TEE proxy verification-based remote attestation method and system, and related equipment

Abstract

The invention provides a remote certification method and system based on TEE proxy verification and related equipment, and the method comprises the steps: carrying out the localization of verification logic in a virtual server supervision system and a trusted execution environment in a client virtual server; the storage measurement log of the client virtual server does not need to be sent to the virtual server supervision system in the verification process, and only the verification result needs to be returned to the virtual server supervision system, so that the problem of data leakage possibly existing when the storage measurement log of the client virtual server is sent to the supervision system is solved; the execution process of the method is realized based on the existing cloud service architecture, the implementation difficulty is small, and the compatibility is high.

Description

TECHNICAL FIELD

[0001] The present application is suitable for the field of cloud computing technology, and particularly relates to a remote attestation method and system based on TEE proxy verification and related equipment. BACKGROUND

[0002] With the continuous development of the information industry, the security risks faced by information systems are also growing. Software attacks on information systems are often accompanied by integrity destruction, such as executable program replacement, configuration file tampering, backdoor program implantation, etc. Therefore, the industry has proposed integrity protection technology to measure and verify key data during system startup and operation, so that the system runs in the trusted state expected by the design target.

[0003] In the client virtual server operation and maintenance scenario based on a data center, the measurement and verification method of the integrity protection technology is implemented by integrity measurement and remote attestation. Among them, the integrity measurement is the basis of remote attestation, which provides static measurement and dynamic measurement based on the virtualization trusted platform module in the client virtual server, wherein the dynamic measurement is calculated by the Integrity Measurement Architecture (IMA) of the client virtual server operating system kernel to access the file during system operation and recorded in the Storage Measurement Log (SML) of the operating system kernel, and at the same time, the IMA expands the hash value to the Platform Configuration Register (PCR) of the virtualization trusted platform module through the hash expansion interface of the virtualization trusted platform module. Relying on the non-tamperable characteristics of the PCR provided by the virtualization trusted platform module, the SML realizes the faithful recording of the integrity measurement results of the files accessed during system operation through the integrity measurement records composed of the PCR index, file name and hash value triplets.

[0004] Remote attestation is implemented based on integrity measurement, which is an important service provided by cloud service providers to client virtual server tenants for checking the integrity of the client virtual server system. The remote attestation method implemented by the prior art is generally that the virtual server supervision system of the cloud service provider acts as the verification party, sends a remote attestation request to the client virtual server as the verified party, the verified party sends the PCR value and the SML to the verification party, the verification party verifies the integrity of the SML using the PCR value, and then compares the hash value of the file recorded in the SML with the reference value held by the verification party, and further confirms whether the system of the verified party is trusted.

[0005] However, in the above method, after the client virtual server is delivered for use by the tenant, the tenant will deploy and store the tenant's own programs and data files in the client virtual server, which belong to the tenant's privacy data but are also measured by the IMA, so the SML inevitably contains the characteristic information of these programs and data files, including the file name, hash value, etc. In the existing remote attestation method, the verified party sends the SML to the verifier, although the measured files themselves are not directly sent, but in fact the characteristic information of the verified party has been exposed, which not only does not comply with the clause in the cloud service contract that the cloud service provider cannot pry into the data of the client virtual server, but also provides an opportunity for malicious attackers. If the verifier is attacked by the attacker, the attacker can obtain the SML and analyze it, and through big data rainbow table, the file content can be obtained from the hash value, causing privacy leakage; or the types and versions of the programs currently installed by the verified party can be inferred, and the vulnerabilities of the program versions can be used to attack the verified party.

[0006] Obviously, the root cause of the above defects is that the existing method requires the verified party to provide the SML externally. Therefore, it is necessary to study a new remote attestation method to overcome the above defects. SUMMARY

[0007] The present application provides a remote attestation method based on TEE proxy verification, a system and related equipment, aiming to solve the security problem that the existing remote attestation method requires the verified party to provide log files externally in the verification process.

[0008] To solve the above technical problems, in a first aspect, the present application provides a remote attestation method based on TEE proxy verification, which is implemented by a virtual server management system as a verifier, and the remote attestation method comprises the following steps: S101, verifying the initial trusted state of the client virtual server, and in the case that the client virtual server is in a trusted state, exchanging identity authentication public keys for mutual identity authentication credentials with the client virtual server, and then negotiating a remote attestation base key with the client virtual server according to a pre-set key exchange method; S102, deriving a remote attestation session key for remote attestation based on the remote attestation base key; S103, determining a remote attestation verification policy for remote attestation, and sending the remote attestation verification policy after being encrypted by the remote attestation session key according to a pre-set authentication encryption algorithm; S104, receiving a remote attestation verification result, the remote attestation verification result being obtained and sent by the client virtual server after the remote attestation verification policy is decrypted and executed by the client virtual server according to the preset authentication encryption algorithm, and then being encrypted by the client virtual server using the remote attestation session key possessed by the client virtual server according to the preset authentication encryption algorithm; S105, decrypting the remote attestation verification result using the remote attestation session key according to the preset authentication encryption algorithm, and obtaining a remote attestation judgment result about whether the current client virtual server is trusted according to the remote attestation verification result.

[0009] Further, step S101 includes the following sub-steps: S1011, creating the client virtual server and verifying its initial trusted state; S1012, sending a first identity authentication public key possessed by itself and obtaining a second identity authentication public key; wherein the second identity authentication public key is sent by the client virtual server; S1013, generating a first temporary key pair based on a preset key generation method, the first temporary key pair including a first temporary public key and a first temporary private key, and signing the first temporary public key using a private key corresponding to the first identity authentication public key, and sending the signed first temporary public key; S1014, receiving a second temporary public key, and performing signature verification on the second temporary public key using the second identity authentication public key, and after the signature verification passes, generating the remote attestation base key using the first temporary private key and the second temporary public key as data sources according to a preset key exchange method, the second temporary public key being sent by the client virtual server after receiving the first temporary public key and passing the signature verification, being generated based on the preset key generation method, and being signed using a private key corresponding to the second identity authentication public key.

[0010] Further, the preset key generation method is an ECDSA digital signature algorithm, and the preset key exchange method is an ECDH key agreement algorithm.

[0011] Further, step S102 includes the following sub-steps: S1021, generating a first random number and a second random number, and concatenating the second random number to the tail of the first random number to obtain a salt value; S1022, taking the salt value and the remote attestation base key as parameters of a preset key derivation algorithm to calculate the remote attestation session key; S1023, sending the first random number, the second random number, and the salt value signed using a private key corresponding to the first identity authentication public key.

[0012] Further, the preset key derivation algorithm is an HKDF key derivation algorithm.

[0013] Further, in step S103, the remote attestation verification policy at least includes a platform configuration register index of the client virtual server and a file name and a reference value of a file corresponding to the platform configuration register index that needs to be audited, the file being a file in a software component when the client virtual server is created, and the reference value being a hash value of the file. The preset authentication encryption algorithm is an AES-GCM algorithm, the first random number is used as additional data used when the preset authentication encryption algorithm is encrypted, the second random number is used as an initial vector used when the preset authentication encryption algorithm is encrypted, and the first tag is used as an authentication tag of the remote attestation verification policy.

[0014] Further, in step S105, the first random number is used as additional data used when the preset authentication encryption algorithm is decrypted, the second random number is used as an initial vector used when the preset authentication encryption algorithm is decrypted, and the second tag is used as an authentication tag of the remote attestation verification result.

[0015] In a second aspect, the present application further provides another remote attestation method based on TEE proxy verification, which is implemented by a client virtual server as a verified party based on its trusted execution environment, and includes the following steps: S201, after being verified by the virtual server supervision system to be in an initial trusted state and exchanging identity authentication public keys for identity authentication credentials with the virtual server supervision system, negotiating a remote attestation base key with the virtual server supervision system according to a preset key exchange method; S202, deriving a remote attestation session key for remote attestation based on the remote attestation base key; S203, receiving a remote attestation verification policy, wherein the remote attestation verification policy is generated by the virtual server supervision system and sent out after being encrypted by the virtual server supervision system using the remote attestation session key owned by the virtual server supervision system according to a preset authentication encryption algorithm; S204, decrypting and executing the remote attestation verification policy according to the preset authentication encryption algorithm using the remote attestation session key, to obtain a remote attestation verification result of whether the current own state is in a trusted state; S205, encrypting the remote attestation verification result according to the preset authentication encryption algorithm using the remote attestation session key, and sending out the encrypted remote attestation verification result.

[0016] Further, step S201 comprises the following sub-steps: S2011, verifying an initial trusted state of itself by the virtual server supervision system, wherein the client virtual server is created by the virtual server supervision system; S2012, receiving a first identity authentication public key and storing it in a trusted execution environment of itself, and then sending a second identity authentication public key owned by itself; wherein the first identity authentication public key is sent by the virtual server supervision system; S2013, receiving a first temporary public key, and performing signature verification on the first temporary public key using the first identity authentication public key, after the signature verification is passed, generating a second temporary key pair based on a preset key generation method, the second temporary key pair comprising a second temporary public key and a second temporary private key, generating the remote attestation base key based on the first temporary public key and the second temporary private key as data sources according to a preset key exchange method, and then sending the second temporary public key after signing it by a private key corresponding to the second identity authentication public key; wherein the first temporary public key is generated and signed by the virtual server supervision system and then sent.

[0017] Further, step S202 comprises the following sub-steps: S2021, receiving a first random number, a second random number, and a salt value signed by a private key corresponding to the first identity authentication public key; wherein the first random number, the second random number, and the salt value are all generated and sent by the virtual server supervision system; S2022, verifying the signature of the salt value using the first identity authentication public key, and after the signature verification is passed, calculating the remote attestation session key using the salt value and the remote attestation base key as parameters of the preset key derivation algorithm.

[0018] Further, step S204 comprises the following sub-steps: S2041, decrypting the remote attestation verification policy using the remote attestation session key according to the preset authentication encryption algorithm to obtain a platform configuration register index of the client virtual server and a file name and a reference value of a file corresponding to the platform configuration register index which needs to be audited; wherein the preset authentication encryption algorithm is an AES-GCM algorithm, the first random number is used as additional data used in decryption of the preset authentication encryption algorithm, the second random number is used as an initial vector used in decryption of the preset authentication encryption algorithm, and the first label is used as an authentication label of the remote attestation verification policy; S2042, obtain a platform configuration register value corresponding to the platform configuration register index and the first random number as parameters, and obtain a storage measurement log corresponding to the platform configuration register value based on the platform configuration register value, detect the integrity of the file decrypted by the remote attestation verification strategy based on the storage measurement log and the reference value, and obtain the remote attestation verification result of whether the current self is in a trusted state, wherein if the integrity detection passes, the self is in the trusted state.

[0019] Further, in step S205, the first random number is used as additional data used when the preset authentication encryption algorithm is encrypted, the second random number is used as an initial vector used when the preset authentication encryption algorithm is encrypted, and the second label is used as an authentication label of the remote attestation verification result.

[0020] In a third aspect, the present application also provides a remote attestation system based on TEE proxy verification, which comprises a first remote attestation module implemented in a virtual server supervision system and a second remote attestation module implemented in a client virtual server based on a trusted execution environment thereof, wherein the first remote attestation module comprises: a first base key agreement module configured to verify an initial trusted state of the client virtual server, exchange identity authentication public keys for identity authentication credentials with the client virtual server in the case that the client virtual server is in the trusted state, and then obtain a remote attestation base key by negotiation with the client virtual server according to a preset key exchange method; a first session key derivation module configured to derive a remote attestation session key for remote attestation based on the remote attestation base key; a remote attestation sending module configured to determine a remote attestation verification strategy for remote attestation, encrypt the remote attestation verification strategy according to a preset authentication encryption algorithm using the remote attestation session key, and then send out the encrypted remote attestation verification strategy; a first remote attestation receiving module configured to receive a remote attestation verification result, which is obtained and sent out by the client virtual server after the remote attestation verification strategy is decrypted and executed according to the preset authentication encryption algorithm by the client virtual server, and then encrypted according to the preset authentication encryption algorithm using the remote attestation session key owned by the client virtual server; a remote attestation decryption module configured to decrypt the remote attestation verification result according to the preset authentication encryption algorithm using the remote attestation session key, and obtain a remote attestation judgment result about whether the current client virtual server is trusted according to the remote attestation verification result; The second remote attestation module comprises: a second base key agreement module, configured to, after exchanging identity authentication public keys for identity authentication credentials with the virtual server supervision system after the virtual server supervision system verifies that the client virtual server is in an initial trusted state, agree with the virtual server supervision system on a remote attestation base key according to a preset key agreement method; a second session key derivation module, configured to derive a remote attestation session key for remote attestation based on the remote attestation base key; a second remote attestation receiving module, configured to receive a remote attestation verification policy, wherein the remote attestation verification policy is generated by the virtual server supervision system and sent out after being encrypted by the virtual server supervision system using the remote attestation session key owned by the virtual server supervision system according to a preset authentication encryption algorithm; a remote attestation execution module, configured to decrypt and execute the remote attestation verification policy according to the preset authentication encryption algorithm using the remote attestation session key, to obtain a remote attestation verification result of whether the current state of the client virtual server is in a trusted state; a remote attestation encryption module, configured to encrypt the remote attestation verification result according to the preset authentication encryption algorithm using the remote attestation session key, and send out the encrypted remote attestation verification result.

[0021] In a fourth aspect, the present application further provides a computer device, comprising a memory, a processor, and a TEE agent verification-based remote attestation program stored in the memory and executable on the processor, wherein the processor implements the steps of the TEE agent verification-based remote attestation method when executing the TEE agent verification-based remote attestation program.

[0022] In a fifth aspect, the present application further provides a storage medium, wherein the storage medium stores a TEE agent verification-based remote attestation program, and the TEE agent verification-based remote attestation program implements the steps of the TEE agent verification-based remote attestation method when executed by a processor.

[0023] The present application has the advantages that the TEE agent verification-based remote attestation method localizes the verification logic in the virtual server supervision system and the trusted execution environment inside the client virtual server, and the storage measurement log of the client virtual server does not need to be sent to the virtual server supervision system during the verification process, but only needs to return the verification result to the virtual server supervision system, thereby solving the problem of possible data leakage when the storage measurement log of the client virtual server is sent to the supervision system, and the execution process of the method of the present application is based on the existing cloud service architecture, which has low implementation difficulty and high compatibility. BRIEF DESCRIPTION OF DRAWINGS

[0024] The present application will be described in detail below with reference to the drawings. The above and other aspects of the present application will become more apparent and more readily appreciated from the following detailed description, taken in conjunction with the accompanying drawings, in which: Figure 1 is a step flow chart of a remote attestation method based on TEE proxy verification provided by an embodiment of the present application; Figure 2 is a remote attestation verification strategy content schematic diagram provided by an embodiment of the present application; Figure 3 is a step flow chart of another remote attestation method based on TEE proxy verification provided by an embodiment of the present application; Figure 4 is a structure schematic diagram of a remote attestation system based on TEE proxy verification provided by an embodiment of the present application; Figure 5 is a structure schematic diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0026] Embodiment One Please refer to Figure 1 , Figure 1 is a step flow chart of a remote attestation method based on TEE proxy verification provided by an embodiment of the present application, the remote attestation method is implemented by a virtual server supervision system as a verification party, and the remote attestation method comprises the following steps: S101, verifying the initial trusted state of a client virtual server, in the case that the client virtual server is in a trusted state, exchanging identity authentication public keys for identity authentication credentials with the client virtual server, and then negotiating a remote attestation base key with the client virtual server according to a preset key exchange method.

[0027] Specifically, the virtual server supervision system (Virtual Machine Supervisor, VMS for short) in the embodiment of the application is generally held and managed by a cloud service provider in a real scene, which is responsible for the full life cycle operation and maintenance of a client virtual server (Client Virtual Machine, CVM for short), including creation, update, audit and recovery, and can be adjusted according to the business scene, and in the embodiment of the application, it serves as a verification party of remote attestation. In contrast, the client virtual server is a verified party of remote attestation. In a cloud service scene, the client virtual server is allocated to a tenant for use. Therefore, the virtual server supervision system and the client virtual server are not necessarily directly connected in a physical manner, so that the client virtual server has untrustworthiness compared with the virtual server supervision system. The trusted execution environment (Trusted Execution Environment, TEE for short) is a secure computing environment based on processor hardware isolation technology, which includes a security system for realizing isolation between the trusted execution environment and a rich execution environment (Rich Execution Environment, REE for short). The rich execution environment REE is a non-secure computing environment relative to the trusted execution environment, which includes an operating system provided for the tenant to use. The rich execution environment has an integrity measurement function based on a virtualized trusted platform module (Virtualized Trusted Platform Module, vTPM for short) and a remote attestation function realized based on the prior art, and is fully compatible with the trusted platform module technical specification formulated by the trusted computing group (Trusted Computing Group, TCG for short). The trusted execution environment and the rich execution environment realize interaction through a secure monitor call (Secure Monitor Call, SMC for short) secure communication mechanism, which can ensure that sensitive data in the trusted execution environment is not illegally accessed or tampered with by the rich execution environment, and the execution process of a trusted application in the trusted execution environment is not observed or interfered with by the rich execution environment.

[0028] The remote attestation method of the embodiment of the application is realized based on the virtual server supervision system. Based on the technical concept as described above, specifically, step S101 includes the following sub-steps: S1011, creating the client virtual server and verifying the initial trusted state thereof.

[0029] The software component of the client virtual server is assigned by the virtual server supervision system at the time of creation, so the virtual server supervision system has the baseline value of the software component, thereby enabling the virtual server supervision system to verify the trusted state of the client virtual server, which can be achieved by existing attestation methods; at the same time, because there are no tenant programs and data files in the client virtual server before the client virtual server is delivered to the tenant for use, the remote attestation method based on the existing method to verify the initial trusted state of the client virtual server in step S1011 will not cause tenant privacy leakage.

[0030] S1012, send the first identity authentication public key owned by itself, and obtain a second identity authentication public key; wherein the second identity authentication public key is sent by the client virtual server.

[0031] The first identity authentication public key is an asymmetric key pair previously held by the virtual server supervision system. The second identity authentication public key is an asymmetric key pair generated by the vTPM of the rich execution environment RE when the client virtual server is created, which belongs to the specification definition of the trusted platform module technology.

[0032] Under this specification, the first identity authentication public key is PK_VMS, and the corresponding private key is SK_VMS, wherein the private key SK_VMS is strictly kept secret by the virtual server supervision system and is only used for signature operation; The second identity authentication public key is PK_CVM, and the corresponding private key is SK_CVM, wherein the private key SK_CVM is stored in the vTPM of the client virtual server after being generated and cannot be read outside the vTPM, and can only be used for signature operation by the vTPM of the client virtual server.

[0033] S1013, generate a first temporary key pair based on a preset key generation method, the first temporary key pair includes a first temporary public key and a first temporary private key, and the first temporary public key is signed using the private key corresponding to the first identity authentication public key, and the signed first temporary public key is sent out.

[0034] In the embodiment of the application, the preset key generation method is the ECDSA digital signature algorithm.

[0035] S1014, receiving a second temporary public key, and verifying the signature of the second temporary public key using the second identity authentication public key, after the signature verification passes, generating the remote attestation base key using the first temporary private key and the second temporary public key as data sources according to the preset key exchange method, the second temporary public key is generated by the client virtual server based on the preset key generation method after receiving the first temporary public key and passing the signature verification, and is sent out after being signed by the private key corresponding to the second identity authentication public key.

[0036] Specifically, in the embodiment of the application, the preset key exchange method is ECDH (Elliptic Curve Diffie-Hellman, Elliptic Curve Diffie-Hellman) key agreement algorithm, and the remote attestation base key agreement process of steps S1013-S1014 is as follows: Firstly, for the virtual server supervision system, it needs to generate a temporary key pair (i.e. the first temporary key pair) including the first temporary public key PK_VMS_T and the first temporary private key SK_VMS_T using the ECDSA digital signature algorithm; The first temporary public key PK_VMS_T is signed by the private key SK_VMS to obtain the signature of the first temporary public key PK_VMS_T; The first temporary public key PK_VMS_T and its corresponding signature are sent to the client virtual server; Secondly, for the client virtual server, it needs to verify the signature of the first temporary public key PK_VMS_T using the first identity authentication public key PK_VMS in the trusted execution environment; If the signature verification passes, it also generates a temporary key pair (i.e. the second temporary key pair) including the second temporary public key PK_CVM_T and the second temporary private key SK_CVM_T using the ECDSA digital signature algorithm; At this time, the client virtual server has obtained the first temporary public key and the second temporary key pair, and then the client virtual server calculates the remote attestation base key using the ECDH key agreement algorithm in the trusted execution environment using the first temporary public key PK_VMS_T and the second temporary private key SK_CVM_T as data sources, and the calculation process can be represented as: KDK = ECDH (SK_CVM_T, PK_VMS_T); Wherein, KDK is the remote attestation base key; Then, the second temporary public key PK_CVM_T is transmitted to the rich execution environment REE through the SMC secure communication mechanism, and a signature of the second temporary public key PK_CVM_T is calculated in the rich execution environment REE through the vTPM using the private key SK_CVM; subsequently, the second temporary public key PK_CVM_T and the corresponding signature are sent to the virtual server supervision system; Finally, for the virtual server supervision system, the second temporary public key PK_CVM_T is verified by using the second identity authentication public key PK_CVM; If the signature verification is passed, the virtual server supervision system obtains the first temporary key pair and the second temporary public key, and uses the ECDH key agreement algorithm to calculate the remote attestation base key, taking the first temporary private key SK_VMS_T and the second temporary public key PK_CVM_T as data sources, and the calculation process can be represented as: KDK = ECDH (SK_VMS_T, PK_CVM_T); Wherein, KDK is the remote attestation base key.

[0037] It can be understood that, according to the principle of the ECDH key agreement algorithm, the virtual server supervision system and the client virtual server in the embodiment of the application can each calculate the same remote attestation base key using the temporary public key provided by the other party without sharing each other's temporary private key; and according to the principle of the ECDSA digital signature algorithm key generation, the temporary key pair generated by the virtual server supervision system and the client virtual server for key agreement calculation has randomness, so the calculated remote attestation base key also has randomness, which ensures that the virtual server supervision system and different client virtual servers always negotiate different remote attestation base keys in theory, also known as "one machine one key"; According to the working principle of the trusted execution environment TEE, the second temporary private key SK_CVM_T is generated and used in the trusted execution environment TEE by the client virtual server, and the rich execution environment REE cannot obtain the temporary private key, so the rich execution environment REE cannot calculate the remote attestation base key, ensuring that the remote attestation base key is always in a secure state.

[0038] After the step S1014 is executed, the client virtual server is allocated to the tenant side for use, so that its trusted state will be converted to an untrusted state for the virtual server supervision system at the moment of allocation. In this state, the virtual server supervision system needs to prove the current trusted state of the client virtual server through the remote attestation method.

[0039] S102, deriving a remote attestation session key for remote attestation based on the remote attestation base key.

[0040] Step S102 occurs before each request for remote attestation by the virtual server supervision system.

[0041] Specifically, step S102 includes the following sub-steps: S1021, generating a first random number and a second random number, and concatenating the second random number to the tail of the first random number to obtain a salt value.

[0042] In the embodiment of the application, the virtual server supervision system generates the first random number N1 and the second random number N2 using a true random number generator, and the salt value N1 || N2 is composed of N2 concatenated to the tail of N1. The true random number generator is a hardware device in the virtual server supervision system that can generate a random number sequence using the current entropy value as a seed. The entropy value is related to the random physical signal noise of the hardware device at that time, such as temperature, time, voltage, and current, and is a true random value, so it can ensure that the generated random number sequence has true randomness.

[0043] S1022, using the salt value and the remote attestation base key as parameters of a preset key derivation algorithm to calculate the remote attestation session key.

[0044] The remote attestation session key derivation process can be represented by the following relationship: KSK= HKDF(KDK, N1 || N2); Wherein, KSK is the remote attestation session key; N1 || N2 is the salt value composed of N2 concatenated to the tail of N1.

[0045] S1023, sending the first random number, the second random number, and the salt value signed by the private key corresponding to the first identity authentication public key.

[0046] In the embodiment of the application, the preset key derivation algorithm is the HKDF key derivation algorithm (HMAC-based Key Derivation Function, HMAC-based Key Derivation Function).

[0047] In the remote attestation session key derivation phase, the virtual server supervision system and the client virtual server each use the same parameters to calculate the same session key, rather than transmitting the session key between each other.

[0048] It can be understood that, according to the principle of the HKDF key derivation algorithm, the virtual server supervision system and the client virtual server in the embodiment of the application can each calculate the same remote attestation session key without transferring the remote attestation base key, by using the first random number N1 and the second random number N2 provided by the virtual server supervision system; because the first random number N1 and the second random number N2 used each time for remote attestation session are randomly generated by the virtual server supervision system, the remote attestation session key also has randomness, which ensures that each remote attestation session between the virtual server supervision system and the client virtual server theoretically always uses a different remote attestation session key, also known as "one-time pad"; Moreover, although the first random number N1 and the second random number N2 are transferred in plaintext, because the rich execution environment REE does not have the remote attestation base key, the rich execution environment REE cannot calculate the remote attestation session key, ensuring that the remote attestation session key is always in a secure state.

[0049] S103, determining a remote attestation verification policy for remote attestation, and sending the remote attestation verification policy after being encrypted by using the remote attestation session key according to a preset authentication encryption algorithm.

[0050] S104, receiving a remote attestation verification result, the remote attestation verification result being obtained and sent by the client virtual server after being encrypted by using the remote attestation session key possessed by the client virtual server according to the preset authentication encryption algorithm after being decrypted and executed by the client virtual server according to the preset authentication encryption algorithm.

[0051] Specifically, in order to facilitate understanding of the specific implementation mode of the steps in the embodiment of the application, the embodiment of the application will describe the content of the remote attestation verification policy generated by the virtual server supervision system: The remote attestation verification policy sent by the virtual server supervision system at least includes a platform configuration register index (i.e., a PCR index) of the client virtual server and a file name and a reference value of a file corresponding to the platform configuration register index that needs to be audited, the file being a file in a software component of the client virtual server when the client virtual server is created, and the reference value being a hash value of the file. In the implementation process, other fields can be added according to actual conditions.

[0052] It can be understood that the software component of the client virtual server is allocated by the virtual server supervision system when being created, or is allocated by the virtual server supervision system when the client virtual server is updated and maintained, so the virtual server supervision system always has the correct hash value of the file in the software component of the client virtual server.

[0053] In the implementation of the embodiment of the present application, the content of a remote attestation verification policy is composed as shown in Figure 2 Generally, the range of platform configuration register indexes is 0 to 23, which corresponds to the 24 platform configuration register indexes defined in the TCG Trusted Platform Module specification, Figure 2 The PCR index in the remote attestation verification policy set in the virtual server supervision system is 10, and in addition, it includes the file names and reference values of four files that need to be audited, wherein the files represented by the file names belong to the Linux operating system running in the rich execution environment RE of the client virtual server software component.

[0054] The remote attestation verification policy determined by the virtual server supervision system is transmitted to the client virtual server after being encrypted by the AES-GCM algorithm, and the first random number is used as additional data used when the preset authentication encryption algorithm is encrypted, the second random number is used as an initial vector used when the preset authentication encryption algorithm is encrypted, and the first label is used as the authentication label of the remote attestation verification policy. Specifically, the AES-GCM algorithm combines symmetric key encryption and message authentication, ensures that the same plaintext generates different ciphertexts when encrypted by the same key through the use of an initial vector, and establishes a binding relationship with the ciphertext using an additional data to prevent replay attacks, which can ensure the confidentiality, integrity and sender identity of the message.

[0055] The process of encrypting the remote attestation verification policy by the virtual server supervision system using the preset authentication encryption algorithm can be represented by the following relationship: {S_RAP, TAG1} = Encrypt(AES-GCM, KSK, RAP, IV, AAD); Wherein, S_RAP is the remote attestation verification policy ciphertext generated by the AES-GCM algorithm; TAG1 is the remote attestation verification policy authentication label generated by the AES-GCM algorithm, which is the first label in the embodiment of the present application; Encrypt represents the encryption operation; KSK is the remote attestation session key; RAP is the remote attestation verification policy; AAD is the additional data required for the encryption operation of the AES-GCM algorithm, which uses the first random number N1 in the present embodiment; IV is the initial vector required for the encryption operation of the AES-GCM algorithm, which uses the second random number N2 in the present embodiment.

[0056] It can be understood that by using the first random number N1 and the second random number N2 as input parameters for the AES-GCM algorithm encryption, the binding of the remote attestation verification policy and the current remote attestation session is further enhanced, so that the remote attestation verification policy transmitted in the current remote attestation session can be and only can be used in the current remote attestation session.

[0057] To facilitate understanding of the execution principle of the step remote attestation verification policy, the process of the client virtual server executing the remote attestation verification policy (i.e. the content of step S204 in the subsequent embodiment two) is first described here: The client virtual server calls the AES-GCM algorithm to perform a decryption operation on the encrypted remote attestation verification policy in the encrypted remote attestation verification policy using the remote attestation session key, the remote attestation verification policy authentication tag in the encrypted remote attestation verification policy, the initial vector and the additional data, to obtain the remote attestation verification policy, and the calculation process can be represented as: RAP = Decrypt (AES-GCM, KSK, S_RAP, TAG1, IV, AAD); Wherein, RAP is the remote attestation verification policy; Decrypt represents the decryption operation; KSK is the remote attestation session key; S_RAP is the remote attestation verification policy ciphertext; TAG1 is the remote attestation verification policy authentication tag, which is the first tag in the embodiment of the application; AAD is the additional data required for the decryption operation of the AES-GCM algorithm, which uses the first random number N1 in this embodiment; IV is the initial vector required for the decryption operation of the AES-GCM algorithm, which uses the second random number N2 in this embodiment.

[0058] According to the principle of the AES-GCM algorithm, only the same initial vector and additional data as those used in encryption can be used, and the ciphertext and the ciphertext authentication tag are not tampered with, so that the decryption operation can be successfully executed. Therefore, if the above decryption operation is successful, it means that the remote attestation verification policy obtained by decryption is trusted.

[0059] Further, the client virtual server obtains the platform configuration register value corresponding to itself by taking the platform configuration register index and the first random number as parameters, and obtains the storage measurement log corresponding to itself based on the platform configuration register value, detects the integrity of the file decrypted from the remote attestation verification policy based on the storage measurement log and the reference value, and obtains the remote attestation verification result of whether the current itself is in a trusted state, wherein if the integrity detection passes, the itself is in a trusted state.

[0060] S105, using the remote attestation session key to decrypt the remote attestation verification result according to the preset authentication encryption algorithm, and obtaining the remote attestation judgment result about whether the current client virtual server is trusted according to the remote attestation verification result.

[0061] In step S105, the first random number is used as additional data used in decryption of the preset authentication encryption algorithm, the second random number is used as an initial vector used in decryption of the preset authentication encryption algorithm, and the second tag is used as an authentication tag of the remote attestation verification result.

[0062] The virtual server supervision system decrypts the encrypted remote attestation verification result to obtain its content, and the decryption process in step S105 can be represented by the following relationship: Result = Decrypt(AES-GCM, KSK, S_Result, TAG2, IV, AAD); wherein Result is the remote attestation verification result; Decrypt represents a decryption operation; KSK is the remote attestation session key; S_Result is the remote attestation verification result ciphertext; TAG2 is the remote attestation verification result authentication tag, which is the second tag in the embodiment of the application; AAD is additional data required for the AES-GCM algorithm decryption operation, and the first random number N1 is used in the embodiment; and IV is an initial vector required for the AES-GCM algorithm decryption operation, and the second random number N2 is used in the embodiment.

[0063] The difference between the preset authentication encryption algorithm encryption and decryption using the first tag in step S103 and the preset authentication encryption algorithm encryption and decryption in step S105 is that the second tag is used as an authentication tag in step S105 to decrypt the remote attestation verification result, thereby marking the difference between the remote attestation phase processes.

[0064] According to the principle of the AES-GCM algorithm, only the same initial vector and additional data as those used in encryption are used, and the ciphertext and the ciphertext authentication tag are not tampered with, and the decryption operation can be successfully executed. Therefore, if the above decryption operation is successful, it indicates that the remote attestation verification result decrypted by the virtual server supervision system is indeed generated by the client virtual server, and the content is complete; then, the virtual server supervision system can confirm whether the current client virtual server is in a trusted state according to the content of the remote attestation verification result.

[0065] It can be understood that, by using the first random number N1 and the second random number N2 as input parameters of the AES-GCM algorithm encryption, the binding of the remote attestation verification result and the current remote attestation session is further enhanced, so that the remote attestation verification result transmitted in the current remote attestation session can be and only can be used in the current remote attestation session.

[0066] Embodiment Two Please refer to Figure 3 , Figure 3is a step flowchart of another remote attestation method based on TEE proxy verification provided by the embodiment of the application, the remote attestation method is implemented by a client virtual server as a verified party based on its trusted execution environment, and the remote attestation method comprises the following steps: S201, after the virtual server supervision system verifies that the client virtual server is in an initial trusted state and exchanges identity authentication public keys for identity authentication credentials with the virtual server supervision system, a remote attestation base key is negotiated with the virtual server supervision system according to a preset key exchange method.

[0067] Unlike the process executed by the virtual server supervision system in the first embodiment, the remote attestation method in the embodiment of the application is implemented by a client virtual server as a verified party based on its trusted execution environment, and compared with the virtual server supervision system, the client virtual server is used by a tenant, and thus is in a relatively insecure environment. To this end, the trusted execution environment can be used to implement a relatively secure and trusted software environment in the client virtual server. On this basis, the remote attestation method in the embodiment of the application can be a remote attestation agent (RAA) running in the trusted execution environment, which is a trusted application running in the trusted execution environment developed according to the trusted application development specification, and its role is to safely participate in the execution of the remote attestation method proposed in the embodiment of the application in the trusted execution environment and cannot be observed or interfered by the rich execution environment (REE) of the client virtual server.

[0068] Based on the technical concept described above, specifically, step S201 comprises the following sub-steps: S2011, verify the initial trusted state of the client virtual server through the virtual server supervision system, wherein the client virtual server is created by the virtual server supervision system.

[0069] The software components of the client virtual server are assigned by the virtual server supervision system when the client virtual server is created, and thus the virtual server supervision system has the reference value of the software components, so that the virtual server supervision system can verify the trusted state of the client virtual server, and this step can be implemented by an existing attestation method.

[0070] S2012, receive a first identity authentication public key and store it in the trusted execution environment of the client virtual server, and then send a second identity authentication public key owned by the client virtual server; wherein the first identity authentication public key is sent by the virtual server supervision system.

[0071] Specifically, the second identity authentication public key is an asymmetric key pair generated by a vTPM of a rich execution environment (REE), which belongs to the specification definition of a trusted platform module technology. Through step S1012, the virtual server supervision system and the client virtual server exchange their respective identity authentication public keys. In consideration of the risk of the rich execution environment of the client virtual server, the first identity authentication public key received needs to be stored in the trusted execution environment.

[0072] S2013, receiving a first temporary public key, and performing signature verification on the first temporary public key using the first identity authentication public key. After the signature verification is passed, a second temporary key pair is generated based on a preset key generation method, the second temporary key pair includes a second temporary public key and a second temporary private key, and the remote attestation base key is generated based on the first temporary public key and the second temporary private key as data sources according to a preset key exchange method. Then, the second temporary public key is signed by a private key corresponding to the second identity authentication public key and is sent out. The first temporary public key is generated by the virtual server supervision system, signed, and sent out.

[0073] The steps of negotiating the remote attestation base key by the virtual server supervision system and the client virtual server are fully described in steps S1013-S1014 of Embodiment One, and are not repeated here.

[0074] It can be understood that, according to the principle of the ECDH key negotiation algorithm, the virtual server supervision system and the client virtual server in the embodiment of the application can each calculate the same remote attestation base key using the temporary public key provided by the other party without sharing each other's temporary private key. According to the principle of the ECDSA digital signature algorithm key generation, the temporary key pair generated by the virtual server supervision system and the client virtual server for key negotiation calculation has randomness, and thus the calculated remote attestation base key also has randomness, which ensures that the virtual server supervision system and different client virtual servers always negotiate different remote attestation base keys in theory, also known as "one machine one key". Further, according to the working principle of the trusted execution environment (TEE), the second temporary private key SK_CVM_T is generated and used in the trusted execution environment (TEE) by the client virtual server. The rich execution environment (REE) cannot obtain the temporary private key, and thus the rich execution environment (REE) cannot calculate the remote attestation base key, ensuring that the remote attestation base key is always in a secure state.

[0075] After step S2013 is executed, the client virtual server is assigned to the tenant side for use, so its trusted state will be converted to an untrusted state for the virtual server supervision system at the moment of assignment. In this state, the virtual server supervision system needs to prove the current trusted state of the client virtual server through a remote attestation method.

[0076] S202, deriving a remote attestation session key for remote attestation based on the remote attestation base key.

[0077] Step S202 includes the following sub-steps: S2021, receiving a first random number, a second random number, and a salt value signed with a private key corresponding to the first identity authentication public key; wherein the first random number, the second random number, and the salt value are all generated and sent by the virtual server supervision system.

[0078] Specifically, the virtual server supervision system uses a true random number generator to generate a first random number N1 and a second random number N2, and the salt value N1 || N2 is composed by splicing N2 at the tail of N1.

[0079] S2022, verifying the signature of the salt value using the first identity authentication public key, and after the signature verification passes, using the salt value and the remote attestation base key as parameters of the preset key derivation algorithm to calculate the remote attestation session key.

[0080] The remote attestation session key derivation process in step S2022 can be represented by the following relationship: KSK= HKDF(KDK, N1 || N2); Wherein, KSK is the remote attestation session key; N1 || N2 is the salt value composed by splicing N2 at the tail of N1.

[0081] In the remote attestation session key derivation phase, the virtual server supervision system and the client virtual server each use the same parameters to calculate the same session key, rather than transferring the session key between each other. Therefore, in step S2022, the client virtual server verifies the signature of N1 || N2 using the public key PK_VMS in the TEE, and if the signature verification passes, it uses the same HKDF key derivation algorithm and calculation formula as the virtual server supervision system to calculate the remote attestation session key.

[0082] It can be understood that according to the principle of the HKDF key derivation algorithm, the virtual server supervision system and the client virtual server in the embodiment of the application can each calculate the same remote attestation session key without transferring the remote attestation base key, by using the first random number N1 and the second random number N2 provided by the virtual server supervision system; because the first random number N1 and the second random number N2 used each time for the remote attestation session are randomly generated by the virtual server supervision system, the remote attestation session key also has randomness, which ensures that each remote attestation session between the virtual server supervision system and the client virtual server theoretically always uses a different remote attestation session key, also known as "one-time pad"; Moreover, although the first random number N1 and the second random number N2 are transferred in plaintext, because the rich execution environment REE does not have the remote attestation base key, the rich execution environment REE cannot calculate the remote attestation session key, ensuring that the remote attestation session key is always in a secure state.

[0083] S203, receiving a remote attestation verification policy, wherein the remote attestation verification policy is generated by the virtual server supervision system and is sent after being encrypted by using the remote attestation session key owned by the virtual server supervision system according to a preset authentication encryption algorithm.

[0084] Specifically, the remote attestation verification policy determined by the virtual server supervision system at least includes a platform configuration register (PCR) index and the file name and reference value of the file to be audited corresponding to the platform configuration register index, and other fields can be added according to actual conditions. Moreover, because the software components of the client virtual server are allocated by the virtual server supervision system when the client virtual server is created, or are allocated by the virtual server supervision system when the client virtual server is updated and maintained, the virtual server supervision system always has the correct hash value of the file in the software components of the client virtual server.

[0085] S204, decrypting and executing the remote attestation verification policy according to the preset authentication encryption algorithm by using the remote attestation session key, to obtain a remote attestation verification result of whether the current self-state is in a trusted state.

[0086] The remote attestation verification policy determined by the virtual server supervision system is transmitted to the client virtual server after being encrypted by the AES-GCM algorithm, and correspondingly, the client virtual server needs to be decrypted and processed. Specifically, step S204 includes the following sub-steps: S2041, decrypt the remote attestation verification policy using the remote attestation session key according to the preset authentication encryption algorithm to obtain a platform configuration register index of the client virtual server and a file name and a reference value of a file corresponding to the platform configuration register index that needs to be audited; wherein the preset authentication encryption algorithm is an AES-GCM algorithm, the first random number is used as additional data used in decryption of the preset authentication encryption algorithm, the second random number is used as an initial vector used in decryption of the preset authentication encryption algorithm, and the first tag is used as an authentication tag of the remote attestation verification policy; S2042, obtain a platform configuration register value corresponding to itself by taking the platform configuration register index and the first random number as parameters, and obtain a storage measurement log corresponding to itself based on the platform configuration register value, detect the integrity of the file decrypted from the remote attestation verification policy based on the storage measurement log and the reference value to obtain the remote attestation verification result of whether the current itself is in a trusted state, wherein if the integrity detection passes, the itself is in a trusted state.

[0087] Specifically, the client virtual server calls the AES-GCM algorithm to use the remote attestation session key, the remote attestation verification policy authentication tag in the encrypted remote attestation verification policy, the initial vector and the additional data to perform a decryption operation on the remote attestation verification policy ciphertext in the encrypted remote attestation verification policy, and obtain the remote attestation verification policy. The calculation process can be represented as: RAP = Decrypt(AES-GCM, KSK, S_RAP, TAG1, IV, AAD); Wherein, RAP is the remote attestation verification policy; Decrypt represents a decryption operation; KSK is the remote attestation session key; S_RAP is the remote attestation verification policy ciphertext; TAG1 is the remote attestation verification policy authentication tag, which is the first tag in the embodiment of the application; AAD is additional data required for the decryption operation of the AES-GCM algorithm, which uses the first random number N1 in the embodiment; IV is the initial vector required for the decryption operation of the AES-GCM algorithm, which uses the second random number N2 in the embodiment.

[0088] Further, the client virtual server specifically confirms the integrity of each content of itself according to the content of the decrypted remote attestation verification policy. The confirmation process is specifically: The client virtual server calls the tpm2_quote interface of the vTPM through the SMC secure communication mechanism to pass the PCR index (10 is used as an example in the embodiment) and the first random number N1 to the vTPM; The vTPM returns the PCR

[10] and the signature bound with the first random number N1 and signed by the private key SK_CVM to the RAA through the tpm2_quote interface; The above signature is verified using the public key PK_CVM, and if the signature verification is successful, the obtained PCR value is considered to be trusted.

[0089] It should be noted that the method of passing the PCR index and the first random number N1 through the tpm2_quote interface and the method of returning the PCR

[10] and the signature bound with the first random number N1 and signed by the private key SK_CVM to the vTPM through the tpm2_quote interface are defined by the TCG Trusted Platform Module Specification; according to the definition of the tpm2_quote interface in the TCG Trusted Platform Module Specification, passing the first random number N1 to the vTPM can make the returned signature carry the feature of the first random number N1, so that the attacker cannot replay the outdated (used in the previous session) PCR value to ensure security.

[0090] Further, according to the determined PCR value, it is further necessary to verify whether the corresponding SML is trusted. The client virtual server reads the SML from the operating system kernel of the rich execution environment RE through the SMC secure communication mechanism; The replayed PCR value is calculated using a hash extension algorithm according to the hash values of all measured files associated with the PCR index in the SML; The replayed PCR value is compared with the obtained PCR value, and if they are consistent, it can be confirmed that the SML is trusted.

[0091] Specifically, in the implementation process, reading the SML from the operating system kernel of the rich execution environment RE means reading the SML from the Linux operating system kernel file system path. The hash extension algorithm is a PCR value calculation method defined by the TCG Trusted Platform Module Specification, which is used to calculate a new PCR value based on the hash value of the measured file and the current PCR value when performing integrity measurement, and is used to calculate a replayed PCR value based on the hash values in the integrity measurement records associated with a specified PCR index in the SML when performing remote attestation, and its effectiveness and security have been widely recognized by the industry. The specific process of the hash extension algorithm used when performing integrity measurement is as follows: During the running of the verified party (in this embodiment, the client virtual server), the IMA of the operating system kernel writes the hash value of each measured file into the SML (i.e., adds a complete integrity measurement record associated with the specified PCR index in the SML) and extends the hash value into the PCR corresponding to the specified PCR index in the vTPM through the hash extension interface tpm2_pcr_extend of the vTPM (the interface implements the hash extension algorithm defined in the TCG Trusted Platform Module Technical Specification). Because the measurement time of each measured file has a sequence, the hash values in the complete integrity measurement records associated with the specified PCR index in the SML also naturally have a sequence (this sequence is referred to as a hash value sequence). Obviously, the PCR value corresponding to the specified PCR index in the vTPM is the result of the iterative calculation of the hash extension algorithm based on the hash value sequence.

[0092] The specific process of the hash extension algorithm for performing remote attestation is as follows: the verified party (in this embodiment, the client virtual server, or the RAA running in the trusted execution environment thereof) reads the hash values (i.e., the hash value sequence) in the complete integrity measurement records associated with the specified PCR index in the SML, iteratively calculates based on the hash value sequence according to the same hash extension algorithm, and obtains the replayed PCR value. If the SML is not tampered with, the replayed PCR value must be exactly the same as the PCR value obtained through the tpm2_quote interface of the vTPM (which has been verified by signature); otherwise, if the two values are inconsistent, it indicates that the integrity of the SML has been destroyed.

[0093] On this basis, step S2042 also needs to verify the integrity of all the files that need to be audited using the SML and the reference values, and specifically: According to the file name of each file that needs to be audited in the remote attestation verification policy, find the integrity measurement record of each file from the SML; Extract the hash value of each file from the found integrity measurement record and compare it with the reference value of the file in the remote attestation verification policy; If the hash values of all the files are consistent with the reference values, it is considered that all the files that need to be audited are complete, and the remote attestation verification result Result = 0x01 (indicating trusted) is generated; if there is a file whose hash value is inconsistent with the reference value, it is considered that there is a tampered file in the files that need to be audited, and the remote attestation verification result Result = 0x00 (indicating untrusted) is generated. According to the content of the remote attestation verification result, when the virtual server supervision system obtains the content, it can directly confirm whether the current client virtual server is in a trusted state.

[0094] S205, encrypt the remote attestation verification result according to the preset authentication encryption algorithm using the remote attestation session key, and send the encrypted remote attestation verification result.

[0095] In step S205, the first random number is used as additional data used by the preset authentication encryption algorithm, the second random number is used as an initial vector used by the preset authentication encryption algorithm, and the second label is used as an authentication label of the remote attestation verification result.

[0096] The remote attestation result encryption process can be represented by the following relationship: {S_Result, TAG2} = Encrypt(AES-GCM, KSK, Result, IV, AAD); Wherein, S_Result is the remote attestation verification result ciphertext generated by the AES-GCM algorithm; TAG2 is the remote attestation verification result authentication label generated by the AES-GCM algorithm, which is the second label in the embodiment of the application; Encrypt represents the encryption operation; KSK is the remote attestation session key; Result is the remote attestation verification result; AAD is the additional data required for the encryption operation of the AES-GCM algorithm, which uses the first random number N1 in this embodiment; IV is the initial vector required for the encryption operation of the AES-GCM algorithm, which uses the second random number N2 in this embodiment.

[0097] It can be understood that by using the first random number N1 and the second random number N2 as input parameters for the AES-GCM algorithm encryption, the binding of the remote attestation verification result and the current remote attestation session is further enhanced, so that the remote attestation verification result transmitted in the current remote attestation session can be and only can be used in the current remote attestation session.

[0098] Through the above embodiments one and two, the steps of the proposed remote attestation method are described from the perspectives of the virtual server supervision system and the client virtual server, respectively. It can be understood that the remote attestation event is realized by the interaction between the virtual server supervision system and the client virtual server in the actual implementation process, so the steps S101 to S105 and the steps S201 to S205 of the above embodiments one and two should also have a certain order in the implementation logic. Specifically, the remote attestation method proposed in the embodiment of the application can also be described as the following process according to the interaction sequence between the virtual server supervision system and the client virtual server: S101, (by the virtual server supervision system) verifying an initial trusted state of a client virtual server, in a case that the client virtual server is in a trusted state, exchanging identity authentication public keys for identity authentication credentials with the client virtual server, and then negotiating a remote attestation base key with the client virtual server according to a preset key exchange method.

[0099] S201, (the client virtual server) in a case that the client virtual server is verified by the virtual server supervision system to be in an initial trusted state, exchanging identity authentication public keys for identity authentication credentials with the virtual server supervision system, and then negotiating a remote attestation base key with the virtual server supervision system according to a preset key exchange method.

[0100] In the initial verification and remote attestation base key negotiation phase, step S101 and step S201 are actually the same step performed by different subjects of the remote attestation method.

[0101] S102, (by the virtual server supervision system) deriving a remote attestation session key for remote attestation based on the remote attestation base key; S202, (by the client virtual server) deriving a remote attestation session key for remote attestation based on the remote attestation base key.

[0102] Referring to the description of steps S102 and S202 in Embodiment One and Embodiment Two, the derivation process of the remote attestation session key actually has a sequence, in this phase, first, the virtual server supervision system needs to generate a random number and a salt value, and then the virtual server supervision system sends the generated parameters to the client virtual server, and the two respectively derive the remote attestation session key based on the same parameters.

[0103] S103, (by the virtual server supervision system) determining a remote attestation verification policy for remote attestation, and sending the remote attestation verification policy after being encrypted by the remote attestation session key according to a preset authentication encryption algorithm; S203, (by the client virtual server) receiving the remote attestation verification policy, wherein the remote attestation verification policy is generated by the virtual server supervision system and sent after being encrypted by the remote attestation session key owned by the virtual server supervision system according to a preset authentication encryption algorithm; S204, (by the client virtual server) decrypting and executing the remote attestation verification policy according to the preset authentication encryption algorithm using the remote attestation session key, and obtaining a remote attestation verification result of whether the current self-state is in a trusted state; S205, (by the client virtual server) encrypting the remote attestation verification result according to the preset authentication encryption algorithm using the remote attestation session key, and sending the encrypted remote attestation verification result; S104, (by the virtual server supervision system) receiving a remote attestation verification result, the remote attestation verification result being obtained by the client virtual server after decrypting and executing the remote attestation verification policy according to the preset authentication encryption algorithm, and being encrypted by the client virtual server using the remote attestation session key owned by the client virtual server according to the preset authentication encryption algorithm; S105, (by the virtual server supervision system) decrypting the remote attestation verification result according to the preset authentication encryption algorithm using the remote attestation session key, and obtaining a remote attestation judgment result about whether the current client virtual server is trusted according to the remote attestation verification result.

[0104] After the remote attestation session key derivation ends, the actual remote attestation process starts, and this stage follows the logic of initiating remote attestation by the virtual server supervision system, performing remote attestation by the client virtual server and obtaining the result, and receiving the result by the virtual server supervision system.

[0105] In the overall process of the remote attestation method based on TEE agent verification proposed in the embodiments of the present application, the client virtual server only returns the verification result indicating that the client virtual server is trusted or untrusted to the virtual server supervision system, without transmitting any file hash value, file name or other characteristic information, so that even if the attacker intercepts the communication content, he cannot infer the file content from the communication content; In addition, the remote attestation method proposed in the embodiments of the present application verifies the initial state of the client virtual server before it is delivered to the tenant using the remote attestation method of the prior art, and the remote attestation after the client virtual server is delivered to the tenant uses the technical solution of the present application, which is based on the dynamic measurement implemented by the operating system kernel IMA and vTPM in the rich execution environment RE, and follows the same TCG trusted platform module technical specification.

[0106] In general, the present application has the beneficial effects of providing a remote attestation method based on TEE agent verification, which localizes the verification logic in the virtual server supervision system and the trusted execution environment inside the client virtual server, and the storage measurement log of the client virtual server does not need to be sent to the virtual server supervision system during the verification process, but only needs to return the verification result to the virtual server supervision system, solving the problem of possible data leakage when the storage measurement log of the client virtual server is sent to the supervision system. The execution process of the method of the present application is based on the existing cloud service architecture, which has low implementation difficulty and high compatibility.

[0107] Embodiment three The embodiment of the present application also provides a remote attestation system 300 based on TEE proxy authentication, which refers to Figure 4 , Figure 4 FIG. 1 is a structural schematic diagram of the remote attestation system based on TEE proxy authentication provided by the embodiment of the present application, which comprises a first remote attestation module 301 implemented in a virtual server supervision system and a second remote attestation module 302 implemented in a client virtual server based on a trusted execution environment thereof. The first remote attestation module 301 comprises: a first base key negotiation module 3011 configured to verify an initial trusted state of the client virtual server, exchange identity authentication public keys for mutual identity authentication credentials with the client virtual server in the case that the client virtual server is in the trusted state, and then negotiate a remote attestation base key with the client virtual server according to a preset key exchange method; a first session key derivation module 3012 configured to derive a remote attestation session key for remote attestation based on the remote attestation base key; a remote attestation sending module 3013 configured to determine a remote attestation verification policy for remote attestation, and send the remote attestation verification policy after being encrypted by the remote attestation session key according to a preset authentication encryption algorithm; a first remote attestation receiving module 3014 configured to receive a remote attestation verification result, which is obtained and sent by the client virtual server after being decrypted and executed by the client virtual server according to the preset authentication encryption algorithm on the remote attestation verification policy, and then being encrypted by the remote attestation session key owned by the client virtual server according to the preset authentication encryption algorithm; a remote attestation decryption module 3015 configured to decrypt the remote attestation verification result according to the preset authentication encryption algorithm by using the remote attestation session key, and obtain a remote attestation judgment result about whether the current client virtual server is trusted according to the remote attestation verification result; The second remote attestation module 302 comprises: a second base key negotiation module 3021 configured to, in the case that itself is verified by the virtual server supervision system to be in an initial trusted state, exchange identity authentication public keys for mutual identity authentication credentials with the virtual server supervision system, and then negotiate a remote attestation base key with the virtual server supervision system according to a preset key exchange method; a second session key derivation module 3022 configured to derive a remote attestation session key for remote attestation based on the remote attestation base key; a second remote attestation receiving module 3023, configured to receive a remote attestation verification policy, wherein the remote attestation verification policy is generated by the virtual server supervision system and is sent out after being encrypted by using the remote attestation session key possessed by the virtual server supervision system according to a preset authentication encryption algorithm; a remote attestation executing module 3024, configured to decrypt and execute the remote attestation verification policy according to the preset authentication encryption algorithm by using the remote attestation session key, to obtain a remote attestation verification result of whether a current self state is in a trusted state; a remote attestation encrypting module 3025, configured to encrypt the remote attestation verification result according to the preset authentication encryption algorithm by using the remote attestation session key, and send out the encrypted remote attestation verification result.

[0108] The remote attestation system based on TEE agent verification 300 can implement the steps in the remote attestation method based on TEE agent verification in Embodiments One and Two, and can achieve the same technical effects. Refer to the descriptions in the above embodiments, which will not be repeated here.

[0109] Embodiment Three The embodiment of the application further provides a computer device, please refer to Figure 5 , Figure 5 is a structural schematic diagram of the computer device provided by the embodiment of the application. The computer device 400 comprises a memory 402, a processor 401, and a computer program stored in the memory 402 and capable of running on the processor 401.

[0110] The processor 401 invokes the computer program stored in the memory 402, and implements, by a virtual server supervision system as a verification party, the steps in the remote attestation method based on TEE agent verification provided by Embodiment One of the application. Please refer to Figure 1 , which specifically comprises the following steps: S101, verifying an initial trusted state of a client virtual server, and in the case that the client virtual server is in a trusted state, exchanging identity authentication public keys for identity authentication credentials with the client virtual server, and then negotiating a remote attestation base key with the client virtual server according to a preset key exchange method; S102, deriving a remote attestation session key for remote attestation based on the remote attestation base key; S103, determining a remote attestation verification policy for remote attestation, and sending out the remote attestation verification policy after being encrypted by using the remote attestation session key according to a preset authentication encryption algorithm; S104, receiving a remote attestation verification result, the remote attestation verification result being obtained and sent by the client virtual server after the remote attestation verification policy is decrypted and executed by the client virtual server according to the preset authentication encryption algorithm, and then being encrypted by the client virtual server using the remote attestation session key possessed by the client virtual server according to the preset authentication encryption algorithm; S105, decrypting the remote attestation verification result using the remote attestation session key according to the preset authentication encryption algorithm, and obtaining a remote attestation judgment result about whether the current client virtual server is trusted according to the remote attestation verification result.

[0111] Further, step S101 includes the following sub-steps: S1011, creating the client virtual server and verifying its initial trusted state; S1012, sending a first identity authentication public key possessed by itself and obtaining a second identity authentication public key; wherein the second identity authentication public key is sent by the client virtual server; S1013, generating a first temporary key pair based on a preset key generation method, the first temporary key pair including a first temporary public key and a first temporary private key, and signing the first temporary public key using a private key corresponding to the first identity authentication public key, and sending the signed first temporary public key; S1014, receiving a second temporary public key, and performing signature verification on the second temporary public key using the second identity authentication public key, and after the signature verification passes, generating the remote attestation base key using the first temporary private key and the second temporary public key as data sources according to a preset key exchange method, the second temporary public key being sent by the client virtual server after receiving the first temporary public key and passing the signature verification, being generated based on the preset key generation method, and being signed using a private key corresponding to the second identity authentication public key.

[0112] Further, the preset key generation method is an ECDSA digital signature algorithm, and the preset key exchange method is an ECDH key agreement algorithm.

[0113] Further, step S102 includes the following sub-steps: S1021, generating a first random number and a second random number, and concatenating the second random number to the tail of the first random number to obtain a salt value; S1022, taking the salt value and the remote attestation base key as parameters of a preset key derivation algorithm to calculate the remote attestation session key; S1023, sending the first random number, the second random number, and the salt value signed using a private key corresponding to the first identity authentication public key.

[0114] Further, the preset key derivation algorithm is an HKDF key derivation algorithm.

[0115] Further, in step S103, the remote attestation verification policy at least includes a platform configuration register index of the client virtual server and a file name and a reference value of a file corresponding to the platform configuration register index that needs to be audited, the file being a file in a software component when the client virtual server is created, and the reference value being a hash value of the file. The preset authentication encryption algorithm is an AES-GCM algorithm, the first random number is used as additional data used when the preset authentication encryption algorithm is encrypted, the second random number is used as an initial vector used when the preset authentication encryption algorithm is encrypted, and the first tag is used as an authentication tag of the remote attestation verification policy.

[0116] Further, in step S105, the first random number is used as additional data used when the preset authentication encryption algorithm is decrypted, the second random number is used as an initial vector used when the preset authentication encryption algorithm is decrypted, and the second tag is used as an authentication tag of the remote attestation verification result.

[0117] Alternatively, the processor 401 invokes the computer program stored in the memory 402, and the client virtual server as a verified party is implemented based on a trusted execution environment and performs steps in another remote attestation method based on TEE proxy verification provided by the second embodiment of the present application. Please refer to the second embodiment of the present application for details. Figure 3 , and specifically includes the following steps: S201, in the case that the virtual server is verified to be in an initial trusted state by the virtual server supervision system, after exchanging identity authentication public keys for identity authentication credentials with the virtual server supervision system, a remote attestation base key is obtained by negotiating with the virtual server supervision system according to a preset key exchange method; S202, a remote attestation session key used for remote attestation is derived based on the remote attestation base key; S203, a remote attestation verification policy is received, wherein the remote attestation verification policy is generated by the virtual server supervision system and sent out after being encrypted by the virtual server supervision system using the remote attestation session key owned by the virtual server supervision system according to a preset authentication encryption algorithm; S204, the remote attestation verification policy is decrypted and executed according to the preset authentication encryption algorithm using the remote attestation session key, and a remote attestation verification result of whether the current state of the virtual server is in a trusted state is obtained. S205, encrypt the remote attestation verification result according to the preset authentication encryption algorithm using the remote attestation session key, and send the encrypted remote attestation verification result.

[0118] Further, step S201 comprises the following sub-steps: S2011, verify the initial trusted state of itself through the virtual server supervision system, wherein the client virtual server is created by the virtual server supervision system; S2012, receive a first identity authentication public key and store it in the trusted execution environment of itself, and then send a second identity authentication public key owned by itself; wherein the first identity authentication public key is sent by the virtual server supervision system; S2013, receive a first temporary public key, and use the first identity authentication public key to perform signature verification on the first temporary public key, after the signature verification is passed, generate a second temporary key pair including a second temporary public key and a second temporary private key based on a preset key generation method, generate the remote attestation base key using the first temporary public key and the second temporary private key as data sources according to a preset key exchange method, and then send the second temporary public key after signing it by the private key corresponding to the second identity authentication public key; wherein the first temporary public key is generated and signed by the virtual server supervision system and then sent.

[0119] Further, step S202 comprises the following sub-steps: S2021, receive a first random number, a second random number, and a salt value signed by the private key corresponding to the first identity authentication public key; wherein the first random number, the second random number, and the salt value are all generated and sent by the virtual server supervision system; S2022, use the first identity authentication public key to verify the signature of the salt value, and after the signature verification is passed, use the salt value and the remote attestation base key as parameters of the preset key derivation algorithm to calculate the remote attestation session key.

[0120] Further, step S204 comprises the following sub-steps: S2041. Using the remote proof session key, the remote proof verification strategy is decrypted according to the preset authentication encryption algorithm to obtain the platform configuration register index of the client virtual server and the file name and base value of the file to be audited corresponding to the platform configuration register index; wherein, the preset authentication encryption algorithm is the AES-GCM algorithm, the first random number is used as the additional data used when the preset authentication encryption algorithm is decrypted, the second random number is used as the initial vector used when the preset authentication encryption algorithm is decrypted, and the first tag is used as the authentication tag of the remote proof verification strategy; S2042. Obtain the platform configuration register value corresponding to itself using the platform configuration register index and the first random number as parameters, and obtain the storage metric log corresponding to itself based on the platform configuration register value. Based on the storage metric log and the benchmark value, check the integrity of the file obtained by the remote proof verification strategy decryption, and obtain the remote proof verification result of whether itself is in a trusted state. If the integrity check passes, it is in a trusted state.

[0121] Furthermore, in step S205, the first random number is used as additional data when the preset authentication encryption algorithm is used for encryption, the second random number is used as the initial vector when the preset authentication encryption algorithm is used for encryption, and the second tag is used as the authentication tag of the remote proof verification result.

[0122] The computer device 400 provided in this embodiment of the invention can implement the steps in the remote proof method based on TEE proxy verification as described in the above embodiments, and can achieve the same technical effect. Referring to the description in the above embodiments, it will not be repeated here.

[0123] Example 4 This invention also provides a storage medium storing a remote proof program based on TEE proxy verification. When the remote proof program based on TEE proxy verification is executed by a processor, it implements the various processes and steps in the remote proof method based on TEE proxy verification provided in this invention and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0124] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by hardware related to computer programs or instructions. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0125] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0126] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0127] The embodiments of the present invention have been described above with reference to the accompanying drawings. The disclosed embodiments are merely preferred embodiments of the present invention. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many equivalent changes in form under the guidance of the present invention without departing from the spirit and scope of the claims. All such changes are within the protection scope of the present invention.

Claims

1. A remote verification method based on TEE proxy verification, characterized in that, The remote authentication method is implemented by a virtual server monitoring system acting as the verifier, and includes the following steps: S101. Verify the initial trusted state of the client virtual server. If the client virtual server is in a trusted state, exchange identity authentication public keys with the client virtual server for each other's identity authentication credentials. Then, negotiate with the client virtual server to obtain a remote proof base key according to a preset key exchange method. S102. Derive a remote proof session key for performing remote proof based on the remote proof base key; S103. Determine the remote proof verification strategy for remote proof, and encrypt the remote proof verification strategy using the remote proof session key according to the preset authentication encryption algorithm before sending it out; S104. Receive the remote proof verification result. The remote proof verification result is obtained by the client virtual server after decrypting and executing the remote proof verification strategy according to the preset authentication encryption algorithm, and then encrypting it using the remote proof session key it possesses according to the preset authentication encryption algorithm and sending it out. S105. Using the remote proof session key, the remote proof verification result is decrypted according to the preset authentication encryption algorithm, and a remote proof judgment result regarding whether the current client virtual server is trustworthy is obtained based on the remote proof verification result.

2. The remote verification method based on TEE proxy verification according to claim 1, characterized in that, Step S101 includes the following sub-steps: S1011. Create the client virtual server and verify its initial trusted state; S1012. Send out the first identity authentication public key it possesses and obtain the second identity authentication public key; wherein, the second identity authentication public key is sent by the client virtual server; S1013. Generate a first temporary key pair based on a preset key generation method. The first temporary key pair includes a first temporary public key and a first temporary private key. Sign the first temporary public key using the private key corresponding to the first identity authentication public key. Send out the signed first temporary public key. S1014. Receive the second temporary public key and use the second identity authentication public key to sign and verify the second temporary public key. After the signature verification is successful, generate the remote proof base key according to the preset key exchange method using the first temporary private key and the second temporary public key as the data source. The second temporary public key is generated by the client virtual server based on the preset key generation method after receiving the first temporary public key and verifying the signature, and then signed with the private key corresponding to the second identity authentication public key before being issued.

3. The remote verification method based on TEE proxy verification according to claim 2, characterized in that, The preset key generation method is the ECDSA digital signature algorithm; the preset key exchange method is the ECDH key negotiation algorithm.

4. The remote verification method based on TEE proxy verification according to claim 2, characterized in that, Step S102 includes the following sub-steps: S1021. Generate a first random number and a second random number, and append the second random number to the end of the first random number to obtain a salt value; S1022. Using the salt value and the remote proof base key as parameters of a preset key derivation algorithm, calculate the remote proof session key; S1023. Send out the first random number, the second random number, and the salt value signed with the private key corresponding to the first identity authentication public key.

5. The remote verification method based on TEE proxy verification according to claim 4, characterized in that, The preset key derivation algorithm is the HKDF key derivation algorithm.

6. The remote verification method based on TEE proxy verification according to claim 4, characterized in that, In step S103, the remote proof verification strategy includes at least the platform configuration register index of the client virtual server and the file name and base value of the file to be audited corresponding to the platform configuration register index. The file is a file in the software component when the client virtual server is created, and the base value is the hash value of the file. The preset authentication encryption algorithm is the AES-GCM algorithm, and the first random number is used as the additional data used when the preset authentication encryption algorithm is encrypted, the second random number is used as the initial vector used when the preset authentication encryption algorithm is encrypted, and the first tag is used as the authentication tag of the remote proof verification strategy.

7. The remote verification method based on TEE proxy verification according to claim 4, characterized in that, In step S105, the first random number is used as additional data for decryption by the preset authentication encryption algorithm, the second random number is used as the initial vector for decryption by the preset authentication encryption algorithm, and the second tag is used as the authentication tag for the remote proof verification result.

8. A remote verification method based on TEE proxy verification, characterized in that, The remote proof method is implemented by a client virtual server, acting as the verified party, based on its trusted execution environment. The remote proof method includes the following steps: S201. After being verified by the virtual server monitoring system to be in an initial trusted state, the user exchanges identity authentication public keys with the virtual server monitoring system for each other's identity authentication credentials, and then negotiates with the virtual server monitoring system to obtain a remote proof base key according to a preset key exchange method. S202. Derive a remote proof session key for performing remote proof based on the remote proof base key; S203. Receive remote proof verification strategy, wherein the remote proof verification strategy is generated by the virtual server monitoring system and encrypted using the remote proof session key it possesses according to a preset authentication encryption algorithm before being sent out; S204. Using the remote proof session key, decrypt and execute the remote proof verification strategy according to the preset authentication encryption algorithm to obtain the remote proof verification result of whether the current self-state is in a trusted state; S205. Use the remote proof session key to encrypt the remote proof verification result according to the preset authentication encryption algorithm, and send the encrypted remote proof verification result.

9. The remote verification method based on TEE proxy verification according to claim 8, characterized in that, Step S201 includes the following sub-steps: S2011. The client virtual server verifies its initial trusted state through the virtual server monitoring system, wherein the client virtual server is created by the virtual server monitoring system; S2012. Receive the first identity authentication public key and store it in its own trusted execution environment, and then send out its own second identity authentication public key; wherein, the first identity authentication public key is sent by the virtual server monitoring system; S2013. Receive the first temporary public key and verify its signature using the first identity authentication public key. After successful signature verification, generate a second temporary key pair based on a preset key generation method. The second temporary key pair includes a second temporary public key and a second temporary private key. Generate the remote proof base key using the first temporary public key and the second temporary private key as data sources according to the preset key exchange method. Then, sign the second temporary public key with the private key corresponding to the second identity authentication public key and send it out. The first temporary public key is generated and signed by the virtual server monitoring system before being sent out.

10. The remote verification method based on TEE proxy verification according to claim 9, characterized in that, Step S202 includes the following sub-steps: S2021. Receive a first random number, a second random number, and a salt value signed with the private key corresponding to the first identity authentication public key; wherein, the first random number, the second random number, and the salt value are all generated and sent by the virtual server monitoring system; S2022. Verify the signature of the salt value using the first identity authentication public key. After the signature verification is successful, use the salt value and the remote proof base key as parameters of the preset key derivation algorithm to calculate the remote proof session key.

11. The remote verification method based on TEE proxy verification according to claim 10, characterized in that, Step S204 includes the following sub-steps: S2041. Using the remote proof session key, the remote proof verification strategy is decrypted according to the preset authentication encryption algorithm to obtain the platform configuration register index of the client virtual server and the file name and base value of the file to be audited corresponding to the platform configuration register index; wherein, the preset authentication encryption algorithm is the AES-GCM algorithm, the first random number is used as the additional data used when the preset authentication encryption algorithm is decrypted, the second random number is used as the initial vector used when the preset authentication encryption algorithm is decrypted, and the first tag is used as the authentication tag of the remote proof verification strategy; S2042. Obtain the platform configuration register value corresponding to itself using the platform configuration register index and the first random number as parameters, and obtain the storage metric log corresponding to itself based on the platform configuration register value. Based on the storage metric log and the benchmark value, check the integrity of the file obtained by the remote proof verification strategy decryption, and obtain the remote proof verification result of whether itself is in a trusted state. If the integrity check passes, it is in a trusted state.

12. The remote verification method based on TEE proxy verification according to claim 11, characterized in that, In step S205, the first random number is used as the additional data used when encrypting with the preset authentication encryption algorithm, the second random number is used as the initial vector used when encrypting with the preset authentication encryption algorithm, and the second tag is used as the authentication tag of the remote proof verification result.

13. A remote verification system based on TEE (Telecommunications Equipment Proxy) verification, characterized in that, The remote authentication system includes a first remote authentication module implemented in a virtual server monitoring system and a second remote authentication module implemented in a client virtual server based on its trusted execution environment, wherein the first remote authentication module includes: The first base key negotiation module is used to verify the initial trusted state of the client virtual server. When the client virtual server is in a trusted state, it exchanges identity authentication public keys with the client virtual server for each other's identity authentication credentials. Then, it negotiates with the client virtual server to obtain a remote proof base key according to a preset key exchange method. The first session key derivation module is used to derive a remote proof session key for performing remote proof based on the remote proof base key; The remote proof sending module is used to determine the remote proof verification strategy for remote proof, and to encrypt the remote proof verification strategy using the remote proof session key according to a preset authentication encryption algorithm before sending it out; The first remote proof receiving module is used to receive the remote proof verification result. The remote proof verification result is obtained by the client virtual server decrypting and executing the remote proof verification strategy according to the preset authentication encryption algorithm, and then encrypting it with the remote proof session key it possesses according to the preset authentication encryption algorithm before sending it out. The remote proof decryption module is used to decrypt the remote proof verification result using the remote proof session key according to the preset authentication encryption algorithm, and obtain a remote proof judgment result on whether the current client virtual server is trustworthy based on the remote proof verification result; The second remote verification module includes: The second base key negotiation module is used to negotiate a remote proof base key with the virtual server monitoring system after exchanging identity authentication public keys used for mutual identity authentication credentials with the virtual server monitoring system when it is verified by the virtual server monitoring system to be in an initial trusted state. The second session key derivation module is used to derive a remote proof session key for performing remote proof based on the remote proof base key; The second remote proof receiving module is used to receive the remote proof verification strategy, wherein the remote proof verification strategy is generated by the virtual server monitoring system and encrypted using the remote proof session key it possesses according to a preset authentication encryption algorithm before being sent out; The remote proof execution module is used to decrypt and execute the remote proof verification strategy using the remote proof session key according to the preset authentication encryption algorithm, and obtain the remote proof verification result of whether its current state is in a trusted state; The remote proof encryption module is used to encrypt the remote proof verification result using the remote proof session key according to the preset authentication encryption algorithm, and then send the encrypted remote proof verification result.

14. A computer device, characterized in that, include: The system includes a memory, a processor, and a remote proof program based on TEE proxy verification stored on the memory and executable on the processor. When the processor executes the remote proof program based on TEE proxy verification, it implements the steps of the remote proof method based on TEE proxy verification as described in any one of claims 1-7 or 8-12.

15. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the remote proof method based on TEE proxy verification as described in any one of claims 1-7 or 8-12.

Images