevant information about the connection, and there is a risk of privacy data being exposed.

[0035] This application proposes a remote diagnosis method based on a trusted module, which adopts a trusted module for key protection and identity authentication, and can securely establish a VPN connection to prevent eavesdropping; at the same time, a whitelist and VPN group are used for management to limit the use time and scope of VPN and reduce the attack surface of the device; after each remote diagnosis, the relevant memory data is cleared and filled with random values ​​to avoid privacy data exposure, thereby improving the security of remote diagnosis.

[0036] Reference Figure 1 As shown, a remote diagnosis method based on a trusted module involves a terminal device, a server and a remote debugging host, wherein the terminal device has a trusted module, and a whitelist and a VPN group are preset in the server; the method comprises the following steps:

[0037] Step 1: The terminal device sends a device activation request to the server. Specifically, the terminal device sends the device activation request to the server via https.

[0038] Step 2: After receiving the device activation request, the server verifies whether the terminal device is in the whitelist; if the verification fails, it replies with an illegal request and cannot perform remote diagnosis on the terminal device; if the verification passes, the VPN connection configuration information is sent to the terminal device;

[0039] Step 3: The terminal device uses the trusted module to encrypt and store the VPN connection configuration information, and then the terminal device parses the VPN connection configuration information and loads it into memory;

[0040] Step 4: The server sends a command to start the VPN client to the terminal device, the terminal device starts the VPN client, and the VPN client establishes a secure tunnel with the server;

[0041] Step 5: The remote debugging host starts the VPN client and sends a connection request to the specified VPN group. The VPN client establishes a secure tunnel with the server. A virtual private network is established through two secure tunnels, allowing the remote debugging host to remotely diagnose the terminal device.

[0042] This remote diagnosis method utilizes a trusted module to encrypt private information, which can protect private information, achieve secure connections, and avoid eavesdropping. At the same time, the use of whitelists and VPN groups for management can limit the timing and scope of VPN use. Only preset terminal devices can establish VPN connections, thereby reducing the attack surface of terminal devices.

[0043] Before step 1, you need to import the PSK (pre-shared key) into the terminal device, encrypt the PSK through the trusted module and store it persistently, and calculate the activation information for activating the terminal device. The activation information includes the identification information of the terminal device.

[0044] Specifically, the PSK is stored in the form of ciphertext on the storage medium of the terminal device, and the encryption key is stored in the trusted module; the PSK is first decrypted by the trusted module to obtain the ciphertext of the PSK; then the ciphertext of the PSK is assembled with the identification information of the terminal device to form the activation information;

[0045] The identification information of the terminal device includes the SN code and IMEI code. The activation information is generally PSK+IMEI+SN;

[0046] Enter the identification information of the terminal devices into the whitelist and VPN group in advance. Generally, the entry operation is performed by the administrator. After the server site is deployed, the administrator can log in to the server and enter the identification information of the terminal devices to be activated later into the whitelist. At the same time, a VPN group is created and the identification information of the terminal devices is entered into the VPN group.

[0047] The device activation request includes activation information. The server decodes and decrypts the device activation request to obtain the activation information. The server has a PSK file saved in advance. After decoding and decrypting the device activation request, the server obtains the PSK ciphertext and the identification information of the terminal device. First, it verifies whether the PSK ciphertext is consistent with the PSK file saved by it. If they are consistent, the identification information of the terminal device is extracted; if they are inconsistent, the request is rejected.

[0048] The server verifies whether the terminal device is in the whitelist according to the activation information, and retrieves whether there is identification information of the terminal device in the whitelist. If so, the verification is successful; otherwise, the verification fails.

[0049] In this embodiment, after the server verification is passed, the server will encrypt the connection information and send the connection information to the terminal device via https; the connection information includes the MQTT proxy address, server port number, password, device certificate, and encrypted device private key;

[0050] The terminal device decrypts the connection information and encrypts the sensitive information in the connection information using a trusted module and then stores it. The sensitive information includes the device private key, address, and server port number.

[0051] The terminal device loads the encrypted sensitive information and reports the basic device information to the server through MQTT and TLS. The basic device information includes the device type and firmware version.

[0052] The server then sends VPN connection configuration information to the terminal device via MQTT and TLS. The VPN connection configuration information includes the VPN server address, VPN service port number, and cipher suite type.

[0053] The terminal device then decrypts the VPN connection configuration information, encrypts the VPN connection configuration information using a trusted module, and stores it; the terminal device then parses the VPN connection configuration information and loads it into memory;

[0054] After that, the server sends a command to start the VPN client through MQTT and TLS, and the terminal device will start the VPN client. After the VPN client and server are authenticated based on two-way TLS, a secure tunnel will be established.

[0055] In this embodiment, after the VPN client is installed on the remote debugging host, the administrator generates and imports the corresponding secret key, device certificate, and CA certificate according to the machine code of the remote debugging host, so as to facilitate the establishment of TLS communication with the server;

[0056] On the remote debugging host, log in to the VPN client using a username and password. If the username and password are correct, start the VPN client and send a connection request to the server via https. After two-way TLS authentication, the VPN client and the server establish a secure tunnel.

[0057] In this embodiment, step 6 is also included: after completing the remote diagnosis, the server removes the identification information of the terminal device from the whitelist and the VPN group;

[0058] Specifically, the operation can be performed by an administrator. After the remote diagnosis is completed, the administrator logs into the server and removes the identification information of the terminal device from the server's whitelist and VPN group;

[0059] The server closes the remote connection function of the terminal device through MQTT and TLS; the terminal device deletes the stored keys, device certificates, and VPN connection configuration information;

[0060] At the same time, the terminal device will delete temporary files and fill the relevant memory area with random values, that is, delete the relevant information of the remote connection;

[0061] In this way, privacy data can be avoided from being exposed.

[0062] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A remote diagnosis method based on a trusted module, characterized in that: The invention relates to a terminal device, a server and a remote debugging host, wherein the terminal device has a trusted module, and the server is preset with a white list and a VPN group; and the invention comprises the following steps: Step 1: The terminal device sends a device activation request to the server; Step 2: After receiving the device activation request, the server verifies whether the terminal device is in the whitelist; if the verification fails, it replies that the request is illegal and cannot perform remote diagnosis on the terminal device; if the verification passes, it sends the VPN connection configuration information to the terminal device; Step 3: The terminal device uses a trusted module to encrypt and store the VPN connection configuration information, and the terminal device parses the VPN connection configuration information and loads it into a memory; Step 4: The server sends a command to start the VPN client to the terminal device, the terminal device starts the VPN client, and the VPN client establishes a secure tunnel with the server; Step 5: The remote debugging host starts the VPN client and sends a connection request to the specified VPN group, and the VPN client establishes a secure tunnel with the server; a virtual private network is established through two secure tunnels, allowing the remote debugging host to remotely diagnose the terminal device.

2. The remote diagnosis method based on a trusted module according to claim 1, characterized in that: The method further includes step 6: after completing the remote diagnosis, the server removes the terminal device from the whitelist; The server turns off the remote connection function of the terminal device, and the terminal device deletes the VPN connection configuration information.

3. The remote diagnosis method based on a trusted module according to claim 2, characterized in that: In step 6, the terminal device deletes the temporary file and fills the relevant memory area with a random value.

4. The remote diagnosis method based on a trusted module according to claim 1, characterized in that: Before step 1, it is necessary to import the PSK into the terminal device, encrypt the PSK through the trusted module and store it persistently, and calculate activation information for activating the terminal device, where the activation information includes identification information of the terminal device.

5. The remote diagnosis method based on a trusted module according to claim 4, characterized in that: Pre-enter the identification information of the terminal device into the whitelist and VPN group respectively; The device activation request includes activation information. The server obtains the activation information and verifies whether the terminal device is in the whitelist according to the activation information.

6. The remote diagnosis method based on a trusted module according to claim 1, characterized in that: In step 2, after the server verification is passed, the server will encrypt the connection information and send the connection information to the terminal device; The terminal device decrypts the connection information, encrypts the sensitive information in the connection information using a trusted module, and then stores the encrypted information; The terminal device loads the encrypted sensitive information and then reports basic device information to the server; The server sends VPN connection configuration information to the terminal device.

7. The remote diagnosis method based on a trusted module according to claim 6, characterized in that: The connection information includes the MQTT proxy address, port number, password, device certificate, and encrypted device private key; The sensitive information includes the device private key, address and port number; The basic device information includes device type and firmware version; The VPN connection configuration information includes a VPN server address, a port number, and a cipher suite type.

8. The remote diagnosis method based on a trusted module according to claim 6, characterized in that: The terminal device and the server communicate via https, MQTT and TLS.

9. The remote diagnosis method based on a trusted module according to claim 8, characterized in that: The VPN client and the server establish a secure tunnel based on mutual TLS authentication.

10. The remote diagnosis method based on a trusted module according to claim 1, characterized in that: In step 5, the remote debugging host uses a password to authenticate and log in to the VPN client, and the VPN client sends a connection request via https; the VPN client and the server establish a secure tunnel based on two-way TLS authentication.

Images