Component trusted recovery method and device, equipment and storage medium

Abstract

The invention relates to a trusted recovery method and device of a component, equipment and a storage medium, and the method comprises the steps: firstly determining a to-be-started target component based on a TPCM module; the target component comprises any one of firmware, an operating system and an application; performing credibility verification on the target component through the reference value of the target component; if the verification fails, acquiring a backup file of the target component; and performing credibility verification on the backup file through the reference value of the target component, and if verification on the backup file is successful, recovering the target component through the backup file. It can be seen that according to the scheme, after it is detected that the credibility verification of the target component fails, the target component can be rapidly recovered through the verified backup file, the target component is recovered to the credible state again and then started, the safety problems such as data loss and system damage are avoided, and the safety and reliability of the system are improved.

Description

Technical Field

[0001] The present application relates to the field of trusted computing technology, and in particular to a trusted recovery method, device, equipment and storage medium for a component. Background Art

[0002] At present, if there is no security mechanism to protect the firmware, operating system and other components after being tampered, the stability and performance of the system may be seriously affected, and the equipment may have frequent errors, crashes, and unstable operation, which will not only reduce the user experience, but also have a negative impact on the life of the equipment, and even lead to data leakage, loss of key information, equipment control, increased supply chain risks, increased repair costs, production interruption and other security issues. Common protection mechanisms include regularly updating firmware and operating systems, using trusted sources to download and install software, etc., but when the firmware or operating system is tampered with, under the protection of common security mechanisms, the computer may be blocked from powering on to prevent the tampered firmware from loading and executing when the system starts, and an early warning will be reported through the system log or security management system to isolate the infected system from the network to prevent the spread of malicious code and further damage; complex disaster recovery plans and other measures are used to reduce losses and resume production, but this still has problems such as high costs, data loss, and system damage.

[0003] Therefore, how to avoid data loss, system damage and other problems when components such as firmware and operating systems are tampered with, and how to improve the security and reliability of the system are technical problems that technical personnel in this field need to solve. Summary of the invention

[0004] The present application provides a trusted recovery method, device, equipment and storage medium for components to avoid data loss, system damage and other problems when components such as firmware and operating system are tampered with, thereby improving the security and reliability of the system.

[0005] In a first aspect, the present application provides a trusted recovery method for a component, the trusted recovery method is based on a TPCM module, and the trusted recovery method includes:

[0006] Determine a target component to be started; wherein the target component includes: any one of firmware, operating system and application;

[0007] Performing trustworthy verification on the target component through a reference value of the target component;

[0008] If the verification fails, obtaining a backup file of the target component;

[0009] Performing trustworthy verification on the backup file through the benchmark value of the target component;

[0010] If the backup file is successfully verified, the target component is restored through the backup file.

[0011] Optionally, performing trustworthy verification on the target component by using a reference value of the target component includes:

[0012] Get the metrics and benchmark values ​​of the target component;

[0013] Determining whether the measurement value is the same as the reference value;

[0014] If so, the verification is determined to be successful; if not, the verification is determined to be failed.

[0015] Optionally, obtaining a backup file of the target component includes:

[0016] Determine a target storage location using a preset trusted recovery strategy; the target storage location is a storage location storing the target component;

[0017] A backup file of the target component is obtained from the target storage location.

[0018] Optionally, a preset trusted recovery strategy is used to determine the target storage location, including:

[0019] Determine the current network status;

[0020] If the network state is an offline state, determining a target storage location from a trusted storage area or a device storage area of ​​the TPCM module;

[0021] If the network state is a connected state, a target storage location is determined from the trusted management center, the trusted storage area of ​​the TPCM module, and the device storage area.

[0022] Optionally, restoring the target component through the backup file includes:

[0023] The tampered portion of the target component is overwritten by the backup file.

[0024] Optionally, before determining the target component to be started, the method further includes:

[0025] Obtain the baseline value and backup files of each component through the TPCM module and / or the trusted software base agent.

[0026] Optionally, obtain the baseline values ​​and backup files of each component, including:

[0027] Collect component benchmarks for each component;

[0028] Determine the benchmark value of each component according to the component benchmark of each component;

[0029] Use component baselines of each component as backup files;

[0030] Encrypt and store the backup files of each component in the corresponding storage location;

[0031] The storage location includes at least one of a trusted management center, a trusted storage area of ​​a TPCM module, and a device storage area.

[0032] In a second aspect, the present application provides a trusted recovery device for a component, the trusted recovery device is based on a TPCM module, and the trusted recovery device includes:

[0033] A determination module, used to determine a target component to be started; wherein the target component includes: any one of firmware, operating system and application;

[0034] A first verification module, configured to perform trustworthy verification on the target component through a reference value of the target component;

[0035] A first acquisition module, used for acquiring a backup file of the target component when the verification of the target component fails;

[0036] A second verification module, configured to perform trustworthy verification on the backup file through a reference value of the target component;

[0037] The recovery module is used to restore the target component through the backup file when the backup file verification succeeds.

[0038] In a third aspect, the present application provides an electronic device, including:

[0039] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the above-mentioned trusted recovery method of the present application through the computer program.

[0040] In a fourth aspect, the present application further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned trusted recovery method of the present application.

[0041] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the present application provides a trusted recovery solution for a component, and the trusted recovery method is based on the TPCM module; in the solution, the target component to be started is first determined; the target component includes: any one of firmware, operating system and application; the target component is trusted verified by the benchmark value of the target component; if the verification fails, the backup file of the target component is obtained; the backup file is trusted verified by the benchmark value of the target component, and if the backup file is successfully verified, the target component is restored by the backup file. It can be seen that after detecting that the trusted verification of the target component fails, the solution can quickly restore the target component through the verified backup file, so that the target component can be restored to a trusted state and restarted, avoiding security issues such as data loss and system damage, and improving the security and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0045] Figure 1 A flow chart of a trusted recovery method for a component provided in an embodiment of the present application;

[0046] Figure 2 A schematic diagram of the overall process of trusted recovery of each component provided in an embodiment of the present application;

[0047] Figure 3 A flow chart of another trusted recovery method for a component provided in an embodiment of the present application;

[0048] Figure 4 A schematic diagram of the system structure in a networked state provided in an embodiment of the present application;

[0049] Figure 5 A schematic diagram of the system structure in an offline state provided in an embodiment of the present application;

[0050] Figure 6 A flowchart of firmware recovery in an offline state provided by an embodiment of the present application;

[0051] Figure 7 Another firmware recovery flow chart in an offline state provided by an embodiment of the present application;

[0052] Figure 8 A flowchart of firmware recovery in an online state provided by an embodiment of the present application;

[0053] Fig. 9 A flowchart of kernel recovery in an offline state provided in an embodiment of the present application;

[0054] Fig.10 A flowchart of kernel recovery in an online state provided by an embodiment of the present application;

[0055] Fig.11 A schematic diagram of the structure of a trusted recovery device of a component provided in an embodiment of the present application;

[0056] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] Currently, common protection mechanisms after components such as firmware or operating systems are tampered with include: regularly updating firmware and operating systems, using trusted sources to download and install software, and paying attention to security announcements and reminders in a timely manner to reduce the occurrence of these risks; strengthening the security development and management of firmware and operating systems to reduce the generation of vulnerabilities and reduce potential security risks; when firmware or operating systems are tampered with, malicious code is spread by preventing computers from powering on, etc. However, there are still problems such as high costs, data loss, system destruction, equipment damage, difficulty in recovery, business interruption, and wide impact, all of which bring huge losses to users.

[0058] In addition, the existing technology solves the problem through complex early warning response, analysis and positioning, recovery and reconstruction, test and verification and other measures, which brings high costs and implementation complexity. Especially in the fields of industrial control, finance, and key infrastructure, high requirements for business continuity are placed on the existing solution limitations. Therefore, the embodiments of the present application provide a trusted recovery method, device, equipment, and storage medium for components to help users more effectively reduce such security risks, protect user data, business continuity, and rapid recovery, thereby reducing the losses and impacts caused by security incidents and improving the security and reliability of the system.

[0059] Before explaining this application, the terms involved in this solution are explained first:

[0060] TPCM module (Trusted Platform Control Module): Trusted Platform Control Module, a hardware core module integrated in the trusted computing platform, used to establish and protect the trust source point, providing integrity measurement, secure storage, trusted reporting, and cryptographic services for trusted computing.

[0061] NOR Flash (Non-volatile Flash Technology): Due to its fast read speed and random access capability, NOR Flash is often used to store boot code, system boot program and other application scenarios that require fast loading. It is suitable for storing small capacity but frequently read data.

[0062] eMMC (Embedded Multi Media Card): eMMC has higher storage density and faster write speed, suitable for storing large amounts of data and applications. It is suitable for application scenarios that require a large amount of storage space and frequent read and write, such as operating systems, applications, and data storage.

[0063] Trusted storage: A hardware-based secure storage area based on a root of trust provides users with secure storage space for sensitive files such as certificates, keys, and configuration files, ensuring that users obtain high-security storage at the hardware level.

[0064] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0065] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0066] See also Figure 1 , is a flow chart of a trusted recovery method for a component provided in an embodiment of the present application. The trusted recovery method is based on a TPCM module and includes the following steps:

[0067] S101, determining a target component to be started; wherein the target component includes: any one of firmware, operating system and application;

[0068] In the present application, the target components to be started include: firmware, operating system and application, and the startup order of each component is: firmware, operating system and application; among them, the firmware can be BIOS (Basic Input Output System) / Uboot (boot loader), and the operating system can include kernel and init (initialization component).

[0069] S102, performing trustworthy verification on the target component through the benchmark value of the target component;

[0070] In this application, the reference value is data that represents the trustworthy characteristics of a component and is used as a reference to determine whether the component is trustworthy. For example, the hash value of key executable files and configuration files in the firmware and operating system is calculated and used as the reference value. In addition, configuration parameters, module information and other data can also be recorded as the reference value when the device is first started.

[0071] Before the target component is started, the present application first needs to verify the trustworthiness of the target component through the benchmark value of the target component. In some embodiments of the present application, when verifying the trustworthiness of the target component through the benchmark value of the target component, it is necessary to obtain the measurement value and the benchmark value of the target component to determine whether the measurement value and the benchmark value are the same; if so, the verification is determined to be successful; if not, the verification is determined to be failed.

[0072] It should be noted that the measurement value of this application is the value re-collected and generated when verifying the target component, and its generation method is exactly the same as the generation method of the benchmark value. If the re-collected measurement value is the same as the benchmark value, it means that the target component is in a trusted state, the verification is successful, and the target component is started; if the re-collected measurement value is different from the benchmark value, it means that the target component is in an untrusted state, the verification fails, and the component recovery process is executed.

[0073] S103, if the verification fails, obtaining a backup file of the target component;

[0074] In the present application, if the verification of the target component to be started fails, it means that the target component has been tampered with, and continuing to start it will cause security problems. Therefore, in the present application, for the target component that failed verification, it is necessary to obtain the backup file of the target component. The backup file is a backup file generated by the TPCM module after collecting various key information of each component when the device is started for the first time. The backup file can be encrypted and stored in a secure storage area. Among them, since the measurement value of the component contains the identification information of the component, the present application can obtain the backup file from the secure storage area according to the measurement value of the target component. If the TPCM module encrypts the backup file when storing it, after obtaining the backup file from the secure storage area, it needs to be decrypted by the TPCM module, and the subsequent steps will be continued only after the decryption is successful.

[0075] The backup files used for trusted recovery in this application are collected based on the TPCM module, stored based on the TPCM module, and trusted verification based on the TPCM module. The entire life cycle of the backup file is protected based on the TPCM module. From data collection, data writing to storage devices, to data being read and used, backup files need to verify the source of data and the credibility of the storage process based on trusted roots, national secret algorithms, and trusted verification mechanisms. The backup file can be stored in a trusted storage area within the TPCM module, or it can be stored in a trusted management center, other dedicated servers, or the device storage area of ​​the device itself based on the TPCM module, such as: eMMC (Embedded Multi Media Card, embedded multimedia card), NAND Flash (non-volatile memory), Nor Flash (non-volatile memory) and other areas. When stored and used, the TPCM module is used to ensure that the backup file will not be subject to unauthorized access, tampering, and loss, thereby ensuring the security and credibility of the backup file.

[0076] S104, performing trustworthy verification on the backup file through the benchmark value of the target component;

[0077] After the application obtains the backup file of the target component, in order to ensure the accuracy of the backup file, it is necessary to perform a credible verification on the backup file. Only when the backup file is verified to be a credible backup file, the target component will be restored through the backup file. After the restoration, the target component is restarted, and S101 is continued to be executed to determine whether the next target component to be started has passed the verification. If the verification fails, the credible recovery is continued. Among them, when the application verifies the backup file, the reference value of the backup file can be obtained to determine whether the reference value of the backup file is the same as the reference value of the component stored in the TPCM module. If they are the same, it means that the backup file verification is successful. If they are not the same, it means that the backup file verification has failed.

[0078] S105: If the backup file is successfully verified, the target component is restored through the backup file.

[0079] In some embodiments of the present application, when restoring the target component through a backup file, the tampered part of the target component can be overwritten by the backup file. Among them, when restoring the target component, the present application can overwrite the entire target component through a backup file, but this method consumes a lot of time. Therefore, in the present application, only the tampered part of the target component is overwritten by the backup file, thereby improving the recovery speed of the component.

[0080] See also Figure 2 , is a schematic diagram of the overall process of trusted recovery of each component provided in an embodiment of the present application. It can be seen that the TPCM module needs to measure each component before starting. If the measurement is successful, the component is started and the next component to be started is measured; if the measurement fails, the backup file of the component is obtained, and the trusted verification is performed based on the TPCM module, and the corresponding component is replaced by the backup file. In this embodiment, only the firmware (BIOS / Uboot) and the kernel are taken as examples for explanation: if the TPCM module measures the firmware successfully, the kernel is continued to be measured after the firmware is started; if the measurement fails, the firmware backup stored based on the TPCM module is obtained, and the firmware is restored after the trusted verification is performed based on the TPCM module, and the firmware is started to continue to measure the kernel; if the kernel is measured successfully, the kernel is started and other components are continued to be measured; if the kernel is measured unsuccessfully, the kernel backup stored based on the TPCM module is obtained, and the kernel is restored after the trusted verification is performed based on the TPCM module, and the kernel is started and other components are continued to be measured.

[0081] The present application can execute the trusted recovery method of the component based on the TPCM module, or can jointly execute the trusted recovery method of the component based on the TPCM module and the trusted software base agent, which is not specifically limited here. Among them, if the target component to be started is the firmware and the operating system, the component recovery operation can be completed by the TPCM module alone, and if the target component to be started is the application, the TPCM module and the trusted software base agent can be combined to execute this solution, that is:

[0082] If the target component is a firmware or operating system, the firmware or operating system is verified to be trustworthy through the TPCM module. If the measurement result is that the trusted state is abnormal, the recovery action is executed, the backup file is reloaded, and the backup file verified by the TPCM module overwrites the tampered part. The recovery is completed and restarted to restore the integrity and trustworthiness of the system. If the target component is an application, the key indicators of the application (such as file integrity, running behavior, configuration parameters, etc.) are measured in real time during the application operation through the trusted software base agent and the TPCM module, and then the measurement value is compared with the previously stored benchmark value. If it is found that there is a significant difference between the measurement value and the benchmark value (for example, the file hash value is different, the configuration parameter is illegally modified, etc.), it is determined that the trusted state of the application is abnormal, and the TPCM module sends a recovery instruction according to the strategy. After receiving the instruction, the trusted software base agent executes the recovery action, obtains the backup file of the application according to the measurement value of the application, and the TPCM module verifies the application based on the benchmark value of the application and the benchmark value of the backup file. After the verification is passed, the application backup covers the tampered part, the recovery is completed, and the application is restarted.

[0083] In this application, the TPCM module, as the starting point of the trust chain, performs trusted verification on each component in the startup process step by step to ensure the credibility of the entire startup process. During the startup process, if any inconsistency is found, the TPCM module will prevent the loading of components with abnormal status, prevent the tampered components from affecting the system security, and trigger the recovery mechanism. The TPCM module is designed according to the relevant standards of national trusted computing. It is the core component of the protection components in the dual system architecture and the basis for building the active immune defense system of trusted terminal devices. It provides functions such as integrity measurement, trusted storage, trusted reporting, and password services. The TPCM module can be customized according to actual needs, with a variety of product forms such as built-in, external, motherboard integrated, and BMC built-in. For different application scenarios, the customized TPCM module can provide strong security protection for the system in various application scenarios, provide fast and reliable trusted recovery functions, and ensure the integrity, credibility, and reliability of the system and data. The main tasks of the trusted software base agent include intercepting system behavior, obtaining behavior and environmental data, assisting in execution control, establishing management end communication, and establishing communication with the TPCM module.

[0084] In summary, the present application discloses a method for implementing trusted recovery based on the TPCM module. When the firmware, operating system and application are tampered with, the recovery function of the firmware, operating system and application is provided according to the trusted recovery function mode. Trusted recovery means that after detecting that the target component to be started has been tampered with or damaged, it can automatically restore its integrity, reload the correct backup file verified by the TPCM module for recovery, and return it to a trusted state, avoiding security issues such as data loss and system damage, and improving the security and reliability of the system.

[0085] In some embodiments of the present application, before determining the target component to be started, it is also necessary to obtain the baseline value and backup file of each component through the TPCM module and / or the trusted software base agent. The process of obtaining the baseline value and backup file of each component includes the following steps:

[0086] Collect component benchmarks of each component, determine benchmark values ​​of each component based on the component benchmarks of each component, use the component benchmarks of each component as backup files, and encrypt and store the backup files of each component in corresponding storage locations, wherein the storage locations include at least one of a trusted management center, a trusted storage area of ​​a TPCM module, and a device storage area.

[0087] In the present application, when the TPCM module is started for the first time after deployment, the TPCM module and / or the trusted software base agent needs to collect the component content of each component as a component baseline, and back up and store the component baseline as a backup file based on the TPCM module; it is also necessary to generate a baseline value for each component based on the component baseline; the present application also needs to pre-set a trusted recovery strategy, which includes the strategy used when the component is restored, recording the storage location of the baseline value of each component, the storage location of the backup file, how to select the backup file for recovery under different conditions, etc.

[0088] Here, the benchmark collection process, benchmark value generation process and backup process of each component are explained:

[0089] 1. Benchmark collection process:

[0090] When the device is started for the first time, the TPCM module will collect various key information of each component. For firmware, it will read the firmware version, configuration parameters, firmware module information, etc.; for operating systems, it will involve many aspects such as basic system information (such as version, kernel information), configuration information (user account, security policy, etc.), performance-related information, software and patch information, network configuration information, etc. For applications, it will involve code integrity information, dependencies, configuration parameters, running behaviors, etc. This stage is to comprehensively collect various relevant data as the basic material for subsequent verification.

[0091] Firmware benchmark collection process: The firmware benchmark is collected through the TPCM module. During the collection, the TPCM module can communicate with the chip storing the firmware to read the firmware data, or the interface provided by the firmware can be used for interactive collection, or the firmware update tool can be used.

[0092] Operating system benchmark collection process: When collecting operating system benchmarks, the TPCM module will obtain information on system information, kernel, configuration, policy, performance, and many other aspects. When the system is initialized, all binary executable files, dynamic libraries, kernel modules (drivers) and other format files in the system directory are collected, and after scanning and analyzing all files in the system, a system benchmark file is generated. During the system benchmark collection process, the trusted software base agent will assist the TPCM module. For example, after the system kernel is started, the trusted software base agent will supplement the collected information and assist in information collection, data integration and transmission, etc. For example:

[0093] When collecting system information, the TPCM module is mainly responsible for obtaining basic data from the hardware level, such as the device's hardware identifier, BIOS / UEFI (Unified Extensible Firmware Interface) version, etc. The trusted software agent can assist in collecting additional system information at the software level.

[0094] For system configuration information, the TPCM module may have difficulty understanding some complex software configuration semantics, and the trusted software agent can act as an intermediate translator.

[0095] The TPCM module may obtain the physical location and basic storage format of the policy information storage, and the trusted software agent can deeply interpret the policy content.

[0096] The TPCM module can obtain basic data on device performance from the hardware level, such as the basic frequency of the CPU (Central Processing Unit) and the capacity of the memory. The trusted software agent can assist in collecting performance information from the perspective of software operation.

[0097] The TPCM module and the trusted software agent may use different data formats to represent information. The trusted software agent can convert the collected information into a format that can be processed and stored by the TPCM module.

[0098] The trusted software agent can assist the TPCM module in integrating the collected multi-source information. For example, after collecting system configuration and performance information, the trusted software agent can combine this information in a certain logical order and structure to check whether there are any contradictions or incompleteness between the information.

[0099] Application benchmark collection process: In a trusted computing system, the collection of application benchmarks when the device is first started is usually not performed directly by the TPCM module. Common collection methods include collection based on signature servers, collection by trusted software base agents, etc. In this application, the collection of application benchmarks can be done through a trusted software base agent. It collects and organizes relevant information about application software and its running components through specific interfaces and mechanisms to generate application benchmarks. This information may include software code integrity information, dependencies, configuration parameters, etc. to ensure the credibility of the software during startup and operation.

[0100] 2. Benchmark value generation process:

[0101] After collecting component benchmarks, this application will extract benchmark values ​​from the collected information, which are used to establish standards that can be used for verification. Among them:

[0102] Firmware baseline value: includes version, integrity value (hash value), configuration parameters, module information and other baseline information;

[0103] System baseline value: contains basic system information, such as identification, version, type, kernel information, integrity value (hash value), configuration information, performance information, trusted policy status, target trusted status, and other benchmark information;

[0104] Application baseline value: includes name, package name, version, integrity value (hash value), type, permissions, calling relationship and other baseline information.

[0105] In the present application, in order to ensure the accuracy of the reference value, the reference value of the component may be written into the trusted storage area of ​​the TPCM module for storage.

[0106] 2. Backup process:

[0107] In this application, the firmware content collected during benchmark collection is used as the firmware benchmark, the operating system content collected is used as the operating system benchmark, and the application content collected is used as the application benchmark. These content benchmark files are used as backup files and can be encrypted and backed up and stored based on the TPCM module.

[0108] Among them, firmware backup is completed through the TPCM module, which can ensure that the backup data is under trusted control from the beginning.

[0109] The operating system backup is completed by the trusted software base agent and the TPCM module. For example, there is a communication interface between the trusted software base agent and the TPCM module to coordinate the backup work after the baseline is collected. The trusted software base agent can coordinate the backup process. It organizes and stores the operating system benchmark data in a suitable format based on the hardware-related information provided by the TPCM module and the software information collected by itself. For example, the backup data of the operating system is stored in a specific security area of ​​the local storage device, and in cooperation with the TPCM module, the backup data is encrypted using the encryption key provided by the TPCM module to ensure the security and integrity of the backup data. For example, when the TPCM module completes the collection of the firmware and kernel benchmark content, the trusted software base agent receives a notification from the TPCM module through the interface, informing that the backup is about to start and the format, size and other information of the relevant data. The trusted software base agent can help prepare the data format required for the backup.

[0110] During the backup encryption process, the trusted software base agent can participate in the negotiation of encryption parameters. The trusted software base agent can monitor the process and status of backup storage. The trusted software base agent will record backup-related information, including the time of the backup, the version of the backup file (if it is multiple backups), the storage location of the backup file (logical location in the TPCM module), etc.

[0111] Application backup is completed through the trusted software base agent, and the backup execution process is dominated by the trusted software base agent. The trusted software base agent works at the software level and has a more direct interactive interface with the application. During the backup process, the trusted software base agent is responsible for ensuring the integrity and consistency of the backup data. It can use the encryption key provided by the TPCM module to encrypt the backup data to ensure the security and integrity of the backup data. At the same time, the trusted software base agent will coordinate the relationship between the backup data to ensure that the relevant application files, configuration files, and data files can be fully backed up to avoid the loss or mismatch of some files.

[0112] In summary, the present application can effectively obtain the baseline value and backup files of each component through the TPCM module and / or the trusted software base agent, thereby ensuring that during the component measurement and component recovery process, the components are effectively verified through the baseline values, and the components are reliably restored through the backup files, thereby ensuring the security of the system and the reliability of the data.

[0113] See also Figure 3 , is a flow chart of another trusted recovery method of a component provided in an embodiment of the present application, the trusted recovery method is based on the TPCM module and includes the following steps:

[0114] S201, determining a target component to be started; wherein the target component includes: any one of firmware, operating system and application;

[0115] S202, performing trustworthy verification on the target component through the benchmark value of the target component;

[0116] S203: If the verification fails, a preset trusted recovery strategy is used to determine a target storage location; the target storage location is a storage location where the target component is stored;

[0117] S204, obtaining a backup file of the target component from the target storage location;

[0118] S205, performing trustworthy verification on the backup file through the benchmark value of the target component;

[0119] S206: If the backup file is successfully verified, the target component is restored through the backup file.

[0120] In this application, the backup files of each component can be stored in different locations according to the different network status. Figure 4 , is a schematic diagram of the system structure in the networked state provided by the embodiment of the present application. In the networked state, the system is composed of a TPCM module, a trusted software base agent software, and a trusted management center software, which are jointly constituted by a client and a server. The TPCM module is implemented in hardware, and a trusted policy is preset. The TPCM module provides functions such as integrity measurement, trusted storage, trusted reporting, and cryptographic services. The trusted software base agent software is deployed on the client, and its main tasks include intercepting system behavior, obtaining behavior and environmental data, assisting in execution control, establishing management-side communication, and establishing communication with the TPCM module. The TPCM module and the terminal are registered in the trusted management center and report their own status in a timely manner. The trusted management center software is deployed on the server side (hardware server, with a built-in trusted root and trusted software base, and a trusted device with high security protection itself), and obtains information such as policies, benchmarks, status, logs, etc. of the terminal system and applications through interaction with the client, and provides management functions.

[0121] When connected to the Internet, this application can send the backup files of firmware, operating system and application to the trusted management center based on the TPCM module, and back them up through the trusted management center. In this solution, trusted recovery can be achieved in the connected state, and the terminal does not require other hardware modifications. The management end can perform baseline backup, policy management, and trusted recovery management.

[0122] Furthermore, the present application can also take into account system requirements, storage capacity, read and write speeds, security and other factors, and based on the trusted root, back up each component to the trusted storage area and device storage area within the TPCM module; for example: in order to ensure that trusted recovery of components can be achieved offline during data recovery, the backup files of each component can be stored in the trusted storage area and device storage area within the TPCM module at the same time.

[0123] See also Figure 5 , is a schematic diagram of the system structure in an offline state provided by an embodiment of the present application. The system consists of a TPCM module and a trusted software base agent software. The TPCM module is implemented in hardware, and a trusted policy is preset. The TPCM module provides functions such as integrity measurement, trusted storage, trusted reporting, and cryptographic services. The trusted software base agent software is deployed on the client, and its main tasks include intercepting system behavior, obtaining behavior and environmental data, assisting in execution control, establishing management-side communication, establishing communication with the TPCM module, etc. In an offline state, the present application can store the backup files of the firmware, operating system, and application in the trusted storage area within the TPCM module based on the TPCM module, and can also store the backup files of each component in the device storage area based on the TPCM module.

[0124] Therefore, in some embodiments of the present application, when determining the target storage location using a preset trusted recovery strategy, it is first necessary to determine the current network status. If the network status is offline, the target storage location is determined from the trusted storage area of ​​the TPCM module or the device storage area; if the network status is online, the target storage location is determined from the trusted management center, the trusted storage area of ​​the TPCM module, and the device storage area.

[0125] Through this method, the present application enables the present solution to perform component recovery operations regardless of whether it is in an online state or an offline state, and can meet the requirements of different security levels and cope with various usage scenarios, thereby ensuring normal equipment communication, data security, system security, normal business operation, and ensuring the normal operation of the production line and reducing losses.

[0126] Here, taking the kernel of the firmware and operating system as an example, the recovery process of the online state and the offline state is explained as follows:

[0127] See also Figure 6 , is a flowchart of firmware recovery in an offline state provided by an embodiment of the present application; through Figure 6 It can be seen that the TPCM module measures the firmware. If the measurement is successful, the firmware is started; if the measurement fails, since the current network status is offline, the firmware backup file in the TPCM module can be called at this time. After the TPCM module verifies the firmware backup file, it overwrites the tampered part with the backup file, completes the recovery, and restarts.

[0128] See also Figure 7 , is a flowchart of firmware recovery in an offline state provided by an embodiment of the present application; through Figure 7It can be seen that the TPCM module measures the firmware. If the measurement is successful, the firmware is started; if the measurement fails, since the current network status is offline, the firmware backup file in the device storage area can be called at this time. After the TPCM module verifies the firmware backup file, it overwrites the tampered part with the backup file, completes the recovery, and restarts.

[0129] See also Figure 8 , is a flowchart of firmware recovery in an online state provided by an embodiment of the present application; through Figure 8 It can be seen that the TPCM module measures the firmware. If the measurement is successful, the firmware is started; if the measurement fails and it is detected that the network can be connected through the BMC (Baseboard Management Controller), the current network status is determined to be online. At this time, the firmware backup file of the trusted management center can be called. After the TPCM module verifies the firmware backup file, it overwrites the tampered part with the backup file, completes the recovery, and restarts.

[0130] See also Fig. 9 , is a flowchart of kernel recovery in an offline state provided by an embodiment of the present application; through Fig. 9 It can be seen that the TPCM module measures the kernel. If the measurement is successful, the kernel is started; if the measurement fails, since the current network status is offline, the kernel backup file in the TPCM module can be called at this time. After the TPCM module verifies the kernel backup file, it overwrites the tampered part with the backup file, completes the recovery, and restarts.

[0131] See also Fig.10 , is a kernel recovery flow chart in an online state provided by an embodiment of the present application; through Fig.10 It can be seen that the TPCM module measures the kernel. If the measurement is successful, the kernel is started. If the measurement fails, the network can be connected after the firmware is started, so the current network status is online. At this time, the kernel backup file of the trusted management center can be called. After the TPCM module verifies the kernel backup file, it overwrites the tampered part with the backup file, completes the recovery, and restarts.

[0132] In summary, in this application, if a component is detected to be tampered with, a trusted component can be automatically loaded according to the preset strategy to return it to a trusted state. This solution relies on the various functions provided by the TPCM module, especially platform integrity measurement and trusted control, to solve security issues such as data leakage, data loss, equipment control, increased supply chain risks, increased repair costs, and production interruptions to the greatest extent. This solution has at least the following beneficial effects:

[0133] 1. The TPCM module verifies the system from the hardware level by establishing a trust chain, ensuring that only authorized firmware, systems, and software that have been checked can run. This hardware-based security mechanism greatly improves the system's anti-attack capabilities, prevents unauthorized access and tampering, and ensures the security of system startup.

[0134] 2. The TPCM module monitors the integrity of the system in real time. Once it detects that the firmware or operating system has been tampered with or failed, it can immediately start the recovery program, quickly recover, and restore to a trusted state. This mechanism ensures the continuity of production, business, and services. For example, in the production environment of the industrial control field, even in the face of malicious attacks, the TPCM module can quickly restore the system to a safe and trusted state, avoiding long-term production interruptions and ensuring the continuity of key businesses.

[0135] 3. The trusted recovery mechanism of the TPCM module ensures that the system can quickly recover to normal after an attack or failure, improving the reliability and stability of the system. This reliability is particularly important for critical infrastructure and industrial control systems, as their normal operation is essential for production and safety.

[0136] 4. The trusted recovery mechanism of the TPCM module can not only restore the integrity of the system, but also protect the security of system data. Through real-time monitoring and recovery, the TPCM module ensures that data will not be lost or tampered with after an attack or failure, protects the core assets of the enterprise, and ensures the integrity and availability of data.

[0137] 5. The trusted recovery function of the TPCM module reduces the need for manpower, reduces maintenance workload, and reduces maintenance costs caused by system failures and security incidents.

[0138] 6. Administrators do not need to manually check and repair the system. Through unified management, trusted recovery strategies can be customized on demand and the trusted status of the equipment can be monitored in real time. The TPCM module can automatically detect and repair problems, reducing management costs and complexity, making management more efficient and convenient.

[0139] 7. The automatic recovery function of the TPCM module is suitable for various types of systems. It has high scalability and flexibility and can be widely used in different industries and application scenarios to provide comprehensive security protection for the system.

[0140] See also Fig.11 , Fig.11 A schematic diagram of a trusted recovery device structure of a component provided in an embodiment of the present application, the trusted recovery device is based on a TPCM module, and the device specifically includes:

[0141] The determination module 11 is used to determine the target component to be started; wherein the target component includes: any one of firmware, operating system and application;

[0142] A first verification module 12, configured to perform trustworthy verification on the target component through a reference value of the target component;

[0143] A first acquisition module 13, used for acquiring a backup file of the target component when the verification of the target component fails;

[0144] A second verification module 14, configured to perform trustworthy verification on the backup file through a reference value of the target component;

[0145] The recovery module 15 is used to restore the target component through the backup file when the backup file verification is successful.

[0146] As an optional embodiment, the first verification module includes:

[0147] A first acquisition unit, used to acquire a measurement value and a reference value of a target component;

[0148] The judging unit is used to judge whether the measurement value is the same as the reference value; if so, the verification is judged to be successful; if not, the verification is judged to be failed.

[0149] As an optional embodiment, the first acquisition module includes:

[0150] A first determining unit, configured to determine a target storage location using a preset trusted recovery strategy; the target storage location is a storage location storing the target component;

[0151] The second obtaining unit is used to obtain the backup file of the target component from the target storage location.

[0152] As an optional embodiment, the first determining unit is specifically configured to:

[0153] Determine the current network status; if the network status is offline, determine the target storage location from the trusted storage area or device storage area of ​​the TPCM module; if the network status is online, determine the target storage location from the trusted management center, the trusted storage area of ​​the TPCM module and the device storage area.

[0154] As an optional embodiment, the recovery module is specifically used to: overwrite the tampered part of the target component with the backup file.

[0155] As an optional embodiment, the device further includes:

[0156] The second acquisition module is used to acquire the baseline value and backup file of each component through the TPCM module and / or the trusted software base agent.

[0157] As an optional embodiment, the second acquisition module includes:

[0158] A collection unit, used for collecting component benchmarks of each component;

[0159] A second determining unit, configured to determine a reference value of each component according to a component reference of each component;

[0160] A third determining unit, configured to use the component baseline of each component as a backup file;

[0161] A storage unit, used to encrypt and store the backup files of each component in a corresponding storage location;

[0162] The storage location includes at least one of a trusted management center, a trusted storage area of ​​a TPCM module, and a device storage area.

[0163] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0164] See also Fig.12 , Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0165] A processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. The processor 21 executes the steps of the trusted recovery method described in any of the above method embodiments through the computer program.

[0166] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU; the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0167] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the trusted recovery method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0168] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0169] certainly, Fig.12 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Fig.12 More or fewer components than shown, or combinations of certain components.

[0170] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by a processor, the steps of the trusted recovery method described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0171] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0172] In summary, the technical solution provided by this application has at least the following beneficial effects:

[0173] 1. High flexibility and scalability. This solution targets a variety of device types and can include different technical implementation methods to meet different security level requirements. It has strong versatility, adaptability, and flexibility. For example, military equipment, medical equipment, consumer electronic devices, including servers, PCs, mobile terminals, IoT devices, etc., the security requirements of different devices in different scenarios vary greatly. The trusted recovery mechanism that integrates the TPCM module can meet these diverse security requirements through different technical implementation methods based on the characteristics of different devices. Users can choose the appropriate implementation method and customize the trusted recovery strategy based on their own device characteristics and security requirements. It has high flexibility. With the continuous development of technology, the solution can also be continuously upgraded and expanded to adapt to new security threats and challenges.

[0174] 2. Adaptability to different network states. Taking the online and offline states into consideration is an innovative design. Most security solutions are designed mainly for the online state, ignoring the fact that offline devices also have security risks. This solution can effectively perform trusted verification and recovery whether in the online state or offline state. When in the online state, the latest security policies and backup data can be obtained in a timely manner; when in the offline state, recovery operations can also be performed based on local trusted and secure storage to ensure the security and availability of the device in various network environments. For example, some offline devices in the party, government and military fields, such as tactical communication equipment, may be offline during combat, but they may also be subject to physical attacks that cause the firmware or operating system to be tampered with. This solution can also perform trusted verification and recovery in the offline state, which is an innovative design for security protection in different device operating states.

[0175] 3. Coping with various usage scenarios. In different usage scenarios such as high-security party, government and military application scenarios, ordinary enterprise office scenarios, industrial production scenarios, and home IoT scenarios, the security threats faced by devices are different. The flexibility of the TPCM module solution enables it to cope with these complex and diverse scenarios. The TPCM module can ensure device security through its trusted verification and recovery functions.

[0176] 4. Improve system security and enhance system stability. From the perspective of the overall system, the trusted verification and recovery functions of the TPCM module can promptly discover and repair security risks at the bottom of the system, ensuring that the equipment is restored to a trusted state as soon as possible, reducing downtime and data loss risks caused by failures.

[0177] 5. Improve data security. Firmware and operating systems are the basic platforms for data storage and processing. This solution prevents malicious programs from stealing and tampering with data by exploiting vulnerabilities in firmware or operating systems by restoring the correct image. For example, for servers in financial institutions, the trusted recovery function of the TPCM module can ensure the security of the operating system and firmware, reduce the risk of being attacked, and reduce the risk of data loss due to failures, thereby protecting important data.

[0178] 6. Ensure normal communication of devices and normal operation of business. Whether it is a server in an enterprise network or a sensor node in the Internet of Things, normal communication is crucial. This solution can ensure that components related to device communication are in normal state through trusted recovery of firmware and operating system. For example, in base station equipment, if the firmware is tampered with, it may cause abnormal signal transmission. Timely trusted recovery of the TPCM module can quickly fix the problem and ensure normal communication between the base station and mobile devices.

[0179] 7. Combination of trusted storage and recovery. Combining trusted verification with recovery from trusted storage is an innovative idea. It breaks the limitation of traditional security solutions that can only be reinstalled or repaired once a problem occurs. For example, in industrial control systems, the trusted recovery function based on the TPCM module can quickly restore firmware and operating systems from trusted storage, avoiding the long downtime and complex debugging process that may be caused by traditional repair methods.

[0180] 8. Reduce maintenance costs. The solution implements automated trusted verification and recovery functions, reducing manual intervention. At the same time, due to the use of hardware-level security protection mechanisms, through early prevention and rapid recovery mechanisms, it also reduces equipment downtime, improves equipment availability and production efficiency, and reduces security risks and maintenance costs caused by software vulnerabilities or attacks, and reduces maintenance costs caused by system failures and security incidents.

[0181] 9. Simplify management complexity. The trusted recovery function of the TPCM module can be integrated with the existing equipment management system and management center to achieve centralized management and monitoring of equipment. Administrators can customize trusted recovery strategies through a unified management interface, monitor the trusted status of equipment in real time, and promptly discover and handle equipment with abnormal trusted status, which greatly simplifies the complexity of equipment management and improves management efficiency.

[0182] In summary, the innovation of the trusted recovery mechanism of the TPCM module in this application has significant innovation and advantages in the field of device security. It can not only improve the security and stability of the device and reduce management and maintenance costs, but also has flexibility and scalability, and can adapt to different device types and scenario requirements.

[0183] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0184] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A trusted recovery method for a component, characterized in that: The trusted recovery method is based on the TPCM module, and the trusted recovery method includes: Determine a target component to be started; wherein the target component includes: any one of firmware, operating system and application; Performing trustworthy verification on the target component through a reference value of the target component; If the verification fails, obtaining a backup file of the target component; Performing trustworthy verification on the backup file through the benchmark value of the target component; If the backup file is successfully verified, the target component is restored through the backup file.

2. The trusted recovery method according to claim 1, characterized in that: Performing trustworthy verification on the target component through the reference value of the target component includes: Get the metrics and benchmark values ​​of the target component; Determining whether the measurement value is the same as the reference value; If so, the verification is determined to be successful; if not, the verification is determined to be failed.

3. The trusted recovery method according to claim 1, characterized in that: Obtaining a backup file of the target component, including: Determine a target storage location using a preset trusted recovery strategy; the target storage location is a storage location storing the target component; A backup file of the target component is obtained from the target storage location.

4. The trusted recovery method according to claim 3, characterized in that: Leverage pre-built trusted recovery policies to target storage locations, including: Determine the current network status; If the network state is an offline state, determining a target storage location from a trusted storage area or a device storage area of ​​the TPCM module; If the network state is a connected state, a target storage location is determined from the trusted management center, the trusted storage area of ​​the TPCM module, and the device storage area.

5. The trusted recovery method according to claim 1, characterized in that: Restoring the target component through the backup file includes: The tampered part of the target component is overwritten by the backup file.

6. The trusted recovery method according to any one of claims 1 to 5, characterized in that: Before determining the target component to be started, it also includes: Obtain the baseline value and backup files of each component through the TPCM module and / or the trusted software base agent.

7. The trusted recovery method according to claim 6, characterized in that: Obtain the baseline values ​​and backup files of each component, including: Collect component benchmarks for each component; Determine the benchmark value of each component according to the component benchmark of each component; Use component baselines of each component as backup files; Encrypt and store the backup files of each component in the corresponding storage location; The storage location includes at least one of a trusted management center, a trusted storage area of ​​a TPCM module, and a device storage area.

8. A trusted recovery device for a component, characterized in that: The trusted recovery device is based on the TPCM module, and the trusted recovery device includes: A determination module, used to determine a target component to be started; wherein the target component includes: any one of firmware, operating system and application; A first verification module, configured to perform trustworthy verification on the target component through a reference value of the target component; A first acquisition module, used for acquiring a backup file of the target component when the verification of the target component fails; A second verification module, configured to perform trustworthy verification on the backup file through a reference value of the target component; The recovery module is used to restore the target component through the backup file when the backup file verification succeeds.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the trusted recovery method described in any one of claims 1 to 7 of the present application through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the trusted recovery method described in any one of claims 1 to 7 of the present application.

Images