A method, apparatus, device, and medium for auditing servers.

Abstract

This disclosure relates to a server auditing method, apparatus, device, and medium, belonging to the field of computer technology. The method includes: controlling the server to start according to a preset startup mode to ensure that data information remains unchanged during the startup process from the Basic Input / Output System (PIOS) to the operating system; mapping the operating system's auditable data to a PCIe card connected to the server via direct memory access, so that the PCIe card audits the auditable data according to a preset audit cycle and preset audit mode, obtaining an audit result; obtaining the PCIe card's audit result as indicating that the data has not been modified; and auditing the process through an internal audit module embedded in the operating system, obtaining a process audit result. By employing the above technical solution and using a dual auditing approach, a secure and reliable computing environment is constructed for the server, ensuring the immutability of the computing environment and guaranteeing the security, integrity, and confidentiality of loaded server code and data.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method, apparatus, device and medium for auditing servers. Background Technology

[0002] Existing server-based technical solutions involve a hybrid application of Trusted Execution Environment (TEE) and Untrusted Execution Environment. CPU (Central Processing Unit) scheduling requires a significant amount of computation to isolate the Trusted Execution Environment, and the hybrid scheduling of the Trusted and Untrusted Execution Environments is the root cause of performance degradation.

[0003] In related technologies, such as process-level isolation schemes and virtual machine-level isolation schemes, since trusted execution environments coexist with untrusted execution environments, real-time encryption of the trusted execution environment is required. This greatly affects the computing performance of the trusted execution environment and results in technical problems such as low efficiency of accessing external devices to the trusted execution environment. Summary of the Invention

[0004] In order to solve the above-mentioned technical problems, or at least partially solve the above-mentioned technical problems, this disclosure provides a server auditing method, apparatus, device and medium.

[0005] This disclosure provides a server auditing method, comprising: controlling the server to start according to a preset startup mode to ensure that the data information during the startup process from the Basic Input / Output System to the Operating System remains unchanged; mapping the auditable data of the Operating System to a PCIe card connected to the server via Direct Memory Access, so that the PCIe card performs audit processing on the auditable data according to a preset audit cycle and a preset audit mode to obtain an audit result; obtaining that the audit result of the PCIe card is that the data has not been modified, and performing process audit processing through an internal audit module embedded in the Operating System to obtain a process audit result.

[0006] Optionally, the server auditing method further includes: obtaining the memory block information of the operating system, and performing hash processing on the memory block information based on a preset hash algorithm to obtain a hash value; using the memory block information and the hash value as the data to be audited.

[0007] Optionally, the PCIe card performs audit processing on the data to be audited according to a preset audit period and a preset audit method to obtain an audit result, including: obtaining the memory block information to be audited based on the data to be audited according to the preset audit period; performing hash processing on the memory block information to be audited based on the hash algorithm to obtain the hash value to be audited; and comparing the hash value to be audited with the hash value in the data to be audited to determine the audit result.

[0008] Optionally, the process auditing process through the internal audit module embedded in the operating system to obtain the process audit result includes: determining whether the process includes a signature; if the process does not include a signature, then determining the process as an illegal process as the process audit result.

[0009] Optionally, the method further includes: if the process includes a signature, obtaining the number of all processes including signatures; and comparing the number of processes with a target number to determine the process audit result.

[0010] Optionally, the method further includes: when the audit result of the PCIe card indicates that the data has not been modified and the audit result of the process indicates that the process is normal, exchanging data with the external connection device of the operating system based on the direct memory access method.

[0011] Optionally, controlling the server startup according to a preset startup method includes: performing signature verification on the bootloader during the server startup process; and loading the bootloader that has passed the signature verification.

[0012] This disclosure also provides a server auditing device, comprising: a startup module for controlling the server startup according to a preset startup method to ensure that data information remains unchanged during the startup process from the Basic Input / Output System to the Operating System; a first auditing module for sending the auditable data of the operating system to a PCIe card connected to the server via direct memory access, so that the PCIe card performs audit processing on the auditable data according to a preset audit cycle and a preset audit method to obtain an audit result; and a second auditing module for obtaining the audit result from the PCIe card that the data has not been modified, and performing process audit processing on the process through an internal auditing module embedded in the operating system to obtain a process audit result.

[0013] This disclosure also provides an electronic device, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the server auditing method provided in this disclosure.

[0014] This disclosure also provides a computer-readable storage medium storing a computer program for performing an auditing method for a server as provided in this disclosure.

[0015] This disclosure also provides a computer program product, including a computer program, wherein the computer program is executed by a processor as an auditing method for a server provided in the embodiments of this application.

[0016] Compared with the prior art, the technical solution provided in this disclosure has the following advantages: The server auditing scheme provided in this disclosure controls the server startup according to a preset startup mode to ensure that the data information from the basic input / output system to the operating system startup process remains unchanged; the audit data of the operating system is given to the PCIe (PCI-Express, a high-speed serial computer expansion bus standard) card connected to the server through Direct Memory Access (DMA), so that the PCIe card performs audit processing on the audit data according to a preset audit cycle and preset audit method to obtain the audit result; the audit result of the PCIe card is that the data has not been changed, and the process is audited through the internal audit module embedded in the operating system to obtain the process audit result. By adopting the above technical solution, all server resources are used for the TEE environment, avoiding the additional computational loss caused by real-time encryption and decryption. The dual audit method ensures the immutability of the computing environment, guarantees the security, integrity and confidentiality of the loaded server code and data, allows for secure and transparent data exchange with external connected devices such as GPUs (Graphics Processing Units), minimizes audit computation, and enables the dynamic loading of signed and controlled processes. As a result, the entire trusted execution environment can achieve applications without shutting down, and unsigned processes can be monitored in real time to prevent malicious code from launching unmonitored and audited processes. Attached Figure Description

[0017] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0018] Figure 1 A flowchart illustrating a server auditing method provided in this embodiment of the disclosure;

[0019] Figure 2 A flowchart illustrating another server auditing method provided in this embodiment of the disclosure;

[0020] Figure 3An example diagram illustrating a server auditing method provided in an embodiment of this disclosure;

[0021] Figure 4 A schematic diagram of the structure of a server auditing device provided in an embodiment of this disclosure;

[0022] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0023] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0024] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0025] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0026] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0027] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0028] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0029] Specifically, existing technical solutions mainly include process-level isolation schemes and virtual machine-level isolation schemes. Taking Intel SGX (Software Guard Extensions) technology as an example, process-level isolation uses the Enclave, a core component of Intel SGX. The Enclave is a protected area created inside the CPU, similar to a secure container. It remains hidden from the operating system, malware, and even programs with root privileges, ensuring the security of sensitive data. High-security code and data in applications are executed and stored within the Enclave. The Memory Encryption Engine (MEE) is a special hardware component in SGX technology used to generate encryption keys and encrypt and decrypt code and data within the Enclave. When the Enclave starts, the MEE generates an encryption key. Subsequently, data within the Enclave is encrypted when written to memory; only the code within the Enclave can decrypt and access this data, effectively protecting data from theft or tampering.

[0030] Specifically, Enclave creation: When an application starts, its security-related code and data are loaded into the Enclave. At this time, the operating system and hardware automatically allocate a block of SGX memory for the Enclave and ensure through memory isolation mechanisms that only the code inside the Enclave can access and modify this memory; external programs and the operating system cannot access the data within it. Memory encryption: The MEE uses a generated encryption key to encrypt the code and data in the Enclave and stores the encrypted data in the allocated SGX memory. When the code inside the Enclave needs to access the encrypted data, it sends a request to the MEE, which then decrypts the data using the same encryption key and returns the decrypted data to the code inside the Enclave. The entire encryption and decryption process is performed at the hardware level, ensuring data security. Execution protection: When the processor accesses data in the Enclave, it automatically switches to Enclave mode. This mode forces additional hardware checks on every memory access to prevent known memory attacks, further ensuring the integrity and confidentiality of the data and code in the Enclave.

[0031] The virtual machine isolation solution, taking Hygon CSV (Cloud Security Virtualization) as an example, specifically involves memory encryption and isolation: When writing data to memory, the CPU hardware automatically encrypts the data; when reading data from memory, the hardware automatically decrypts it. Each CSV virtual machine uses a different key to ensure data confidentiality. Simultaneously, Hygon CPUs internally use ASIDs to distinguish different CSV virtual machines from the host. Each CSV virtual machine uses independent CPU resources such as cache and TLB, achieving resource isolation between the CSV virtual machine and the host, further enhancing security. Building a trusted execution environment: Based on the aforementioned secure encrypted virtual machines, CSV technology constructs a trusted execution environment. This not only ensures the confidentiality of virtual machine data but also guarantees data integrity, effectively preventing host operating systems and virtual machine management from launching remapping attacks on virtual machines by rewriting nested page tables.

[0032] The two technical solutions mentioned above, due to the coexistence of TEE and untrusted execution environment, require real-time encryption of the trusted execution environment, which greatly affects the computing performance of the trusted environment and results in low efficiency in accessing external devices of the trusted execution environment. For example, when GPUs build trusted execution environments based on artificial intelligence computing power, the existing methods cannot directly access peripheral devices of the system (such as network cards and other PCIe cards).

[0033] To address the aforementioned issues, the server auditing method proposed in this disclosure controls the server startup according to a preset startup mode to ensure that the data information during the startup process from the Basic Input / Output System (PIOS) to the operating system remains unchanged. The auditable data of the operating system is mapped to a PCIe card connected to the server via Direct Memory Access (DMI), so that the PCIe card performs audit processing on the auditable data according to a preset audit cycle and preset audit method, obtaining audit results. If the audit result from the PCIe card indicates that the data has not been modified, the process is audited through an internal audit module embedded in the operating system, obtaining process audit results. Using this technical solution, a secure and reliable computing environment can be constructed for the server, ensuring the immutability of the computing environment, guaranteeing the security, integrity, and confidentiality of the code and data loaded on the server, avoiding the additional computational losses caused by real-time encryption and decryption. Devices connected via the PCIe interface exchange data within a TEE-protected environment, resulting in minimal audit computational overhead and ensuring that the program and data during operation are not tampered with with minimal performance loss.

[0034] Figure 1 This is a flowchart illustrating a server auditing method provided in an embodiment of the present disclosure. The method can be executed by a server auditing device, which can be implemented using software and / or hardware, and is generally integrated into an electronic device. Figure 1 As shown, the method includes:

[0035] Step 101: Control the server to start according to the preset startup method to ensure that the data information from the basic input / output system to the operating system startup process remains unchanged.

[0036] In this embodiment of the disclosure, the BIOS (Basic Input Output System) is a firmware program that runs first when the computer starts up. It is responsible for initializing hardware devices, loading the operating system, etc.

[0037] Specifically, BIOS secure boot can be understood as verifying the signature of the bootloader (such as UEFI) during the boot process to ensure that only certified and trusted bootloaders are loaded. This ensures that the data information from the basic input / output system to the operating system boot process remains unchanged. In other words, secure boot technology constructs a trust chain for system boot, ensuring that the code and data during the boot process are not tampered with from the BIOS to the operating system.

[0038] Step 102: Map the operating system's auditable data to the PCIe card connected to the server via direct memory access, so that the PCIe card can audit the auditable data according to the preset audit cycle and preset audit method to obtain the audit results.

[0039] In this embodiment, the PCIe card can be a custom-developed FPGA card or a custom chip card. The audit data can be mapped to the PCIe card through direct memory access. The audit data includes audit memory block information and verification information that has been processed from the audit memory block information, such as the hash value corresponding to the hash processing of the audit memory block information. Thus, the PCIe card can perform audit processing on the audit data according to a preset audit cycle and preset audit method to obtain audit results.

[0040] The preset audit cycle and audit method can be pre-set according to actual application needs. Specifically, the audit process involves obtaining the auditable memory block information based on the auditable data, performing hash processing on the auditable memory block information using a hash algorithm to obtain the auditable hash value, comparing the auditable hash value with the hash value in the auditable data, and determining the audit result. For example, if the auditable hash value and the hash value in the auditable data are the same, the audit passes; if they are different, the audit fails.

[0041] Step 103: Obtain the audit result of the PCIe card, which shows that the data has not been modified. Then, perform audit processing on the process through the internal audit module embedded in the operating system to obtain the process audit result.

[0042] In this embodiment of the disclosure, the audit result of the PCIe card may be that the audit passed (i.e., the data was not changed) or failed (i.e., the data was changed), and relevant warning operations can be performed; if the audit result of the PCIe card is that the data was not changed, the process is audited by the internal audit module embedded in the operating system to obtain the process audit result.

[0043] Specifically, the internal audit module embedded in the operating system audits the processes and obtains the process audit results. It can determine whether a process includes a signature. Processes without signatures can be identified as illegal processes. Alternatively, it can count all processes that include signatures and check whether the number of processes that should exist is consistent with the target number. If the number is consistent, the process audit result is determined to be passed; if the number is inconsistent, the process audit result is determined to be failed.

[0044] The server auditing scheme provided in this embodiment controls the server startup according to a preset startup mode to ensure that the data information from the Basic Input / Output System (BIOS) to the operating system startup process remains unchanged. The auditable data of the operating system is provided to the PCIe (PCI-Express, a high-speed serial computer expansion bus standard) card connected to the server via Direct Memory Access (DMA). The PCIe card then audits the auditable data according to a preset audit cycle and preset audit method, obtaining an audit result. The audit result from the PCIe card indicates that the data has not been modified. The process is then audited through an internal audit module embedded in the operating system, obtaining the process audit result. Using this technical solution, all server resources are used in the TEE environment, avoiding the additional computational loss caused by real-time encryption and decryption. The dual auditing method ensures the immutability of the computing environment, guaranteeing the security, integrity, and confidentiality of loaded server code and data. It allows for secure and transparent data exchange with external connected devices such as GPUs (Graphics Processing Units). The audit computation is small, and signed, controlled processes can be dynamically loaded. Therefore, the entire trusted execution environment can achieve applications without shutting down, and unsigned processes can be monitored in real time, preventing malicious code from launching unmonitored and unaudited processes.

[0045] Figure 2 This is a flowchart illustrating another server auditing method provided in this embodiment of the present disclosure. This embodiment further optimizes the server auditing method described above. Figure 2 As shown, the method also includes:

[0046] Step 201: During the server startup process, the bootloader is signed and verified. The bootloader that passes the signature verification is loaded to ensure that the data information from the basic input / output system to the operating system startup process remains unchanged.

[0047] Specifically, enabling UEFI (Unified Extensible Firmware Interface) secure boot can ensure that only digitally signed boot programs are loaded; or enabling TPM (Trusted Platform Module) and ensuring that the TPM chip is working properly can enhance the reliability of BIOS secure boot by using the chip.

[0048] Therefore, by employing secure boot technology, a trust chain is constructed for system startup, ensuring that the code and data during the boot process are not tampered with, from the BIOS to the operating system.

[0049] Step 202: Obtain the memory block information of the operating system, and perform hash processing on the memory block information based on the preset hash algorithm to obtain the hash value. Map the memory block information and hash value as audit data to the PCIe card connected to the server through direct memory access.

[0050] Step 203: The PCIe card obtains the information of the memory block to be audited based on the data to be audited according to the preset audit cycle, performs hash processing on the information of the memory block to be audited based on the hash algorithm, obtains the hash value to be audited, compares the hash value to be audited with the hash value in the data to be audited, and determines the audit result.

[0051] The memory block information can include information such as memory block addresses. Each memory block information is processed by a hash algorithm to correspond to a hash value. If the data has not been changed, the hash values ​​will be the same. Therefore, the audit result is determined by comparing the hash value to be audited with the hash value in the data to be audited.

[0052] Specifically, by connecting an external PCIe card specifically designed to audit the operating system code and data area after secure boot, the operating system code and data area that need to be audited are mapped to the PCIe card via DMA. The PCIe card then dynamically and periodically audits whether the operating system has been tampered with.

[0053] Step 204: Obtain the audit result of the PCIe card, which is that the data has not been modified. Use the internal audit module embedded in the operating system to determine whether the process includes a signature. If the process does not include a signature, the process is determined to be an illegal process. If the process includes a signature, obtain the number of all processes that include signatures. Compare the number of processes with the target number to determine the process audit result.

[0054] Specifically, the operating system embeds an internal audit module, which is protected by the PCIe card's runtime audit to ensure its immutability. The internal audit module performs dynamic audits on subsequently loaded processes, such as detecting illegal processes and whether the signature process has been tampered with.

[0055] Step 205: If the audit result of the PCIe card shows that the data has not been changed and the process audit result shows that the process is normal, exchange data with the external connected devices of the operating system based on the direct memory access method.

[0056] As an example, such as Figure 3 As shown, a secure boot technology is employed from BIOS to the operating system (OS). The PCIe card is used to audit the OS and the internal audit module, thereby ensuring the immutability of the internal audit module. The internal audit module performs dynamic auditing of subsequently loaded processes, such as... Figure 3 Audit the controlled signature processes 1 to n in the process.

[0057] Therefore, a server-wide TEE environment is constructed, where all server resources are used for the TEE environment, avoiding the additional computational loss caused by real-time encryption and decryption; it is highly compatible with general computing environments, and devices connected to the PCIe interface under the TEE environment are all protected by the TEE; there is no need for a real-time encrypted computing environment, and a hash algorithm is used for environment verification and auditing, with minimal audit computational overhead, ensuring that the program and data during operation are not tampered with with minimal performance loss.

[0058] In summary, the server auditing method of this disclosure does not involve encryption technology, but adopts a dynamic auditing approach for running code and data to ensure the security and trustworthiness of the operating environment; the operating system and peripheral devices such as GPU cards can exchange data securely and transparently; the auditing computation is small; signed and controlled processes can be dynamically loaded, and the entire trusted execution environment can achieve application updates without shutting down; unsigned processes can be monitored in real time to exclude malicious code from launching unmonitored and audited processes.

[0059] Figure 4 This is a schematic diagram of the structure of a server auditing device provided in an embodiment of this disclosure. The device can be implemented by software and / or hardware, and is generally integrated into an electronic device. For example... Figure 4 As shown, the device includes:

[0060] The startup module 301 is used to control the server to start according to a preset startup mode, so as to ensure that the data information during the startup process from the basic input / output system to the operating system remains unchanged;

[0061] The first audit module 302 is used to send the audit data of the operating system to the PCIe card connected to the server via direct memory access, so that the PCIe card can perform audit processing on the audit data according to a preset audit cycle and a preset audit method to obtain audit results;

[0062] The second audit module 303 is used to obtain the audit result of the PCIe card as "data has not been changed", and to perform audit processing on the process through the internal audit module embedded in the operating system to obtain the process audit result.

[0063] Optionally, the server auditing device further includes: an acquisition and processing module, used to acquire memory block information of the operating system, and perform hash processing on the memory block information based on a preset hash algorithm to obtain a hash value, and use the memory block information and the hash value as the data to be audited.

[0064] Optionally, the first audit module 302 is specifically used for: sending the auditable data of the operating system to a PCIe card connected to the server via direct memory access, so that the PCIe card obtains auditable memory block information based on the auditable data according to a preset audit cycle; performing hash processing on the auditable memory block information based on the hash algorithm to obtain an auditable hash value; and comparing the auditable hash value with the hash value in the auditable data to determine the audit result.

[0065] Optionally, the second audit module 303 is specifically used to: obtain the audit result of the PCIe card as the data has not been changed, determine whether the process includes a signature; if the process does not include a signature, determine that the process is an illegal process as the audit result of the process.

[0066] Optionally, the second audit module 303 is further configured to: if the process includes a signature, obtain the number of all processes including signatures; and determine the process audit result by comparing the number of processes with the target number.

[0067] Optionally, the device further includes a data exchange module, used to exchange data with the external connection device of the operating system based on the direct memory access method when the audit result of the PCIe card is that the data has not been changed and the audit result of the process is that the process is normal.

[0068] Optionally, the startup module 301 is specifically used to perform signature verification on the bootloader during the server startup process; and to load the bootloader that has passed the signature verification to ensure that the data information from the basic input / output system to the operating system startup process remains unchanged.

[0069] The server auditing device provided in this disclosure can execute the server auditing method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects for executing the method.

[0070] This disclosure also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the server auditing method provided in any embodiment of this disclosure.

[0071] Figure 5 This is a schematic diagram of an electronic device provided in an embodiment of the present disclosure. See below for details. Figure 5 The diagram illustrates a structural schematic suitable for implementing the electronic device 400 in the embodiments of this disclosure. The electronic device 400 in the embodiments of this disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0072] like Figure 5 As shown, the electronic device 400 may include a processing unit 401 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in ROM 402 (ROM being a read-only memory) or a program loaded from storage device 408 into RAM 403 (RAM being a random access memory). RAM 403 also stores various programs and data required for the operation of the electronic device 400. The processing unit 401, ROM 402, and RAM 403 are interconnected via bus 404. I / O interface 405 (I / O being an input / output interface) is also connected to bus 404.

[0073] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic device 400 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 400 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0074] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 409, or installed from storage device 408, or installed from ROM 402. When the computer program is executed by processing device 401, it performs the functions defined in the server auditing method of embodiments of this disclosure.

[0075] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0076] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0077] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0078] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0079] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0080] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units are not, in some cases, intended to limit the specific unit.

[0081] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0082] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0083] According to one or more embodiments of this disclosure, this disclosure provides an electronic device, including:

[0084] processor;

[0085] Memory used to store the processor's executable instructions;

[0086] The processor is configured to read the executable instructions from the memory and execute the instructions to implement the server auditing method as provided in any of the present disclosure.

[0087] According to one or more embodiments of the present disclosure, the present disclosure provides a computer-readable storage medium storing a computer program for performing an auditing method for a server as described in any of the present disclosure.

[0088] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0089] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0090] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A server auditing method, characterized in that, include: The server is controlled to start according to a preset startup method to ensure that the data information during the startup process from the basic input / output system to the operating system remains unchanged. The auditable data of the operating system is mapped to the PCIe card connected to the server via direct memory access, so that the PCIe card performs audit processing on the auditable data according to a preset audit cycle and preset audit method to obtain audit results; The audit result of the PCIe card is that the data has not been modified. The process is then audited using the internal audit module embedded in the operating system to obtain the process audit result. This process auditing includes: determining whether the process includes a signature; if the process does not include a signature, it is determined to be an illegal process as the process audit result; if the process includes a signature, the number of all processes including signatures is obtained; and the process audit result is determined by comparing this number with a target number.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the memory block information of the operating system, and perform hash processing on the memory block information based on a preset hash algorithm to obtain a hash value; The memory block information and the hash value are used as the data to be audited.

3. The method according to claim 2, characterized in that, The PCIe card performs audit processing on the data to be audited according to a preset audit cycle and preset audit method, and obtains audit results, including: According to the preset audit cycle, obtain the memory block information to be audited based on the data to be audited; The information of the memory block to be audited is hashed based on the hash algorithm to obtain the hash value to be audited. The audit result is determined by comparing the hash value to be audited with the hash value in the data to be audited.

4. The method according to claim 1, characterized in that, The method further includes: If the audit result of the PCIe card indicates that the data has not been modified and the audit result of the process indicates that the process is normal, data exchange is performed with the external connected devices of the operating system based on the direct memory access method.

5. The method according to claim 1, characterized in that, The step of controlling the server to start according to a preset startup method includes: The bootloader undergoes signature verification during the server startup process; Load the bootloader if the signature verification is successful.

6. A server auditing device, characterized in that, include: The startup module is used to control the server to start according to a preset startup method, so as to ensure that the data information during the startup process from the basic input / output system to the operating system remains unchanged. The first audit module is used to send the audit data of the operating system to the PCIe card connected to the server via direct memory access, so that the PCIe card can perform audit processing on the audit data according to a preset audit cycle and preset audit method to obtain audit results. The second audit module is used to obtain the audit result of the PCIe card as "data has not been modified," and to perform process auditing processing through the internal audit module embedded in the operating system to obtain the process audit result. The process auditing processing through the internal audit module embedded in the operating system to obtain the process audit result includes: determining whether the process includes a signature; if the process does not include a signature, determining the process as an illegal process as the process audit result; if the process includes a signature, obtaining the number of all processes including signatures; and comparing the number of processes with a target number to determine the process audit result.

7. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the auditing method of the server as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for executing the auditing method for the server as described in any one of claims 1-5.

Images