Cluster construction method and system based on trusted computing

Abstract

The invention provides a cluster construction method and system based on trusted computing, and relates to the technical field of clusters, and the method comprises the steps: deploying a trusted environment which comprises a trusted server and a plurality of terminals, the trusted server measures the terminals through trusted computing, and the plurality of terminals form a secure trusted cluster; by means of the trusted agent, the terminal initiates a registration request to the trusted server, and the trusted agent configures IPSec for the successfully registered terminal and adds the terminal into the secure trusted cluster; in the process that the terminal interacts with other terminals in the secure and trusted cluster through IPSec, the trusted server continuously measures the terminal and automatically removes the terminal which fails in measurement from the secure and trusted cluster; according to the method, the trusted technology and the IPSec technology are combined, the secure and trusted cluster is constructed, and the integrity and security of the cluster are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of cluster technology, and in particular to a cluster construction method and system based on trusted computing. Background Art

[0002] A cluster is a group of independent computers that are interconnected by a high-speed network. They form a group and are managed as a single system. When a client interacts with the cluster, the cluster acts like an independent server. In real application scenarios, customers need a small server or virtual machine cluster with high security. Cluster technology can alleviate concurrency and transfer single points of failure at a relatively low cost, thereby obtaining relatively high benefits in terms of performance, reliability, and flexibility.

[0003] In current cluster technology, IPSec (Internet Protocol Security) technology is used to cryptographically protect computer communications in the cluster. However, when a machine in an IPSEC cluster is infected by a virus or Trojan horse, it can still communicate with other computers, destroying the integrity and security of the cluster. Summary of the invention

[0004] In order to solve the above problems, the present disclosure proposes a cluster construction method and system based on trusted computing, which combines trusted technology with IPSec technology to build a secure and trusted cluster and improve the integrity and security of the cluster.

[0005] According to some embodiments, the present disclosure adopts the following technical solutions: A cluster construction method based on trusted computing, comprising: Deploy a trusted environment, including a trusted server and several terminals, wherein the trusted server measures the terminals through trusted computing, and the several terminals form a secure and trusted cluster; With the help of a trusted agent, the terminal initiates a registration request to the trusted server. The trusted agent configures IPSec for the successfully registered terminal and adds it to the secure trusted cluster. When a terminal interacts with other terminals in a secure and trusted cluster through IPSec, the trusted server continuously measures the terminal and automatically removes the terminal that fails the measurement from the secure and trusted cluster.

[0006] Furthermore, the trusted server is composed of a trusted management center and a CA certification center; The trusted management center measures the terminal by interacting with the trusted agent of the terminal for trusted data; The CA authentication center interacts with the trusted management center for authentication data to generate a certificate key pair for the terminal that has successfully measured.

[0007] Furthermore, the terminal is a physical machine or a virtual machine, and a trusted agent based on a TCM chip is deployed for each terminal.

[0008] Furthermore, the specific process of the registration request is as follows: The trusted agent sends its own information to the trusted server; After receiving the registration request, the trusted server registers the information of the trusted agent and sends a measurement request to the trusted agent; After receiving the measurement request, the trusted agent returns the measurement data; The trusted server measures the terminal through trusted computing based on the measurement data. If the measurement is successful, a certificate key pair is generated through the CA certification center and sent to the trusted agent together with the newly generated IPSec configuration file.

[0009] Furthermore, after the registration is successful, the trusted agent receives the IPSec configuration file and the certificate key pair sent by the trusted server, and then configures and starts IPSec. Furthermore, during the continuous measurement process, if the measurement fails, a message is sent to the CA certification center to request it to update the certificate revocation list.

[0010] According to some embodiments, the present disclosure adopts the following technical solutions: A cluster construction system based on trusted computing, comprising: The environment deployment module is configured to: deploy a trusted environment, including a trusted server and a plurality of terminals, wherein the trusted server measures the terminals through trusted computing, and the plurality of terminals constitute a secure and trusted cluster; The terminal registration module is configured as follows: with the help of a trusted agent, the terminal initiates a registration request to a trusted server, the trusted agent configures IPSec for the successfully registered terminal, and adds it to a secure trusted cluster; The continuous measurement module is configured such that when the terminal interacts with other terminals in the secure and trusted cluster through IPSec, the trusted server continuously measures the terminal and automatically removes the terminal that fails the measurement from the secure and trusted cluster.

[0011] According to some embodiments, the present disclosure adopts the following technical solutions: A computer program product includes a computer program, wherein when the computer program is executed by a processor, the cluster construction method based on trusted computing is implemented.

[0012] According to some embodiments, the present disclosure adopts the following technical solutions: A non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, a cluster construction method based on trusted computing is implemented.

[0013] According to some embodiments, the present disclosure adopts the following technical solutions: An electronic device comprises: a processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes and implements the cluster construction method based on trusted computing.

[0014] Compared with the prior art, the present invention has the following beneficial effects: The present invention combines trusted technology with IPSEC technology, and utilizes the advantages of trusted computing in protecting the integrity of computer systems to create a method for building a secure and trusted cluster. On the one hand, each computer in the cluster is protected by trusted computing technology. On the other hand, when the trusted computing measurement of a computer in the cluster fails, it can be automatically kicked out of the IPSEC cluster, thereby protecting the integrity, security and credibility of the cluster. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure.

[0016] Figure 1 This is the overall architecture diagram of Example 1.

[0017] Figure 2 This is a flow chart of a terminal joining a trusted cluster in Example 1.

[0018] Figure 3 This is a flowchart of automatically removing a terminal in Example 1. DETAILED DESCRIPTION

[0019] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0020] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0021] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0022] Example 1 In one embodiment of the present disclosure, a cluster construction method based on trusted computing is provided, which combines trusted technology with IPSEC technology to build a secure and trusted cluster and improve the integrity and security of the cluster. The specific implementation process is as follows: Step S1: deploy a trusted environment, including a trusted server and several terminals. The trusted server measures the terminals through trusted computing, and the several terminals form a secure and trusted cluster.

[0023] The overall architecture is as follows Figure 1 As shown, the trusted server can be a virtual machine or a physical machine, which needs to be deployed in a relatively secure environment. The trusted server includes a trusted management center and a CA certification center. The terminals in the trusted terminal cluster can be physical machines or virtual machines, and a secure trusted cluster is built based on the trusted server.

[0024] The terminal deploys a trusted agent based on the TCM chip. During the deployment process, a hash value is generated for the executable files, drivers and other information on the terminal. The hash value list is used as a whitelist and sent to the trusted management center during registration. The agent registers with the trusted management center, and the trusted management center continuously measures the terminal through a series of trusted data interactions. When the first measurement is successful, the trusted management center sends the IPSec configuration file and certificate key pair data to the agent (the certificate key pair comes from the CA certification center). After receiving the data, the agent configures the terminal, that is, the agent configures IPSec for the terminal. After the configuration is completed, this terminal can interact with other terminals through IPSec.

[0025] When the trusted management center finds that a terminal fails to measure, it will inform the CA certification center to update the CRL table (certificate revocation list). The trusted management center will notify all terminals of the updated CRL table. After receiving the message, each agent will exclude the terminal that failed to measure from the cluster through IPSec, that is, the terminal that failed to measure can no longer connect to the network with other terminals.

[0026] Step S2: With the help of the trusted agent, the terminal initiates a registration request to the trusted server. The trusted agent configures IPSec for the successfully registered terminal and adds it to the secure trusted cluster.

[0027] The process of a terminal joining a secure and trusted cluster is as follows: Figure 2 As shown: (1) The agent needs to register with the trusted management center.

[0028] The agent transmits its own information (including but not limited to TCM's EK, AIK certificate, uuid, ip, whitelist, etc.) to the trusted management center.

[0029] (2) The trusted management center registers based on the information provided by the Agent.

[0030] (3) After registration is completed, the trusted management center initiates a measurement request to the Agent.

[0031] (4) The Agent sends measurement data according to the measurement request. The measurement data is information such as executable files and drivers on the terminal.

[0032] (5) After the trusted management center successfully measures the Agent, it starts to send a request to the CA certification center to apply for the certificate key pair of this Agent; if the trusted management center fails to measure the Agent, the subsequent process is terminated, the user is prompted and the log is recorded.

[0033] The measurement here is: The trusted management center holds a whitelist of each terminal, that is, a hash value list. By comparing the hash value in the whitelist with the hash value of the received measurement data, if the two are consistent, the measurement is considered successful; if the measurement fails, it proves that the terminal's execution program has been tampered with or is not a legitimate program.

[0034] (6) After receiving the request from the trusted management center, the CA certification center generates a certificate key pair for the Agent and sends it to the trusted management center.

[0035] (7) The trusted management center will then generate an IPSec configuration file for the Agent and send the IPSec configuration file and certificate key pair to the Agent in the terminal system.

[0036] (8) After receiving the IPSec configuration file and certificate key pair, the Agent configures IPSec, enables the IPSec service, and adds the terminal system to the trusted cluster; the terminal systems in the trusted cluster interact with each other through the IPSec network.

[0037] Step S3: When the terminal interacts with other terminals in the secure and trusted cluster through IPSec, the trusted server continuously measures the terminal and automatically removes the terminal that fails the measurement from the secure and trusted cluster.

[0038] like Figure 3 As shown in the figure, when a terminal is no longer trusted, the trusted cluster can automatically remove it. The process is as follows: (1) The trusted management center interacts with the agent and continuously measures the terminal.

[0039] (2) When the terminal system generates an unknown new file (possibly a virus) or the file is illegally tampered with, the measurement data is sent to the trusted management center again.

[0040] (3) After receiving the data, the trusted management center measures the failure and then sends a message to the CA certification center, requesting it to update the CRL list.

[0041] (4) The CA certification center updates the CRL, performs relevant processing, and sends the updated CRL to the trusted management center.

[0042] Example 2 In one embodiment of the present disclosure, a cluster construction system based on trusted computing is provided, including: The environment deployment module is configured to: deploy a trusted environment, including a trusted server and a plurality of terminals, wherein the trusted server measures the terminals through trusted computing, and the plurality of terminals constitute a secure and trusted cluster; The terminal registration module is configured as follows: with the help of a trusted agent, the terminal initiates a registration request to a trusted server, the trusted agent configures IPSec for the successfully registered terminal, and adds it to a secure trusted cluster; The continuous measurement module is configured such that when the terminal interacts with other terminals in the secure and trusted cluster through IPSec, the trusted server continuously measures the terminal and automatically removes the terminal that fails the measurement from the secure and trusted cluster.

[0043] Example 3 In one embodiment of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the cluster construction method based on trusted computing is implemented.

[0044] Example 4 In one embodiment of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium is used to store computer instructions, and when the computer instructions are executed by a processor, the cluster construction method based on trusted computing is implemented.

[0045] Example 5 In one embodiment of the present disclosure, an electronic device is provided, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes and implements the cluster construction method based on trusted computing.

[0046] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0047] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0048] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A cluster construction method based on trusted computing, characterized in that: include: Deploy a trusted environment, including a trusted server and several terminals, wherein the trusted server measures the terminals through trusted computing, and the several terminals form a secure and trusted cluster; With the help of a trusted agent, the terminal initiates a registration request to the trusted server. The trusted agent configures IPSec for the successfully registered terminal and adds it to the secure trusted cluster. When a terminal interacts with other terminals in a secure and trusted cluster through IPSec, the trusted server continuously measures the terminal and automatically removes the terminal that fails the measurement from the secure and trusted cluster.

2. A cluster construction method based on trusted computing as claimed in claim 1, characterized in that: The trusted server is composed of a trusted management center and a CA certification center; The trusted management center measures the terminal by interacting with the trusted agent of the terminal for trusted data; The CA authentication center interacts with the trusted management center for authentication data to generate a certificate key pair for the terminal that has successfully measured.

3. A cluster construction method based on trusted computing as claimed in claim 1, characterized in that: The terminal is a physical machine or a virtual machine, and a trusted agent based on a TCM chip is deployed for each terminal.

4. The cluster construction method based on trusted computing according to claim 1, characterized in that: The specific process of the registration request is as follows: The trusted agent sends its own information to the trusted server; After receiving the registration request, the trusted server registers the information of the trusted agent and sends a measurement request to the trusted agent; After receiving the measurement request, the trusted agent returns the measurement data; The trusted server measures the terminal through trusted computing based on the measurement data. If the measurement is successful, a certificate key pair is generated through the CA certification center and sent to the trusted agent together with the newly generated IPSec configuration file.

5. The cluster construction method based on trusted computing according to claim 1, characterized in that: After the registration is successful, the trusted agent receives the IPSec configuration file and the certificate key pair sent by the trusted server, and then configures and starts IPSec.

6. A cluster construction method based on trusted computing as claimed in claim 1, characterized in that: During the continuous measurement process, if the measurement fails, a message is sent to the CA certification center to request it to update the certificate revocation list.

7. A cluster construction system based on trusted computing, characterized in that: include: The environment deployment module is configured to: deploy a trusted environment, including a trusted server and a plurality of terminals, wherein the trusted server measures the terminals through trusted computing, and the plurality of terminals constitute a secure and trusted cluster; The terminal registration module is configured as follows: with the help of a trusted agent, the terminal initiates a registration request to a trusted server, the trusted agent configures IPSec for the successfully registered terminal, and adds it to a secure trusted cluster; The continuous measurement module is configured such that when the terminal interacts with other terminals in the secure and trusted cluster through IPSec, the trusted server continuously measures the terminal and automatically removes the terminal that fails the measurement from the secure and trusted cluster.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the cluster construction method based on trusted computing described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by the processor, a cluster construction method based on trusted computing as described in any one of claims 1 to 6 is implemented.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes a cluster construction method based on trusted computing as described in any one of claims 1 to 6.

Images