Server auditing method and device, equipment and medium

Abstract

The embodiment of the invention relates to an auditing method and device of a server, equipment and a medium, and relates to the technical field of computers, and the auditing method comprises the steps that the server is controlled to be started according to a preset starting mode so as to determine that data information in the starting process from a basic input and output system to an operating system remains unchanged; mapping to-be-audited data of an operating system to a PCIE card connected with a server in a direct memory access mode, so that the PCIE card performs audit processing on the to-be-audited data according to a preset audit period and a preset audit mode to obtain an audit result; if the obtained audit result of the PCIE card is that the data is not changed, audit processing is conducted on the process through an internal audit module embedded in the operating system, and a process audit result is obtained. By adopting the technical scheme, a safe and credible computing environment of the server is constructed by adopting a double auditing mode, so that the computing environment is ensured not to be tampered, and the security, integrity and confidentiality of loading server codes and data are ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an audit method, device, equipment and medium for a server. Background Art

[0002] The existing server-based technical solution is a mixed application of trusted execution environment (TEE) and non-trusted execution environment. CPU (Central Processing Unit) scheduling requires a large amount of computing power to isolate the trusted execution environment. The mixed scheduling of trusted execution environment and non-trusted execution environment is the root cause of performance degradation.

[0003] In related technologies, such as process-level isolation solutions and virtual machine-level isolation solutions, since the trusted execution environment and the non-trusted execution environment coexist, the trusted execution environment needs to be encrypted in real time, which greatly affects the computing performance of the trusted execution environment, and there are technical problems such as low efficiency of accessing external devices to the trusted execution environment. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a server audit method, device, equipment and medium.

[0005] The present disclosure provides an audit method for a server, comprising: controlling the startup of the server according to a preset startup method to determine that data information from a basic input / output system to an operating system startup process remains unchanged; mapping the audited data of the operating system to a PCIE card connected to the server through a direct memory access method, so that the PCIE card performs an audit process on the audited data according to a preset audit cycle and a preset audit method to obtain an audit result; obtaining the audit result of the PCIE card that the data has not been changed, and performing an audit process on the process through an internal audit module embedded in the operating system to obtain a process audit result.

[0006] Optionally, the audit method of the server further includes: obtaining memory block information of the operating system, and performing hash processing on the memory block information based on a preset hash algorithm to obtain a hash value; and using the memory block information and the hash value as the data to be audited.

[0007] Optionally, the PCIE card performs audit processing on the data to be audited according to a preset audit cycle and a preset audit method to obtain an audit result, including: obtaining memory block information to be audited based on the data to be audited according to the preset audit cycle; performing hash processing on the memory block information to be audited based on the hash algorithm to obtain a hash value to be audited; comparing the hash value to be audited with the hash value in the data to be audited to determine the audit result.

[0008] Optionally, the process is audited by an internal audit module embedded in the operating system to obtain a process audit result, including: determining whether the process includes a signature; if the process does not include a signature, determining that the process is an illegal process as the process audit result.

[0009] Optionally, the method further includes: if the process includes a signature, obtaining the number of all processes including the signature process; and determining the process audit result based on comparing the number of processes with a target number.

[0010] Optionally, the method further includes: when the audit result of the PCIE card is that the data has not been changed and the process audit result is that the process is normal, exchanging data with an externally connected device of the operating system based on the direct memory access method.

[0011] Optionally, controlling the server startup according to a preset startup mode includes: performing signature verification on a boot loader during the server startup process; and loading the boot loader that passes the signature verification.

[0012] The disclosed embodiment also provides an audit device for a server, the device comprising: a startup module, used to control the startup of the server according to a preset startup method, so as to determine that data information from a basic input / output system to an operating system startup process remains unchanged; a first audit module, used to send the audited data of the operating system to a PCIE card connected to the server through a direct memory access method, so that the PCIE card performs an audit process on the audited data according to a preset audit cycle and a preset audit method to obtain an audit result; a second audit module, used to obtain the audit result of the PCIE card that the data has not been changed, and perform an audit process on the process through an internal audit module embedded in the operating system to obtain a process audit result.

[0013] An embodiment of the present disclosure also provides an electronic device, which includes: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the audit method of the server provided in the embodiment of the present disclosure.

[0014] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the audit method of the server provided by the embodiment of the present disclosure.

[0015] The embodiment of the present disclosure also provides a computer program product, including a computer program, wherein the computer program is executed by a processor as the audit method of the server provided in the embodiment of the present application.

[0016] The technical solution provided by the embodiment of the present disclosure has the following advantages over the prior art: the audit solution of the server provided by the embodiment of the present disclosure controls the startup of the server according to a preset startup method to ensure that the data information from the basic input and output system to the operating system startup process remains unchanged; the audited data of the operating system is given to a PCIE (PCI-Express, a high-speed serial computer expansion bus standard) card connected to the server through a direct memory access (DMA, Direct Memory Access) method, so that the PCIE card performs audit processing on the audit data according to a preset audit cycle and a preset audit method to obtain an audit result; the audit result of the PCIE card is that the data has not been changed, and the process is audited through an internal audit module embedded in the operating system to obtain a process audit result. By adopting the above technical solution, all server resources are used in the TEE environment to avoid additional computing losses caused by real-time encryption and decryption. A double audit method is used to ensure that the computing environment cannot be tampered with, to ensure the security, integrity and confidentiality of loaded server code and data, to ensure that data can be exchanged safely and transparently with external connected devices such as GPU (Graphics Processing Unit) cards, to reduce the amount of audit calculations, and to dynamically load signed controlled processes. Therefore, the entire trusted execution environment can realize applications without shutting down, and unsigned processes can be monitored in real time to prevent malicious code from starting processes that are not monitored and audited. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0018] Figure 1 A flow chart of a server audit method provided by an embodiment of the present disclosure;

[0019] Figure 2 A flowchart of another server audit method provided by an embodiment of the present disclosure;

[0020] Figure 3An example diagram of an audit method for a server provided in an embodiment of the present disclosure;

[0021] Figure 4 A schematic diagram of the structure of an audit device for a server provided in an embodiment of the present disclosure;

[0022] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0024] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0025] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0026] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0027] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0028] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0029] Specifically, the existing technical solutions mainly include process-level isolation solutions and virtual machine-level isolation solutions. Among them, Intel SGX (Software Guard Extensions) technology is used as an example for process-level isolation. Enclave is the core component of Intel SGX. It is a protected area created inside the CPU, similar to a secure container. It remains hidden from the operating system, malware, and even programs with root permissions, ensuring the security of sensitive data. Code and data with high security requirements in applications will be placed in the Enclave for execution and storage. The Memory Encryption Engine (MEE) is a special hardware component in SGX technology that is used to generate encryption keys and encrypt and decrypt code and data in the Enclave. When the Enclave is started, the MEE generates an encryption key. After that, the data in the Enclave will be encrypted when it is written to the memory. Only the code inside the Enclave can decrypt and access the data, thereby effectively protecting the data from being stolen or tampered with.

[0030] Specifically, create an Enclave: When the application starts, the code and related data of its secure part will be loaded into the Enclave. At this time, the operating system and hardware will automatically allocate a piece of SGX memory for the Enclave, and use the memory isolation mechanism to ensure that only the code inside the Enclave can access and modify this memory, and external programs and the operating system cannot access the data in it; memory encryption: MEE will use the generated encryption key to encrypt the code and data in the Enclave, and store the encrypted data in the allocated SGX memory. When the code inside the Enclave needs to access the encrypted data, it will send a request to MEE, and MEE will use the same encryption key to decrypt the data and return the decrypted data to the code inside the Enclave. The entire encryption and decryption process is performed at the hardware level to ensure the security of the data; execution protection: When the processor accesses the data in the Enclave, it will automatically switch to the Enclave mode. This mode will force additional hardware checks on each memory access to prevent known memory attacks and further ensure the integrity and confidentiality of the data and code in the Enclave.

[0031] Among them, the virtual machine isolation solution takes Haiguang CSV, or Cloud Security Virtualization, as an example. Specifically, memory encryption and isolation: the CPU hardware automatically encrypts the CSV virtual machine when writing memory data, and automatically decrypts the memory data when reading it. Each CSV virtual machine uses a different key to ensure the confidentiality of the data. At the same time, the ASID is used inside the Haiguang CPU to distinguish different CSV virtual machines and hosts. Each CSV virtual machine uses independent CPU resources such as Cache and TLB, which implements resource isolation between the CSV virtual machine and the host, further enhancing security; building a trusted execution environment: Based on the above secure encrypted virtual machine, CSV technology builds a trusted execution environment. It not only ensures the confidentiality of the virtual machine data, but also ensures the integrity of the data, effectively preventing the host operating system and virtual machine management from remapping attacks on the virtual machine by rewriting the virtual machine's nested page table.

[0032] The above two technical solutions require real-time encryption of the trusted execution environment due to the coexistence of TEE and the non-trusted execution environment, which greatly affects the computing performance of the trusted environment and the inefficiency of access to external devices in the trusted execution environment. For example, when GPU is building a trusted execution environment based on artificial intelligence computing power, the existing method cannot directly access system peripherals (such as network cards and other PCIE cards).

[0033] In view of the above problems, the audit method of the server proposed in the embodiment of the present disclosure controls the startup of the server according to the preset startup mode to determine that the data information from the basic input and output system to the operating system startup process remains unchanged; the audit data of the operating system is mapped to the PCIE card connected to the server through direct memory access, so that the PCIE card performs audit processing on the audit data according to the preset audit cycle and preset audit mode to obtain the audit result; the audit result of the PCIE card is obtained as the data has not been changed, and the process is audited through the internal audit module embedded in the operating system to obtain the process audit result. By adopting the above technical solution, a safe and reliable computing environment for the server can be constructed to ensure that the computing environment cannot be tampered with, to ensure the security, integrity and confidentiality of the code and data loaded on the server, to avoid the additional computing loss caused by real-time encryption and decryption, and the devices based on the PCIE interface plug-in realize data exchange in the TEE protection environment, the audit computing overhead is extremely small, and the program and data of the running process are guaranteed not to be tampered with with minimal performance loss.

[0034] Figure 1 The present invention provides a flow chart of a server audit method provided in an embodiment of the present invention. The method can be executed by an audit device of the server, wherein the device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 1 As shown, the method includes:

[0035] Step 101: Control the server startup according to a preset startup mode to ensure that data information from the basic input and output system to the operating system startup process remains unchanged.

[0036] In the disclosed embodiments, BIOS (Basic Input Output System) is a firmware program that is first run when a computer is started, and is responsible for initializing hardware devices, loading an operating system, and the like.

[0037] Specifically, BIOS secure boot can be understood as performing signature verification on the boot loader (such as UEFI) during the boot process to ensure that only authenticated and trusted boot programs are loaded, thereby ensuring that the data information from the basic input and output system to the operating system startup process remains unchanged. That is, the secure boot technology is used to construct a trust chain for system startup, ensuring that the code and data of the boot process from BIOS to the operating system have not been tampered with.

[0038] Step 102: Map the audit data of the operating system to a PCIE card connected to the server through direct memory access, so that the PCIE card performs audit processing on the audit data according to a preset audit cycle and a preset audit method to obtain an audit result.

[0039] In the disclosed embodiment, the PCIE card may be a custom-developed FPGA card or a custom-developed chip card, and the data to be audited may be mapped to the PCIE card through direct memory access; wherein the data to be audited includes memory block information to be audited, verification information processed on the memory block information to be audited, such as a hash value corresponding to hash processing of the memory block information to be audited, so that the PCIE card may perform audit processing on the audit data according to a preset audit cycle and a preset audit method to obtain an audit result.

[0040] Among them, the preset audit cycle can be pre-set according to actual application needs, and the audit method can also be pre-set according to actual application needs. Specifically, the memory block information to be audited is obtained based on the data to be audited, and the memory block information to be audited is hashed based on the hash algorithm to obtain the hash value to be audited, and the hash value to be audited is compared with the hash value in the data to be audited to determine the audit result. For example, if the hash value to be audited and the hash value in the data to be audited are the same, it means that the audit is passed, and if the hash value to be audited and the hash value in the data to be audited are different, it means that the audit is failed.

[0041] Step 103, obtaining the audit result of the PCIE card, which is that the data has not been changed, audits the process through the internal audit module embedded in the operating system to obtain the process audit result.

[0042] In the disclosed embodiment, the audit result of the PCIE card may be that the audit passed, i.e., the data has not been changed, or the audit failed, i.e., the data has been changed, and relevant early warning operations can be performed; when the audit result of the PCIE card is that the data has not been changed, the process is audited through the internal audit module embedded in the operating system to obtain the process audit result.

[0043] Specifically, the process is audited through the internal audit module embedded in the operating system to obtain the process audit result. It can be determined whether the process includes a signature. A process that does not include a signature can be identified as an illegal process, or the number of all processes including signature processes can be counted to see if it is consistent with the number of processes that should exist, that is, the target number. If the number is consistent, the process audit result is determined to be passed; if the number is inconsistent, the process audit result is determined to be failed.

[0044] The audit scheme of the server provided by the embodiment of the present disclosure controls the startup of the server according to the preset startup mode to determine that the data information from the basic input and output system to the startup process of the operating system remains unchanged; the audit data of the operating system is given to the PCIE (PCI-Express, a high-speed serial computer expansion bus standard) card connected to the server through direct memory access (DMA, Direct Memory Access) mode, so that the PCIE card performs audit processing on the audit data according to the preset audit cycle and preset audit mode to obtain the audit result; the audit result of the PCIE card is obtained that the data has not been changed, and the process is audited and processed by the internal audit module embedded in the operating system to obtain the process audit result. With the above technical scheme, all resources of the server are used for the TEE environment, avoiding the additional computing loss caused by real-time encryption and decryption, and using a double audit method to ensure that the computing environment cannot be tampered with, ensuring the security, integrity and confidentiality of the loaded server code and data, and the data can be exchanged safely and transparently with external connection devices such as GPU (Graphics Processing Unit, image processor) card, the audit calculation amount is small, and the signed controlled process can be dynamically loaded, so that the entire trusted execution environment can realize the application without shutting down, and the unsigned process can be monitored in real time, excluding malicious code from starting the process that is not monitored and audited.

[0045] Figure 2 This is a flow chart of another server audit method provided by the embodiment of the present disclosure. Based on the above embodiment, this embodiment further optimizes the above server audit method. Figure 2 As shown, the method also includes:

[0046] Step 201 , during the server startup process, the boot loader is signature verified, and the boot loader that passes the signature verification is loaded to ensure that the data information from the basic input and output system to the operating system startup process remains unchanged.

[0047] Specifically, enabling the UEFI (Unified Extensible Firmware Interface) secure boot function can ensure that only the digitally signed boot program is loaded; or enabling the TPM (Trusted Platform Module) function and ensuring that the TPM chip works properly, that is, enhancing the reliability of BIOS secure boot by using the chip.

[0048] Therefore, secure boot technology is used to construct a trust chain for system boot, ensuring that the code and data of the boot process from BIOS to the operating system are not tampered with.

[0049] Step 202: Obtain memory block information of the operating system, and perform hash processing on the memory block information based on a preset hash algorithm to obtain a hash value, and map the memory block information and the hash value as audit data to a PCIE card connected to the server through a direct memory access method.

[0050] Step 203: The PCIE card obtains the memory block information to be audited based on the data to be audited according to the preset audit cycle, performs hash processing on the memory block information to be audited based on the hash algorithm to obtain the hash value to be audited, compares the hash value to be audited with the hash value in the data to be audited, and determines the audit result.

[0051] Among them, the memory block information can be information such as the memory block address. Each memory block information is processed by the hash algorithm to correspond to a hash value. When the data is not changed, the hash value comparison is the same. Therefore, the audit result is determined by comparing the hash value to be audited with the hash value in the data to be audited.

[0052] Specifically, by connecting an external PCIE card that is specifically used to audit the code and data areas of the operating system after secure boot, the code and data areas of the operating system that need to be audited are mapped to the PCIE card through DMA, and the PCIE card dynamically and periodically audits whether the operating system has been tampered with.

[0053] Step 204, the audit result of the PCIE card is that the data has not been changed. The internal audit module embedded in the operating system is used to determine whether the process includes a signature. If the process does not include a signature, the process is determined to be an illegal process. If the process includes a signature, the number of all processes including the signature process is obtained, and the process audit result is determined based on the comparison between the process number and the target number.

[0054] Specifically, the operating system embeds an internal audit module, which is protected by the PCIE card runtime audit to ensure that the internal audit module cannot be tampered with. The internal audit module performs dynamic audits on the later loaded processes, such as discovering illegal processes and whether the signed processes have been tampered with.

[0055] Step 205: When the audit result of the PCIE card indicates that the data has not been changed and the process audit result indicates that the process is normal, data is exchanged with an externally connected device of the operating system based on a direct memory access method.

[0056] As an example, Figure 3 As shown in the figure, secure boot technology is used from BIOS to operating system OS (Operating System), and the OS and internal audit module are audited through PCIE card to ensure that the internal audit module cannot be tampered with. The internal audit module dynamically audits the later loaded processes, such as Figure 3 Audit the controlled signature processes 1 to n in .

[0057] Therefore, a TEE environment based on the entire server is constructed, that is, all server resources are used in the TEE environment to avoid the additional computing loss caused by real-time encryption and decryption; it is highly compatible with the general computing environment, and all devices based on PCIE interface plug-ins in the TEE environment are in the TEE protection environment; there is no need for real-time encryption of the computing environment, and a hash algorithm is used for environmental verification and auditing. The audit computing overhead is extremely small, and minimal performance loss is used to ensure that programs and data in the running process are not tampered with.

[0058] In summary, the audit method of the server in the embodiment of the present disclosure does not involve encryption technology, and adopts a dynamic audit running code and data method to ensure the security and reliability of the operating environment; the operating system and peripheral devices such as GPU cards can exchange data safely and transparently; the audit calculation amount is small; signed controlled processes can be dynamically loaded, and the entire trusted execution environment can achieve application updates without shutting down; unsigned processes can be monitored in real time to prevent malicious code from starting processes that are not monitored and audited.

[0059] Figure 4 This is a schematic diagram of the structure of an audit device for a server provided in an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can generally be integrated into an electronic device. Figure 4 As shown, the device comprises:

[0060] The startup module 301 is used to control the server startup according to a preset startup mode to ensure that the data information from the basic input and output system to the operating system startup process remains unchanged;

[0061] The first audit module 302 is used to send the audit data of the operating system to the PCIE card connected to the server through direct memory access, so that the PCIE card performs audit processing on the audit data according to a preset audit cycle and a preset audit method to obtain an audit result;

[0062] The second audit module 303 is used to obtain the audit result of the PCIE card, which is that the data has not been changed, and to audit the process through the internal audit module embedded in the operating system to obtain the process audit result.

[0063] Optionally, the auditing device of the server further includes: an acquisition and processing module, used to obtain memory block information of the operating system, and hash the memory block information based on a preset hash algorithm to obtain a hash value, and use the memory block information and the hash value as the data to be audited.

[0064] Optionally, the first audit module 302 is specifically used to: send the data to be audited of the operating system to a PCIE card connected to the server through direct memory access, so that the PCIE card obtains the memory block information to be audited based on the data to be audited according to a preset audit cycle; hash the memory block information to be audited based on the hash algorithm to obtain the hash value to be audited; compare the hash value to be audited with the hash value in the data to be audited to determine the audit result.

[0065] Optionally, the second audit module 303 is specifically used to: obtain the audit result of the PCIE card that the data has not been changed, and determine whether the process includes a signature; if the process does not include a signature, determine that the process is an illegal process as the process audit result.

[0066] Optionally, the second audit module 303 is further specifically used to: if the process includes a signature, obtain the number of all processes including the signature process; and determine the process audit result based on the comparison between the process number and the target number.

[0067] Optionally, the device also includes: a data exchange module, which is used to exchange data with an external connection device of the operating system based on the direct memory access method when the audit result of the PCIE card is that the data has not been changed and the process audit result is that the process is normal.

[0068] Optionally, the startup module 301 is specifically used to perform signature verification on the boot loader during the server startup process; and perform loading processing on the boot loader that passes the signature verification to ensure that data information from the basic input and output system to the operating system startup process remains unchanged.

[0069] The audit device of the server provided in the embodiment of the present disclosure can execute the audit method of the server provided in any embodiment of the present disclosure, and has the functional modules and beneficial effects corresponding to the execution method.

[0070] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the server audit method provided by any embodiment of the present disclosure.

[0071] Figure 5 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 5 , which shows a schematic diagram of the structure of an electronic device 400 suitable for implementing the embodiment of the present disclosure. The electronic device 400 in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0072] like Figure 5 As shown, the electronic device 400 may include a processing device 401 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a ROM 402 (ROM is a read-only memory) or a program loaded from a storage device 408 to a RAM 403 (RAM is a random access memory). In the RAM 403, various programs and data required for the operation of the electronic device 400 are also stored. The processing device 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An I / O interface 405 (I / O is input / output) is also connected to the bus 404.

[0073] Typically, the following devices may be connected to the I / O interface 405: an input device 406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 408 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 409. The communication device 409 may allow the electronic device 400 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 5 The electronic device 400 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0074] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 409, or installed from the storage device 408, or installed from the ROM 402. When the computer program is executed by the processing device 401, the above-mentioned functions defined in the audit method of the server of the embodiment of the present disclosure are executed.

[0075] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0076] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0077] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0078] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0079] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0080] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0081] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0082] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0083] According to one or more embodiments of the present disclosure, the present disclosure provides an electronic device, including:

[0084] processor;

[0085] a memory for storing instructions executable by the processor;

[0086] The processor is used to read the executable instructions from the memory and execute the instructions to implement any server audit method provided in the present disclosure.

[0087] According to one or more embodiments of the present disclosure, the present disclosure provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute any of the server audit methods provided by the present disclosure.

[0088] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0089] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0090] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A server audit method, characterized in that: include: Control the server to start up according to a preset startup mode to ensure that data information from the basic input and output system to the operating system startup process remains unchanged; Mapping the audited data of the operating system to a PCIE card connected to the server through direct memory access, so that the PCIE card performs audit processing on the audited data according to a preset audit cycle and a preset audit method to obtain an audit result; The audit result of the PCIE card is that the data has not been changed, and the process is audited by an internal audit module embedded in the operating system to obtain a process audit result.

2. The method according to claim 1, characterized in that The method further comprises: Obtaining memory block information of the operating system, and performing hash processing on the memory block information based on a preset hash algorithm to obtain a hash value; The memory block information and the hash value are used as the data to be audited.

3. The method according to claim 2, characterized in that The PCIE card performs audit processing on the data to be audited according to a preset audit cycle and a preset audit method to obtain an audit result, including: Acquiring the memory block information to be audited based on the data to be audited according to a preset audit cycle; Performing hash processing on the memory block information to be audited based on the hash algorithm to obtain a hash value to be audited; The to-be-audited hash value is compared with the hash value in the to-be-audited data to determine the audit result.

4. The method according to claim 1, characterized in that: The process is audited by the internal audit module embedded in the operating system to obtain the process audit result, including: Determining whether the process includes a signature by an internal audit module embedded in the operating system; If the process does not include a signature, the process is determined to be an illegal process as a result of the process audit.

5. The method according to claim 4, characterized in that The method further comprises: If the process includes a signature, obtain the number of all processes including the signature process; The process audit result is determined based on the comparison between the process quantity and the target quantity.

6. The method according to claim 1, characterized in that The method further comprises: When the audit result of the PCIE card is that the data has not been changed and the process audit result is that the process is normal, data is exchanged with an externally connected device of the operating system based on the direct memory access mode.

7. The method according to claim 1, characterized in that The controlling the server startup according to a preset startup mode includes: Performing signature verification on the boot loader during the server startup process; The boot loader that passes the signature verification is loaded.

8. An audit device for a server, characterized in that: include: A startup module, used for controlling the startup of the server according to a preset startup mode, so as to ensure that the data information from the basic input and output system to the operating system startup process remains unchanged; A first audit module is used to send the audit data of the operating system to a PCIE card connected to the server through a direct memory access method, so that the PCIE card performs audit processing on the audit data according to a preset audit cycle and a preset audit method to obtain an audit result; The second audit module is used to obtain the audit result of the PCIE card, which is that the data has not been changed, and to audit the process through the internal audit module embedded in the operating system to obtain the process audit result.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the server audit method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the server audit method described in any one of claims 1 to 7.

Images