Data integrity measurement method based on MPT tree

Abstract

According to the method, the measurement record is stored and verified by using the MPT tree in the integrity measurement architecture, and the search and integrity verification performance of the measurement list is enhanced by using the efficient path search function and the data verification function of the MPT tree. Kernel measurement records are transmitted to a user mode through netlink and a kernel-to-user-mode data transmission mechanism of a virtual file system, the measurement records are inserted into an MPT tree in a user mode processing program, a root hash value is calculated, the MPT tree is used for achieving searching of the measurement records, the MPT tree is stored in a Key-Value database LevelDB to achieve persistent storage of the measurement records, and the measurement records are stored in the kernel-to-user-mode data transmission mechanism. And verifying the integrity of the measurement record by using the stored MPT tree.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of integrity measurement technology, and in particular to the design and implementation of an MPT tree integrity measurement architecture, a method and device for discovering social groups based on a temporal graph neural network. Background Art

[0002] In the current digital era, the Linux operating system has become an indispensable technical infrastructure worldwide due to its open source nature, flexibility and wide application areas. However, with the rapid development of Internet technology, Linux systems and their application environments are facing increasingly severe security threats. Malware, code backdoors, supply chain attacks and other security vulnerabilities continue to emerge, seriously threatening the stable operation of the system and data security. Especially in the open source ecosystem, although the community-driven development model has promoted the rapid development of technology, it has also left security risks due to lax code review and untimely maintenance. In addition, the increasing complexity of the system and the pursuit of high performance make it increasingly difficult to balance security and efficiency.

[0003] In this context, trusted computing has emerged as an emerging computer security paradigm, aiming to ensure the integrity and security of computing platforms by building a multi-level trust chain from hardware to software. Trusted measurement, as the core of trusted computing, is responsible for dynamically monitoring the integrity and reliability of system components and is a key link in ensuring terminal security. However, the traditional Linux integrity measurement architecture uses a linear structure for measurement record storage, which is not only inefficient, but also incapable of security performance when faced with a large amount of measurement data.

[0004] In response to the above problems, researchers have begun to explore new metric record storage solutions to improve the efficiency and security of metric data management. Among them, data structures such as Merkel Trees are introduced to replace linear lists, and the efficiency of integrity measurement is improved by optimizing query paths and data verification capabilities. However, these solutions still have limitations in practical applications, such as the complexity of Huffman tree construction and the structural change overhead when inserting new nodes into the Merkel tree, which limit the ability to quickly find specific path metric records and verify multiple applications in parallel. Summary of the invention

[0005] In view of the above problems existing in the prior art, an embodiment of the present invention provides a social group discovery method and device based on a temporal graph neural network.

[0006] This invention project proposes an integrity measurement architecture based on Merkel Patricia Trie (MPT tree). MPT tree is a data structure that combines the advantages of Merkel tree and dictionary tree. With its efficient path search and data verification functions, it provides a new idea for the management of measurement lists. This invention transmits the measurement records generated by the kernel to the user state through the netlink and virtual file system mechanism, builds the MPT tree using the user state program, and inserts the measurement records in the form of nodes. It uses the prefix matching characteristics of the MPT tree to achieve fast search, and uses the root hash value to complete the integrity check. In addition, the project also stores the MPT tree in a key-value database such as LevelDB to achieve persistent storage and efficient access to measurement records. This solution aims to fundamentally improve the performance bottleneck of the Linux system in integrity measurement and provide technical support for building a more secure and reliable computing environment.

[0007] The present invention optimizes the measurement record storage process of the existing integrity measurement framework by using an MPT tree (Merkle Patricia Tree) to replace a linear data structure, uses netlink and a virtual file system to transmit file measurement values ​​generated by a kernel and corresponding file paths to a user-state program, and the user-state program implements an MPT tree. After receiving the measurement data, the path and the file measurement value are inserted into the MPT tree and saved in the form of tree nodes. Prefix matching is used in the MPT tree to realize fast search of the file path, and root node hash calculation is used to complete integrity verification, so as to finally obtain an integrity measurement framework based on the measurement storage structure of the MPT tree. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work. Figure 1 The overall process of the integrity measurement architecture based on the MPT tree is demonstrated, including the acquisition of kernel measurement records, insertion, search and storage of measurement records, and local and remote proof of data integrity. Figure 2 The structure of the integrity measurement device based on the MPT tree is described, which mainly includes a kernel measurement record acquisition module, a measurement record processing module (involving insertion, search and storage), and an integrity verification module; Figure 3 The physical structure of the electronic device required to implement the present invention is shown, including components such as a processor, a memory, and a communication interface; Figure 4The various components of the MPT integrity measurement framework and their interactions are described in detail, such as data transmission between kernel and user mode, construction and storage of the MPT tree, etc. Figure 5 Demonstrated the synchronization mechanism of metric records between kernel and user mode through semaphores and virtual file system; Figure 6 Describes the process of transmitting metric records between the kernel and user mode using the netlink interface, including sending and receiving messages. Figure 7 The workflow of the user-mode program TIMA is shown, including receiving the metric records transmitted by the kernel, inserting them into the MPT tree, calculating the root hash value, and storing the MPT tree in the database; Figure 8 The insertion process of the MPT tree is illustrated by examples, including the insertion of new data and the update of old data, as well as the conversion of node types.

Claims

1. Design and implementation of an MPT tree integrity measurement architecture, characterized in that: include: Step 1, obtain kernel measurement records. The measurement records generated in the kernel need to be exported to the user space for storage, which requires the use of the kernel-user communication mechanism in Linux. Linux provides a variety of methods to realize data interaction from the kernel to the user space, including system calls, signal mechanisms, virtual file systems (such as / proc, / debugfs, etc.), ioctl interfaces, netlink, etc. In this design, the transmission of measurement records from the kernel to the user space is realized through the combination of signal virtual file systems and netlink interfaces. Step 2, insert, search and store the obtained measurement records. After the kernel IMA module transfers the new measurement record information to the user space, the file path and summary of the measurement object can be obtained. Next, these data need to be handed over to the user-state program TIMA for processing. The program is based on the operation of the MPT tree. The key-value pair data of <path, summary> is inserted into the MPT tree to complete the storage of the measurement record, and the measurement record is located by searching for nodes in the MPT tree. This involves the update and search operations of the MPT tree. Finally, the MPT tree node data is serialized and inserted into the database to realize the persistent storage of the MPT tree memory data.

2. The method for obtaining kernel measurement records according to claim 1, characterized in that: Step 1 includes: transmission of measurement records based on signal-virtual file system. Seq_file interface is an efficient kernel programming abstraction, which is often used to create a virtual file composed of a series of data sequences. When operating files through functions such as open and read, the system VFS is called to the kernel layer, and ordinary files are associated with sequence data structures in the kernel. Then, the sequence objects are traversed and output through the callback functions start(), stop(), next(), and show() provided by seq_operation, and finally the kernel sequence data is mapped to files in user space. And transmission of measurement records based on netlink. Linux netlink is a message subsystem implemented based on the general BSD Socket architecture, which can realize two-way data communication between the kernel and users, and between users. At the same time, netlink is an asynchronous communication mechanism. The messages transmitted by both parties will be saved in the socket queue. The messages sent by the sender will be saved in the receiving queue of the receiver's socket, and the receiver does not need to receive the message immediately. Netlink supports multicast. The kernel can send messages to a netlink group, and any program that joins the netlink group can receive the message. By utilizing the characteristics of netlink and creating a user-defined protocol number, the kernel IMA module can package new metric records into socket messages after they are generated and send them to a multicast group. The user-mode IMA program only needs to join the multicast group and listen to and read the message receiving queue of the group to obtain new metric records.

3. The insertion, search and storage of metric records according to claim 1, characterized in that: Step 2 includes: MPT tree node design, insertion method, search method, root value calculation, persistent storage, and MPT tree-based integrity architecture application.

4. The MPT tree-based integrity architecture application according to claim 3, characterized in that: include: Local attestation of data integrity and remote attestation of data integrity. After the kernel measurement record is stored in the MPT tree, it can be applied to local and remote proof of data integrity. In the existing integrity verification framework, the summary value obtained by file measurement will not only be added to the measurement list, but also enter the platform configuration register PCR in the TPM for extension. The extension operation is essentially a series of hash calculations on each summary value to obtain a reference value that can be used as a basis for integrity verification. During an extension process, the reference value stored in the PCR is spliced ​​with the summary value of the file participating in this extension, and then the original reference value in the register is updated to the summary value obtained by hashing the splicing result.

5. The design and implementation of an MPT tree integrity measurement architecture according to claim 1, characterized in that: It includes: the first main module: obtaining kernel measurement records, and the second main module: inserting, searching and storing measurement records.

6. An electronic device, characterized in that: include: At least one processor, at least one memory and a communication interface; wherein, The processor, memory and communication interface communicate with each other; The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method according to any one of claims 1 to 5.

7. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which cause the computer to execute the method of any one of claims 1 to 5.

Images