Method, system, equipment and medium for generating and uploading credible state alarm information

Abstract

The invention discloses a credible state alarm information generation and uploading method, system, equipment and medium, and the method comprises the steps: in the process of starting a credible report list, process protection and application program access control, when a file is tampered, the file is illegally accessed or a process is maliciously killed, generating log information through a credible bottom layer, and sending the log information to the credible bottom layer; the log information is sent; according to the method, the system, the equipment and the medium, the log information is received through a trusted agent, the log information is analyzed to obtain trusted alarm information, the trusted alarm information is sent to a management center according to a Thrift interface protocol, and the alarm information can be accurately transmitted to the management center through the method, the system, the equipment and the medium.

Description

Technical Field

[0001] The present application belongs to the technical field of data transmission, and relates to a method, system, device and medium for generating and uploading reliable status alarm information. Background Art

[0002] In a trusted operating system, when a terminal device in the trusted operating system is attacked illegally, the trusted protection strategy can detect that a file becomes untrusted, or a process becomes untrusted, and an alarm will be generated when the status changes from trusted to untrusted, or from untrusted to trusted. However, the alarm information cannot be transmitted to the management center in a timely and accurate manner, which results in the management center being unable to take corresponding measures in a timely manner to resolve the above-mentioned illegal attacks, thereby seriously affecting the security of the trusted operating system. Summary of the invention

[0003] The purpose of the present application is to overcome the shortcomings of the above-mentioned prior art and to provide a method, system, device and medium for generating and uploading trusted status alarm information, which can accurately transmit the alarm information to the management center.

[0004] To achieve the above objectives, the present application discloses a method for generating and sending trusted status alarm information, including:

[0005] When a target condition exists during the operation of the trusted agent, the trusted agent generates an alarm message; wherein the target condition includes at least one of file tampering, illegal file access, or malicious process killing;

[0006] The trusted agent encrypts the alarm information through the trusted root of the trusted platform control module TPCM, and reports the encrypted alarm information to the management center through the thrift interface protocol;

[0007] The management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information.

[0008] Optionally, the trusted agent encrypts the alarm information through the trusted root of the trusted platform control module TPCM, and reports the encrypted alarm information to the management center through the thrift interface protocol, including:

[0009] The trusted agent loads the public key and private key of the trusted root TPCM;

[0010] The trusted agent encrypts the warning information by using the public key;

[0011] Based on the thrift interface protocol, the trusted agent sends the encrypted alarm information to the management center.

[0012] Optionally, the management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, including:

[0013] The management center receives the encrypted alarm information;

[0014] The management center decrypts the encrypted alarm information by using the loaded private key of the trusted root TPCM to obtain the alarm information.

[0015] Optionally, after the management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, the method further includes at least one of the following:

[0016] The management center sends notification information of the message to the trusted agent via the thrift interface protocol, wherein the notification information is used to notify the trusted agent that the alarm information has been received;

[0017] The warning information is cached in a database.

[0018] The present application discloses a system for generating and sending reliable status alarm information, including:

[0019] A generating module, configured to generate an alarm message when a target condition exists during the operation of the trusted agent; wherein the target condition includes at least one of file tampering, illegal file access, or malicious process killing;

[0020] An encryption module, used for the trusted agent to encrypt the alarm information through the trusted root of the trusted platform control module TPCM, and report the encrypted alarm information to the management center through the thrift interface protocol;

[0021] The decryption module is used for the management center to decrypt the encrypted alarm information through the TPCM trusted root to obtain the alarm information.

[0022] Optionally, the encryption module is used to:

[0023] The trusted agent loads the public key and private key of the trusted root TPCM;

[0024] The trusted agent encrypts the warning information by using the public key;

[0025] Based on the thrift interface protocol, the trusted agent sends the encrypted alarm information to the management center.

[0026] Optionally, the decryption module is used to:

[0027] The management center receives the encrypted alarm information;

[0028] The management center decrypts the encrypted alarm information by using the loaded private key of the trusted root TPCM to obtain the alarm information.

[0029] The present application also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for generating and uploading the trusted status alarm information are implemented.

[0030] The present application discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for generating and uploading trusted status alarm information are implemented.

[0031] An embodiment of the present application also provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the steps of the method for generating and uploading trusted status alarm information as described in any one of the first aspects.

[0032] This application has the following beneficial effects:

[0033] In the specific operation of the method, system, device and medium for generating and sending the trusted status alarm information described in the present application, the trusted agent parses the log information to obtain the trusted alarm information, and then sends the trusted alarm information to the management center according to the thrift interface protocol, thereby improving the security and reliability of information transmission, preventing the information from being illegally tampered with, and illegally importing certificate information, ensuring the security of communication data, and the data security and reliability of protocol layer encryption, preventing data leakage, and preventing the possibility of data leakage and loss from the root. These alarms are handled in the management center to restore system credibility and ensure system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0035] Figure 1 This is one of the flow charts of a method for generating and sending trusted status alarm information in an embodiment of the present application;

[0036] Figure 2 This is the second flow chart of a method for generating and sending trusted status alarm information in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] In the description of the present application, it should be understood that the terms “include” and “comprise” indicate the presence of the described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0039] It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

[0040] It should be further understood that the term "and / or" used in the specification and the appended claims of this application refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this application generally indicates that the associated objects are in an "or" relationship.

[0041] It should be understood that, although the terms first, second, third, etc. may be used to describe preset ranges, etc. in the embodiments of the present application, these preset ranges should not be limited to these terms. These terms are only used to distinguish preset ranges from each other. For example, without departing from the scope of the embodiments of the present application, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0042] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0043] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed by various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians of the art without making creative work are within the scope of protection of the present application.

[0044] The accompanying drawings show various schematic diagrams of structures according to the embodiments disclosed in the present application. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may further design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0045] Embodiment 1

[0046] refer to Figure 1 The method for generating and sending the trusted status alarm information described in this application includes the following steps:

[0047] Step 101: When a target condition exists during the operation of the trusted agent, the trusted agent generates an alarm message; wherein the target condition includes at least one of file tampering, illegal file access, or malicious process killing;

[0048] Step 102: The trusted agent encrypts the alarm information through the trusted root of the trusted platform control module TPCM, and reports the encrypted alarm information to the management center through the thrift interface protocol;

[0049] Step 103: The management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information.

[0050] In a specific embodiment of the present application, when the trusted whitelist, process protection, and application access control are started, when a file is tampered with, a file is illegally accessed, or a process is maliciously killed, the trusted underlying layer generates log information, and then sends the log information to the trusted agent; the trusted agent parses the alarm information, splices the required information in json format, obtains formatted trusted alarm information, and then sends the trusted alarm information to the management center according to the thrift interface protocol.

[0051] Optionally, the trusted agent encrypts the alarm information through the trusted root of the trusted platform control module TPCM, and reports the encrypted alarm information to the management center through the thrift interface protocol, including:

[0052] The trusted agent loads the public key and private key of the trusted root TPCM;

[0053] The trusted agent encrypts the warning information by using the public key;

[0054] Based on the thrift interface protocol, the trusted agent sends the encrypted alarm information to the management center.

[0055] Optionally, the management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, including:

[0056] The management center receives the encrypted alarm information;

[0057] The management center decrypts the encrypted alarm information by using the loaded private key of the trusted root TPCM to obtain the alarm information.

[0058] Optionally, after the management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, the method further includes at least one of the following:

[0059] The management center sends notification information of the message to the trusted agent via the thrift interface protocol, wherein the notification information is used to notify the trusted agent that the alarm information has been received;

[0060] The warning information is cached in a database.

[0061] In some specific embodiments, the trusted agent loads the public key and the private key through the TPCM trusted root; when an illegal intrusion or illegal operation by the user occurs, the trusted bottom layer sends log information to the trusted agent; the trusted agent encrypts the alarm information using the public key to obtain encrypted data; the encrypted data is sent to the management center according to the Thrift interface protocol; the management center receives the encrypted data and decrypts the encrypted data using the private key to obtain trusted alarm information; the trusted alarm information is stored in a database.

[0062] It should be noted that a complete trusted system is generally composed of a trusted bottom layer, a trusted agent, and a management center. This information will be registered in the management center and managed uniformly by the management center. Trusted protection policies and trusted enhancement policies are configured on each terminal device. When these terminal devices are attacked illegally, the trusted protection policy can detect that the file becomes untrusted, or the process becomes untrusted, and an alarm will be generated when the state changes from trusted to untrusted, or from untrusted to trusted. As long as there are untrusted applications or programs, the trusted state of the entire system will be affected. The trusted enhancement functions mainly include trusted whitelist, application access control, and process protection. When a program not in the whitelist is executed, an alarm will be generated; when a file without permission is illegally accessed, an alarm will be generated; when a process is killed maliciously, an alarm will be generated. The alarms generated by these attack operations will be sent to the management center layer by layer by the trusted module on the terminal, and different disposal methods will be provided for each alarm to form a closed-loop management, thereby improving the security and reliability of the system, preventing illegal tampering of information, and illegal import of certificate information. Ensure the security of communication data, ensure that the data encrypted at the protocol layer is safe and reliable, prevent data leakage, and prevent the possibility of data leakage and loss from the root. Handle these alarms in the management center, restore the system's credibility, and ensure system security.

[0063] Embodiment 2

[0064] The present application discloses a system for generating and sending reliable status alarm information, including:

[0065] A generating module, configured to generate an alarm message when a target condition exists during the operation of the trusted agent; wherein the target condition includes at least one of file tampering, illegal file access, or malicious process killing;

[0066] An encryption module, used for the trusted agent to encrypt the alarm information through the trusted root of the trusted platform control module TPCM, and report the encrypted alarm information to the management center through the thrift interface protocol;

[0067] The decryption module is used for the management center to decrypt the encrypted alarm information through the TPCM trusted root to obtain the alarm information.

[0068] Optionally, the encryption module is used to:

[0069] The trusted agent loads the public key and private key of the trusted root TPCM;

[0070] The trusted agent encrypts the warning information by using the public key;

[0071] Based on the thrift interface protocol, the trusted agent sends the encrypted alarm information to the management center.

[0072] Optionally, the decryption module is used to:

[0073] The management center receives the encrypted alarm information;

[0074] The management center decrypts the encrypted alarm information by using the loaded private key of the trusted root TPCM to obtain the alarm information.

[0075] Embodiment 3

[0076] The present application also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for generating and sending the trusted status alarm information are implemented, for example, including: in the process of starting the trusted report list, process protection and application access control, when a file is tampered with, a file is illegally accessed or a process is maliciously killed, log information is generated through the trusted bottom layer and sent; the log information is received through a trusted agent, and the log information is parsed to obtain trusted alarm information, and the trusted alarm information is sent to a management center according to a thrift interface protocol. The process of receiving the log information through the trusted agent, parsing the log information, obtaining the trusted alarm information, and sending the trusted alarm information to the management center according to the thrift interface protocol is: loading a public key and a private key through the trusted agent; encrypting the log information through the public key to obtain encrypted data; sending the encrypted data to the management center according to the thrift interface protocol; receiving the encrypted data through the management center, and decrypting the encrypted data using the private key to obtain the trusted alarm information. The memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc. The processor, network interface, and memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard architecture bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.

[0077] Embodiment 4

[0078] The present application also discloses a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the method for generating and sending the trusted status alarm information are implemented. For example, in the process of starting the trusted report list, process protection and application access control, when a file is tampered with, a file is illegally accessed or a process is maliciously killed, log information is generated through the trusted bottom layer and sent; the log information is received through a trusted agent, and the log information is parsed to obtain trusted alarm information, and the trusted alarm information is sent to a management center according to a thrift interface protocol. The process of receiving the log information through a trusted agent, parsing the log information, obtaining trusted alarm information, and sending the trusted alarm information to the management center according to the thrift interface protocol is: loading a public key and a private key through a trusted agent; encrypting the log information through a public key to obtain encrypted data; sending the encrypted data to the management center according to the thrift interface protocol; receiving the encrypted data through the management center, and decrypting the encrypted data using a private key to obtain trusted alarm information. Specifically, the computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0079] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0080] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0081] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0082] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0083] Those skilled in the art will readily appreciate other embodiments of the present application after considering the disclosure of the specification and application. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0084] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

[0085] The above is only a preferred embodiment of the present application and does not constitute any limitation to the present application. Any simple modification, change and equivalent structural change made to the above embodiments based on the technical essence of the present application shall still fall within the protection scope of the technical solution of the present application.

Claims

1. A method for generating and sending trusted status alarm information, characterized in that: include: When a target condition exists during the operation of the trusted agent, the trusted agent generates an alarm message; wherein the target condition includes at least one of file tampering, illegal file access, or malicious process killing; The trusted agent encrypts the alarm information through the trusted root of the trusted platform control module TPCM, and reports the encrypted alarm information to the management center through the thrift interface protocol; The management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information.

2. The method for generating and sending trusted status alarm information according to claim 1, characterized in that: The trusted agent encrypts the alarm information through the trusted root of the trusted platform control module TPCM, and reports the encrypted alarm information to the management center through the thrift interface protocol, including: The trusted agent loads the public key and private key of the trusted root TPCM; The trusted agent encrypts the warning information by using the public key; Based on the thrift interface protocol, the trusted agent sends the encrypted alarm information to the management center.

3. The method for generating and sending trusted status alarm information according to claim 2, characterized in that: The management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, including: The management center receives the encrypted alarm information; The management center decrypts the encrypted alarm information by using the loaded private key of the trusted root TPCM to obtain the alarm information.

4. The method for generating and sending trusted status alarm information according to claim 1, characterized in that: After the management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, the method further includes at least one of the following: The management center sends notification information of the message to the trusted agent via the thrift interface protocol, wherein the notification information is used to notify the trusted agent that the alarm information has been received; The warning information is cached in a database.

5. A system for generating and sending reliable status alarm information, characterized in that: include: A generating module, configured to generate an alarm message when a target condition exists during the operation of the trusted agent; wherein the target condition includes at least one of file tampering, illegal file access, or malicious process killing; An encryption module, used for the trusted agent to encrypt the alarm information through the trusted root of the trusted platform control module TPCM, and report the encrypted alarm information to the management center through the thrift interface protocol; The decryption module is used for the management center to decrypt the encrypted alarm information through the TPCM trusted root to obtain the alarm information.

6. The system for generating and sending trusted status alarm information according to claim 5, characterized in that: The trusted agent encrypts the alarm information through the trusted root of the trusted platform control module TPCM, and reports the encrypted alarm information to the management center through the thrift interface protocol, including: The trusted agent loads the public key and private key of the trusted root TPCM; The trusted agent encrypts the warning information by using the public key; Based on the thrift interface protocol, the trusted agent sends the encrypted alarm information to the management center.

7. The system for generating and sending trusted status alarm information according to claim 5, characterized in that: The management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, including: The management center receives the encrypted alarm information; The management center decrypts the encrypted alarm information by using the loaded private key of the trusted root TPCM to obtain the alarm information.

8. The method for generating and sending trusted status alarm information according to claim 5, characterized in that: After the management center decrypts the encrypted alarm information through the TPCM trusted root to obtain the alarm information, the method further includes at least one of the following: The management center sends notification information of the message to the trusted agent via the thrift interface protocol, wherein the notification information is used to notify the trusted agent that the alarm information has been received; The warning information is cached in a database.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for generating and uploading trusted status alarm information according to any one of claims 1 to 4 are implemented.

10. A computer program product, characterized in that The computer program product is stored in a storage medium, and the computer program product is executed by at least one processor to implement the steps of the method for generating and uploading trusted status alarm information according to any one of claims 1 to 4.

Images