Method and apparatus for secure forensics in confidential computing architecture
Patent Information
- Application Number
- CN202411678164.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-03-14
Smart Images
Figure CN119622766A_ABST
Abstract
Description
Technical Field
[0001] One or more embodiments of the present specification relate to a confidential computing framework, and more particularly, to a method and apparatus for performing security forensics in a confidential computing framework. Background Art
[0002] With the development of computing technology in various industries and the increase in cloud and end users, people store a large amount of data in various computer devices. As the industry develops, people's attention to the security of devices and data is also increasing. In order to ensure the security of devices and data, various architecture manufacturers have also proposed their own solutions, such as ARM's TrustZone technology, AMD's Secure Virtual Machine Encryption Technology (SEV), Intel's Software Guard Extension (SGX) technology, and so on. These solutions provide users with a secure trusted execution environment for confidentially storing and processing data, protecting it from untrusted kernels and traditional applications. Taking Arm's TrustZone technology as an example, it regards the operating environment of traditional kernels and applications as a non-secure world, creates an isolated secure world, and defines a security layer with the highest authority for world switching. The non-secure world will not be able to directly access the secure world, and needs to be verified by the firmware of the security layer to access specific resources.
[0003] However, TrustZone systems are actually vulnerable to privilege escalation attacks and exploitable vulnerabilities. In recent years, at least hundreds of security vulnerabilities have been reported in TrustZone systems, most of which affect trusted applications and trusted operating systems in the secure world. In addition, due to the relatively large code base, TrustZone virtualization technology also exposes potential attack surfaces. By exploiting TrustZone vulnerabilities, attackers can still perform software chain attacks to control the entire system.
[0004] Digital forensics techniques can be used to examine TrustZone systems by capturing snapshots of target data, such as memory and instructions, to support background analysis and evidence collection. The lack of digital forensics tools prevents platform owners from conducting incident response or regular security scans. However, the field of security forensics for compromised TrustZone is unexplored and has unresolved challenges. Summary of the invention
[0005] One or more embodiments of this specification describe a method and apparatus for performing secure forensics in a confidential computing architecture, which is capable of performing secure digital forensics on target objects of a potentially compromised TrustZone system.
[0006] According to a first aspect, a method for performing security forensics in a platform having a confidential computing architecture is provided, wherein the confidential computing architecture includes a secure world, a domain world, a common world, and a root world; a root monitor is deployed in the root world, and a trusted zone system runs in the secure world; the method includes:
[0007] The root monitor modifies the master granularity protection table GPT so that in the modified master GPT, the access permission of the first memory segment in the secure world memory portion is set to be inaccessible; the first memory segment is used to store the code and data of the proxy module;
[0008] The root monitor creates a first GPT, which is only used for the processing core running the agent module; in the first PGT, the access permission of the first memory segment is set to belong to the secure world;
[0009] The proxy module obtains page table information of a target object and stores it in the first memory segment to execute memory acquisition of the target object; the target object is a method for managing memory of at least a part of the trusted zone system.
[0010] According to a second aspect, a device for performing security forensics in a platform having a confidential computing architecture is provided, wherein the confidential computing architecture includes a secure world, a domain world, a common world, and a root world; a root monitor is deployed in the root world, and a trusted zone system runs in the secure world; the device includes the root monitor and an agent module, wherein:
[0011] The root monitor is configured to modify a master granularity protection table GPT so that in the modified master GPT, access rights of a first memory segment in the secure world memory portion are set to be inaccessible; the first memory segment is used to store code and data of the proxy module;
[0012] The root monitor is further configured to create a first GPT, the first GPT being used only for the processing core running the proxy module; in the first PGT, the access permission of the first memory segment is set to belong to the secure world;
[0013] The proxy module is configured to obtain page table information of a target object and store it in the first memory segment to perform memory acquisition of the target object; the target object is at least a part of the trusted zone system.
[0014] According to a third aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect is implemented.
[0015] In the embodiments of this specification, the core components of the forensic system are placed in the monitor of the EL3 root world to ensure isolation. In order to reduce the code introduced into the root world, the root monitor deploys an agent module in the secure world and delegates the memory acquisition operation to the agent module for execution. In order to ensure the security of memory acquisition, the root monitor creates a protection layer through a granular protection mechanism to isolate the agent module co-located in the secure world from the TrustZone system. In this way, memory acquisition for the TrustZone system is safely executed at a low code cost. Furthermore, for memory access capture, the root monitor uses the GPC mechanism, the interrupt signal issued by the performance management unit PMU in the hardware platform, and the corresponding handler in the root monitor to jointly implement it. The root monitor also improves the security of instruction tracing by configuring the recording method of instruction tracing data. In the above manner, digital forensics of the TrustZone system is fully and securely implemented. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.
[0017] Figure 1 A schematic diagram showing the Arm confidential computing architecture;
[0018] Figure 2 Shows the access control of each world to the physical address space in the confidential computing architecture;
[0019] Figure 3 A schematic diagram showing the architecture of a forensics system according to an embodiment of this specification;
[0020] Figure 4 A schematic diagram showing the isolation of the proxy module and the TrustZone system;
[0021] Figure 5 A schematic diagram of the page table "grafting" scheme is shown;
[0022] Figure 6 A flowchart showing the capture of memory execution in one specific embodiment is shown;
[0023] Figure 7 The following is a schematic diagram showing the memory capture process for a section of instructions. DETAILED DESCRIPTION
[0024] The solution provided in this specification is described below in conjunction with the accompanying drawings.
[0025] To ensure data security, ARM provides TrustZone technology, in which the operating environment of the traditional kernel and application is regarded as a non-secure world (Normal World), an isolated secure world (Secure World) is created outside of it, and a security layer with the highest authority is defined for world switching.
[0026] Specifically, in the Armv8-A architecture, the CPU core divides exceptions into four levels based on privilege division, EL0 to EL3, where EL0 represents the application level, EL1 is used for the system kernel (kernal), EL2 represents the virtual machine manager (hypervisor), and EL3 represents the security layer monitor. These four levels can also be used to represent the permission level of the operating environment. In the TrustZone trusted zone technology, the CPU security state is divided into a non-secure (Normal) state and a secure state. EL0 and EL1 can run in any state. For example, an untrusted operating system OS (untrusted OS) can be executed in EL1 in the non-secure world, and a trusted OS can be executed in EL1 in the secure world. EL2 can be used in a secure state. EL3 is the security layer monitor, which always exists in the secure world and is used to execute the switching of the security state.
[0027] Under this architecture, the non-secure world cannot directly access the secure world and needs to be verified by the security layer monitor to access specific resources. Sensitive or confidential data and high-privilege software applications run in the secure world, thus providing a trusted execution environment TEE for these confidential data.
[0028] However, in practice, the TrustZone system may still be affected by privilege escalation attacks and exploitable vulnerabilities, thus being "damaged" and no longer trustworthy. The TrustZone system referred to in this article is the entire system running in the secure world, from the underlying hypervisor, operating system OS to the upper-level applications. For a TrustZone system that may be damaged, it is hoped that digital forensics technology can be used to analyze and record the security of the TrustZone system operation in order to conduct post-analysis or pre-warning.
[0029] Digital forensics usually includes one or more of the following: obtaining the target object's memory storage (i.e., memory acquisition), capturing the target object's memory access behavior to specific memory (memory access capture), and tracking and recording the executed instructions. Through the above forensics methods, the target object can be analyzed in the background and evidence can be collected during runtime to form its inspection record. However, the secure digital forensics of the TrustZone system faces many challenges and difficulties.
[0030] Schemes for examining the rich execution environment (REE) called the non-secure world (Normal World) in the ARM architecture have been proposed in the related art. However, it is very challenging to apply the scheme designed for the REE environment to the TrustZone system for the following reasons. First, the traditional forensics method based on the rich execution environment is blocked by the isolation of TrustZone, making it infeasible. Second, alternative methods may adopt the deployment of forensic tools in the secure world, such as tools based on TrustZone virtualization. However, the TrustZone system (including the hypervisor) is untrusted, that is, these forensic tools are not isolated from the TrustZone system under software exploitation attacks; attackers in TrustZone can still fully control these forensic tools, making them unsafe. Finally, the TrustZone Address Space Controller (TZASC) is usually configured to perform memory isolation. However, attackers in the secure world can modify the access rights based on TZASC, making TZASC insufficient to protect the forensic system.
[0031] In view of this, a solution for secure forensics of the TrustZone system is proposed in this specification, which is implemented based on the ARM confidential computing architecture CCA (Confident ia l Compute Architecture itecture). Specifically, by extending the function of the root monitor of the root world in the CCA architecture, secure forensics of the TrustZone system is achieved without modifying the hardware.
[0032] In order to clearly illustrate the solution of the embodiment, the CCA architecture and the corresponding memory isolation mechanism are first introduced.
[0033] ARM Confidential Computing Architecture CCA is part of the Armv9-A architecture. It introduces the Realm Management Extension based on the original TrustZone architecture. In addition to the non-secure world and secure world that already exist in the trusted zone technology, this extension introduces the Realm world and the Root world. In order to support the isolation of different worlds, the CCA architecture provides the Realm Management Extension RME (Realm Management Extension) component at the hardware layer to extend the isolation mode.
[0034] Figure 1 A schematic diagram of the ARM confidential computing architecture is shown. Figure 1As shown in the figure, in the ARM confidential computing agency CCA, the operating environment is divided into four worlds: secure world, non-secure world or normal world (Normal), domain world and root world. The root world monitor with the highest authority runs in the root world and is responsible for the isolation and communication between worlds. The domain world is used to provide a protected virtual machine confidential computing environment called the confidential domain for virtual machines. The domain management monitor RMM runs in the domain world and is responsible for managing the execution of domain virtual machines and the interaction with the non-secure world. Users can put virtual machines into the confidential domain as domain virtual machines to isolate illegal access from external software. Domain virtual machines are isolated from each other using virtualization technology, and RMM will be responsible for managing the accessible address space of virtual machines in different domains. Domain virtual machines do not need to trust the non-secure world and the secure world, but only need to trust the domain management monitor and the root world monitor.
[0035] Correspondingly, the Arm confidential computing architecture CCA also divides the physical address space PAS (Phys ica l addressspaces) of the memory into four worlds. Figure 2 The figure shows the access control of the physical address space by the security status of each world in the confidential computing architecture. Figure 2 As shown, the root world has the highest access rights and can access the address spaces belonging to each world. The non-secure world has the lowest access rights and can only access the address spaces of the non-secure world. The secure world and the domain world can access the address spaces of the non-secure world and the address spaces belonging to their own worlds. In addition, there is a permission level of "No-access", which is set to an inaccessible address space, and no subject in any world has the right to access it.
[0036] In the Arm confidential computing architecture, the access control of address spaces in different worlds is achieved by building a granular protection table GPT (Granu le Protection ion Table le) and performing a granular protection check GPC (Granu le Protection ion Check) based on the GPT table. Specifically, the confidential computing architecture CCA maintains a granular protection table GPT in memory, where each entry is Figure 2 The granular protection shown indicates that the GPI records the security status of a segment of physical memory at a fine-grained level. Typically, the granularity of the record is in memory pages (4KB segments). In this way, the security status and access rights of each memory page are recorded in the GPT table. When the allocation of memory pages is migrated and changed in different worlds, the entries in the GPT can be dynamically updated.
[0037] When the processor accesses the memory, the aforementioned RME component in the hardware layer performs a granular protection check GPC. During the check, the security status of the current CPU core is obtained (i.e., it is determined which world the code running on the CPU core belongs to), and the security status of the memory page requested for access is obtained by reading the GPT table, and the two are checked to see if they match. If the GPC check fails (for example, if the host OS of the non-secure world requests to access the memory of the domain world), a granular protection fault GPF (Granu le Protection ion Fau lt) signal will be issued, thereby rejecting the memory access, thereby ensuring isolation between worlds.
[0038] Based on the above Arm confidential computing architecture CCA, a solution and system for digital forensics of the TrustZone system are proposed. Figure 3 The schematic diagram of the architecture of the forensic system of the embodiment of this specification is shown. The forensic system is used to provide inspection and forensic capabilities for the TrustZone system. The forensic system runs on a platform enabled with the Arm confidential computing architecture CCA. For the sake of clarity and simplicity, Figure 3 The illustration of the domain world is omitted because it is not very relevant to the forensic system.
[0039] As mentioned above, the TrustZone system may be damaged by software attacks. In order to safely execute the forensics mechanism for the TrustZone system under possible software attacks, according to the technical concept of this solution, it is necessary to perform forensics in a protected execution environment. According to the embodiment of this specification, the core components of the forensics system are placed in the monitor of the EL3 root world to ensure isolation. The monitor located in the root world is referred to as the root monitor hereinafter.
[0040] In order to reduce the code introduced into the root world, avoid the expansion of the highest privileged level code, and reduce the trusted computing base TCB, according to an embodiment of this specification, the root monitor deploys an agent module in the secure world, namely Figure 3 The root monitor delegates the memory acquisition operation to the agent module for execution. To ensure the security of memory acquisition, the root monitor creates a protection layer through a granular protection mechanism to isolate the agent module co-located in the secure world from the TrustZone system. In this way, memory acquisition for the TrustZone system can be safely executed with a small code cost.
[0041] Furthermore, in one embodiment, the root monitor includes a memory capture module for performing memory access capture. The memory access capture is implemented by means of the GPC mechanism, the interrupt signal issued by the performance management unit PMU in the hardware platform, and the corresponding processing program in the root monitor. The specific process of memory capture will be expanded later and will not be described in detail here.
[0042] According to an embodiment, the root monitor further includes an instruction tracing module for assisting in executing instruction tracing. With regard to instruction tracing, the root monitor improves the security of instruction tracing by configuring a recording method for instruction tracing data.
[0043] Furthermore, in one embodiment, the root monitor also includes an isolation control module for ensuring the isolation and security of hardware components involved in the forensic process.
[0044] The following first describes the process of the forensic system starting a forensic session, and then elaborates on the implementation method of each forensic process in detail.
[0045] According to one implementation, the root monitor provides a local interface for authorized users (e.g., administrators) to call. The administrator can issue a forensic request by calling the interface, and through the request, indicate the specific forensic operation to be performed, such as memory acquisition and memory access capture, and can also specify the memory address to be captured, etc. In response to the forensic request, the root monitor starts the forensic operation.
[0046] According to another implementation, the root monitor supports remote initiation of forensic operations to suit remote operation scenarios. In a typical scenario of remote operation, the platform owner deploys the TrustZone system in a CCA-enabled computing platform that the platform owner owns. These computing platforms can be remote, distributed platforms such as cloud computing infrastructures, and the platform owner cannot directly interact with the computing platform in physical space. Figure 3 As shown, the platform owner can remotely initiate a forensic session using a remote host on a trusted system.
[0047] Specifically, a client is installed in the non-secure world of the computing platform, and the client is configured to communicate with the root monitor through an encrypted channel (E2EE). The platform owner uses a trusted host to connect to the client through an encrypted channel (E2EE) using a network communication interface, and the client forwards the sent data to the root monitor. Specifically, the root monitor can first obtain authentication information from the remote host, including the identity information of the platform owner (e.g., identity certificate), and perform identity authentication based on the authentication information. After the verification is passed, the platform owner can send a request to the root monitor through the client according to the needs of forensic analysis. Through the encrypted channel, the root monitor securely receives the request, starts executing the requested forensic operation, and returns the result to the host.
[0048] Root Monitor provides platform owners with basic forensic capabilities for TrustZone, including memory acquisition, memory access capture, and instruction tracing. These are described below.
[0049] First, the implementation of the Memory Acquisition function is described. Figure 3 As described above, the root monitor deploys an agent module in the secure world and delegates the agent module to implement the memory acquisition function for the TrustZone system. However, the TrustZone system itself may be subject to attacks that threaten the memory acquisition process of the agent module. Therefore, the root monitor creates a protection layer to isolate the agent module co-located in the secure world from the TrustZone system.
[0050] Specifically, as mentioned above, the physical address space PAS of the memory is divided into four worlds, and the world to which each memory page belongs and the corresponding access rights are recorded through the GPT table. In an embodiment of the present specification, a section of memory can be allocated to the proxy module in the memory segment allocated to the secure world, which is called the first memory segment. The first memory segment is used to record and store the code and corresponding data of the proxy module. In order to isolate the proxy module from the TrustZone system, a dual GPT table is used to perform memory access control.
[0051] Figure 4 The diagram of the isolation of the proxy module and the TrustZone system is shown. In order to establish isolation, the root monitor modifies the system's main GPT table so that in the modified main GPT, the access rights of the first memory segment allocated to the proxy module are set to be inaccessible (No-access). In addition, the root monitor also creates a dedicated first GPT table for the proxy module, in which the access rights of the first memory segment are set to belong to the secure world, and the other parts are the same as the main GPT table. The above two GPT tables are set to use the first GPT table only when the CPU core runs the proxy module, and use the main GPT table in other cases.
[0052] exist Figure 4 In the main GPT table, GPT M The first GPT table dedicated to the proxy module is denoted as GPT A g. From Figure 4 As you can see, GPT M With GPT A g Only the permissions of the Agent Memory segment (i.e., the first memory segment used for the agent module) are different. M In GPT, the segment is set to be inaccessible, while in A g, the segment is set to belong to the secure world.
[0053] In this way, the CPU cores running any other programs except the proxy module will use GPT M Conduct GPC verification. MThe Agent Memory section in the TrustZone system is set to be inaccessible, so no other program can access this memory section. The same is true for any program code in the TrustZone system.
[0054] GPT is used only when the CPU core is running the code of the proxy module A g, where the Agent Memory section is set to belong to the secure world, thus ensuring the normal operation of the agent module.
[0055] It is understandable that the above two GPT tables are generally stored in the root world segment of the memory. The root monitor can configure which GPT table the CPU core uses by setting the register TTBR in the CPU core that is dedicated to recording the base address of the GPT table.
[0056] By using the above dual GPT tables to perform different access controls, although the proxy module and the TrustZone system belong to the same secure world, there is isolation of memory access. In particular, the TrustZone system cannot access the memory area where the proxy module is located, ensuring that the proxy module can safely perform memory acquisition.
[0057] Generally, in the memory acquisition process, to obtain the memory storage content of the target object, it is necessary to first obtain its page table. Therefore, the proxy module can obtain the page table information of the target object and store it securely in the first memory segment to perform memory acquisition of the target object. The target object can be at least a part of the TrustZone system as the inspection object, for example, it can be a hypers ior in the TrustZone system, or an operating system OS, or an application on the OS, or a combination of the above, which is not limited here.
[0058] In one embodiment, the root monitor authorization agent module directly obtains the page table of the target object and performs memory reading and analysis based on the page table of the target object. It is understandable that the page table records the mapping relationship between the virtual address and the physical address allocated to the program. When the root monitor at the EL3 level uses the page table to analyze and check the memory, the page table can be used to first convert the virtual address VA of the analysis object in the virtual space of the target object (TrustZone system or part thereof) to the virtual address VA of the target object (TrustZone system or part thereof). TZ Translate to physical address PA TZ , this process can be recorded as VA TZ ->PA TZ Then, the physical address is mapped to the virtual address VA of the virtual space of the EL3 root monitor. EL3 , that is, execute PA TZ ->VA EL3 , thereby performing the analysis in EL3.
[0059] In order to further optimize memory acquisition and reduce extra operations, in one embodiment, a page table "grafting" solution is used to avoid the above translation and mapping operations and improve acquisition efficiency. This is designed for the multi-level page table currently used by the mainstream, taking advantage of the unique advantage that the proxy module and TrustZone both belong to the secure world.
[0060] As known to those skilled in the art, a multi-level page table uses page tables of multiple levels to record address mapping relationships. In a multi-level page table, the virtual space is divided into multiple levels, and the corresponding virtual address is divided into multiple parts, each of which corresponds to a different level of space and page table index. The high-order part of the virtual address is used to index the highest-level page table, while the low-order part is used to index the lower-level page table. Each level of the page table contains a pointer to the next level of the page table (pointing to the memory address of the next level of the page table), until the last level of the page table points to the actual physical page number.
[0061] Specifically, the L0-level page table is the highest-level page table, typically containing 512 page table entries. Each page table entry at the L0 level corresponds to a segment of virtual space, and contains the physical memory address of the L1-level page table used to index the segment of virtual space as a pointer. The page tables of each level are arranged layer by layer in a tree-like manner until the lowest-level page table, in which the page table entries point to the page numbers of the physical memory. Typically, an entry at the L0 level can be used to index 512GB of the L4 level or 1GB of the L3 level virtual memory space. In a system that performs permission control, each page table entry in the page table also contains the configured permission information.
[0062] like Figure 5 As shown, in order to optimize memory acquisition, in one embodiment of the present specification, the agent module can obtain the L0-level page table of the target object (hereinafter referred to as the target L0-level page table), and copy its page table entries to the new L0-level page table L0 in the memory segment dedicated to the agent module (the aforementioned first memory segment Agent Memory). A In the case where the L0 level page table of the target object contains permission information, the proxy module removes the permission information and only retains the value of the pointer in the page table entry.
[0063] More specifically, the proxy module can read the first base address from the page table base address register TTBR of the target processing core when the target processing core running the target object is suspended, and obtain the target L0 level page table through the first base address, so as to perform the above-mentioned copy operation. The target processing core can be suspended in many ways, for example, the root monitor controls some hardware units to send an interrupt signal to force the target processing core to be suspended.
[0064] Generally, the target L0-level page table will not be completely filled. AThere will be several empty page table entries in g. Next, L0 A Several empty page table entries in the g page table are set to point to the next level page table of the proxy module itself, namely the L1 page table. This part of the page table content records the mapping relationship in the memory space allocated for the proxy module, which is used to associate the code and data of the proxy module with its allocated physical memory segment. This part of the mapping can be called local mapping. The page table obtained in this way can be used as the page table used by the proxy module. To this end, the TTBR ( Figure 5 The proxy TTBR shown is set to point to L0 A g The base address of the page table in memory.
[0065] So, like Figure 5 As shown, the grafted total L0 level page table L0 A g contains two mapping parts. The white part is the target mapping, and the value in its page table entry is copied from the target L0-level page table of the target object. Like the target L0-level page table, the pointer value in this part of the page table entry points to the physical address in the segment allocated for the TrustZone system in the secure PAS, and the physical address stores the L1-level page table of the target object. Through the target mapping part, the physical memory of the target object can be addressed step by step. The gray part is the local mapping, and the pointer value in its page table entry points to the physical address in the aforementioned first memory segment in the secure PAS, and the physical address stores the L1-level page table of the proxy module.
[0066] In some embodiments, the entire system adopts a two-stage address translation mechanism. In this case, the target L0 level page table of the aforementioned target object and the integrated L0 level page table L0 A g are the second-stage page tables in the two-stage address translation mechanism (stage-2 page tables).
[0067] It can be understood that since both the TrustZone system and the proxy module belong to the secure world, the corresponding page tables also belong to the secure PAS, which provides a basis for the grafting and integration of the two parts of the page table. Since the page table of the target object in the TrustZone system is integrated into the page table used by the proxy module, it is equivalent to directly performing memory acquisition and analysis in the virtual space of the proxy module, thereby avoiding the aforementioned additional steps of first translating and then mapping, and improving the efficiency of memory acquisition.
[0068] As mentioned above, the root monitor implements secure memory acquisition without significantly increasing the root world code by deploying an agent module isolated from the TrustZone system in the secure world. Furthermore, the performance of memory acquisition and analysis is further improved through an optimized page table grafting solution.
[0069] The implementation of memory access capture is described below. Memory access capture includes capturing the execution / read / write operations of the specified target memory address. In order to perform memory access capture, one idea is to use the granularity check GPC mechanism in the confidential computing architecture ACC to detect access to the target segment memory. However, this faces the following difficulties and challenges, namely, the GPT table used for memory access control under the GPC mechanism has a page (4k size) as the minimum granularity, however, the target memory address that needs to be captured is generally one or several rows in a page, which is much smaller than the granularity of the page. Therefore, in the embodiments of the present specification, with the help of the hardware component performance monitoring unit PMU, the GPC mechanism and the interrupt handling mechanism are used to implement memory access capture.
[0070] The Performance Monitoring Unit (PMU) is a commonly used hardware component in the Arm architecture that uses a set of performance counter registers to track CPU events. Each architecture defines a set of standard events with a corresponding number of events. When the performance counter register reaches its capacity, the Performance Monitor Interrupt (PMI) signal is triggered.
[0071] The Generic Interrupt Controller (GIC) is the central resource for managing interrupts in the system. The GIC can enable, disable, or forward interrupt signals from hardware resources. Logically, the GIC includes a distributor and a CPU interface, where the distributor can gather all interrupt signals, prioritize / sort them, and forward the highest priority interrupt signals to the CPU processing core.
[0072] The above hardware resources can be used in combination with the GPC mechanism to implement internal access capture. Specifically, the platform owner or analyst can set a specific address, hereinafter referred to as the first address, as the address to be captured through the aforementioned forensic request. In response to such a request, the root monitor can set the access rights of the first memory page containing the first address in the aforementioned master GPT to be inaccessible. Subsequently, if an access operation to the first memory page occurs, a granular protection fault GPF (Granu le Protection ion Fau lt) will be triggered. Therefore, the root monitor performs a configuration operation so that subsequent access to the first memory page triggers the performance monitoring unit PMU to generate a performance monitoring interrupt PMI signal. Thereby, the PMI signal handler (PMIhandler) suspends the access operation when it is determined that the current access address matches the first address.
[0073] Figure 6A flowchart for capturing memory execution in a specific embodiment is shown. Figure 6 As shown, in step S601, according to the first address set in the forensic request, the access permission of the first memory page containing the first address is set to inaccessible. During the execution of the target object of the TrustZone system, it is assumed that the program executes an instruction, which is stored at the second address, and the second address is located in the above-mentioned first memory page. At this time, in step S602, an instruction execution request for the second address in the first memory page is received. As mentioned above, since the first memory page is set to inaccessible in the main GPTM table, the execution request for the second address will trigger the granular protection fault GPF, and the process will be transferred to the GPF program (GPF handler) in the root monitor for handling GPF faults for further processing.
[0074] In step S603, the GPF handler program determines whether the second address matches the set capture target first address. If they match, the instruction execution is suspended and the execution of the target address is captured. If the two do not match, it means that the program requests to execute another address that is located in the same memory page as the target address. In order not to hinder the normal execution of the program code and to ensure that the target address can be captured, the root monitor performs configuration operations. First, in step S604, the root monitor restores the access rights of the first memory page in the main GPT table to accessible, and executes the current instruction in step S605. In addition, in step S606, the root monitor activates the PMU, that is, sets its register to a state that is about to overflow, so that the execution of subsequent instructions will trigger the PMU to generate a PMI signal.
[0075] In a specific example, the root monitor configures the event counter register of the PMU, which counts the PMU_CPU_CYCLES event, which indicates each instruction execution. The value set by the root monitor for the event counter register can be the maximum value before overflow, such as 0xffffffff. In this way, once a subsequent instruction is executed, the event register will overflow, triggering the PMU to generate a PMI signal.
[0076] It should be noted that the root monitor can pre-configure the interrupt controller GIC to ensure that the GIC routes the PMI signal to EL3 where the root monitor is located. In addition, the root monitor can also adjust the GIC priority register to assign the highest priority to the above PMI interrupt to ensure that the CPU responds to it immediately. The configuration of the GIC can be performed in advance.
[0077] After the PMU is activated in step S606, the next instruction is executed as the program counter increments in step S607. As mentioned above, since the PMU has been activated to a state of overflow, the execution of the next instruction will cause the PMU to issue a PMI signal. The GIC routes the PMI signal to the PMI handler in the root monitor.
[0078] In step S608, the PMI handler determines whether the address of the currently executed instruction matches the first address. If it matches, the target address execution is captured. Specifically, the execution of the current instruction is suspended, the root monitor records this instruction, notifies the analyst, and waits for instructions for further operations. If it does not match, then in step S609, it is determined whether the address of the currently executed instruction has exceeded the first memory page. If not, then in step S610, the PMU is reactivated, that is, its register is set to a state of overflow again, and then, it returns to step S607 and continues to execute the next instruction. Until it is determined in step S609 that the instruction address has exceeded the first memory page, at this time, in step S611, the access permission of the first memory page is modified back to inaccessible.
[0079] Combine the following Figure 7 The above capture process is described in an example. Figure 7 This example shows a section of instructions that have been loaded into the memory. The black square in the upper left corner is the target address set by the analyst to be captured. Figure 7 In stage (1), the entire memory page containing the target address (i.e., the first memory page mentioned above) is set to be inaccessible in the main GPT table, which is shown in gray. The numbers 0x2000, 0x2004, etc. on the left represent the program counter value, where the program counter value in the black box indicates the currently executed instruction.
[0080] In stage (1), the program requests to execute instruction 1 at 0x2000. The address of instruction 1 is located in the first memory page. Since the first memory page is set to be inaccessible, the execution request for instruction 1 will trigger GPF. Figure 6 As shown in step S603, the GPF handler determines that the address of the current instruction 1 is different from the target address, so the root monitor sets the first memory page to be accessible and executes the instruction 1. In addition, the root monitor activates the PMU. Figure 7 As shown in stage (2), the access prohibition of the first memory page is eliminated and is no longer displayed in gray, and instruction 1 is executed. In addition, the PMU is activated.
[0081] Next, the program counter increments to 0x2004 and executes the next instruction, instruction 2. At this point, the PMU is triggered and generates a PMI signal. In steps S608 and S609, the PMI handler determines that the address of instruction 2 is different from the target address and is still in the first memory page range, so it reactivates the PMU and returns to step S607 to execute the next instruction.
[0082] Then, the program counter increments to 0x2008 and executes the next instruction, instruction 3. Once again, the PMU is triggered and generates a PMI signal. In step S608, the PMI handler finds that the address of the current instruction 3 is exactly the set target address, so it pauses execution, submits the record, and waits for the operation instruction. Figure 7 This is shown in stage (3) in .
[0083] If the program receives an instruction from the analyst to continue execution after the pause, the program continues to execute until it reaches 0x3000, where it can be determined that the first memory page has been exceeded. At this time, the first memory page is modified back to an inaccessible state, as shown in stage (4).
[0084] The capture of memory execution is described above with examples. The capture of memory read / write is similar, where the root monitor sets the GPT entry corresponding to the memory page (still referred to as the first memory page) containing the specified target address to inaccessible. In the GPF handler of the root monitor, the EC bit and ISS bit of the ESR_EL3 register are used to identify and distinguish memory read / write operations. For GPF caused by memory read / write access, the root monitor uses the ELR_EL3 register to identify the instruction address that initiates the GPF, and uses the FAR_EL3 register to locate the address of the accessed memory. When the access address does not match the target address, the root monitor similarly modifies the access rights of the first memory page in the main GPT table to allow read / write operations, and performs activation settings similar to the above for the PMU. Thus, the access operation can be executed, thereby triggering the PMU to issue a PMI interrupt. In the case of address mismatch, the root monitor deactivates the PMU and sets the first memory page to inaccessible again in the main GPT table. Thus, it is ensured that subsequent access operations to the memory can generate corresponding triggers and be captured.
[0085] The above describes the capture of memory access in forensic operations. The following describes another component of forensic operations, instruction tracing.
[0086] In digital forensics or security scanning, control flow analysis is very important for understanding the execution of the target object. The process of capturing control flow is usually called instruction tracing. In the embodiments of this specification, the root monitor can use the hardware component introduced in Armv9, the Embedded Trace Extension ETE (Embedded Trace Extension) to support instruction tracing. The ETE component supports instruction tracing for PASs of different exception levels (including EL0-EL2) and different worlds (including normal world, secure world and domain world).
[0087] In order to allow the capture and tracing of specific content during the execution of the target object, the root monitor can provide an interface API for configuring the tracing function of the ETE, so that analysts can focus on specific memory address ranges or exception levels of interest through ETE filters. In Armv9, the newly introduced component trace buffer extension TRBE (TraceBuffer Extension) can store captured ETE trace data in system memory. However, this does not prevent the trace data from being tampered with. A compromised TrustZone system can also access the memory cache used by TRBE, because this cache must belong to the same world PAS segment as the target object in the TrustZone system, that is, both belong to the secure world PAS.
[0088] In order to protect the trace data, in an embodiment of the present specification, the root monitor configures the ETE component to send the acquired instruction trace data to a dedicated on-chip cache, and sets the on-chip cache to be accessible only through dedicated registers. The above-mentioned dedicated registers are securely set to be accessible only to the root monitor. The memory of the root monitor is located in the root world, so that any object in the secure world, including the operating system and hypervisor, cannot access the instruction trace data, ensuring its security.
[0089] In the above digital forensics process, some hardware components are selectively used to assist according to the needs of the forensics operation. These hardware components include the aforementioned performance monitoring unit PMU, interrupt controller GIC, and embedded trace extension ETE. However, high-privilege adversaries in a compromised TrustZone system can also access these hardware components, which potentially causes the risk of these hardware components being tampered with. In order to ensure the security of these hardware components, such as Figure 3 As shown, according to one embodiment, an isolation control module is provided in the root monitor to ensure the isolation and security of the hardware components involved in the forensic process.
[0090] Analysis shows that the hardware components in the CCA platform can generally be accessed through system registers and / or memory-mapped MMIO. Specifically, the PMU can be accessed through both system registers and MMIO, the ETE can only be accessed through system registers, and the GIC can only be accessed through MMIO. For these two access methods, the above isolation control module performs isolation security settings in different ways.
[0091] As mentioned above, both PMU and ETE can be accessed through system registers. In order to ensure the isolation security of hardware components, in an embodiment of the present specification, the isolation control module in the root monitor can configure the target registers dedicated to permission management in the system so that only the root monitor can access the system registers of PMU and ETE. Specifically, the MDCR_EL3 register can manage interrupt routing and control other security states; and the CPTR_EL3 register can be used to control access rights to the coprocessor and access rights to the system registers. The hardware component Debugv8p4 can implement the configuration of the fields in the MDCR_EL3 and CPTR_EL3 registers. Based on this, the isolation control module can use the hardware component to configure the above-mentioned target registers. More specifically, the TPM bit of the MDCR_EL3 register and the TTA bit of the CPTR_EL3 register can be configured to ensure that during the forensic operation, only the root monitor can access the system registers of PMU and ETE.
[0092] On the other hand, both PMU and GIC can be accessed through memory-mapped MMIO. In order to prevent privileged adversaries from tampering with the configuration of PMU and GIC, according to an embodiment of this specification, the isolation control module in the root monitor sets the memory-mapped MMIO segments corresponding to PMU and GIC in the aforementioned master GPT to belong to the root world. In this way, the TrustZone system in the secure world has no access to the corresponding MMIO segments, ensuring the security of accessing PMU and GIC through MMIO.
[0093] Through the above settings of the isolation control module, the hardware components used in the forensic process are isolated from the TrustZone system (objects in other lower-privilege worlds are of course even less accessible), ensuring the security of the forensic process and forensic data.
[0094] Reviewing the above, in the embodiments of this specification, the core components of the forensic system are placed in the monitor of the EL3 root world to ensure isolation. In order to reduce the code introduced into the root world, the root monitor deploys an agent module in the secure world and delegates the memory acquisition operation to the agent module for execution. In order to ensure the security of memory acquisition, the root monitor creates a protection layer through a granular protection mechanism to isolate the agent module co-located in the secure world from the TrustZone system. In this way, memory acquisition for the TrustZone system is safely executed at a lower code cost. For memory access capture, the root monitor uses the GPC mechanism, the interrupt signal issued by the performance management unit PMU in the hardware platform, and the corresponding handler in the root monitor to jointly implement it. The root monitor also improves the security of instruction tracing by configuring the recording method of instruction tracing data. In the above manner, digital forensics of the TrustZone system is fully and securely implemented.
[0095] On the other hand, corresponding to the above method process, the embodiment of this specification also discloses a device for performing security forensics in a platform with a confidential computing architecture, wherein the confidential computing architecture includes a secure world, a domain world, a common world, and a root world; a root monitor is deployed in the root world, and a trusted zone system runs in the secure world; the device includes the root monitor and an agent module: wherein:
[0096] The root monitor is configured to modify a master granularity protection table GPT so that in the modified master GPT, access rights of a first memory segment in the secure world memory portion are set to be inaccessible; the first memory segment is used to store code and data of the proxy module;
[0097] The root monitor is further configured to create a first GPT, the first GPT being used only for the processing core running the proxy module; in the first PGT, the access permission of the first memory segment is set to belong to the secure world;
[0098] The proxy module is configured to obtain page table information of a target object and store it in the first memory segment to perform memory acquisition of the target object; the target object is at least a part of the trusted zone system.
[0099] In a specific implementation, the root monitor may also include a memory access capture module, configured to: in response to a request to set the first address as the address to be captured, set the access permission of the first memory page in the master GPT to be inaccessible; the first memory page contains the first address; in response to an access operation to the first memory page, perform a configuration operation so that subsequent access to the first memory page triggers the performance monitoring unit PMU to generate a performance monitoring interrupt PMI signal; and the PMI signal handler suspends the access operation when it is determined that the current access address matches the first address.
[0100] For the specific implementation of the above device, please refer to Figures 3 to 7 The implementation process described will not be repeated here.
[0101] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores an executable code, and when the processor executes the executable code, the Figures 3 to 7 Describe the evidence collection method.
[0102] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.
[0103] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.
Claims
1. A method for performing security forensics in a platform with a confidential computing architecture, wherein the confidential computing architecture includes a secure world, a domain world, a common world, and a root world; a root monitor is deployed in the root world, and a trusted zone system runs in the secure world; the method includes: The root monitor modifies the master granularity protection table GPT so that in the modified master GPT, the access permission of the first memory segment in the secure world memory portion is set to be inaccessible; the first memory segment is used to store the code and data of the proxy module; The root monitor creates a first GPT, which is only used for the processing core running the agent module; in the first PGT, the access permission of the first memory segment is set to belong to the secure world; The proxy module obtains page table information of a target object and stores it in the first memory segment to perform memory acquisition of the target object; the target object is at least a part of the trusted zone system.
2. The method according to claim 1, wherein: A client is deployed in the common world; before the proxy module obtains the page table information of the target object, the method further includes: The client receives a forensic request from a remote host and forwards it to the root monitor via an encrypted channel; The root monitor runs the agent module in response to the forensic request.
3. The method according to claim 2, further comprising, before receiving the evidence collection request: The client receives authentication information from the remote host, including identity information of the platform owner; The root monitor verifies the authentication information.
4. The method according to claim 1, wherein: The proxy module obtains page table information of the target object, including: The proxy module copies the page table entry of the target L0-level page table of the target object to the first L0-level page table in the first memory segment; Several empty page table entries in the first L0 level page table are set to point to the next level page table of the proxy module itself.
5. The method according to claim 4, wherein: The proxy module copies the page table entry of the target L0-level page table of the target object to the first L0-level page table in the first memory segment, including: The proxy module obtains the target L0-level page table, removes the permission information of each page table entry therein, and copies the obtained information to the first L0-level page table.
6. The method according to claim 4, wherein: The proxy module copies the page table entry of the target L0-level page table of the target object to the first L0-level page table in the first memory segment, including: In the case that the target processing core running the target object is suspended, the proxy module reads a first base address from a page table base address register of the target processing core, obtains the target L0 level page table through the first base address, and performs the copying.
7. The method according to claim 4, wherein: The target L0-level page table and the first L0-level page table are both second-stage page tables in a two-stage address translation mechanism.
8. The method according to claim 1, further comprising: In response to a request to set the first address as the address to be captured, the root monitor sets the access permission of the first memory page in the primary GPT to be inaccessible; The first memory page includes the first address; In response to an access operation to the first memory page, the root monitor performs a configuration operation so that subsequent access to the first memory page triggers a performance monitoring unit PMU to generate a performance monitoring interrupt PMI signal; The PMI signal processing program suspends the access operation to the current access address when determining that the current access address matches the first address.
9. The method according to claim 8, further comprising: The interrupt controller GIC routes the PMI signal to the root monitor according to the configuration of the root monitor.
10. The method according to claim 1, further comprising: The root monitor configures the embedded trace extension (ETE) component to send the acquired instruction trace data to a dedicated on-chip cache, and sets the on-chip cache to be accessible only through dedicated registers.
11. The method according to claim 9, further comprising: The root monitor sets the memory-mapped MMIO segments corresponding to the PMU and the GIC in the master GPT to belong to the root world.
12. The method according to claim 8, wherein: The system registers of the PMU are set so that only the root monitor has access.
13. The method according to claim 10, wherein: The system registers of the ETE are set so that only the root monitor has access.
14. A device for performing security forensics in a platform with a confidential computing architecture, wherein the confidential computing architecture includes a secure world, a domain world, a common world, and a root world; a root monitor is deployed in the root world, and a trusted zone system runs in the secure world; the device includes the root monitor and an agent module, wherein: The root monitor is configured to modify a master granularity protection table GPT so that in the modified master GPT, access rights of a first memory segment in the secure world memory portion are set to be inaccessible; the first memory segment is used to store code and data of the proxy module; The root monitor is further configured to create a first GPT, the first GPT being used only for the processing core running the proxy module; in the first PGT, the access permission of the first memory segment is set to belong to the secure world; The proxy module is configured to obtain page table information of a target object and store it in the first memory segment to perform memory acquisition of the target object; the target object is at least a part of the trusted zone system.
15. A computing device, comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 13 is implemented.