Verification method and device of hardware platform, computer equipment and storage medium

Abstract

The invention relates to the technical field of security verification, and discloses a verification method and device for a hardware platform, and the method comprises the steps: obtaining at least one piece of first target hardware equipment information, and first key information corresponding to a target resource, the at least one piece of first target hardware equipment information being obtained from a plurality of pieces of hardware equipment in a to-be-tested hardware platform; searching the signature information from the target storage device, and if the signature information is found, decrypting the signature information according to the first key information to obtain hardware abstract verification information corresponding to the security hardware platform; determining a first hardware abstract of the to-be-tested hardware platform according to the at least one piece of first target hardware equipment information and a preset rule; and if the hardware abstract verification information is matched with the first hardware abstract, determining that the to-be-tested hardware platform is a safe hardware platform. Therefore, the security of the hardware equipment platform is verified through software, the target resource is prevented from being copied to an unauthorized hardware platform for use, and the security of the target resource is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of security verification technology, and in particular to a verification method, device, computer equipment and storage medium for a hardware platform. Background Art

[0002] At present, when it comes to accessing sensitive resources, existing security measures often cannot meet its high security requirements, and these guarantees often rely on the support and cooperation of computer system manufacturers. Traditional security strategies usually focus on hardware systems through system firmware self-checks, and then ensure the security of system software, such as implementing SecureBoot to ensure security and reliability during resource access. However, this method can only verify whether the hardware system is secure, and does not take into account the software system's ability to identify hardware security.

[0003] Therefore, although the hardware and system firmware can prevent the operation of unsafe software, the system software or application cannot perceive and verify the security and reliability of its operating platform (hardware and firmware). This means that when the storage medium storing sensitive data and important software and other resources is moved to other devices, the security of the storage medium cannot be effectively guaranteed, and illegal users may access sensitive resources in the storage medium through this channel, thus causing potential security risks. Summary of the invention

[0004] In view of this, the present invention provides a hardware platform verification method, apparatus, computer equipment, and storage medium to solve the security problem of the current hardware device platform.

[0005] In a first aspect, the present invention provides a method for verifying a hardware platform, the method comprising:

[0006] Acquire at least one first target hardware device information and first key information corresponding to the target resource, wherein the at least one first target hardware device information is acquired from a plurality of hardware devices in the hardware platform to be tested;

[0007] Searching for signature information from the target storage device, and if the signature information is found, decrypting the signature information according to the first key information to obtain hardware summary verification information corresponding to the secure hardware platform, wherein the signature information is used to indicate that the secure hardware platform is authorized to use the target resource;

[0008] Determine a first hardware summary of the hardware platform to be tested according to the at least one first target hardware device information and preset rules;

[0009] If the hardware digest verification information matches the first hardware digest, the hardware platform to be tested is determined to be a secure hardware platform.

[0010] The present invention provides a method for recovering video metadata, which obtains the first target hardware device information in the hardware platform to be tested, and the first secret key information corresponding to the target resource, decrypts the signature information according to the first secret key information, obtains the hardware summary verification information corresponding to the security platform, determines the first hardware summary of the hardware platform to be tested according to the first target hardware device information and preset rules, and compares if the hardware summary verification information matches the above-mentioned first hardware summary, then determines that the above-mentioned hardware platform to be tested is a security hardware platform. By generating a first hardware summary from the first target hardware device information, and comparing it with the hardware summary verification information corresponding to the security hardware platform, if the hardware summary verification information matches the first hardware summary, then determines that the above-mentioned hardware platform to be tested is a security hardware platform, thereby realizing the security of the hardware device platform through software verification, avoiding the target resource from being copied to an unauthorized hardware platform for use, and thus ensuring the security of the target resource.

[0011] In an optional implementation, determining the first hardware summary of the hardware platform to be tested according to the at least one first target hardware device information and a preset rule includes:

[0012] Sorting the at least one first target hardware device information according to the preset rule to obtain a first target hardware device information sequence;

[0013] According to a preset verification algorithm and the first target hardware device information sequence, a first hardware summary of the hardware platform to be tested is determined.

[0014] The method provided in this embodiment can ensure that each feature of the hardware platform is standardized according to predetermined rules by sorting at least one first target hardware device information to obtain a first target hardware device information sequence. This sorting method can reduce errors caused by inconsistent arrangement order of device information, improve the accuracy of the hardware summary, and make the verification process more reliable. By combining a preset verification algorithm with a hardware device information sequence, a hardware summary can be generated in a systematic and standardized manner. This method can effectively prevent tampering or forgery of device information, ensure that the generated hardware summary reflects the true status of the hardware device, and thus improve the security of the verification process.

[0015] In an optional implementation manner, before searching for signature information from the target storage device, the method further includes:

[0016] Acquire at least one second target hardware device information in the above-mentioned secure hardware platform, wherein the at least one second target hardware device information is acquired from a plurality of hardware devices in the above-mentioned secure hardware platform;

[0017] Sorting the at least one second target hardware device information according to the preset rule to obtain a second target hardware device information sequence;

[0018] Determine, according to a preset verification algorithm and the second target hardware device information sequence, a second hardware digest of the secure hardware platform as the hardware digest verification information;

[0019] Encrypting the second hardware digest according to the second key information to obtain the signature information, the second key information is the same as the first key information, or the second key is a private key and the first key is a public key corresponding to the second key;

[0020] The signature information is stored in the target storage device.

[0021] The method provided in this embodiment can effectively enhance the integrity and security of the hardware summary by introducing the second target hardware device information and sorting it according to preset rules. Different hardware device information participates in the generation of the summary, which not only improves the coverage of the summary, but also avoids the risk that a single hardware information may be tampered with or forged. As the core information of hardware verification, the second hardware summary is more reliable and can better ensure the authenticity and integrity of the hardware platform. The generation of the hardware summary involves the information of multiple hardware devices, and this information is sorted and encrypted. Even if an attacker tries to forge a hardware device, he still needs to change the information of multiple hardware devices to successfully forge the correct hardware summary. This greatly increases the difficulty of hardware forgery and enhances the system's anti-tampering capabilities.

[0022] In an optional implementation, after determining that the hardware platform to be tested is the secure hardware platform, the method further includes:

[0023] When the second target hardware device is changed, clearing the signature information based on the second key information;

[0024] Acquire the changed second target hardware device information and the unchanged second target hardware device information;

[0025] Sorting the changed second target hardware device information and the unchanged second target hardware device information according to the preset rule to obtain a third target hardware device information sequence;

[0026] Determine a third hardware digest of the secure hardware platform according to the preset verification algorithm and the third target hardware device information sequence;

[0027] The third hardware digest is encrypted according to the second key information to obtain updated signature information.

[0028] The method provided in this embodiment helps prevent the old signature information from being abused or tampered with by clearing the original signature information and regenerating the hardware summary when the second target hardware device changes, thereby improving the system's adaptability and security to hardware device changes. By obtaining the changed and unchanged hardware device information and sorting them according to preset rules, a new hardware summary is generated to ensure that the platform's identity information is always consistent with the actual hardware configuration, reducing potential verification errors or forgery risks. After the hardware information is changed, the updated signature information is generated based on the new hardware summary encryption to ensure that the new verification data remains encrypted and protected during transmission and storage to avoid information leakage or tampering.

[0029] In an optional implementation, the above method further includes:

[0030] Creating a security domain for the target resource, where the security domain is used to store the target resource;

[0031] Obtaining a control block of the security domain, the control block being used to manage the access status of the security domain and the access address of the target resource;

[0032] Allocate the access address of the target resource, and copy the target resource to the access address of the target resource;

[0033] When it is determined that the hardware platform to be tested is the secure hardware platform, setting the access state of the security domain to an available state;

[0034] In response to the access request, the access address of the target resource is fed back to the access requester, wherein the access request is used to request access to the target resource.

[0035] The method provided in this embodiment can effectively isolate and protect sensitive resources by creating a security domain for the target resource and managing the access status. The target resources stored in the security domain cannot be accessed without authorization, ensuring the security of the resources. Acquiring and using the control block to manage the access status of the security domain and the access address of the target resource helps to finely control the access to the resource. The design of the control block ensures that the resource can only be accessed under specific conditions, thereby avoiding unauthorized access or abuse. By allocating an access address and copying the target resource to the address, efficient management and dynamic adjustment of resources are ensured. This can flexibly adjust the location of resources according to actual needs, and improve the flexibility and scalability of resource management. By checking the hardware platform, it is ensured that only the secure hardware platform can access the target resources in the security domain. This hardware platform verification mechanism effectively prevents illegal access by unauthorized hardware platforms.

[0036] In an optional implementation, the above method further includes:

[0037] When the target second hardware device is changed, the access state of the security domain is set to a disabled state;

[0038] When it is determined that the changed hardware platform is the above-mentioned secure hardware platform, the access state of the above-mentioned security domain is set to an available state, and the above-mentioned changed hardware platform includes a changed target second hardware device.

[0039] The method provided in this embodiment sets the access status of the security domain to a disabled state when the target second hardware device changes. This mechanism can respond to hardware changes immediately and ensure that resources are not accessed by unauthorized devices during the process of hardware device changes. The disabled state can effectively prevent potential security risks and malicious access. By verifying the changed hardware platform, the access status of the security domain is set to an available state only when it is confirmed that the changed hardware platform is a "secure hardware platform." This ensures that only authorized secure hardware platforms can access sensitive resources, thereby improving the security of the system.

[0040] In an optional implementation, the above method further includes:

[0041] If the above signature information is not obtained, it is determined that the above hardware platform to be tested is a non-secure platform;

[0042] Alternatively, if the verification information does not match the first hardware digest, determining that the hardware platform to be tested is a non-secure platform;

[0043] When it is determined that the second hardware platform is a non-secure platform, the access request corresponding to the target resource is rejected, and the target resource is locked.

[0044] The method provided in this embodiment can promptly determine that the hardware platform is a "non-secure platform" when the correct signature information is not obtained or the verification information does not match the predetermined hardware summary. This step ensures that only hardware that has been verified and matches the hardware summary can access system resources, avoiding potential security threats. It effectively prevents untrusted or potentially malicious hardware platforms from accessing sensitive resources, ensures the security of system resources, and reduces the risk of potential data leakage or damage.

[0045] In a second aspect, a verification device for a hardware platform includes:

[0046] An acquisition module, used to acquire at least one first target hardware device information and first key information corresponding to a target resource, wherein the at least one first target hardware device information is acquired from a plurality of hardware devices in a hardware platform to be tested;

[0047] A decryption module, used to search for signature information from the target storage device, and if the signature information is found, decrypt the signature information according to the first key information to obtain hardware summary verification information corresponding to the secure hardware platform, wherein the signature information is used to indicate that the secure hardware platform is authorized to use the target resource;

[0048] A determination module, configured to determine the first hardware summary of the hardware platform to be tested according to the at least one first target hardware device information and a preset rule;

[0049] The comparison module is used for comparing and determining that the hardware platform to be tested is a secure hardware platform if the hardware digest verification information matches the first hardware digest.

[0050] The present invention provides a video metadata recovery device, which obtains the first target hardware device information in the hardware platform to be tested, and the first secret key information corresponding to the target resource, decrypts the signature information according to the first secret key information, obtains the hardware summary verification information corresponding to the security platform, determines the first hardware summary of the hardware platform to be tested according to the first target hardware device information and preset rules, and compares the hardware summary verification information with the above-mentioned first hardware summary. If the hardware summary verification information matches the above-mentioned first hardware summary, it is determined that the above-mentioned hardware platform to be tested is a secure hardware platform. By generating a first hardware summary from the first target hardware device information and comparing it with the hardware summary verification information corresponding to the secure hardware platform, if the hardware summary verification information matches the first hardware summary, it is determined that the above-mentioned hardware platform to be tested is a secure hardware platform, thereby realizing the security of the hardware device platform through software verification, avoiding the target resource from being copied to an unauthorized hardware platform for use, and thus ensuring the security of the target resource.

[0051] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the hardware platform verification method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0052] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the hardware platform verification method of the first aspect or any corresponding embodiment thereof.

[0053] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the hardware platform verification method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 is one of the flow charts of the verification method of the hardware platform according to an embodiment of the present invention;

[0056] Figure 2 is a second flowchart of the verification method of the hardware platform according to an embodiment of the present invention;

[0057] Figure 3 is a schematic diagram of the architecture of a verification method for a hardware platform according to an embodiment of the present invention;

[0058] Figure 4 is a schematic diagram of a verification device for a hardware platform according to an embodiment of the present invention;

[0059] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0061] According to an embodiment of the present invention, an embodiment of a verification method for a hardware platform is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0062] In this embodiment, a hardware platform verification method is provided, which can be used for the above-mentioned computer. Figure 1 is one of the flow charts of the verification method of the hardware platform according to an embodiment of the present invention, such as Figure 1 shown.

[0063] In a first aspect, the present invention provides a method for verifying a hardware platform, the method comprising:

[0064] Step S101, obtaining at least one first target hardware device information and first key information corresponding to a target resource.

[0065] At least one first target hardware device information is obtained from multiple hardware devices in the hardware platform to be tested. The first target hardware device information is the device information of the first target hardware device. The first target hardware device information can be the part number, serial number, module name, embedded program in the hardware device or data content in the read-only memory of the hard disk, memory, board and various expansion cards and other components that support information reading. The first secret key information can be a public key of asymmetric encryption. The target resource can be software or data.

[0066] One way of obtaining is: obtaining at least one first target hardware device information through BIOS (Basic Input / Output System), and obtaining the first key information in the file system.

[0067] Step S102, searching for signature information from the target storage device, and if the signature information is found, decrypting the signature information according to the first key information to obtain hardware summary verification information corresponding to the secure hardware platform.

[0068] The signature information is used to indicate that the secure hardware platform is authorized to use the target resource. The signature information is an authorization identifier that indicates whether the hardware platform has the right to use the target resource. The target storage device can be a USB flash drive or a memory in the platform under test. The secure hardware platform is the platform that has the right to use the target resource. The hardware summary verification information is the identity and security identifier of the hardware.

[0069] One way to decrypt the signature information is to search for the signature information from the target storage device. The signature information is encrypted data used to prove the identity and authorization status of a hardware platform. If the signature information is found, the first key information is used to decrypt the signature data to obtain the hardware summary verification information.

[0070] Step S103: determining a first hardware summary of the hardware platform to be tested according to at least one first target hardware device information.

[0071] The first hardware digest is the identity and security identifier of the first target hardware device. The preset rule may refer to a method of processing hardware device information, such as a specific encryption method, digest algorithm, etc., to ensure consistency when calculating the hardware digest.

[0072] One way to determine the first hardware digest is: the hardware digest is a unique value obtained by calculating key information of the hardware device through a certain algorithm (such as a hash algorithm), and uniquely identifies the hardware platform.

[0073] Step S104: If the hardware digest verification information matches the first hardware digest, it is determined that the hardware platform to be tested is a secure hardware platform.

[0074] One way to determine that the hardware platform under test is a secure hardware platform is to compare the hardware summary verification information generated by the hardware platform under test with the first hardware summary. If the two summaries are the same, it means that the configuration and identity of the hardware platform under test are consistent with the preset security configuration, the platform has not been tampered with, and meets the security standards.

[0075] The present invention provides a method for recovering video metadata, which obtains the first target hardware device information in the hardware platform to be tested, and the first secret key information corresponding to the target resource, decrypts the signature information according to the first secret key information, obtains the hardware summary verification information corresponding to the security platform, determines the first hardware summary of the hardware platform to be tested according to the first target hardware device information and preset rules, and compares the hardware summary verification information with the first hardware summary. If the hardware summary verification information matches the first hardware summary, the hardware platform to be tested is determined to be a secure hardware platform. By generating a first hardware summary from the first target hardware device information and comparing it with the hardware summary verification information corresponding to the secure hardware platform, if the hardware summary verification information matches the first hardware summary, the hardware platform to be tested is determined to be a secure hardware platform, thereby realizing the security of the hardware device platform through software verification, avoiding the target resource from being copied to an unauthorized hardware platform for use, and thus ensuring the security of the target resource.

[0076] In an optional implementation, in order to further accurately determine the first hardware summary, the above step S103 includes:

[0077] At least one first target hardware device information is sorted according to a preset rule to obtain a first target hardware device information sequence; and a first hardware summary of the hardware platform to be tested is determined according to a preset verification algorithm and the first target hardware device information sequence.

[0078] In this embodiment, sorting the first target hardware device information according to preset rules refers to a standardized sorting method for ensuring that the hardware information is processed in a consistent order. Sorting ensures that the hardware information can be processed in the same order each time a hardware summary is generated. In this way, a consistent summary can be generated regardless of the time at which the device is provided and by whom. Any disordered or redundant parts that may exist in the hardware information are removed to ensure that the hardware information used when generating the summary is standardized.

[0079] The method provided in this embodiment can ensure that each feature of the hardware platform is standardized according to predetermined rules by sorting at least one first target hardware device information to obtain a first target hardware device information sequence. This sorting method can reduce errors caused by inconsistent arrangement order of device information, improve the accuracy of the hardware summary, and make the verification process more reliable. By combining a preset verification algorithm with a hardware device information sequence, a hardware summary can be generated in a systematic and standardized manner. This method can effectively prevent tampering or forgery of device information, ensure that the generated hardware summary reflects the true status of the hardware device, and thus improve the security of the verification process.

[0080] In an optional implementation, in order to further generate signature information, Figure 2 FIG. 2 is a flowchart of a hardware platform verification method according to an embodiment of the present invention. Figure 2 As shown, before the above step S102, it also includes:

[0081] Step S201, obtaining at least one second target hardware device information in the secure hardware platform.

[0082] At least one second target hardware device information is obtained from a plurality of hardware devices in the secure hardware platform.

[0083] The second target hardware device information is the hardware device information of the same type as the first target hardware device information in the secure hardware platform, and can also be obtained through BIOS.

[0084] Step S202: sort at least one second target hardware device information according to a preset rule to obtain a second target hardware device information sequence.

[0085] The second target hardware device information sequence can be in accordance with certain rules (such as dictionary order, hardware type priority, etc.). The hardware information can be standardized to avoid differences caused by changes in order. The sorted information sequence will become the input of the subsequent verification algorithm to ensure that the generated hardware summary is consistent and repeatable.

[0086] Step S203 , determining a second hardware digest of the secure hardware platform as hardware digest verification information according to a preset verification algorithm and the second target hardware device information sequence.

[0087] The preset verification algorithm may be a cryptographic hash algorithm (such as SHA-256, SHA-512, etc.) to ensure the uniqueness and consistency of the hardware information sequence.

[0088] One way to determine the hardware summary verification information is to encrypt the second target hardware device information sequence using an encrypted hash algorithm and use the generated hash value as the hardware summary verification information.

[0089] Step S204: encrypt the second hardware digest according to the second key information to obtain signature information.

[0090] The second key information is the same as the first key information, or the second key is a private key and the first key is a public key corresponding to the second key. That is, the second hardware summary can be encrypted by symmetric encryption or asymmetric encryption to obtain the signature information.

[0091] Step S205: store the signature information in the target storage device.

[0092] That is, the generated signature information is stored in a specified storage device for use in subsequent verification.

[0093] The method provided in this embodiment can effectively enhance the integrity and security of the hardware summary by introducing the second target hardware device information and sorting it according to preset rules. Different hardware device information participates in the generation of the summary, which not only improves the coverage of the summary, but also avoids the risk that a single hardware information may be tampered with or forged. As the core information of hardware verification, the second hardware summary is more reliable and can better ensure the authenticity and integrity of the hardware platform. The generation of the hardware summary involves the information of multiple hardware devices, and this information is sorted and encrypted. Even if an attacker tries to forge a hardware device, he still needs to change the information of multiple hardware devices to successfully forge the correct hardware summary. This greatly increases the difficulty of hardware forgery and enhances the system's anti-tampering capabilities.

[0094] In an optional implementation, in order to further consider the change of the hardware device, after step S104, the following is further included:

[0095] When the second target hardware device is changed, the above-mentioned signature information is cleared based on the above-mentioned second key information; the changed second target hardware device information and the unchanged second target hardware device information are obtained; the above-mentioned changed second target hardware device information and the above-mentioned unchanged second target hardware device information are sorted according to the above-mentioned preset rules to obtain a third target hardware device information sequence; according to the above-mentioned preset verification algorithm and the above-mentioned third target hardware device information sequence, the third hardware digest of the above-mentioned secure hardware platform is determined; the above-mentioned third hardware digest is encrypting according to the second key information to obtain updated signature information.

[0096] In this embodiment, the second target hardware device can be a specific hardware module or device, such as a CPU, storage device, etc. The old signature information is cleared according to the second key information. It is ensured that the outdated signature information is no longer used for verification after the hardware is changed to avoid misleading the system verification process. The relevant information of the changed hardware is obtained, which usually includes the type, configuration, ID, version, etc. of the device. The hardware information that has not changed is obtained to ensure that the system can accurately identify which hardware remains unchanged.

[0097] Furthermore, the changed second target hardware device information is merged with the unchanged hardware device information, and is sorted according to pre-set rules (such as dictionary order, hardware type, priority, etc.) to form a new hardware device information sequence. This ensures that even after the hardware is changed, the system can process the hardware information in a consistent manner to prevent verification inconsistencies caused by changes in the order of information. The new hardware information sequence is calculated using a preset verification algorithm (usually an encrypted hash algorithm such as SHA-256) to obtain a new hardware digest (the third hardware digest).

[0098] The method provided in this embodiment helps prevent the old signature information from being abused or tampered with by clearing the original signature information and regenerating the hardware summary when the second target hardware device changes, thereby improving the system's adaptability and security to hardware device changes. By obtaining the changed and unchanged hardware device information and sorting them according to preset rules, a new hardware summary is generated to ensure that the platform's identity information is always consistent with the actual hardware configuration, reducing potential verification errors or forgery risks. After the hardware information is changed, the updated signature information is generated based on the new hardware summary encryption to ensure that the new verification data remains encrypted and protected during transmission and storage to avoid information leakage or tampering.

[0099] In an optional implementation, in order to further manage the target resources, before the above step S101, the above method further includes:

[0100] Create a security domain for the target resource, which is used to store the target resource; obtain a control block for the security domain, which is used to manage the access status of the security domain and the access address of the target resource; allocate the access address of the target resource, and copy the target resource to the access address of the target resource; when it is determined that the hardware platform to be tested is the secure hardware platform, set the access status of the security domain to an available status; respond to an access request, and feed back the access address of the target resource to the access requester, which is used to request access to the target resource.

[0101] In this embodiment, the security domain is a data structure for storing relevant information of the target resource, such as the entry address, storage address, program pointer backup, stack pointer backup, data exchange area address, etc. The control block is used to add, update, delete or disable the security domain. The control block is a data structure for managing and recording security domain information. It contains metadata related to the security domain, such as access control information, storage location of resources, permissions, etc. After creating the security domain and obtaining the control block, an access address needs to be assigned to the target resource. This address is used to locate the storage location of the resource, usually a memory address or a specific identifier of the device. After the resource is copied to the specified access address, the security domain access status needs to be set according to the status of the hardware platform. Once the access status of the security domain is set to available, the system can respond to the access request from the requester and feedback the access address of the target resource.

[0102] The method provided in this embodiment can effectively isolate and protect sensitive resources by creating a security domain for the target resource and managing the access status. The target resources stored in the security domain cannot be accessed without authorization, ensuring the security of the resources. Acquiring and using the control block to manage the access status of the security domain and the access address of the target resource helps to finely control the access to the resource. The design of the control block ensures that the resource can only be accessed under specific conditions, thereby avoiding unauthorized access or abuse. By allocating an access address and copying the target resource to the address, efficient management and dynamic adjustment of resources are ensured. This can flexibly adjust the location of resources according to actual needs, and improve the flexibility and scalability of resource management. By checking the hardware platform, it is ensured that only the secure hardware platform can access the target resources in the security domain. This hardware platform verification mechanism effectively prevents illegal access by unauthorized hardware platforms.

[0103] In an optional implementation, in order to further manage the security domain, after the above step S101, the above method further includes:

[0104] When the target second hardware device changes, the access status of the above security domain is set to a disabled state; when it is determined that the changed hardware platform is the above security hardware platform, the access status of the above security domain is set to an available state, and the above changed hardware platform includes the changed target second hardware device.

[0105] In this embodiment, when the target second hardware device changes, the system will temporarily disable the security domain associated with the target resource to prevent uncontrolled access during the change process. The access status of the security domain is set to disabled to prevent the changed hardware device from posing a potential security threat to the target resource. Check whether the changed hardware platform still meets the security requirements. If the hardware platform is confirmed to be a secure hardware platform, restore the access rights of the target resource. If the hardware platform is secure, restore the access status of the security domain to available, ready to respond to access requests.

[0106] The method provided in this embodiment sets the access status of the security domain to a disabled state when the target second hardware device changes. This mechanism can respond to hardware changes immediately and ensure that resources are not accessed by unauthorized devices during the process of hardware device changes. The disabled state can effectively prevent potential security risks and malicious access. By verifying the changed hardware platform, the access status of the security domain is set to an available state only when it is confirmed that the changed hardware platform is a "secure hardware platform." This ensures that only authorized secure hardware platforms can access sensitive resources, thereby improving the security of the system.

[0107] In an optional implementation, in order to further determine the non-secure platform, after the above step S103, the above method further includes:

[0108] If the above-mentioned signature information is not obtained, the above-mentioned hardware platform to be tested is determined to be a non-secure platform; or, if the above-mentioned verification information does not match the above-mentioned first hardware summary, the above-mentioned hardware platform to be tested is determined to be a non-secure platform; when the second hardware platform is determined to be a non-secure platform, the access request corresponding to the above-mentioned target resource is rejected, and the above-mentioned target resource is locked.

[0109] In this embodiment, if valid signature information cannot be obtained from the hardware platform, it means that the system cannot verify the legitimacy or security of the hardware platform, and the hardware platform will be judged as an unsafe platform. Once the hardware platform is confirmed to be an unsafe platform, any access request from the platform will be automatically rejected. By checking the signature information and verification information of the hardware platform, it is determined whether the platform meets the security standards. If the verification fails (i.e., the signature information is not obtained or the signature information does not match), the system will identify the hardware platform as an unsafe platform, thereby rejecting the access request from the platform and taking measures to lock the target resources.

[0110] The method provided in this embodiment can promptly determine that the hardware platform is a "non-secure platform" when the correct signature information is not obtained or the verification information does not match the predetermined hardware summary. This step ensures that only hardware that has been verified and matches the hardware summary can access system resources, avoiding potential security threats. It effectively prevents untrusted or potentially malicious hardware platforms from accessing sensitive resources, ensures the security of system resources, and reduces the risk of potential data leakage or damage.

[0111] Figure 3 is a schematic diagram of the architecture of a verification method for a hardware platform according to an embodiment of the present invention. Figure 3 As shown, the operating system includes: a control table with multiple security domains (security domain 1, security domain 2, security domain 3), which is used to control and manage each security domain. Corresponding software or data (i.e., target resources) is stored in each security domain. The software or data in each security domain corresponds to multiple hardware devices (device 1, device 2, device 3, device 4), i.e., the first target hardware device.

[0112] In an optional implementation, during the comparison process between the secure hardware platform and the hardware platform to be tested, the method further includes: further performing multi-dimensional verification on the security of the hardware platform based on the physical state information of the first target hardware device.

[0113] The physical status information includes, but is not limited to, the startup status, operating temperature, voltage fluctuation, and power consumption information of the hardware device during operation.

[0114] When the physical status information of the security hardware platform does not meet the preset security standards, for example, when the operating temperature of the current target hardware device exceeds the normal operating temperature threshold range, the detection software triggers the risk assessment mechanism of the security hardware platform. The detection software dynamically generates a corresponding security report and sends it to the management end.

[0115] After the management end receives the security report sent by the detection software, it generates the corresponding security report evaluation results based on the content of the security report. The evaluation results include: security status score (used to evaluate the current security of the hardware platform under test, including its physical state and whether it complies with the preset safety standards), security risk level (used to assess the security risk level of the platform, such as low, medium, and high risk, based on the degree of deviation between the various physical state data of the platform under test and the preset safety standards), and sends them to the detection software.

[0116] The detection software receives the evaluation results of the security report sent by the management end, and controls the access rights of the target resources according to the evaluation results of the security report.

[0117] If the evaluation results show that the platform security does not meet the requirements, the detection software will introduce additional security verification steps in the process of processing resource access requests. The additional security verification steps include but are not limited to user identity authentication (used to assess the security risk level of the platform, such as low, medium, and high risk, based on the degree of deviation between the physical status data of the platform under test and the preset security standards), access time restrictions (limiting access rights within a specific period of time to avoid unsafe operations during abnormal time periods), regional network isolation, etc. (isolating the network area of ​​the platform under test to limit its communication with key resources and reduce the potential attack surface).

[0118] When the evaluation results indicate that the hardware platform under test is judged to be a non-secure platform, the detection software automatically executes hardware isolation measures, cuts off the physical connection between the hardware platform under test and the target resource, and records the event log in the security control system of the target resource for subsequent security audits and remediation measures.

[0119] When the evaluation result indicates that the hardware platform to be tested is determined to be a safe platform, the detection software feeds back the access address of the target resource to the access requester.

[0120] Beneficial effects: By monitoring and comparing the real-time physical status of the hardware platform, it helps to discover potential hardware failures or safety hazards and enhances the ability to respond to abnormal situations. The detection software can dynamically evaluate the security of the platform based on the real-time hardware status and take appropriate security measures based on the evaluation results. When the platform is judged to be unsafe, it can automatically trigger the isolation mechanism to promptly cut off the physical connection between the hardware platform to be tested and the resources, effectively preventing security vulnerabilities from being exploited. By recording security event logs and generating assessment reports, it helps enterprises conduct subsequent security audits and compliance checks to ensure that there are clear audit records to trace before possible security vulnerabilities are fixed.

[0121] In addition, an embodiment of the present invention further provides a hardware platform verification device, Figure 4 is a schematic diagram of a verification device for a hardware platform according to an embodiment of the present invention, such as Figure 4 As shown, the verification device includes:

[0122] The acquisition module 401 is used to acquire at least one first target hardware device information and first key information corresponding to a target resource. The at least one first target hardware device information is acquired from a plurality of hardware devices in a hardware platform to be tested.

[0123] The decryption module 402 is used to search for signature information from the target storage device. If the signature information is found, the signature information is decrypted according to the first key information to obtain the hardware summary verification information corresponding to the secure hardware platform. The signature information is used to indicate that the secure hardware platform is authorized to use the target resource.

[0124] The determination module 403 is used to determine the first hardware summary of the hardware platform to be tested according to the at least one first target hardware device information and a preset rule.

[0125] The comparison module 404 is used to compare and determine that the hardware platform to be tested is a secure hardware platform if the hardware digest verification information matches the first hardware digest.

[0126] The present invention provides a video metadata recovery device, which obtains the first target hardware device information in the hardware platform to be tested, and the first secret key information corresponding to the target resource, decrypts the signature information according to the first secret key information, obtains the hardware summary verification information corresponding to the security platform, determines the first hardware summary of the hardware platform to be tested according to the first target hardware device information and preset rules, and compares the hardware summary verification information with the above-mentioned first hardware summary. If the hardware summary verification information matches the above-mentioned first hardware summary, it is determined that the above-mentioned hardware platform to be tested is a secure hardware platform. By generating a first hardware summary from the first target hardware device information and comparing it with the hardware summary verification information corresponding to the secure hardware platform, if the hardware summary verification information matches the first hardware summary, it is determined that the above-mentioned hardware platform to be tested is a secure hardware platform, thereby realizing the security of the hardware device platform through software verification, avoiding the target resource from being copied to an unauthorized hardware platform for use, and thus ensuring the security of the target resource.

[0127] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0128] The verification device of the hardware platform in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0129] The embodiment of the present invention also provides a computer device having the above Figure 4 The hardware platform shown is the verification device.

[0130] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0131] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include an integrated circuit. The integrated circuit may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0132] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0133] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0134] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0135] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0136] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0137] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0138] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for verifying a hardware platform, characterized in that: The method comprises: Acquire at least one first target hardware device information and first key information corresponding to the target resource, wherein the at least one first target hardware device information is acquired from a plurality of hardware devices in the hardware platform to be tested; Searching for signature information from the target storage device, and if the signature information is found, decrypting the signature information according to the first key information to obtain hardware summary verification information corresponding to the secure hardware platform, wherein the signature information is used to indicate that the secure hardware platform is authorized to use the target resource; Determining a first hardware summary of the hardware platform to be tested according to the at least one first target hardware device information and a preset rule; If the hardware digest verification information matches the first hardware digest, the hardware platform to be tested is determined to be a secure hardware platform.

2. The method according to claim 1, characterized in that Determining a first hardware summary of the hardware platform to be tested according to the at least one first target hardware device information and a preset rule includes: Sorting the at least one first target hardware device information according to the preset rule to obtain a first target hardware device information sequence; A first hardware digest of the hardware platform to be tested is determined according to a preset verification algorithm and the first target hardware device information sequence.

3. The method according to claim 2, characterized in that Before searching for signature information from the target storage device, the method further includes: Acquire at least one second target hardware device information in the secure hardware platform, wherein the at least one second target hardware device information is acquired from a plurality of hardware devices in the secure hardware platform; Sorting the at least one second target hardware device information according to the preset rule to obtain a second target hardware device information sequence; Determine, according to a preset verification algorithm and the second target hardware device information sequence, a second hardware digest of the secure hardware platform as the hardware digest verification information; encrypting the second hardware digest according to second key information to obtain the signature information, wherein the second key information is the same as the first key information, or the second key is a private key and the first key is a public key corresponding to the second key; The signature information is stored in the target storage device.

4. The method according to claim 3, characterized in that After determining that the hardware platform to be tested is the secure hardware platform, the method further includes: When the second target hardware device is changed, clearing the signature information based on the second key information; Acquire the changed second target hardware device information and the unchanged second target hardware device information; Sorting the changed second target hardware device information and the unchanged second target hardware device information according to the preset rule to obtain a third target hardware device information sequence; Determining a third hardware digest of the secure hardware platform according to the preset verification algorithm and the third target hardware device information sequence; The third hardware digest is encrypted according to the second key information to obtain updated signature information.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Creating a security domain for the target resource, where the security domain is used to store the target resource; Acquire a control block of the security domain, where the control block is used to manage the access status of the security domain and the access address of the target resource; Allocating an access address of the target resource, and copying the target resource to the access address of the target resource; When it is determined that the hardware platform to be tested is the secure hardware platform, setting the access state of the security domain to an available state; In response to the access request, the access address of the target resource is fed back to the access requester, wherein the access request is used to request access to the target resource.

6. The method according to claim 5, characterized in that The method further comprises: When the target second hardware device is changed, setting the access state of the security domain to a disabled state; When it is determined that the changed hardware platform is the secure hardware platform, the access state of the security domain is set to an available state, and the changed hardware platform includes a changed target second hardware device.

7. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: If the signature information is not obtained, determining that the hardware platform to be tested is a non-secure platform; Alternatively, if the verification information does not match the first hardware digest, determining that the hardware platform to be tested is a non-secure platform; When it is determined that the second hardware platform is a non-secure platform, the access request corresponding to the target resource is rejected, and the target resource is locked.

8. A hardware platform verification device, characterized in that: The device comprises: An acquisition module, used to acquire at least one first target hardware device information and first key information corresponding to a target resource, wherein the at least one first target hardware device information is acquired from a plurality of hardware devices in a hardware platform to be tested; a decryption module, configured to search for signature information from a target storage device, and if the signature information is found, decrypt the signature information according to the first key information to obtain hardware summary verification information corresponding to the secure hardware platform, wherein the signature information is used to indicate that the secure hardware platform is authorized to use the target resource; A determination module, configured to determine a first hardware summary of the hardware platform to be tested according to the at least one first target hardware device information and a preset rule; A comparison module is used to compare and determine that the hardware platform to be tested is a secure hardware platform if the hardware digest verification information matches the first hardware digest.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, The memory stores computer instructions, and the processor executes the verification method of the hardware platform according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the hardware platform verification method according to any one of claims 1 to 7.

Images