Information system measurement processing method and device, server and medium

Abstract

The invention discloses an information system measurement processing method and device, a server and a medium, and relates to the technical field of computers.The execution environment of software is divided into a trusted execution environment and a non-trusted execution environment, and a measurement client application requests a measurement trusted application to obtain a measurement configuration file; and acquiring memory data according to the measurement configuration file, generating a measurement verification request, verifying a measurement value in the measurement verification request by measuring the trusted application in the trusted execution environment, comparing the measurement value with a reference value, generating a measurement verification result, and sending the measurement verification result to the measurement client application. The measurement log is generated by measuring the client application, compared with the prior art, the trusted execution environment is created, the operation of calculating the measurement value and comparing the reference value is executed by measuring the trusted application in the trusted execution environment, the process of calculating and comparing the reference value is prevented from being attacked, and the accuracy of the measurement result is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an information system metric processing method, device, server and medium. Background Art

[0002] With the development of the information industry, software running in information systems inevitably have vulnerabilities. Once exploited by attackers, software vulnerabilities will affect the business functions of the system. Dynamic measurement is a method of detecting attack behaviors. It monitors the operating status and system parameters of the system in real time in a dynamic way, and compares the measurement value with the baseline value to detect attack behaviors.

[0003] In the current related technology, the system data to be measured is obtained through the measurement configuration file, the system data to be measured is calculated, and the measurement result is obtained by comparing it with the reference value, and the measurement result is written into the trusted platform module. However, in the related technology, the process of measuring the configuration file and calculating the system data is vulnerable to attack, resulting in a decrease in the accuracy of the measurement result. Summary of the invention

[0004] The present application provides an information system measurement processing method, device, server and medium to at least solve the problem of reduced accuracy of measurement results in related technologies.

[0005] The present application provides an information system measurement processing method, which is applied to measure trusted applications, including:

[0006] receiving a request for obtaining a measurement configuration file sent by a trusted execution environment operating system;

[0007] generating a retrieval instruction according to the request to obtain the metric configuration file;

[0008] Sending the retrieval instruction to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted measurement configuration file according to the retrieval instruction, and decrypts the encrypted measurement configuration file to obtain the measurement configuration file;

[0009] Receiving the measurement configuration file sent by the trusted execution environment operating system;

[0010] storing the metric configuration file, and generating a first shared storage address according to the metric configuration file;

[0011] Sending the first shared storage address to the trusted execution environment operating system, so that the trusted execution environment operating system sends the first shared storage address to the firmware layer, the first shared storage address is used to instruct the firmware layer to switch the trusted execution environment to the non-trusted execution environment, and send the first shared storage address to the trusted execution environment driver, the first shared storage address is used to instruct the trusted execution environment driver to send the first shared storage address to the measurement client application, the first shared storage address is used to instruct the measurement client application to obtain a measurement configuration file according to the first shared storage address, and generate a measurement verification request according to the measurement configuration file;

[0012] receiving the metric verification request sent by the metric client application;

[0013] generating a measurement result according to the measurement verification request;

[0014] The measurement result is sent to the measurement client application, so that the measurement client application generates a measurement log according to the measurement result.

[0015] The present application also provides an information system measurement processing device, which is applied to measure trusted applications, including:

[0016] A first receiving module is used to receive a request for obtaining a measurement configuration file sent by a trusted execution environment operating system;

[0017] A first generating module, configured to generate a retrieval instruction according to the request for obtaining a metric configuration file;

[0018] A first sending module, configured to send the retrieval instruction to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted measurement configuration file according to the retrieval instruction, and decrypts the encrypted measurement configuration file to obtain the measurement configuration file;

[0019] A second receiving module, configured to receive the measurement configuration file sent by the trusted execution environment operating system;

[0020] A storage module, used to store the measurement configuration file and generate a first shared storage address according to the measurement configuration file;

[0021] a second sending module, configured to send the first shared storage address to the trusted execution environment operating system, so that the trusted execution environment operating system sends the first shared storage address to the firmware layer, the first shared storage address is used to instruct the firmware layer to switch the trusted execution environment to the non-trusted execution environment, and send the first shared storage address to the trusted execution environment driver, the first shared storage address is used to instruct the trusted execution environment driver to send the first shared storage address to the measurement client application, the first shared storage address is used to instruct the measurement client application to obtain a measurement configuration file according to the first shared storage address, and generate a measurement verification request according to the measurement configuration file;

[0022] A third receiving module, configured to receive the measurement verification request sent by the measurement client application;

[0023] A second generating module, configured to generate a measurement result according to the measurement verification request;

[0024] The third sending module is used to send the measurement result to the measurement client application, so that the measurement client application generates a measurement log according to the measurement result.

[0025] The present application also provides a server, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned information system metric processing methods when executing the computer program.

[0026] The present application also provides a computer-readable storage medium, in which a computer program is stored, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned information system measurement processing methods are implemented.

[0027] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned information system metric processing methods when executed by a processor.

[0028] Through this application, the execution environment of the software is divided into a trusted execution environment and a non-trusted execution environment. A measurement client application requests a measurement trusted application to obtain a measurement configuration file. According to the measurement configuration file, memory data is collected and a measurement verification request is generated. The measurement value in the measurement verification request is verified in the trusted execution environment by the measurement trusted application, and compared with the benchmark value to generate a measurement verification result. The measurement verification result is sent to the measurement client application, and a measurement log is generated by the measurement client application. Compared with the prior art, a trusted execution environment is created. In the trusted execution environment, the measurement trusted application is used to perform operations of calculating measurement values ​​and comparing benchmark values, so that the process of calculating and comparing benchmark values ​​is avoided from being attacked, and the accuracy of the measurement results is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 A schematic diagram of an application scenario of the information system measurement processing method provided in an embodiment of the present application;

[0031] Figure 2 Schematic diagram of the process of the information system measurement processing method provided in the embodiment of the present application Figure 1 ;

[0032] Figure 3 Schematic diagram of the process of the information system measurement processing method provided in the embodiment of the present application Figure 2 ;

[0033] Figure 4 A system structure diagram of dynamic measurement provided by an embodiment of the present application;

[0034] Figure 5 Schematic diagram of the process of the information system measurement processing method provided in the embodiment of the present application Figure 3 ;

[0035] Figure 6 A schematic diagram of an interactive process of an information system measurement processing method provided by an embodiment of the present application;

[0036] Figure 7 A schematic diagram of an interactive process of an information system measurement processing method provided by another embodiment of the present application;

[0037] Figure 8 A schematic diagram of the structure of an information system metric processing device provided in an embodiment of the present application;

[0038] Fig. 9 A schematic diagram of the structure of the server provided for this application. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] It should be noted that, in the description of this application, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0041] First, the terms involved in this application are explained:

[0042] Measure Trusted Application: measureTA (measure Trusted Application), runs in the trusted execution environment, calculates measurement values, and interacts with the trusted execution environment operating system.

[0043] Trusted execution environment Operating System: TEEOS (Trusted execution environment Operating System), a security mechanism built into a computing system, creates a secure environment through hardware technology to ensure the security of the code and data running in it, and prevent attackers from accessing or tampering with it.

[0044] The measurement client application: measureCA (measure Client Application), runs in a non-trusted execution environment and obtains the data to be measured in the memory.

[0045] Firmware layer: Firmware / security monitor layer, which switches between the trusted execution environment and the untrusted execution environment through SMC (Secure Monitor Call) instructions.

[0046] Trusted execution environment driver: TEEDriver (Trusted execution environment Driver), the TEE driver in the system, switches the program's running environment through the firmware layer.

[0047] Firmware Trusted Platform Module: fTPM (firmware Trusted Platform Module), a module that provides hardware-level encryption and security functions to protect the system's startup process and prevent unauthorized access and tampering.

[0048] In order to solve the problem of reduced accuracy of measurement results in the prior art, the embodiments of the present application propose the following technical concepts: the inventor considers dividing the computer environment into two sides: a non-trusted execution environment side and a trusted execution environment side, deploying a measurement client application and a trusted execution environment driver on the non-trusted execution environment side, deploying a measurement trusted application, a trusted execution environment operating system and a firmware trusted platform module on the trusted execution environment side, and implementing the switching between the trusted execution environment and the non-trusted execution environment through the firmware layer, considering that the measurement client application obtains a measurement configuration file from the measurement trusted application, the measurement configuration file is encrypted and stored in the trusted execution environment operating system, and the measurement configuration file is decrypted by the trusted execution environment operating system, considering that the measurement configuration file is stored in a shared storage address by the measurement trusted application, the measurement client application obtains the data content to be collected by accessing the shared storage address, and collects the corresponding data to be measured according to the data content to be collected, generates a measurement verification request according to the data to be measured, the firmware layer converts the computing environment into a trusted execution environment, calculates the measurement value by the measurement trusted application, generates the measurement result, and returns the measurement result to the measurement client application, and generates a measurement log. Compared with the prior art, the measurement trusted application performs the operation of calculating the measurement value and comparing the benchmark value in the trusted execution environment, avoids the process of calculating and comparing the benchmark value from being attacked, and improves the accuracy of the measurement result.

[0049] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0050] In conjunction with the specific application environment architecture or the specific hardware architecture on which the execution of the information system measurement processing method depends, the specific application environment architecture or the specific hardware architecture is described herein. Figure 1 , Figure 1 A schematic diagram of an application scenario of the information system measurement processing method provided in an embodiment of the present application.

[0051] like Figure 1 As shown, the scenario includes: a measurement client application 101 , a trusted execution environment driver 102 , a firmware layer 103 , a trusted execution environment operating system 104 and a measurement trusted application 105 .

[0052] The measurement client application 101 and the trusted execution environment driver 102 are located in the non-trusted execution environment, and the trusted execution environment operating system 104 and the measurement trusted application 105 are located in the trusted execution environment.

[0053] Specifically, the measurement client application 101 sends a request to obtain the measurement configuration file to the trusted execution environment driver 102, and the trusted execution environment driver 102 sends the request to obtain the measurement configuration file to the firmware layer 103. The firmware layer 103 switches the non-trusted execution environment to the trusted execution environment, and sends the request to obtain the measurement configuration file to the trusted execution environment operating system 104. The trusted execution environment operating system 104 verifies the authority of the measurement client application 101. If the verification is successful, the request to obtain the measurement configuration file is sent to the measurement trusted application 105. The measurement trusted application 105 generates a retrieval instruction and sends the retrieval instruction to the trusted execution environment operating system 104. The trusted execution environment operating system 104 generates a retrieval instruction according to the retrieval instruction. The encrypted measurement configuration file is obtained, and the measurement configuration file is decrypted to obtain the measurement configuration file, and the measurement configuration file is sent to the measurement trusted application 105. The measurement trusted application 105 stores the measurement configuration file and generates a first shared storage address, and the first shared storage address is sent to the measurement client application 101 through the firmware layer 103 and the trusted execution environment driver 102 in sequence. The measurement client application 101 obtains the data to be measured according to the measurement configuration file, generates a measurement verification request, and sends the measurement verification request to the measurement trusted application 105. The measurement trusted application 105 generates a measurement result according to the measurement verification request, and sends the measurement result to the measurement client application 101. The measurement client application 101 generates a measurement log according to the measurement result.

[0054] Figure 2 Schematic diagram of the process of the information system measurement processing method provided in the embodiment of the present application Figure 1 The execution subject of this embodiment can be a trusted measurement application, and this embodiment is not particularly limited here. Figure 2 As shown, the method includes:

[0055] S201: Receive a request for obtaining a measurement configuration file sent by a trusted execution environment operating system.

[0056] In this embodiment, the request to obtain the metric configuration file is generated by the metric client application, and the metric client application sends the request to obtain the metric configuration file to the trusted execution environment driver.

[0057] In this embodiment, the trusted execution environment driver generates an SMC request according to the request to obtain the metric configuration file, and sends the SMC request recording the request to obtain the metric configuration file to the firmware layer.

[0058] In this embodiment, after receiving the SMC request, the firmware layer triggers an instruction to switch the non-trusted execution environment to the trusted execution environment, and simultaneously sends a request to obtain a measurement configuration file to the trusted execution environment operating system.

[0059] Specifically, the trusted execution environment operating system verifies the measurement client application according to the request for obtaining the measurement configuration file, and verifies whether the measurement client application has the authority to call the measurement trusted application in the trusted execution environment operating system.

[0060] If the verification is successful, the trusted execution environment operating system sends a request to obtain the measurement configuration file to the measurement trusted application.

[0061] Specifically, a request for obtaining a measurement configuration file sent by a trusted execution environment operating system is received by way of wireless communication.

[0062] S202: Generate a retrieval instruction according to the request for obtaining the metric configuration file.

[0063] In this embodiment, the measurement trusted application includes a measurement module and a storage module.

[0064] Specifically, the storage module in the measurement trusted application generates a retrieval instruction and calls a secure storage function in the trusted execution environment operating system.

[0065] S203: Sending a retrieval instruction to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted measurement configuration file according to the retrieval instruction, and decrypts the encrypted measurement configuration file to obtain the measurement configuration file.

[0066] In this embodiment, the trusted execution environment operating system includes a secure storage module and an encryption and decryption module.

[0067] Specifically, the trusted execution environment operating system retrieves the encrypted measurement configuration file in the secure storage module according to the retrieval instruction, and decrypts the encrypted measurement configuration file through the encryption and decryption module to obtain the measurement configuration file.

[0068] The encryption and decryption algorithms used by the encryption and decryption module include but are not limited to symmetric encryption algorithms, asymmetric encryption algorithms and hash algorithms.

[0069] S204: Receive a measurement configuration file sent by the trusted execution environment operating system.

[0070] Specifically, the measurement configuration file sent by the trusted execution environment operating system is received by way of wireless communication.

[0071] S205: Store the metric configuration file, and generate a first shared storage address according to the metric configuration file.

[0072] Specifically, the metric configuration file is saved in a shared memory, and a first shared storage address is generated.

[0073] The first shared storage address includes address information and data length of the shared memory.

[0074] S206: Send the first shared storage address to the trusted execution environment operating system, so that the trusted execution environment operating system sends the first shared storage address to the firmware layer, the first shared storage address is used to instruct the firmware layer to switch the trusted execution environment to the non-trusted execution environment, and send the first shared storage address to the trusted execution environment driver, the first shared storage address is used to instruct the trusted execution environment driver to send the first shared storage address to the measurement client application, the first shared storage address is used to instruct the measurement client application to obtain the measurement configuration file according to the first shared storage address, and generate a measurement verification request according to the measurement configuration file.

[0075] Specifically, the measurement trusted application sends the first shared storage address to the trusted execution environment operating system. The trusted execution environment operating system combines the SMC instruction according to the driver program, writes the first shared storage address into the SMC instruction, and sends the SMC instruction to the firmware layer. After receiving the SMC instruction, the firmware layer switches the execution environment from the trusted execution environment to the non-trusted execution environment, and sends the SMC request to the trusted execution environment driver. The trusted execution environment driver sends the first shared storage address in the SMC instruction to the measurement client application.

[0076] Specifically, the measurement client application reads the measurement configuration file according to the first shared storage address, obtains the data to be measured according to the measurement configuration file, collects the virtual address and corresponding address length information of the data to be measured, converts the virtual address into a physical address, and generates a measurement verification request according to the physical address.

[0077] The content recorded in the measurement configuration file includes but is not limited to the process name of the user process, the memory segment to be measured, the memory block to be measured of the kernel module, the system network configuration, the system call information, the cycle of data acquisition and the behavior response information.

[0078] S207: Receive a measurement verification request sent by the measurement client application.

[0079] In this embodiment, the measurement verification request is generated by the measurement client application, and the measurement client application sends the measurement verification request to the trusted execution environment driver.

[0080] In this embodiment, the trusted execution environment driver generates an SMC request according to the measurement verification request, and sends the SMC request recording the measurement verification request to the firmware layer.

[0081] In this embodiment, after receiving the SMC request, the firmware layer triggers an instruction to switch the non-trusted execution environment to the trusted execution environment, and sends a measurement verification request to the trusted execution environment operating system.

[0082] In this embodiment, the trusted execution environment operating system sends a measurement verification request to the measurement trusted application.

[0083] S208: Generate a measurement result according to the measurement verification request.

[0084] Specifically, the physical address in the measurement verification request is obtained, the physical address is mapped to obtain the virtual address, the virtual address is calculated according to the measurement algorithm, the measurement value is obtained, and a benchmark value retrieval instruction is sent to the trusted execution environment operating system to retrieve the corresponding benchmark value and compare it with the measurement value to generate a measurement result.

[0085] S209: Send the measurement result to the measurement client application, so that the measurement client application generates a measurement log according to the measurement result.

[0086] In this embodiment, the measurement result includes a measurement reference value and a measurement value.

[0087] Specifically, the measurement trusted application sends the measurement results to the trusted execution environment operating system. The trusted execution environment operating system generates an SMC instruction based on the measurement results and sends the SMC instruction to the firmware layer. The firmware layer switches the execution environment from the trusted execution environment to the non-trusted execution environment based on the SMC instruction and sends the SMC instruction to the trusted execution environment driver. The trusted execution environment driver sends the measurement results in the SMC instruction to the measurement client application. The measurement client application generates a measurement log based on the measurement results.

[0088] It can be seen from the above embodiments that by dividing the execution environment of the software into a trusted execution environment and a non-trusted execution environment, the measurement client application requests the measurement trusted application to obtain the measurement configuration file, the memory data is collected according to the measurement configuration file and a measurement verification request is generated, the measurement value in the measurement verification request is verified in the trusted execution environment by the measurement trusted application, and compared with the benchmark value to generate a measurement verification result, the measurement verification result is sent to the measurement client application, and a measurement log is generated by the measurement client application. Compared with the prior art, a trusted execution environment is created, and the operations of calculating measurement values ​​and comparing benchmark values ​​are performed by the measurement trusted application in the trusted execution environment, so as to avoid attacks on the process of calculating and comparing benchmark values ​​and improve the accuracy of the measurement results.

[0089] In one embodiment of the present application, step S208 includes:

[0090] S2081: Obtain the physical address in the measurement verification request.

[0091] In this embodiment, the physical address includes physical address information and address length.

[0092] S2082: Map the physical address to obtain a virtual address.

[0093] In this embodiment, the virtual address includes virtual address information and address length.

[0094] S2083: Measure the virtual address according to the measurement algorithm to obtain a measurement value.

[0095] In this embodiment, the measurement algorithm includes but is not limited to the national encryption algorithm, the SHA256 algorithm and the SHA512 algorithm.

[0096] S2084: Send a reference value retrieval request to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted reference value according to the reference value retrieval request, and decrypts the encrypted reference value to obtain the reference value.

[0097] Specifically, the trusted execution environment operating system retrieves the encrypted reference value in the secure storage module according to the reference value retrieval request, and decrypts the encrypted reference value through the encryption and decryption module to obtain the reference value.

[0098] The encryption and decryption algorithms used by the encryption and decryption module include but are not limited to symmetric encryption algorithms, asymmetric encryption algorithms and hash algorithms.

[0099] S2085: Receive the benchmark value sent by the trusted execution environment operating system.

[0100] Specifically, the reference value sent by the trusted execution environment operating system is received by wireless communication.

[0101] S2086: Generate measurement results based on the benchmark value and the measurement value.

[0102] Specifically, the benchmark value and the measurement value are compared. If the measurement value and the benchmark value are the same, the measurement result is that the system is safe; if the measurement value and the benchmark value are different, system operation information is generated according to the measurement result.

[0103] The system operation information includes, but is not limited to, process termination, warning information, system error information, and system operation termination.

[0104] It can be seen from the above embodiments that by measuring the physical address in the measurement verification request in the trusted execution environment, the physical address is mapped to a virtual address, and the measurement value is calculated by the measurement algorithm, and compared with the benchmark value in the trusted execution environment operating system to obtain the measurement result, thereby improving the security of the measurement process.

[0105] In one embodiment of the present application, after step S209, the following steps are further included:

[0106] S210: Receive a metric update request sent by a trusted execution environment operating system.

[0107] In this embodiment, the metric client application receives the edited metric configuration file, verifies the metric configuration file, determines whether the edited data exists, whether the corresponding task is generated according to the edited data, and whether the corresponding execution operation is not performed after the metric is configured. If the verification fails, the operation of updating the metric configuration file is terminated; if the verification passes, the data address to be measured is obtained according to the edited metric configuration file, the data address is converted into a physical address, and saved in the shared memory, and a metric update request is generated, and the shared memory address and the edited metric configuration file are recorded in the metric update request.

[0108] In this embodiment, the measurement client application sends a measurement update request to the trusted execution environment driver. The trusted execution environment driver generates an SMC request based on the measurement update request, and sends the SMC request that records the measurement update request to the firmware layer. After receiving the SMC request, the firmware layer triggers an instruction to switch the non-trusted execution environment to the trusted execution environment, and at the same time sends the measurement update request to the trusted execution environment operating system. The trusted execution environment operating system sends the measurement update request to the measurement trusted application.

[0109] S211: Update the metric configuration file according to the metric update request and generate an update result.

[0110] Specifically, a shared memory address in a measurement update request is obtained, a physical address in the shared memory address is obtained, a virtual address is obtained by mapping the physical address to a trusted execution environment operating system, an edited baseline value is generated according to the virtual address calculation, the edited baseline value and the edited measurement configuration file are sent to the trusted execution environment operating system, the trusted execution environment operating system generates an update result according to the edited baseline value and the edited measurement configuration file, and the update result is sent to the measurement trusted application.

[0111] S212: Send the update result to the measurement client application, so that the measurement client application generates an update log according to the update result.

[0112] In this embodiment, the update result includes update success and update failure.

[0113] Specifically, the measurement trusted application sends the update result to the trusted execution environment operating system. The trusted execution environment operating system generates an SMC instruction based on the update result and sends the SMC instruction to the firmware layer. The firmware layer switches the execution environment from the trusted execution environment to the non-trusted execution environment based on the SMC instruction and sends the SMC instruction to the trusted execution environment driver. The trusted execution environment driver sends the update result in the SMC instruction to the measurement client application. The measurement client application generates an update log based on the update result.

[0114] It can be seen from the above embodiments that by measuring the trusted application, the measurement configuration file is updated in the trusted execution environment according to the measurement update request, and the update result is sent to the measurement client application. The measurement client application generates an update log according to the update result, thereby avoiding the process of updating the measurement configuration file from being attacked and improving the security of updating the measurement configuration file.

[0115] In one embodiment of the present application, step S211 includes:

[0116] S111: Obtain a second shared storage address in the metric update request.

[0117] In this embodiment, the second shared storage address is a shared memory address in the metric update request.

[0118] S112: Obtain the edited metric configuration file and the edited physical address according to the second shared storage address.

[0119] In this embodiment, the physical address includes physical address information and address length.

[0120] Specifically, the measurement module for measuring the trusted application obtains the physical address according to the shared memory address.

[0121] S113: Calculate and generate an edited reference value according to the edited physical address.

[0122] Specifically, the edited physical address is mapped to the trusted execution environment operating system to obtain a virtual address, and the edited reference value is generated based on the virtual address calculation.

[0123] S114: Sending the edited metric configuration file and the edited benchmark value to the trusted execution environment operating system, so that the trusted execution environment operating system generates an update result according to the edited metric configuration file and the edited benchmark value.

[0124] Specifically, the measurement trusted application sends the edited measurement configuration file and the edited benchmark value to the trusted execution environment operating system, the trusted execution environment operating system backs up the corresponding unedited measurement configuration file and benchmark value, generates a backup file, records the edited measurement configuration file and the edited benchmark value as a new measurement configuration file and benchmark value, deletes the corresponding unedited measurement configuration file and benchmark value, and generates an updated result.

[0125] S115: Receive the update result sent by the trusted execution environment operating system.

[0126] Specifically, the update result sent by the trusted execution environment operating system is received by wireless communication.

[0127] It can be seen from the above embodiments that by obtaining the edited physical address, the edited benchmark value is calculated, the edited benchmark value and the edited measurement configuration file are written into the trusted execution environment operating system, and the measurement configuration file and the benchmark value are saved in the trusted execution environment operating system of the trusted execution environment to prevent the measurement configuration file and the benchmark value from being tampered with.

[0128] Figure 3 Schematic diagram of the process of the information system measurement processing method provided in the embodiment of the present application Figure 2 The execution subject of this embodiment can be a measurement client application, and this embodiment is not particularly limited here. Figure 3 As shown, the method includes:

[0129] S301: Send a request to obtain a measurement configuration file to a trusted execution environment driver, so that the trusted execution environment driver sends the request to obtain a measurement configuration file to the firmware layer, the request to obtain a measurement configuration file is used to instruct the firmware layer to switch the non-trusted execution environment to a trusted execution environment according to the request to obtain a measurement configuration file, and send the request to obtain a measurement configuration file to the trusted execution environment operating system, the request to obtain a measurement configuration file is used to instruct the trusted execution environment operating system to verify the permissions of the measurement client application according to the request to obtain a measurement configuration file, and generate a verification result. If the verification result is that the verification is passed, the trusted execution environment operating system sends the request to obtain a measurement configuration file to the measurement trusted application, the request to obtain a measurement configuration file is used to instruct the measurement trusted application to generate a first shared storage address according to the request to obtain a measurement configuration file, and sends the first shared storage address to the firmware layer, and the first shared storage address is used to instruct the firmware layer to switch the trusted execution environment to the non-trusted execution environment.

[0130] S302: Receive a first shared storage address sent by the firmware layer.

[0131] S303: Obtain a metric configuration file according to the first shared storage address, and generate a metric verification request according to the metric configuration file.

[0132] S304: Send a measurement verification request to the measurement trusted application, so that the measurement trusted application generates a measurement result according to the measurement verification request.

[0133] S305: Receive the measurement result sent by the measurement trusted application, and generate a measurement log according to the measurement result.

[0134] Figure 4 A system structure diagram of the dynamic measurement provided in an embodiment of the present application.

[0135] like Figure 4As shown, after the measurement client application of the non-trusted execution environment obtains the data to be measured according to the measurement configuration file, the data to be measured is transmitted to the firmware layer through the firmware layer. The firmware layer converts the environment into a trusted execution environment, calculates the measurement value by measuring the trusted application and compares it with the benchmark value, generates the measurement result, and sends the measurement result to the measurement client. The measurement client generates a measurement log according to the measurement result and writes the measurement log into the firmware trusted platform module.

[0136] It can be seen from the above embodiments that by dividing the execution environment of the software into a trusted execution environment and a non-trusted execution environment, the measurement client application requests the measurement trusted application to obtain the measurement configuration file, the memory data is collected according to the measurement configuration file and a measurement verification request is generated, the measurement value in the measurement verification request is verified in the trusted execution environment by the measurement trusted application, and compared with the benchmark value to generate a measurement verification result, the measurement verification result is sent to the measurement client application, and a measurement log is generated by the measurement client application. Compared with the prior art, a trusted execution environment is created, and the operations of calculating measurement values ​​and comparing benchmark values ​​are performed by the measurement trusted application in the trusted execution environment, so as to avoid attacks on the process of calculating and comparing benchmark values ​​and improve the accuracy of the measurement results.

[0137] In one embodiment of the present application, step S303 includes:

[0138] S3031: Obtain a measurement configuration file in the first shared storage address.

[0139] Specifically, the metric client application accesses the shared memory according to the first shared storage address, and obtains the metric configuration file stored in the shared memory.

[0140] S3032: Obtain a virtual address according to the measurement configuration file.

[0141] Specifically, the virtual address of the data to be measured is obtained according to the measurement configuration file.

[0142] In this embodiment, the virtual address includes virtual address information and address length.

[0143] S3033: Convert the virtual address to a physical address.

[0144] In this embodiment, the physical address includes physical address information and address length.

[0145] S3034: Generate a measurement verification request according to the physical address.

[0146] Specifically, a measurement verification request is created according to the physical address of the data to be measured.

[0147] It can be seen from the above embodiments that the measurement configuration file is obtained through the first shared storage address, the data to be measured is obtained according to the measurement configuration file, a measurement verification request is created according to the data to be measured, and the measurement value is calculated according to the measurement verification request by measuring the trusted application, thereby improving the security of the measurement process.

[0148] In one embodiment of the present application, after step S305, the following steps are further included:

[0149] S306: Send an interface call request to the firmware trusted platform module, so that the firmware trusted platform module establishes a communication link between the measurement client application and the firmware trusted platform module according to the interface call request.

[0150] Specifically, the interface call request is sent to the firmware trusted platform module by means of wireless communication.

[0151] In this embodiment, the firmware trusted platform module runs in a trusted execution environment.

[0152] S307: Send the measurement log to the firmware trusted platform module, so that the firmware trusted platform module obtains the program control register storing the measurement log, and writes the measurement log into the program control register.

[0153] Specifically, the measurement log is sent to the firmware trusted platform module by means of wireless communication.

[0154] It can be seen from the above embodiments that by establishing communication with the firmware trusted platform module, the measurement log is extended to the firmware trusted platform module in the trusted execution environment, and the security and expansion speed of the measurement log extension are improved through the firmware trusted platform module.

[0155] In one embodiment of the present application, after step S305, the following steps are further included:

[0156] S308: Obtain the edited measurement configuration file.

[0157] In this embodiment, the edited metric configuration file may be a metric configuration file sent by a developer and actively received by the metric client application, or the edited metric configuration file may be obtained periodically.

[0158] S309: Verify the edited metric configuration file and generate a verification result.

[0159] In this embodiment, the metric client application receives the edited metric configuration file, verifies the metric configuration file, determines whether the edited data exists, whether to generate a corresponding task based on the edited data, and whether the corresponding execution operation fails after the metric is configured.

[0160] S310: If the verification result is that the verification is passed, the address of the measurement data in the edited measurement configuration file is obtained.

[0161] In this embodiment, if the verification fails, the operation of updating the metric configuration file is terminated.

[0162] S311: Save the measurement data address, and generate a second shared storage address according to the measurement data address.

[0163] Specifically, if the verification passes, the data address to be measured is obtained according to the edited measurement configuration file, the data address is converted into a physical address, and saved in the shared memory.

[0164] S312: Send the second shared storage address to the trusted execution environment driver, so that the trusted execution environment driver generates a metric update request according to the second shared storage address, and sends the metric update request to the firmware layer, the metric update request is used to instruct the firmware layer to switch the non-trusted execution environment to the trusted execution environment, and send the metric update request to the trusted execution environment operating system, the metric update request is used to instruct the trusted execution environment operating system to send the metric update request to the metric trusted application, the metric update request is used to instruct the metric trusted application to update the metric configuration file according to the metric update request, and generate an update result.

[0165] S313: Receive the update result sent by the measurement trusted application.

[0166] It can be seen from the above embodiments that an edited metric configuration file is obtained through a metric client application, the edited metric configuration file is verified, a second shared storage address is generated according to the edited metric configuration file, the second shared storage address is sent to a metric trusted application, and the metric configuration file is updated in a trusted execution environment according to a metric update request through the metric trusted application, and the update result is sent to the metric client application, thereby avoiding attacks on the process of updating the metric configuration file and improving the security of updating the metric configuration file.

[0167] In one embodiment of the present application, after step S313, the following steps are further included:

[0168] S314: Generate a log update request according to the update result.

[0169] In this embodiment, a log update request is generated according to the updated metric log.

[0170] S315: Sending a log update request to the firmware trusted platform module, so that the firmware trusted platform module queries the program control register storing the log according to the log update request, and updates the program control register storing the log according to the log update request.

[0171] Specifically, the firmware trusted platform module receives the updated measurement log sent by the measurement client application, formats the original measurement log, formats the program control register, and writes the updated measurement log into the program control register.

[0172] It can be seen from the above embodiments that by establishing communication with the firmware trusted platform module, the updated measurement log is extended to the firmware trusted platform module in the trusted execution environment, the original extension value is cleared by the firmware trusted platform module, and the updated measurement log is written to the program control register, thereby improving the security and expansion speed of the measurement log expansion.

[0173] Figure 5 Schematic diagram of the process of the information system measurement processing method provided in the embodiment of the present application Figure 3 The execution subject of this embodiment can be a trusted execution environment operating system, and this embodiment is not particularly limited here. Figure 5 As shown, the method includes:

[0174] S501: Receive a request for obtaining a measurement configuration file sent by a firmware layer.

[0175] S502: Verify the authority of the measurement client application according to the obtained measurement configuration file request, and generate a verification result.

[0176] S503: If the verification result is that the verification is passed, a request to obtain the metric configuration file is sent to the metric trusted application, so that the metric trusted application generates a search instruction according to the request to obtain the metric configuration file.

[0177] S504: Receive a search instruction sent by the measurement trusted application.

[0178] S505: Obtain the encrypted measurement configuration file according to the search instruction.

[0179] S506: Decrypt the encrypted measurement configuration file to obtain the measurement configuration file.

[0180] S507: Send the metric configuration file to the metric trusted application, so that the metric trusted application stores the metric configuration file and generates a first shared storage address according to the metric configuration file.

[0181] S508: Receive a first shared storage address sent by the measurement trusted application.

[0182] S509: Send the first shared storage address to the firmware layer, so that the firmware layer switches the trusted execution environment to the non-trusted execution environment according to the first shared storage address, and sends the first shared storage address to the trusted execution environment driver, the first shared storage address is used to instruct the trusted execution environment driver to send the first shared storage address to the measurement client application, the first shared storage address is used to instruct the measurement client application to generate a measurement verification request according to the first shared storage address and send the measurement verification request to the measurement trusted application, the measurement verification request is used to instruct the measurement trusted application to generate a measurement result according to the measurement verification request, and send the measurement result to the measurement client application, the measurement result is used to instruct the measurement client application to generate a measurement log according to the measurement result.

[0183] It can be seen from the above embodiments that by dividing the execution environment of the software into a trusted execution environment and a non-trusted execution environment, the measurement client application requests the measurement trusted application to obtain the measurement configuration file, the memory data is collected according to the measurement configuration file and a measurement verification request is generated, the measurement value in the measurement verification request is verified in the trusted execution environment by the measurement trusted application, and compared with the benchmark value to generate a measurement verification result, the measurement verification result is sent to the measurement client application, and a measurement log is generated by the measurement client application. Compared with the prior art, a trusted execution environment is created, and the operations of calculating measurement values ​​and comparing benchmark values ​​are performed by the measurement trusted application in the trusted execution environment, so as to avoid attacks on the process of calculating and comparing benchmark values ​​and improve the accuracy of the measurement results.

[0184] In one embodiment of the present application, after step S509, the following steps are further included:

[0185] S510: Receive a metric update request sent by the firmware layer.

[0186] In this embodiment, the metric update request is generated when the metric client application obtains the edited metric configuration file and verifies the edited metric configuration file after the verification passes.

[0187] S511: Send a metric update request to the metric trusted application, so that the metric trusted application obtains the second shared storage address in the metric update request, obtains the edited metric configuration file and the edited physical address according to the second shared storage address, and calculates and generates the edited benchmark value according to the edited physical address.

[0188] S512: Receive the edited metric configuration file and the edited reference value sent by the metric trusted application.

[0189] S513: Generate an update result according to the edited metric configuration file and the edited benchmark value.

[0190] Specifically, the metric configuration file and the benchmark value before editing are obtained, a backup file is generated, the metric configuration file and the benchmark value before editing are deleted, the edited metric configuration file and the benchmark value are encrypted by an encryption algorithm, and an update result is generated.

[0191] S514: Send the update result to the firmware layer so that the firmware layer switches the trusted execution environment to the untrusted execution environment according to the update result, and sends the update result to the trusted execution environment driver, where the update result is used to instruct the trusted execution environment driver to send the update result to the measurement client application.

[0192] It can be seen from the above embodiments that by receiving a metric update request, sending the metric update request to a metric trusted application, calculating a baseline value through the metric trusted application, backing up the original metric configuration file and the corresponding baseline value, deleting the original metric configuration file and the corresponding baseline value, writing the edited metric configuration file and the baseline value to the trusted execution environment operating system, and saving the metric configuration file and the baseline value through the trusted execution environment operating system deployed in the trusted execution environment, the metric configuration file and the baseline value are prevented from being tampered with, thereby improving the security of the data.

[0193] In one embodiment of the present application, step S513 includes:

[0194] S131: querying and obtaining the metric configuration file before editing and the benchmark value before editing according to the metric configuration file after editing and the benchmark value after editing.

[0195] Specifically, according to the edited measurement configuration file and the edited reference value, the storage address recording the measurement configuration file and the reference value before editing in the trusted execution environment operating system security storage module is queried to obtain the measurement configuration file and the reference value before editing.

[0196] S132: Generate a backup file according to the measurement configuration file before editing and the benchmark value before editing.

[0197] Specifically, a backup file is generated from the measurement configuration file before editing and the benchmark value before editing, and stored in a backup storage area of ​​the security storage module.

[0198] S133: Encrypt the edited measurement configuration file and the edited reference value to obtain the encrypted measurement configuration file and the reference value.

[0199] Specifically, the edited measurement configuration file and the edited reference value are encrypting according to an encryption algorithm by an encryption module to obtain the encrypted measurement configuration file and the reference value.

[0200] Among them, encryption algorithms include but are not limited to symmetric encryption algorithms, asymmetric encryption algorithms and hash algorithms.

[0201] S134: Storing the encrypted measurement configuration file and the benchmark value to generate an update result.

[0202] Specifically, the encrypted measurement configuration file and the benchmark value are stored in a secure storage module of the trusted execution environment operating system, and an update result is generated.

[0203] It can be seen from the above embodiments that the measurement configuration file and the benchmark value before editing are backed up through the trusted execution environment operating system, the edited measurement configuration file and the benchmark value are encrypted through the encryption module, and stored in the secure storage module of the trusted execution environment operating system, so as to prevent the measurement configuration file and the benchmark value from being tampered with, thereby improving the security of the measurement configuration file and the benchmark value.

[0204] refer to Figure 6 , is an embodiment of the interaction process of measuring trusted applications, trusted execution environment operating system, firmware layer, trusted execution environment driver and measuring client application.

[0205] Figure 6 This is a schematic diagram of the interactive process of the information system measurement processing method provided by an embodiment of the present application. This embodiment takes the interactive process of measuring trusted applications, trusted execution environment operating system, firmware layer, trusted execution environment driver and measuring client application as an example to illustrate the process of dynamic measurement. Figure 6 As shown, the details are as follows:

[0206] S601: The measurement client application sends a request to obtain a measurement configuration file to a trusted execution environment driver.

[0207] S602: The trusted execution environment driver sends a request to obtain a measurement configuration file to the firmware layer.

[0208] S603: The firmware layer switches the non-trusted execution environment to the trusted execution environment according to the request to obtain the measurement configuration file, and sends the request to obtain the measurement configuration file to the trusted execution environment operating system.

[0209] S604: The trusted execution environment operating system verifies the permission of the measurement client application according to the obtained measurement configuration file request and generates a verification result.

[0210] S605: If the verification result is that the verification is passed, the trusted execution environment operating system sends a request to obtain the measurement configuration file to the measurement trusted application.

[0211] S606: The measurement trusted application generates a retrieval instruction according to the request for obtaining the measurement configuration file, and sends the retrieval instruction to the trusted execution environment operating system.

[0212] S607: The trusted execution environment operating system obtains the encrypted measurement configuration file according to the search instruction, decrypts the encrypted measurement configuration file, obtains the measurement configuration file, and sends the measurement configuration file to the measurement trusted application.

[0213] S608: Measuring the trusted application storage measurement configuration file, generating a first shared storage address according to the measurement configuration file, and sending the first shared storage address to the trusted execution environment operating system.

[0214] S609: The trusted execution environment operating system sends the first shared storage address to the firmware layer.

[0215] S610: The firmware layer switches the trusted execution environment to the non-trusted execution environment according to the first shared storage address, and sends the first shared storage address to the trusted execution environment driver.

[0216] S611: The trusted execution environment driver sends the first shared storage address to the measurement client application.

[0217] S612: The metric client application obtains a metric configuration file according to the first shared storage address, generates a metric verification request according to the metric configuration file, and sends the metric verification request to the metric trusted application.

[0218] S613: The measurement trusted application generates a measurement result according to the measurement verification request, and sends the measurement result to the measurement client application.

[0219] S614: The measurement client application generates a measurement log according to the measurement result.

[0220] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0221] Figure 7 This is a schematic diagram of the interactive process of the information system measurement processing method provided by another embodiment of the present application. This embodiment takes the interactive process of measuring trusted applications, trusted execution environment operating system, firmware layer, trusted execution environment driver, measurement client application and firmware trusted platform module as an example to illustrate the process of updating the measurement configuration file. Figure 7 As shown, the details are as follows:

[0222] S701: The measurement client application obtains the edited measurement configuration file.

[0223] S702: The measurement client application verifies the edited measurement configuration file and generates a verification result.

[0224] S703: If the verification result is that the verification is passed, a second shared storage address is generated according to the edited measurement configuration file, and the second shared storage address is sent to the trusted execution environment driver.

[0225] S704: The trusted execution environment driver generates a metric update request according to the second shared storage address, and sends the metric update request to the firmware layer.

[0226] S705: The firmware layer switches the non-trusted execution environment to a trusted execution environment, and sends a metric update request to the trusted execution environment operating system.

[0227] S706: The trusted execution environment operating system sends a measurement update request to the measurement trusted application.

[0228] S707: The measurement trusted application calculates and generates a reference value according to the measurement update request, and sends the reference value to the trusted execution environment operating system.

[0229] S708: The trusted execution environment operating system generates an update result according to the benchmark value and the edited metric configuration file in the metric update request, and sends the update result to the firmware layer.

[0230] S709: The firmware layer switches the trusted execution environment to the untrusted execution environment, and sends the update result to the trusted execution environment driver.

[0231] S710: The trusted execution environment driver sends the update result to the measurement client application.

[0232] S711: The measurement client application generates an update log according to the update result, and sends the update log to the firmware trusted platform module.

[0233] Figure 8 A schematic diagram of the structure of the information system metric processing device provided in the embodiment of the present application is shown in FIG. Figure 8 As shown, the information system measurement processing device 80 provided in this embodiment includes: a first receiving module 801, a first generating module 802, a first sending module 803, a second receiving module 804, a storage module 805, a second sending module 806, a third receiving module 807, a second generating module 808 and a third sending module 809.

[0234] The first receiving module 801 is configured to receive a request for obtaining a measurement configuration file sent by a trusted execution environment operating system.

[0235] The first generating module 802 is configured to generate a retrieval instruction according to a request to obtain a metric configuration file.

[0236] The first sending module 803 is used to send a retrieval instruction to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted measurement configuration file according to the retrieval instruction, and decrypts the encrypted measurement configuration file to obtain the measurement configuration file.

[0237] The second receiving module 804 is configured to receive a measurement configuration file sent by the trusted execution environment operating system.

[0238] The storage module 805 is used to store the measurement configuration file and generate a first shared storage address according to the measurement configuration file.

[0239] The second sending module 806 is used to send the first shared storage address to the trusted execution environment operating system, so that the trusted execution environment operating system sends the first shared storage address to the firmware layer, the first shared storage address is used to instruct the firmware layer to switch the trusted execution environment to the non-trusted execution environment, and send the first shared storage address to the trusted execution environment driver, the first shared storage address is used to instruct the trusted execution environment driver to send the first shared storage address to the measurement client application, the first shared storage address is used to instruct the measurement client application to obtain the measurement configuration file according to the first shared storage address, and generate a measurement verification request according to the measurement configuration file.

[0240] The third receiving module 807 is configured to receive a measurement verification request sent by a measurement client application.

[0241] The second generating module 808 is configured to generate a measurement result according to the measurement verification request.

[0242] The third sending module 809 is used to send the measurement result to the measurement client application, so that the measurement client application generates a measurement log according to the measurement result.

[0243] In a possible implementation, the second generating module 808 includes:

[0244] The first acquisition unit is used to acquire the physical address in the measurement verification request.

[0245] The mapping unit is used to map the physical address to obtain the virtual address.

[0246] The measurement unit is used to measure the virtual address according to the measurement algorithm to obtain a measurement value.

[0247] The first sending unit is used to send a reference value retrieval request to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted reference value according to the reference value retrieval request, and decrypts the encrypted reference value to obtain the reference value.

[0248] The first receiving unit is used to receive a reference value sent by a trusted execution environment operating system.

[0249] The generating unit is used to generate the measurement result according to the reference value and the measurement value.

[0250] In a possible implementation manner, the information system metric processing device 80 further includes:

[0251] The fourth receiving module is used to receive a metric update request sent by the trusted execution environment operating system.

[0252] The update module is used to update the metric configuration file according to the metric update request and generate an update result.

[0253] The fourth sending module is used to send the update result to the measurement client application, so that the measurement client application generates an update log according to the update result.

[0254] In a possible implementation, the update module includes:

[0255] The second acquiring unit is configured to acquire a second shared storage address in the metric update request.

[0256] The third acquiring unit is configured to acquire the edited metric configuration file and the edited physical address according to the second shared storage address.

[0257] The calculation unit is used to calculate and generate the edited reference value according to the edited physical address.

[0258] The second sending unit is used to send the edited measurement configuration file and the edited reference value to the trusted execution environment operating system, so that the trusted execution environment operating system generates an update result according to the edited measurement configuration file and the edited reference value.

[0259] The second receiving unit is used to receive the update result sent by the trusted execution environment operating system.

[0260] For the description of the features in the embodiment corresponding to the information system metric processing device, reference may be made to the relevant description of the embodiment corresponding to the information system metric processing method, which will not be described in detail here.

[0261] Fig. 9 This is a schematic diagram of the server structure provided for this application. Fig. 9 As shown, the server 90 provided in this embodiment includes: at least one processor 901 and a memory 902. Optionally, the server 90 also includes a communication component 903. The processor 901, the memory 902 and the communication component 903 are connected via a bus.

[0262] In the specific implementation process, at least one processor 901 executes the computer execution instructions stored in the memory 902, so that at least one processor 901 executes the above-mentioned information system measurement processing method embodiment.

[0263] The specific implementation process of the processor 901 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0264] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0265] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0266] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0267] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned information system metric processing method embodiments when running.

[0268] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0269] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above-mentioned information system metric processing method embodiments are implemented.

[0270] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, the non-volatile computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned information system measurement processing method embodiments are implemented.

[0271] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0272] The above describes in detail a method, device, server and medium for generating a prediction model of a gene regulatory network provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application, and the description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for those of ordinary skill in the art, without departing from the principles of the present application, several improvements and modifications may also be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for processing information system metrics, characterized in that: Applied to measure trusted applications, including: receiving a request for obtaining a measurement configuration file sent by a trusted execution environment operating system; generating a retrieval instruction according to the request to obtain the metric configuration file; Sending the retrieval instruction to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted measurement configuration file according to the retrieval instruction, and decrypts the encrypted measurement configuration file to obtain the measurement configuration file; Receiving the measurement configuration file sent by the trusted execution environment operating system; storing the metric configuration file, and generating a first shared storage address according to the metric configuration file; Sending the first shared storage address to the trusted execution environment operating system, so that the trusted execution environment operating system sends the first shared storage address to the firmware layer, the first shared storage address is used to instruct the firmware layer to switch the trusted execution environment to the non-trusted execution environment, and send the first shared storage address to the trusted execution environment driver, the first shared storage address is used to instruct the trusted execution environment driver to send the first shared storage address to the measurement client application, the first shared storage address is used to instruct the measurement client application to obtain a measurement configuration file according to the first shared storage address, and generate a measurement verification request according to the measurement configuration file; receiving the metric verification request sent by the metric client application; generating a measurement result according to the measurement verification request; The measurement result is sent to the measurement client application, so that the measurement client application generates a measurement log according to the measurement result.

2. The information system metric processing method according to claim 1, characterized in that: Generating a measurement result according to the measurement verification request includes: Obtaining a physical address in the measurement verification request; Mapping the physical address to obtain a virtual address; Measuring the virtual address according to a measurement algorithm to obtain a measurement value; Sending a reference value retrieval request to the trusted execution environment operating system, so that the trusted execution environment operating system obtains the encrypted reference value according to the reference value retrieval request, and decrypts the encrypted reference value to obtain the reference value; Receiving a reference value sent by the trusted execution environment operating system; A measurement result is generated according to the reference value and the measurement value.

3. The information system metric processing method according to claim 1, characterized in that: After sending the measurement result to the measurement client application so that the measurement client application generates a measurement log according to the measurement result, the method further includes: Receiving a metric update request sent by the trusted execution environment operating system; Update the metric configuration file according to the metric update request and generate an update result; The update result is sent to the metric client application, so that the metric client application generates an update log according to the update result.

4. The information system metric processing method according to claim 3, characterized in that: The updating of the metric configuration file according to the metric update request and generating an update result includes: Obtaining a second shared storage address in the metric update request; Acquire the edited metric configuration file and the edited physical address according to the second shared storage address; Calculate and generate an edited reference value according to the edited physical address; Sending the edited metric configuration file and the edited reference value to the trusted execution environment operating system so that the trusted execution environment operating system generates an update result according to the edited metric configuration file and the edited reference value; Receive an update result sent by the trusted execution environment operating system.

5. A method for processing information system metrics, characterized in that: Applicable to measure client applications, including: Sending a request to obtain a measurement configuration file to a trusted execution environment driver, so that the trusted execution environment driver sends the request to obtain a measurement configuration file to a firmware layer, wherein the request to obtain a measurement configuration file is used to instruct the firmware layer to switch a non-trusted execution environment to a trusted execution environment according to the request to obtain a measurement configuration file, and sending the request to obtain a measurement configuration file to a trusted execution environment operating system, wherein the request to obtain a measurement configuration file is used to instruct the trusted execution environment operating system to verify the permission of the measurement client application according to the request to obtain a measurement configuration file and generate a verification result. If the verification result is that the verification is passed, the trusted execution environment operating system sends the request to obtain a measurement configuration file to a measurement trusted application, wherein the request to obtain a measurement configuration file is used to instruct the measurement trusted application to generate a first shared storage address according to the request to obtain a measurement configuration file, and sends the first shared storage address to the firmware layer, wherein the first shared storage address is used to instruct the firmware layer to switch the trusted execution environment to a non-trusted execution environment; Receiving a first shared storage address sent by the firmware layer; Acquire a metric configuration file according to the first shared storage address, and generate a metric verification request according to the metric configuration file; Sending the measurement verification request to the measurement trusted application, so that the measurement trusted application generates a measurement result according to the measurement verification request; The measurement result sent by the measurement trusted application is received, and a measurement log is generated according to the measurement result.

6. The information system metric processing method according to claim 5, characterized in that: The obtaining a metric configuration file according to the first shared storage address, and generating a metric verification request according to the metric configuration file, includes: Obtaining a measurement configuration file in the first shared storage address; Obtaining a virtual address according to the metric configuration file; Converting the virtual address to a physical address; A metric verification request is generated based on the physical address.

7. The information system metric processing method according to claim 5, characterized in that: After receiving the measurement result sent by the measurement trusted application and generating a measurement log according to the measurement result, the method further includes: Sending an interface call request to a firmware trusted platform module, so that the firmware trusted platform module establishes a communication link between the measurement client application and the firmware trusted platform module according to the interface call request; The measurement log is sent to the firmware trusted platform module, so that the firmware trusted platform module obtains a program control register storing the measurement log, and writes the measurement log into the program control register.

8. The information system metric processing method according to claim 5, characterized in that: After receiving the measurement result sent by the measurement trusted application and generating a measurement log according to the measurement result, the method further includes: Get the edited metrics configuration file; Verifying the edited metric configuration file and generating a verification result; If the verification result is that the verification passes, obtaining the address of the measurement data in the edited measurement configuration file; Saving the measurement data address, and generating a second shared storage address according to the measurement data address; Sending the second shared storage address to a trusted execution environment driver, so that the trusted execution environment driver generates a metric update request according to the second shared storage address, and sending the metric update request to a firmware layer, wherein the metric update request is used to instruct the firmware layer to switch a non-trusted execution environment to a trusted execution environment, and sending the metric update request to a trusted execution environment operating system, wherein the metric update request is used to instruct the trusted execution environment operating system to send the metric update request to a metric trusted application, wherein the metric update request is used to instruct the metric trusted application to update a metric configuration file according to the metric update request and generate an update result; An update result sent by the measurement trusted application is received.

9. An information system measurement processing method, characterized in that: Applicable to trusted execution environment operating systems, including: Receive a request for obtaining a measurement configuration file sent by the firmware layer; Requesting verification of the permission of the measurement client application according to the obtained measurement configuration file, and generating a verification result; If the verification result is that the verification is passed, sending the request to obtain the metric configuration file to the metric trusted application, so that the metric trusted application generates a retrieval instruction according to the request to obtain the metric configuration file; receiving a retrieval instruction sent by the metric trusted application; Obtaining an encrypted measurement configuration file according to the retrieval instruction; decrypting the encrypted measurement configuration file to obtain the measurement configuration file; Sending the metric configuration file to the metric trusted application so that the metric trusted application stores the metric configuration file and generates a first shared storage address according to the metric configuration file; Receiving a first shared storage address sent by the measurement trusted application; The first shared storage address is sent to the firmware layer so that the firmware layer switches the trusted execution environment to the non-trusted execution environment according to the first shared storage address, and sends the first shared storage address to the trusted execution environment driver, wherein the first shared storage address is used to instruct the trusted execution environment driver to send the first shared storage address to the measurement client application, wherein the first shared storage address is used to instruct the measurement client application to generate a measurement verification request according to the first shared storage address and send the measurement verification request to the measurement trusted application, wherein the measurement verification request is used to instruct the measurement trusted application to generate a measurement result according to the measurement verification request and send the measurement result to the measurement client application, wherein the measurement result is used to instruct the measurement client application to generate a measurement log according to the measurement result.

10. The information system metric processing method according to claim 9, characterized in that: After sending the first shared storage address to the firmware layer, the method further includes: Receiving a metric update request sent by the firmware layer; Sending the metric update request to the metric trusted application, so that the metric trusted application obtains the second shared storage address in the metric update request, obtains the edited metric configuration file and the edited physical address according to the second shared storage address, and calculates and generates the edited reference value according to the edited physical address; receiving an edited metric configuration file and an edited reference value sent by the metric trusted application; generating an update result according to the edited metric configuration file and the edited benchmark value; The update result is sent to the firmware layer so that the firmware layer switches the trusted execution environment to a non-trusted execution environment according to the update result, and the update result is sent to the trusted execution environment driver, wherein the update result is used to instruct the trusted execution environment driver to send the update result to the measurement client application.

11. The information system metric processing method according to claim 10, characterized in that: Generating an update result according to the edited metric configuration file and the edited reference value comprises: According to the edited metric configuration file and the edited reference value, query and obtain the metric configuration file before editing and the reference value before editing; generating a backup file according to the metric configuration file before editing and the benchmark value before editing; Encrypting the edited metric configuration file and the edited reference value to obtain an encrypted metric configuration file and reference value; The encrypted metric configuration file and the benchmark value are stored to generate an update result.

12. A method for processing information system metrics, characterized in that: include: The measurement client application sends a request to obtain the measurement configuration file to the trusted execution environment driver; The trusted execution environment driver sends the request to obtain the measurement configuration file to the firmware layer; The firmware layer switches the non-trusted execution environment to the trusted execution environment according to the request to obtain the measurement configuration file, and sends the request to obtain the measurement configuration file to the trusted execution environment operating system; The trusted execution environment operating system verifies the permission of the measurement client application according to the measurement configuration file acquisition request, and generates a verification result; If the verification result is that the verification is passed, the trusted execution environment operating system sends the request to obtain the measurement configuration file to the measurement trusted application; The metric trusted application generates a retrieval instruction according to the request to obtain the metric configuration file, and sends the retrieval instruction to the trusted execution environment operating system; The trusted execution environment operating system obtains the encrypted measurement configuration file according to the search instruction, decrypts the encrypted measurement configuration file to obtain the measurement configuration file, and sends the measurement configuration file to the measurement trusted application; The metric trusted application stores the metric configuration file, generates a first shared storage address according to the metric configuration file, and sends the first shared storage address to the trusted execution environment operating system; The trusted execution environment operating system sends the first shared storage address to the firmware layer; The firmware layer switches the trusted execution environment to a non-trusted execution environment according to the first shared storage address, and sends the first shared storage address to the trusted execution environment driver; The trusted execution environment driver sends the first shared storage address to the measurement client application; The metric client application obtains the metric configuration file according to the first shared storage address, generates a metric verification request according to the metric configuration file, and sends the metric verification request to the metric trusted application; The metric trusted application generates a metric result according to the metric verification request, and sends the metric result to the metric client application; The metric client application generates a metric log according to the metric result.

13. A server, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the information system metric processing method as claimed in any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the information system metric processing method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the information system metric processing method according to any one of claims 1 to 12 are implemented.

Images