Terminal credibility implementation method based on software credibility base and electronic equipment

Abstract

The invention discloses a terminal credibility implementation method based on a software credibility base and electronic equipment, and the method comprises the steps: generating intelligent password keys of a user, a security agent and a terminal based on a credible password service platform, and constructing a credible root under the support of credible hardware; based on the security agent, the intelligent digital key generates a software trusted base; performing security agent verification and software trusted base verification; according to the terminal credibility implementation method based on the software credibility base provided by the invention, the software credibility base is constructed in a manner of combining the security agent with the intelligent digital key without changing bottom hardware equipment of the system, so that the reliability of the terminal system is improved. A security isolation strategy of process operation is realized in combination with a non-interference model, single-point credibility of a terminal computing node is realized, and compared with the prior art, the method has a remarkable technical effect.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to a terminal trusted implementation method based on a software trusted base; the present invention also relates to an electronic device. Background Art

[0002] In information systems, the trusted mechanism and the security mechanism are mutually supportive. The trusted mechanism requires the security mechanism to ensure its uninterrupted operation, and the security mechanism requires the trusted mechanism to provide trusted information about itself and the environment. If the security and trusted mechanisms in the system are complete, then by tracing back along this support relationship, we will eventually obtain an underlying mechanism that has both security and trusted functions and does not require other mechanisms to provide security support. This is the system's root of trust.

[0003] In the prior art, in the existing trusted implementation scheme, the trusted platform control module (TPCM) integrated on the trusted hardware motherboard is used as the system trusted root, which requires the replacement of the entire system hardware when performing trusted enhancement transformation. Current trusted computing mainly uses trusted hardware products with their own trusted roots as the trusted base, and on this basis, further enhances and rectifies the corresponding interfaces and operating systems to achieve single-point trust of terminal computing nodes. Based on this, the system is subject to step-by-step measurement and authentication to achieve active immune trust of the system. However, this method is based on trusted hardware and builds a multi-level in-depth defense system from basic software and hardware, complete machines, network communications, network security to applications, but requires large-scale replacement of all basic hardware in the system, with huge implementation costs and workload, which hinders the application of trusted protection systems in existing large-scale mature systems.

[0004] That is, the existing technology has the problem that the investment cost of replacing trusted hardware is huge, which has a great impact on the normal operation of the existing system and is not conducive to the rapid trust enhancement and security upgrade of large-scale complex network production systems.

[0005] Therefore, how to provide a terminal trust implementation method based on a software trusted base, which can achieve single-point trust of terminal computing nodes without changing the underlying hardware devices of the system, and conveniently realize connection through a trusted network to build a secure and trusted system for the entire network system, has become a technical problem that needs to be urgently solved by technical personnel in this field. Summary of the invention

[0006] In order to solve the above technical problems, the present invention provides a terminal trust implementation method based on a software trusted base. There is no need to change the underlying hardware devices of the system. The software trusted base is constructed in the form of a security agent combined with an intelligent digital key. On this basis, a security isolation strategy for process operation is implemented in combination with a non-interference model to achieve single-point trust of the terminal computing node; and then a secure and trusted system of the entire network system can be built through a trusted network connection.

[0007] The present invention provides a terminal trust implementation method based on software trust base, comprising the steps of:

[0008] Generate intelligent password keys for users, security agents, and terminals based on the trusted password service platform, and build a trusted root with the support of trusted hardware;

[0009] Based on secure agent and intelligent digital key generation software trusted base;

[0010] Perform security agent verification and software trusted base verification;

[0011] Perform trusted verification of terminal system operation based on the verified software trusted base.

[0012] Further, in a preferred embodiment of the present invention, the steps are based on the secure agent and the intelligent digital key generation software trusted base including:

[0013] Generate a key pair through the security management and control platform, where the private key is stored in the USBKey card of the verification user terminal, and the public key is stored in the key management center KMC of the security management and control platform;

[0014] The trusted boot program and the security agent program corresponding to the terminal are packaged into a boot program and stored in the USBKey card;

[0015] The hash summary values ​​generated by the SM3 algorithm for all security agent programs are pre-stored in the security management and control platform, and n hash values ​​are generated for n security agents. (i.e., hash01=hash(original security agent 1 program file), hash02==hash(original security agent 2 program file), ... hash0n==hash(original security agent n program file)).

[0016] Further, in a preferred embodiment of the present invention, the steps of performing security agent verification and software trusted base verification include:

[0017] Connect the USBKey card containing the smart digital key to the user terminal;

[0018] When the terminal starts, the boot program in the USBKey will be executed first when powered on, and the trusted boot program and security agent program will be installed for the user terminal;

[0019] Each security agent communicates and connects securely with the security management and control platform through a secure encrypted channel (encrypted VPN method, using SM4 algorithm);

[0020] Verify the credibility of the security agent's own program files.

[0021] Further, in a preferred embodiment of the present invention, the steps of verifying the credibility of the program file of the security agent itself include the steps of: the security management and control platform uses the underlying password management platform to generate a random challenge code num-sp (p∈1-n) for each security agent connected thereto, and stores it in the security management platform;

[0022] Send a copy of the random challenge code to each security agent through a secure encrypted channel;

[0023] After the security agent receives the challenge code copy num-sp (p∈1-n) through the secure encrypted channel, the terminal uses the same SM3 algorithm as the security management platform to generate the hash value of the program file corresponding to the security agent, that is, hash1p=hash (security agent p program file to be verified)

[0024] Bind the challenge code copy num-sp and the secure proxy program hash value hash1p to get num-s-p+hash1p;

[0025] The binding information is signed and encrypted using the SM2 signature algorithm using the private key stored in the USBKey, and after obtaining sign-p (num-s-p+hash1p), the signature result is returned to the security management and control platform through the same secure encryption channel;

[0026] The security management and control platform uses the public key corresponding to each security agent stored in the KMC to use the same SM2 algorithm to decrypt and verify the signature re-sign-p (sign-p (num-r-p + hash2p), and obtains the challenge code and basic information of the security agent returned by the security agent, recorded as num-r-p + hash2p;

[0027] The signature result is verified by the challenge code and basic information of the security agent returned by the security agent.

[0028] Further, in a preferred embodiment of the present invention, the step of verifying the signature result by the challenge code returned by the security agent and the basic information of the security agent includes the steps of: comparing the challenge code through the security management and control platform, if the challenge code returned by the security agent is inconsistent with the copy of the random challenge code, it is determined that the malicious program is impersonating the security agent, and the terminal connection is rejected;

[0029] If the challenge code returned by the security agent is consistent with the copy of the random challenge code, then determine whether the returned security agent information is consistent with the pre-stored corresponding security agent basic information;

[0030] If the returned secure proxy information is inconsistent with the pre-stored corresponding secure proxy basic information, the secure proxy connection will be rejected;

[0031] If the returned security agent information is consistent with the pre-stored corresponding security agent basic information, the full agent verification and software trusted base verification are completed.

[0032] It should be noted that the challenge code is compared through the security control platform. If num-rp≠

[0033] num-sp, it is determined that the terminal is a malicious program impersonating a security proxy and the terminal connection is rejected to ensure the strong credibility of the security proxy identity.

[0034] If num-rp = num-sp, then further determine whether the returned security proxy information is consistent with the pre-stored corresponding security proxy basic information;

[0035] If hash2p≠hash0p, it means that the security proxy program has been tampered with, and the security proxy connection is rejected;

[0036] If hash2p=hash0p, it proves that the security agent has not been tampered with, completing the security agent verification and software trusted base verification.

[0037] Furthermore, in a preferred embodiment of the present invention, performing trusted verification of terminal system operation based on the verified software trusted base includes: performing static trusted verification of terminal environment; performing static trusted verification of terminal process; performing dynamic trusted verification of terminal; and performing trusted verification of terminal system operation.

[0038] Furthermore, in a preferred embodiment of the present invention, static trust verification of the terminal environment is performed, including the steps of:

[0039] The security agent collects configuration information of the user's terminal environment, including terminal IP, terminal network card MAC address, disk serial number, terminal operating system integrity, confidentiality check value, etc.

[0040] The SM3 algorithm is used to generate the hash summary value of the terminal configuration information for the collected terminal configuration information;

[0041] Compare the terminal configuration information hash digest value with the reference hash digest value. If the terminal configuration information hash digest value and the reference hash digest value are inconsistent, access is denied and logs are reported to the security control platform through a secure channel.

[0042] If the hash digest value of the terminal configuration information is consistent with the reference hash digest value, access is allowed, and logs are reported to the security management and control platform through a secure channel to complete static verification of the terminal environment.

[0043] It should be noted that, in this solution, the SM3 algorithm is used to generate a hash summary value (zd-hash1=hash(IP to be verified, MAC to be verified, disk-serial to be verified, OS-hash to be verified (C, I))) for the collected terminal configuration information.

[0044] By comparing the summary value of the terminal configuration information, if zd-hash1≠zd-hash0, the terminal information has been tampered with, access is denied, and the log is reported to the security control platform through a secure channel;

[0045] If zd-hash1=zd-hash0, the terminal is secure and reliable, access is allowed, and logs are reported to the security management and control platform through a secure channel to complete static verification of the terminal environment.

[0046] Further, in a preferred embodiment of the present invention, the static trusted verification of the terminal process includes the steps of: ensuring the static integrity of the process, that is, ensuring the integrity of the executable files and runtime auxiliary files that are not running on the disk storage medium of the process; verifying and authenticating the integrity of the terminal process file system;

[0047] Define a set of files, which should include execution files and auxiliary files

[0048] When checking static processes The jth file f ij When the set F ij Contains processes arrive All relevant files and processes Checked files i1 to f ij-1 .

[0049] Define the auxiliary function Q(f ij )as follows:

[0050]

[0051] Therefore, we can know that the number of files to be protected by m static processes is And each file must use the hash algorithm to calculate the file's summary value H(f ij ) and save it.

[0052] The integrity metric of a static process can be calculated as follows:

[0053]

[0054] First, all the related files of the static process are summarized once using the SM3 hash algorithm (the symbol "|" is the concatenation operation of the byte string), and then all the summary values ​​are concatenated and summarized again to obtain the integrity measurement value of the process.

[0055] After completing the static process p, the integrity metric H(f ij )=Hash(f ij ) is calculated and saved to a disk file managed by the detection module. The integrity measurement value of each protected static process is placed in the USBKey.

[0056] USBKey can be carried by users. Before starting the protected process, it needs to be tested according to the above process and compared with the integrity measurement value stored in the USBKey. This process is called process integrity authentication. By authenticating the integrity of the process, users can confirm whether the static process they started is safe.

[0057] The dynamic trust verification of the terminal process adopts the dynamic trust verification process of the terminal process based on the non-interference theory, which mainly includes the following steps:

[0058] Process non-interference policy configuration, observe equivalence relations;

[0059] Check the isolation of the results;

[0060] Check single-step isolation;

[0061] Check local non-interference isolation and use structured rules based on trusted pipelines to achieve local non-interference isolation, including the following steps: building trusted pipelines between processes; monitoring pipeline status by monitors implemented by security agents; using structured rules to ensure non-interference between processes;

[0062] Check the two-way non-interference, swap the subject and object relationship of the process in the local non-interference isolation step, and still ensure non-interference.

[0063] Furthermore, in a preferred embodiment of the present invention, performing the trusted verification of terminal system operation includes the following steps:

[0064] Verify that system M runs from a trusted root;

[0065] Verify the system M All meet the requirements of single-step isolation, local non-interference isolation, bidirectional non-isolation and output result isolation;

[0066] Verify whether the process meets the trusted verification, verify(p, q) = true;

[0067] If the above three verification conditions are met, the terminal system operation is trustworthy;

[0068] Among them, the trusted verification function is as follows:

[0069] verify:P×P→{true,false}. The verification function describes

[0070] The relationship between processes

[0071]

[0072] go(·)=run(·), clear(·)=del(·).

[0073] In addition, the present invention also provides an electronic device, including: a computer program, the computer program is used to execute the terminal trusted implementation method based on the software trusted base as described above; a memory, used to store the computer program; and a processor, used to execute the computer program.

[0074] In summary, the terminal trust implementation method based on software trusted base provided by the present invention does not require changes to the underlying hardware devices of the system, and constructs the software trusted base in the form of a security agent combined with an intelligent digital key, and implements a secure isolation strategy for process operation in combination with a non-interference model to achieve single-point trust of terminal computing nodes. Compared with the prior art, the present invention uses a security management and control center platform supported by a cryptographic system including a digital cryptographic root certificate as the trusted root, constructs the software trusted base in the form of a security agent combined with an intelligent digital key, and implements secure isolation of process operation in a non-interference model to achieve single-point trust of terminal computing nodes. Furthermore, a secure and trusted system for the entire network system can be built through a trusted network connection, and there is no need to change the underlying hardware devices of the system. The system's trusted enhancement and security transformation can be achieved through software upgrades such as security agents, intelligent cryptographic systems, and security management and control platforms, which facilitates the rapid construction of trusted terminals and the entire network's trusted system. It should be noted that the present invention is suitable for trusted enhancement and security upgrades and transformations of large and medium-sized complex network information systems, meets the needs of cyberspace security protection, does not require changes to the underlying hardware devices of the system, and implements a secure isolation strategy for process operation in combination with a non-interference model to achieve single-point trust in terminal computing nodes. A secure and trusted system for the entire network system can be built through a trusted network connection, which has significant technical effects compared to the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0076] Figure 1 A flowchart of a method for implementing terminal trust based on a software trusted base provided by an embodiment of the present invention;

[0077] Figure 2 A flowchart of a terminal system operation trust verification based on a software trust base provided by an embodiment of the present invention;

[0078] Figure 3 A schematic diagram of a dynamic trusted verification process of a terminal process according to an embodiment of the present invention;

[0079] Figure 4 This is a flow chart of inter-process isolation based on a non-interference strategy according to an embodiment of the present invention;

[0080] Figure 5 A diagram describing a trusted pipeline involved in an embodiment of the present invention;

[0081] Figure 6 A trusted pipeline operation diagram according to an embodiment of the present invention;

[0082] Figure 7 The figure is a schematic diagram of bidirectional non-interference operation of a trusted pipeline involved in an embodiment of the present invention. DETAILED DESCRIPTION

[0083] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention.

[0084] It should be noted that when an element is referred to as being "fixed on" or "set on" another element, it can be directly on the other element or indirectly set on the other element; when an element is referred to as being "connected to" another element, it can be directly connected to the other element or indirectly connected to the other element.

[0085] It should be understood that the terms "length", "width", "up", "down", "front", "back", "first", "second", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0086] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "multiple" and "several" is two or more, unless otherwise clearly and specifically defined.

[0087] It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with this technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantive technical significance. Any structural modification, change in proportion or adjustment of size, without affecting the effects and purposes that can be achieved by the present invention, should still fall within the scope of the technical contents disclosed by the present invention.

[0088] Please Figure 1 and Figure 7As shown, an embodiment of the present invention provides a terminal trusted implementation method based on a software trusted base, the method comprising: generating intelligent cryptographic keys of users, security agents, and terminals based on a trusted cryptographic service platform, and building a trusted root under the support of trusted hardware; generating a software trusted base based on a security agent and an intelligent digital key; performing security agent verification and software trusted base verification; performing terminal system operation trusted verification based on the verified software trusted base. The terminal trusted implementation method based on a software trusted base provided by the present invention does not require changes to the underlying hardware devices of the system, and constructs a software trusted base in the form of a security agent combined with an intelligent digital key, and implements a secure isolation strategy for process operation in combination with a non-interference model to achieve single-point trust in terminal computing nodes. Compared with the prior art, the present invention uses a security management and control center platform supported by a cryptographic system including a digital cryptographic root certificate as a trusted root, and uses a security agent combined with an intelligent digital key as a trusted root. The software trusted base is constructed in this way, and the secure isolation of process operation is realized with a non-interference model, and the single-point trust of terminal computing nodes is realized. Then, a secure and trusted system of the entire network system can be built through a trusted network connection, and there is no need to change the underlying hardware devices of the system. The trusted enhancement and security transformation of the system can be realized through software upgrades such as security agents, intelligent cryptographic systems, and security management and control platforms, so as to facilitate the rapid construction of trusted terminals and the entire network trusted system. It should be noted that the present invention is suitable for the trusted enhancement and security upgrade and transformation of large and medium-sized complex network information systems, and meets the needs of cyberspace security protection. There is no need to change the underlying hardware devices of the system. The secure isolation strategy of process operation is realized in combination with a non-interference model, and the single-point trust of terminal computing nodes can be realized. A secure and trusted system of the entire network system can be built through a trusted network connection. Compared with the prior art, it has significant technical effects.

[0089] Specifically, in an embodiment of the present invention, the steps are based on a secure agent and a smart digital key generation software trusted base including: generating a key pair through a security management and control platform, wherein the private key is stored in a USBKey card of a verification user terminal, and the public key is stored in a key management center KMC of the security management and control platform;

[0090] The trusted boot program and the security agent program corresponding to the terminal are packaged into a boot program and stored in a USBKey card; the hash summary value generated by all security agent programs using the SM3 algorithm is pre-stored in the security management and control platform, and n corresponding hash values ​​are generated for n security agents. (i.e. hash01=hash(original security agent 1 program file), hash02==hash(original security agent 2 program file), ... hash0n==hash(original security agent n program file)).

[0091] Specifically, in an embodiment of the present invention, the steps for performing security agent verification and software trusted base verification include: connecting a USBKey card containing a smart digital key to a user terminal; when the terminal is started, the boot program in the USBKey will be executed first when power is turned on, and the trusted boot program and security agent program will be installed for the user terminal; each security agent program communicates and connects securely with the security management and control platform through a secure encrypted channel, using an encrypted VPN method and the SM4 algorithm; and performing credibility verification of the security agent's own program files.

[0092] Specifically, in an embodiment of the present invention, the steps for verifying the credibility of the program file of the security agent itself include the following steps: the security management and control platform uses the underlying password management platform to generate a random challenge code num-sp (p∈1-n) for each security agent connected to it, and stores it on the security management platform; a copy of the random challenge code is sent to each security agent through a secure encryption channel; after the security agent receives the copy of the challenge code num-sp (p∈1-n) through the secure encryption channel, the terminal uses the same SM3 algorithm of the security management and control platform to generate a hash value of the program file of the corresponding security agent, that is, hash1p=hash (the program file of the security agent p to be verified), and the copy of the challenge code num-sp and the hash value of the security agent program have h1p is bound to obtain num-s-p+hash1p; the binding information is signed and encrypted using the SM2 signature algorithm through the private key stored in USBKey to obtain sign-p(num-s-p+hash1p) and the signature result is returned to the security management and control platform through the same secure encryption channel; the security management and control platform uses the public key corresponding to each security agent stored in KMC to use the same SM2 algorithm to decrypt and verify the signature re-sign-p(sign-p(num-r-p+hash2p) to obtain the challenge code and basic information of the security agent returned by the security agent, recorded as num-r-p+hash2p; the signature result is verified by the challenge code and basic information of the security agent returned by the security agent.

[0093] Specifically, in an embodiment of the present invention, the step of verifying the signature result by the challenge code returned by the security agent and the basic information of the security agent includes the steps of: comparing the challenge code through the security management and control platform, if the challenge code returned by the security agent is inconsistent with the copy of the random challenge code, it is determined that it is a malicious program impersonating the security agent, and the terminal connection is rejected;

[0094] If the challenge code returned by the security agent is consistent with the copy of the random challenge code, then determine whether the returned security agent information is consistent with the pre-stored corresponding security agent basic information;

[0095] If the returned secure proxy information is inconsistent with the pre-stored corresponding secure proxy basic information, the secure proxy connection will be rejected;

[0096] If the returned security agent information is consistent with the pre-stored corresponding security agent basic information, the full agent verification and software trusted base verification are completed.

[0097] It should be noted that in the embodiment of the present invention, the challenge code is compared through the security management and control platform. If num-rp≠num-sp, it is determined that the malicious program is impersonating the security agent, and the terminal connection is rejected to ensure the strong credibility of the security agent identity. If num-rp=num-sp, it is further determined whether the returned security agent information is consistent with the pre-stored corresponding security agent basic information; if hash2p≠hash0p, it means that the security agent program has been tampered with, and the security agent connection is rejected; if hash2p=hash0p, it is proved that the security agent has not been tampered with, and the security agent verification and software trusted base verification are completed.

[0098] Specifically, in an embodiment of the present invention, performing trusted verification of terminal system operation based on a verified software trusted base includes: performing static trusted verification of the terminal environment; performing static trusted verification of the terminal process; performing dynamic trusted verification of the terminal; and performing trusted verification of the terminal system operation.

[0099] Specifically, in the embodiment of the present invention, static trusted verification of the terminal environment is performed, including the steps of: the security agent collects configuration information of the user terminal environment, including information such as the terminal IP, the terminal network card MAC address, the disk serial number, the integrity of the terminal operating system, and the confidentiality check value;

[0100] The SM3 algorithm is used to generate a hash summary value (zd-hash1=hash(IP to be verified, MAC to be verified, disk-serial to be verified, OS-hash(C,I))) for the collected terminal configuration information.

[0101] By comparing the summary value of the terminal configuration information, if zd-hash1≠zd-hash0, the terminal information has been tampered with, access is denied, and the log is reported to the security control platform through a secure channel;

[0102] If zd-hash1=zd-hash0, the terminal is secure and reliable, access is allowed, and logs are reported to the security management and control platform through a secure channel to complete static verification of the terminal environment.

[0103] More specifically, the terminal process dynamic trust verification adopts the terminal process dynamic trust verification process based on the non-interference theory, which mainly includes the following steps:

[0104] Process non-interference policy configuration, observe equivalence relations;

[0105] Check the isolation of the results;

[0106] Check single-step isolation;

[0107] Check local non-interference isolation and use structured rules based on trusted pipelines to achieve local non-interference isolation, including the following steps: building trusted pipelines between processes; monitoring pipeline status by monitors implemented by security agents; using structured rules to ensure non-interference between processes;

[0108] Check the two-way non-interference, swap the subject and object relationship of the process in the local non-interference isolation step, and still ensure non-interference.

[0109] Specifically, in the embodiment of the present invention, the static trusted verification of the terminal process includes the following steps: the security agent collects the configuration information of the user terminal environment, including the terminal IP, the terminal network card MAC address, the disk serial number, the integrity of the terminal operating system, the confidentiality check value and other information;

[0110] The SM3 algorithm is used to generate the hash summary value of the terminal configuration information for the collected terminal configuration information;

[0111] Compare the terminal configuration information hash digest value with the reference hash digest value. If the terminal configuration information hash digest value and the reference hash digest value are inconsistent, access is denied and logs are reported to the security control platform through a secure channel.

[0112] If the hash digest value of the terminal configuration information is consistent with the reference hash digest value, access is allowed, and logs are reported to the security management and control platform through a secure channel to complete static verification of the terminal environment.

[0113] It should be noted that in the embodiment of this solution, ensuring the static integrity of the process requires ensuring the integrity of the executable files and runtime auxiliary files that are not running on the process disk storage medium; verifying and authenticating the integrity of the terminal process file system;

[0114] Defines a collection of files, including executable files and auxiliary files.

[0115] When checking static processes The jth file f ij When the set F ij Contains processes arrive All relevant files and processes Checked files i1 to f ij-1 .

[0116] Define the auxiliary function Q(f ij )as follows:

[0117]

[0118] Therefore, we can know that the number of files to be protected by m static processes is And each file must use the hash algorithm to calculate the file's summary value H(f ij ) and save it.

[0119] The integrity metric of a static process can be calculated as follows:

[0120]

[0121] First, all the related files of the static process are summarized once using the SM3 hash algorithm (the symbol "|" is the concatenation operation of the byte string), and then all the summary values ​​are concatenated and summarized again to obtain the integrity measurement value of the process.

[0122] After completing the static process p, the integrity metric H(f ij )=Hash(f ij ) is calculated and saved to the disk file managed by the detection module. The integrity measurement value of each protected static process is placed in the USBKey. The USBKey can be carried by the user. Before starting the protected process, it needs to be tested according to the above process and compared with the integrity measurement value stored in the USBKey. This process is called process integrity authentication. By authenticating the integrity of the process, the user can confirm whether the static process he started is safe.

[0123] More specifically, the terminal process dynamic trust verification based on the non-interference theory includes the following implementation schemes:

[0124] First, we use the method of monitoring memory references to measure the integrity of the memory pages of the running process. The process is as follows:

[0125] The private space of a process P active in the system can be considered to consist of a series of (up to n) memory pages:

[0126] G 1 , G 2 , …, G n .The data in each page corresponds to an integrity metric value h 1 ,h 2 ,…,h n .. If the entire process is loaded into memory, the integrity measure of the process in memory is:

[0127]

[0128] Second, inter-process isolation based on a non-interference strategy.

[0129] Specifically:

[0130] Process non-interference policy configuration: Configure the process non-interference policy to meet the following conditions (process pro(a) is said to have no interference with other processes under operation a).

[0131] output(run(s 0 ,α),a)=output(run(s 0 ,del(α,pro(a))),a)

[0132] In the formula, s 0 is the initial state, a∈A,α∈A ＊

[0133] Observational equivalence relation: Each process in the terminal has an observational equivalence relation about the system state The system is said to satisfy the observation equivalence property. That is, from the perspective of process p, the system states s and t are the same.

[0134] Check result isolation: A process is said to satisfy the result isolation property when it meets the following conditions:

[0135]

[0136] Result isolation states that if there are two states that are observationally equivalent for a process p, then executing the same single action in these two states will produce the same output result.

[0137] Checking single-step isolation: A process is said to satisfy the single-step isolation property when

[0138]

[0139] The one-step isolation property states that when two states are observationally equivalent for a process p,

[0140] In these two states, the state of the system will not change when executing the same single action.

[0141] Checking for local non-interference isolation: A process is said to satisfy the local non-interference isolation property when

[0142] Local non-interference isolation property states that if a process that issues action a does not interfere with process p, then from the perspective of process p, the system state is observationally equivalent to the state before executing action a.

[0143] If a process satisfies result isolation, single-step isolation, and local non-interference isolation, then the process is dynamically trusted.

[0144] In addition, the local non-interference isolation is implemented using structured rules based on trusted pipelines, as follows:

[0145] The security agent implements the ACM access controller and process pipeline controller functions, performs trust enhancement on the interactive pipelines between processes, adds the management and control functions of the trusted whitelist and security tag check, establishes trusted pipelines between processes, and forms a secure channel for mutual access between processes.

[0146] By adopting data encryption algorithm (SEA or SM4), a one-way, seamless, and non-interference effective channel is established between entities. <tp>={TPF, TPB, TPO, ACM}; wherein, TPF: trusted process front end, TPB: trusted process back end, TPO: trusted process body and ACM: access controller, i.e., trusted pipe, wherein the trusted pipe is used to establish a trusted connection between processes, which is unidirectional, atomic, secure, and controllable, and can realize secure control of information flow in the existing system.

[0147] For details about the trusted pipeline, see Figure 5 As shown in the figure, after the introduction of trusted pipes, the system adds 4 types of objects: TPF, TPB, TPO, and ACM; the process environment isolation table constitutes the trusted pipe whitelist whitelist. The trusted pipe constitutes the only channel shared between processes. The request create_tp to establish a trusted pipe is initiated by the process, and the software TCB completes the pipe establishment and modifies the trusted pipe whitelist whitelist.

[0148] Among them, the function own: N→SD, u=own(n) means that object n belongs to the u process environment, and the trusted pipeline is represented by a 3-tuple (security domain, object name, operation). The pipeline is a one-way information flow. All trusted pipelines in the system constitute a trusted pipeline whitelist. The trusted pipeline operation diagram is shown in Figure 6 shown.

[0149] In the embodiment of the present invention, the monitor function implemented by the security agent is used for monitoring the pipeline status between processes; observes(u,s), where u is the process and s is the status of the process;

[0150] Structural rules and BLP attribute rules are used to ensure no interference between processes.

[0151] In a trusted pipeline, the equivalence relationship The structured rules that need to be satisfied can be described as:

[0152] s.values_read(u)=t.values_read(u);

[0153]

[0154] n∈observes(u,s)→s.object_values(n)=t.object_values(n);

[0155] s.whitelist = t.whitelist;

[0156] s.tp.ACM(u,n)=t.tp.ACM(u,n).

[0157] BLP attribute rules:

[0158] Simple safety property: n∈observes(u,s)→classification(n)≤clearance(u);

[0159] *Attribute: n∈alters(u,s)→clearance(u)≤classification(n).

[0160] In the embodiment of the present invention, the bidirectional non-interference is checked, and the process subject and object relationship in the previous step is exchanged to still ensure non-interference. The schematic diagram of bidirectional non-interference operation of the trusted channel is as follows Figure 7 shown.

[0161] The inspection rules are:

[0162] P1.Send_tp.whitelist(Creat_tp,Change_tp,,Get_tp,Del_tp)∈

[0163] P2.Recv_tp.whitelist(Creat_tp,Change_tp,,Get_tp,Del_tp);

[0164] P2.Send_tp.whitelist(Creat_tp,Change_tp,,Get_tp,Del_tp)∈

[0165] P1.Recv_tp.whitelist(Creat_tp,Change_tp,,Get_tp,Del_tp).

[0166] Specifically, in an embodiment of the present invention, performing trusted verification of terminal system operation includes the following steps:

[0167] Verify that system M runs from a trusted root; verify that system M All meet the single-step isolation, local non-interference isolation, bidirectional non-isolation and output result isolation; verify whether the process meets the trustworthy verification, verify(p, q) = true; if the above three verification conditions are met, the terminal system operation is trustworthy;

[0168] Among them, the trusted verification function is as follows:

[0169] verify:P×P→{true,false}. The verification function describes

[0170] The relationship between processes

[0171]

[0172] go(·)=run(·), clear(·)=del(·).

[0173] In addition, the present invention also provides an electronic device, including: a computer program, the computer program is used to execute the terminal trusted implementation method based on the software trusted base as described above; a memory, used to store the computer program; and a processor, used to execute the computer program.

[0174] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.< / tp>

Claims

1. A terminal trust implementation method based on software trust base, characterized in that: Includes steps: Generate intelligent password keys based on the security management and control platform, and build a trusted root with the support of trusted hardware; Based on secure agent and intelligent digital key generation software trusted base; Among them, the program files of the security agent include: security agent ID, program version number, program source file, program configuration file, program call library file, terminal configuration information summary value; Perform security agent verification and software trusted base verification; Perform trusted verification of terminal system operation based on the verified software trusted base.

2. The method for implementing terminal trust based on software trusted base according to claim 1, characterized in that: The steps are based on secure agent, intelligent digital key generation software trusted base including: Generate a key pair through the security management and control platform; The private key is stored in the USBKey card of the verification user terminal, and the public key is stored in the key management center KMC of the security control platform; The trusted boot program and the security agent program are packaged to form a boot program and stored in a USBKey card; The hash summary values ​​generated by the SM3 algorithm for all security agent programs are pre-stored in the security management and control platform. N corresponding hash values ​​are generated for n security agents to generate a software trusted base.

3. The method for implementing terminal trust based on software trusted base according to claim 2, characterized in that: The steps to perform security agent verification and software trusted base verification include: Connect the USBKey card containing the smart digital key to the user terminal; When the terminal starts, the boot program in the USBKey is executed to install the trusted boot program and security agent program for the user terminal; Among them, the security agent program communicates and connects securely with the security management and control platform through a secure encrypted channel; Verify the credibility of the security agent's own program files.

4. The method for implementing terminal trust based on software trusted base according to claim 3, characterized in that: The steps to verify the credibility of the security agent's own program files include: Based on the security management and control platform, a random challenge code is generated for each security agent and stored in the security management platform; Send a copy of the random challenge code to each security agent through a secure encrypted channel; The security agent receives a copy of the random challenge code through a secure encrypted channel; The terminal uses the same SM3 algorithm as the security management platform to generate the hash value of the program file corresponding to the security agent; Bind the copy p of the random challenge code to the hash value of the security agent program; The binding information is signed and encrypted using the private key stored in the USBKey using the SM2 signature algorithm and the signature result is returned to the security management and control platform; The security management and control platform uses the public keys corresponding to each security agent stored in the KMC to perform decryption and signature verification using the same SM2 algorithm to obtain the challenge code and basic information of the security agent returned by the security agent; The signature result is verified by the challenge code and basic information of the security agent returned by the security agent.

5. The method for implementing terminal trust based on software trusted base according to claim 4, characterized in that: Steps to verify the signature result using the challenge code and basic information of the security agent returned by the security agent include: The challenge code is compared through the security management and control platform. If the challenge code returned by the security agent is inconsistent with the copy of the random challenge code, it is determined that it is a malicious program impersonating the security agent and the terminal connection is rejected; If the challenge code returned by the security agent is consistent with the copy of the random challenge code, then determine whether the returned security agent information is consistent with the pre-stored corresponding security agent basic information; If the returned secure proxy information is inconsistent with the pre-stored corresponding secure proxy basic information, the secure proxy connection will be rejected; If the returned security agent information is consistent with the pre-stored corresponding security agent basic information, the security agent verification and software trusted base verification are completed.

6. The terminal trusted implementation method based on software trusted base according to any one of claims 1 to 5, characterized in that: The terminal system operation trusted verification based on the verified software trusted base includes: static trusted verification of the terminal environment; static trusted verification of the terminal process; dynamic trusted verification of the terminal process; and trusted verification of the terminal system operation.

7. The method for implementing terminal trust based on software trusted base according to claim 6, characterized in that: Perform static trust verification of the terminal environment, including the following steps: The security agent collects configuration information of the user's terminal environment, including terminal IP, terminal network card MAC address, disk serial number, terminal operating system integrity, confidentiality check value, etc. The SM3 algorithm is used to generate the hash summary value of the terminal configuration information for the collected terminal configuration information; Compare the terminal configuration information hash digest value with the reference hash digest value. If the terminal configuration information hash digest value and the reference hash digest value are inconsistent, access is denied and logs are reported to the security control platform through a secure channel. If the hash digest value of the terminal configuration information is consistent with the reference hash digest value, access is allowed, and logs are reported to the security management and control platform through a secure channel to complete static verification of the terminal environment.

8. The method for implementing terminal trust based on software trusted base according to claim 6, characterized in that: The dynamic trust verification of the terminal process adopts the dynamic trust verification process of the terminal process based on the non-interference theory, which mainly includes the following steps: Process non-interference policy configuration, observe equivalence relations; Check the isolation of the results; Check single-step isolation; Check local non-interference isolation and use structured rules based on trusted pipelines to achieve local non-interference isolation, including the following steps: building trusted pipelines between processes; monitoring pipeline status by monitors implemented by security agents; using structured rules to ensure non-interference between processes; Check the two-way non-interference, swap the subject and object relationship of the process in the local non-interference isolation step, and still ensure non-interference.

9. The method for implementing terminal trust based on software trusted base according to claim 6, characterized in that: The trusted verification of terminal system operation includes the following steps: Verify that system M runs from a trusted root; Verify the system M All meet the requirements of single-step isolation, local non-interference isolation, bidirectional non-isolation and output result isolation; Verify whether the process meets the trusted verification, verify(p, q) = true; If the above three verification conditions are met, the terminal system operation is trustworthy.

10. An electronic device, characterized in that: include: A computer program, the computer program being used to execute the terminal trusted implementation method based on software trusted base as claimed in any one of claims 1 to 9; A memory for storing the computer program; A processor is used to execute the computer program.

Images