Trusted measurement method and device, storage medium and program product

Abstract

The invention relates to the technical field of artificial intelligence, and particularly provides a trusted measurement method and device, a storage medium and a program product. According to the method, the to-be-measured file is screened from the target accessed file which currently triggers the measurement mechanism through the extension attribute in the target accessed file and the newly added extension attribute in the measurement strategy, and the to-be-measured file is subjected to trusted measurement. That is to say, the measurement of a certain specific file is realized through the extended attribute and the newly added extended attribute, and the complexity of trusted measurement of a computer system is greatly reduced.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of artificial intelligence, and in particular, to a trust measurement method, device, storage medium and program product. BACKGROUND

[0002] Currently, through trust measurement and trust verification, it is determined that a system or software runs in a trust state expected by a design target, thereby guaranteeing the integrity of the system and the application. Dynamic measurement is a measurement manner of trust measurement. Dynamic measurement generally measures files in the system periodically or based on event driving after the system is started, accompanying the whole running process of the system.

[0003] In related technologies, measurement is performed based on an IMA measurement strategy, but the IMA measurement cannot measure a certain specific file. No matter whether the measurement is based on matching of a file type, a file opening manner, or matching of a user and a group ID, or a security mark, the overall matching granularity is relatively large, and fine-grained configuration cannot be achieved. SUMMARY

[0004] The present disclosure is proposed in view of the above problems. The present disclosure provides a trust measurement method, device, storage medium and program product.

[0005] According to a first aspect of the present disclosure, a trust measurement method is provided, comprising: obtaining a target accessed file currently triggering a measurement mechanism in a computer system; obtaining an extended attribute of the target accessed file and a measurement strategy corresponding to the target accessed file; obtaining a newly added extended attribute in the measurement strategy; obtaining a file to be measured based on the extended attribute of the target accessed file and the newly added extended attribute; performing trust measurement on the file to be measured.

[0006] In addition, according to the trust measurement method of the first aspect of the present disclosure, the obtaining of the file to be measured based on the extended attribute of the target accessed file and the newly added extended attribute comprises: obtaining a first attribute name of the extended attribute and a second attribute name of the newly added extended attribute; finding an initial file to be measured with the same first attribute name and second attribute name as the target accessed file from the target accessed file; finding the file to be measured with an attribute value corresponding to the first attribute name being less than or equal to an attribute value corresponding to the second attribute name from the initial file to be measured.

[0007] Further, the credibility measurement method according to the first aspect of the present disclosure comprises: In the case that the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are both expressed by characters, the file in which the attribute value corresponding to the first attribute name in the initial file to be measured is the same as the attribute value corresponding to the second attribute name in the initial file to be measured is taken as the file to be measured; In the case that the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are both expressed by numerical values, the file in which the attribute value corresponding to the first attribute name in the initial file to be measured is less than or equal to the attribute value corresponding to the second attribute name in the initial file to be measured is taken as the file to be measured.

[0008] Further, the credibility measurement method according to the first aspect of the present disclosure further comprises: obtaining a threat score pre-configured for the file to be measured; summing the threat scores to obtain the credibility of the computer system.

[0009] Further, the credibility measurement method according to the first aspect of the present disclosure further comprises: obtaining a minimum file set indicated by an administrator, an extended attribute required to be marked for a file, and a measurement policy configured with a newly added extended attribute; marking the file belonging to the minimum file set in the computer system based on the extended attribute; writing the file marked in the computer system into a file system, and writing the measurement policy into a kernel.

[0010] Further, the credibility measurement method according to the first aspect of the present disclosure, the minimum file set comprises N types of files, the extended attribute marked for the files belonging to the same type of file in the N types of files is the same, the difference between the attribute value of the extended attribute required to be marked for the M+1 type of file and the attribute value of the extended attribute required to be marked for the M type of file is 1, the security impact of the M type of file on the computer system after being tampered is greater than the security impact of the M+1 type of file on the computer system after being tampered, and M≤N.

[0011] Further, the credibility measurement method according to the first aspect of the present disclosure, the extended attribute required to be marked for the file further comprises a threat score, and the threat scores in the extended attributes marked for the files belonging to the same type of file in the N types of files are different.

[0012] According to a second aspect of the present disclosure, there is provided a trusted measurement apparatus, comprising: a first obtaining module configured to obtain a target accessed file triggering a measurement mechanism in a computer system; a second obtaining module configured to obtain an extended attribute of the target accessed file and a measurement policy corresponding to the target accessed file; a third obtaining module configured to obtain a newly added extended attribute in the measurement policy; a fourth obtaining module configured to obtain a file to be measured based on the extended attribute of the target accessed file and the newly added extended attribute; a measurement module configured to perform trusted measurement on the file to be measured.

[0013] According to a third aspect of the present disclosure, there is provided an electronic device comprising a memory, a processor and a computer program stored in the memory, the processor being configured to execute the computer program to implement the steps of the method according to the first aspect. According to a fourth aspect of the present disclosure, there is provided a computer readable storage medium having stored thereon a computer program / instructions, the computer program / instructions being executable by a processor to implement the steps of the method according to the first aspect. According to a fifth aspect of the present disclosure, there is provided a computer program product comprising a computer program / instructions, the computer program / instructions being executable by a processor to implement the steps of the method according to the first aspect.

[0014] As will be described in detail below, according to the trusted measurement method of the embodiments of the present disclosure, the file to be measured is filtered from the target accessed file triggering the measurement mechanism by the extended attribute in the target accessed file and the newly added extended attribute in the measurement policy, and the trusted measurement is performed on the file to be measured. That is, the measurement of a specific file is made possible by the extended attribute and the newly added extended attribute, which greatly reduces the complexity of the trusted measurement of the computer system.

[0015] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the subject technology. BRIEF DESCRIPTION OF DRAWINGS

[0016] The foregoing and other objects, features and advantages of the present disclosure will be more fully understood from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0017] Figure 1is a flow chart illustrating a trust measurement method according to an embodiment of the present disclosure.

[0018] Figure 2 is a flow chart illustrating a trust measurement method according to an embodiment of the present disclosure.

[0019] Figure 3 is a flow chart illustrating a trust measurement method according to an embodiment of the present disclosure.

[0020] Figure 4 is a structural schematic diagram illustrating a trust measurement apparatus according to an embodiment of the present disclosure.

[0021] Figure 5 is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure.

[0022] Figure 6 is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] The technical method of the embodiments of the present application will be described in detail below with reference to the accompanying drawings of the embodiments of the present application.

[0024] With the popularity of computers and the Internet, people are increasingly relying on computer systems to process and store sensitive information, such as personal identity information, financial data, business secrets, etc. Therefore, the security and trustworthiness of computer systems have become an increasingly important issue. In the past, people could not confirm the status of the computer system they needed to rely on, and could only blindly establish a connection with it and process sensitive or high-value data and information within the computer system.

[0025] In order to cope with these security challenges, the Trusted Computing Group (TCG) proposes the concept of trusted computing and promotes its standardization. Trusted computing is based on a hardware trusted root, generally using a Trusted Platform Module (TPM) that meets the TCG standard or a Trusted Computing Module (TCM) that meets the national standard as a hardware trusted root, and through trusted measurement and trusted verification, a trust chain is established from the trusted root to the measured component, so as to determine that the system or software is running in the desired trusted state of the design target, thereby ensuring the integrity of the system and application. Trusted measurement is to collect the state of the detected software or system, and verification is to compare the measurement result with the reference value to see if they are consistent. If they are consistent, it means that the verification is passed, and if they are not consistent, it means that the verification fails.

[0026] The trust measurement process can be divided into a static measurement process and a dynamic measurement process. The static measurement, also commonly known as trusted boot or measurement boot, is responsible for measuring the entire process from system power-on to system boot. After the system boot is completed, the measurement value generated in the measurement process is saved in the trusted storage, and will not change during the subsequent entire system operation. The dynamic measurement, generally after the system boot, periodically or event-drivenly measures the files in the system, accompanying the entire operation of the system. The measurement process based on the TPM mainly measures the files in the system, and finally determines whether an untrusted file is opened, mapped or executed in the system through file reference value comparison. Ideally, all files in the system should be measured to confirm whether the system is trusted. However, usually only one copy of the file reference value is saved on the verification side, so all the measured files are basically unmodifiable, which greatly limits the application scenarios. Therefore, in different application scenarios and in combination with the understanding of the system by the security administrator, the trusted state of the system should be determined by the smallest set of files, which can guarantee the trusted state of the system and will not affect the use of the system, so how to define the files to be measured in the security policy becomes particularly important.

[0027] In the related art, an IMA (Integrity Measurement Architecture) measurement strategy is used to measure the system. The IMA is an implementation of a trusted measurement mechanism in the Linux kernel, which is used to measure the integrity of files and ensure that they are not tampered with when executed or read. The IMA calculates the hash value of the file when the file is opened, executed or read, and stores these hash values in memory or records them in a log. The IMA cannot measure a specific file. Whether it is based on file type, file opening mode matching, or based on user and group ID, or security tag matching, the overall matching granularity is relatively large, and it is impossible to measure a specific file. Whether it is based on file type, file opening mode matching, or based on user and group ID, or security tag matching, the overall matching granularity is relatively large, and it is impossible to measure a specific file.

[0028] In order to alleviate the technical problems existing in the related art, the embodiments of the present disclosure provide a trusted measurement method, device, storage medium and program product. The method realizes filtering of files to be measured from the target accessed file currently triggering the measurement mechanism and performing trusted measurement on the files to be measured through the extended attribute in the target accessed file and the newly added extended attribute in the measurement strategy. That is, by extending the attribute and adding the extended attribute, it becomes possible to measure a specific file, greatly reducing the complexity of trusted measurement of the computer system.

[0029] For the convenience of understanding the present embodiment, first, a trusted measurement method disclosed by the present embodiment is introduced in detail, the execution subject of the trusted measurement method provided by the present embodiment is generally an electronic device with certain computing capability, which for example includes a terminal device or a server or other processing device. In some possible implementation manners, the trusted measurement method can be realized by a processor calling computer readable instructions stored in a memory.

[0030] Referring to Figure 1 As shown in the flowchart of the trusted measurement method provided by the present embodiment, the method comprises the following steps: Step 101, obtaining a target accessed file triggering a measurement mechanism in a computer system.

[0031] When the computer system performs a corresponding file access operation, such as reading and writing a file, mapping a file or loading a binary file, the measurement mechanism is triggered to intervene, and these triggering measurement mechanism accesses the accessed file, which is referred to as a target accessed file.

[0032] In the traditional IMA policy, files capable of triggering the measurement mechanism in the computer system are defined, typical strategies include FILE_CHECK (i.e. triggering when a file is read, written or executed), MMAP_CHECK (MAY_EXEC) (i.e. triggering a check when a file is mapped to memory with execution permission), BPRM_CHECK (MAY_EXEC) (i.e. triggering a check when a binary executable file is loaded and executed), on this basis, the target accessed file in the present embodiment refers to a file that will trigger the measurement mechanism based on the traditional measurement policy. The traditional measurement policy here includes but is not limited to the IMA policy.

[0033] Step 102, obtaining the extended attribute of the target accessed file and the measurement policy corresponding to the target accessed file.

[0034] The extended attribute of the target accessed file is a custom label or note in addition to the standard attribute of the target accessed file. These attributes are not part of the file data itself, but are associated with the file as additional information.

[0035] Before the computer system is started for the first time, an administrator (a security administrator or a system administrator) creates a minimum measurement file set of system security configuration, such as a pam configuration file, a sshd configuration file, a profile configuration file, etc., and sets the extended attribute that needs to be marked in the minimum measurement file set, and a file marking module in the computer system marks the files in the minimum measurement file set according to the extended attribute set by the administrator, and writes the marked files to the file system.

[0036] It should be understood that the files in the minimum measurement file set are necessarily files that need to be measured, but the target accessed file triggering the measurement mechanism is not necessarily a file in the minimum measurement file set. Once the target accessed file triggering the measurement access mechanism is a file in the minimum measurement file set and meets the requirements of the measurement policy, the target accessed file needs to be measured, otherwise the target accessed file triggering the measurement mechanism does not need to be measured.

[0037] The administrator also configures the newly added extended attribute in the traditional measurement policy and writes the measurement policy into the kernel through the policy loading module.

[0038] The operation performed on the file is defined in the measurement policy, so the measurement policy corresponding to the file can be determined according to the operation currently performed on the file. Taking the measurement policy measure func=FILE_CHECK xattr_name=security.measure xattr_value=enable as an example, measure func=FILE_CHECK indicates that the file being read out, written or executed needs to be measured, xattr_name=security.measure xattr_value=enable is the newly added extended attribute in the measurement policy, security.measure is the name of the newly added extended attribute, and enable is the attribute value of the newly added extended attribute. If it is found that the target accessed file triggering the measurement access mechanism is a file being read out, written or executed, it can be confirmed that the measurement policy is the measurement policy corresponding to the target accessed file.

[0039] Step 103, obtaining the newly added extended attribute in the measurement policy.

[0040] Step 104, obtaining the file to be measured based on the extended attribute of the target accessed file and the newly added extended attribute.

[0041] Both the extended attribute of the target accessed file and the newly added extended attribute in the measurement policy include two parameters of attribute name and attribute value, so the target accessed file can be filtered based on the two parameters to obtain the file to be measured. Through the newly added extended attribute in the measurement policy and the extended attribute of the target accessed file, the file to be measured that is a file in the minimum measurement file set and meets the requirements of the measurement policy can be found from the target accessed file triggering the measurement mechanism.

[0042] In a specific implementation, in an optional embodiment, step 104 can include the following steps: obtaining a first attribute name of the extended attribute and a second attribute name of the newly added extended attribute; finding an initial to-be-measured file with the same first attribute name and second attribute name from the target accessed file; finding a to-be-measured file with an attribute value corresponding to the first attribute name less than or equal to an attribute value corresponding to the second attribute name from the initial to-be-measured file.

[0043] In the embodiment, the attribute names of the newly added extended attributes in different measurement strategies can be the same or different, and similarly, the attribute values of the newly added extended attributes in different measurement strategies can be the same or different, which are not specifically limited in the embodiment.

[0044] As an example, the following two measurement strategies are given: measure func=FILE_CHECK xattr_name=security.measure xattr_value=enable; measure func=BPRM_CHECK xattr_name=security.measure xattr_value=enable.

[0045] In the example, the attribute names of the newly added extended attributes in the two measurement strategies are both security.measure, and the attribute values are both enable. The meaning of the first measurement strategy is to measure only the target accessed file whose extended attribute has the attribute name security.measure and the attribute value enable, which is read, written or executed. That is, if the extended attribute of the target accessed file whose measurement mechanism is currently triggered has an attribute name other than security.measure or an attribute value other than enable, the target accessed file will not be measured.

[0046] The meaning of the second measurement strategy is to measure only the target accessed file whose extended attribute has the attribute name security.measure and the attribute value enable, which is mapped to the memory with execution permission. That is, if the extended attribute of the target accessed file whose measurement mechanism is currently triggered has an attribute name other than security.measure or an attribute value other than enable, the target accessed file will not be measured.

[0047] As another example, the following two measurement strategies are given: measure func=FILE_CHECK xattr_name=security.level1 xattr_value=1; measure func=BPRM_CHECK xattr_name= security.level2 xattr_value=2; In this example, the attribute names of the extended attributes in the two measurement policies are different, and the attribute values of the extended attributes are also different. The first measurement policy means that only the accessed file whose read, write or execution target has an extended attribute with the attribute name security.level1 and the attribute value 1 is measured. That is, if the attribute name of the extended attribute of the accessed file whose read, write or execution target triggers the measurement mechanism is not security.level1, or the attribute value is not 1, the accessed file will not be measured.

[0048] The attribute value of the extended attribute and the attribute value of the added extended attribute can be expressed in the form of a string or in the form of a number. On this basis, finding the file to be measured from the initial file to be measured, whose attribute value corresponding to the first attribute name is less than or equal to the attribute value corresponding to the second attribute name, can include the following steps: In the case where the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are both expressed in characters, the file in the initial file to be measured whose attribute value corresponding to the first attribute name is the same as the attribute value corresponding to the second attribute name is taken as the file to be measured. In the case where the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are both expressed in numbers, the file in the initial file to be measured whose attribute value corresponding to the first attribute name is less than or equal to the attribute value corresponding to the second attribute name is taken as the file to be measured.

[0049] In one example, the measurement policy is measure func=FILE_CHECK xattr_name=security.measure xattr_value=enable, that is, the second attribute name of the added extended attribute is security.measure, and the attribute value corresponding to the second attribute name is enable, that is, the attribute value corresponding to the second attribute name is expressed in characters. In this case, for the initial file to be measured whose attribute name is security.measure, only in the case where the attribute value of the security.measure extended attribute in the initial file to be measured is enable, the initial file to be measured is taken as the file to be measured.

[0050] It should be understood that in this example, if the attribute value of the extended attribute with the attribute name of security. measure in the initial to-be-measured file is not enable, such as the attribute value is empty or is disable, then the initial to-be-measured file is not a to-be-measured file, and accordingly, the file does not need to be measured.

[0051] In yet another example, the measurement policy is measure func=FILE_CHECK xattr_name=security. level1 xattr_value=3, that is, the second attribute name of the added extended attribute is security. level1, and the attribute value corresponding to the second attribute name is 2, that is, the attribute value corresponding to the second attribute name is expressed by a numerical value. In this case, for the initial to-be-measured file with the attribute name of security. level1 of the extended attribute, as long as the attribute value of the extended attribute with the attribute name of security. level1 in the initial to-be-measured file is less than or equal to 3, the initial to-be-measured file can be taken as a to-be-measured file.

[0052] It should be understood that in this example, if the attribute value of the extended attribute with the attribute name of security. level1 in the initial to-be-measured file is greater than 3 or the attribute value is empty, then the initial to-be-measured file is not a to-be-measured file, and accordingly, the file does not need to be measured.

[0053] Step 105, performing trusted measurement on the to-be-measured file.

[0054] In some embodiments, after performing trusted measurement on the to-be-measured file, the threat score pre-configured for the to-be-measured file can also be obtained, and by summing the threat scores, the trusted degree of the computer system can be obtained.

[0055] The administrator sets the extension attribute of the file in the minimum metric file set which needs to be marked, and the synchronization can set the threat score of each file, which reflects the harm degree of the file after being tampered with. In the specific operation, taking the extension attribute security. measure as an example, the extension attribute security. measure can be extended to contain two attributes, one attribute identifies the threat level (level) of the file, and the other attribute identifies the threat score (score) of the file. Finally, the threat scores of the files which are not tampered with are added to obtain the final total score, so as to identify the trusted program of the computer system. The higher the score is, the higher the trust degree of the system is. A trusted threshold can be set on the server side, and when the trust score of the computer system exceeds the threshold, the computer system is determined to be trusted. In the scheme, the threat level is used for file classification, and the threat score is used for further fine control. The scheme helps to improve the tolerance of the system to the tampering of the file with a lower threat level, thereby improving the availability of the system.

[0056] In the technical scheme provided by the embodiment, the extension attribute in the target accessed file and the newly added extension attribute in the metric policy are used to filter the files to be measured from the target accessed file which triggers the metric mechanism, and the files to be measured are subjected to trusted measurement. That is, the extension attribute and the newly added extension attribute are used to make the measurement of a specific file possible, which greatly reduces the complexity of the trusted measurement of the computer system.

[0057] The embodiment of the disclosure also provides a trusted measurement method, as shown in Figure 2 The method can include the following steps: The method can include the following steps:

[0058] In the method, the file marking phase, the metric policy configuration phase and the file measurement phase can be included. The file marking phase can include the following steps: Step 201, determining, by an administrator (system administrator or security administrator), a minimum metric file set which meets the system security requirement; Step 202, marking, by a file marking module, all files in the minimum metric file set in the computer system according to the extension attribute name (such as security. measure) set by the administrator; Step 203, writing, by the file marking module, the extension attribute of the file into the file system.

[0059] The metric policy configuration phase can include the following steps: Step 204, configuring, by the administrator, a metric policy based on the newly added extension attribute; Step 205, writing, by a policy loading module, the metric policy into the kernel.

[0060] The document measurement phase may include the following steps: Step 206: When performing corresponding file access operations, such as reading and writing files, mmap files, or loading binary files, the measurement mechanism is triggered. Step 207: After performing the traditional policy check, the measurement strategy checking module filters based on the file's extended attributes and only measures the marked files.

[0061] When configuring a measurement strategy based on the newly added extended attributes, you can add the extended attributes after the traditional measurement strategy to further filter files, or you can leave them alone without combining them with the traditional strategy, as shown below: measure func=FILE_CHECK xattr_name=security.measure xattr_value=enable; measure func=BPRM_CHECK xattr_name=security.measure xattr_value=enable; measure f unc=MMAP_CHECK xattr_name=security.measure xattr_value=enable.

[0062] As described above, a new extended attribute named security.measure with the value enable has been added to the measurement policy. The policy parsing logic has been updated to parse xattr_name and xattr_value and save the corresponding content to the policy entry.

[0063] In step 207, when filtering based on the file's extended attributes, it first checks whether the measurement strategy contains the xattr_name and xattr_value attributes. If they do not exist, it directly returns a strategy match; if they do exist, it proceeds to the extended attribute matching logic. Retrieve the extended attribute values ​​of the open file based on xattr_name in the measurement strategy; If no value is returned or the return value is disabled, it indicates that the policy was not hit and no measurement is required; if the return value is enabled, it indicates that the policy was hit and the file should be measured.

[0064] The following describes embodiments of the disclosed solution in two application scenarios.

[0065] Example 1: A Cluster Security Inspection Method Based on Trusted Computing In cloud computing scenarios, servers and virtual machines are typically built in clusters and equipped with client / server architecture management software for automated operation and maintenance. The operation and maintenance content may include system-level indicator observation, such as basic indicators such as CPU, memory, disk, I / O, etc.; application component indicator observation, such as application components such as middleware, database, message queue, etc.; security status monitoring and configuration, such as whether the system security configuration is appropriate, whether security hardening is required, and whether the system has known vulnerabilities.

[0066] In client / server (C / S) architecture, automated operations and maintenance typically involve the server issuing commands to agents on client machines. These agents perform local operations and then send the results back. While this method works for observing performance metrics, it presents significant challenges for security status detection and configuration. Security considerations begin with threat models. Existing security status detection and configuration mechanisms rely on the assumption that clients faithfully transmit local configuration results, failing to account for malicious attacks on client machines. This assumption is unrealistic. A malicious attack could easily tamper with the local configuration results, removing or modifying insecure configuration items or information about known vulnerabilities before returning the data to the server. Implementing cluster security checks using trusted computing can address this issue, but traditional policy-based configuration results in numerous redundant files being measured. The processing flow based on this disclosed solution is as follows: Figure 3 As shown, the following steps may be included: Step 301: The administrator creates a minimal set of measurement files for system security configuration, such as PAM configuration files, SSHD configuration files, profile configuration files, etc., a measurement policy based on extended attributes, and a file tagging module, and provides a service interface.

[0067] Step 302: When the client machine starts up for the first time, it actively accesses the service interface to obtain relevant content and completes file marking and security policy loading locally.

[0068] Step 303: The server sends a security configuration detection request to the agent, which includes a request instruction and a challenge value (random number).

[0069] Step 304: The Agent performs a local configuration scan and obtains the results.

[0070] Step 305: The Agent sends a request to the Trusted Computing Platform module of the client machine with {scan result + random number} as the new challenge value.

[0071] Step 306: The Trusted Computing Platform module generates and signs a proof report, which includes the metrics related to the system security configuration file, and returns it to the Agent.

[0072] Step 307: The Agent sends the measurement logs and proof report to the server.

[0073] Step 308: The server first verifies the signature of the proof report and compares it with the baseline value in the system security configuration file. Only after confirming that there are no errors can it conclude that the client's security detection result is credible.

[0074] Example 2: A method for classifying the reliability of a system The required level of system trust may vary in different application scenarios. Generally, the higher the required level of system trust, the lower the system's availability. Based on the disclosed solution, a method for classifying system trust can be implemented, with the following steps: First, categorize all files in the system that have a security impact, for example: There are certain types of files that can be tampered with, such as / etc / passwd, / etc / shadow, and / etc / sudoers. Tampering with these files can lead to privilege escalation or complete system control. The second type of file, if tampered with, will have a significant impact on the security of certain critical services and applications of the system, such as / etc / ssh / sshd_config, / etc / nginx / nginx.conf, which may lead to service interruption, information leakage or partial control of the system; ...... Type N files, such as / tmp and / var / tmp, have a relatively small impact on the overall system security if tampered with.

[0075] Secondly, different security attributes are set for different types of files, such as security.level1, security.level2, ..., security.leveln. Different values ​​are also set for the same security attribute. For example, the security.measure extended attribute is set to 1, 2, 3, ..., N for different types of files. This method has better configurability.

[0076] Furthermore, configure a security policy based on extended attributes and modify the matching logic of the metric policy to add matching for different levels. For example, configure the metric policy as follows: measure func=FILE_CHECKxattr_name=security.measure xattr_value=n.

[0077] The matching workflow is as follows: When matching a policy, first check if the policy entry contains the xattr_name and xattr_value attributes. If they do not exist, return that the policy has been matched. If they do exist, proceed to the extended attribute matching logic. Retrieve the extended attribute value of the open file based on xattr_name in the policy entry; If no value is returned or the return value is greater than n, the policy is considered not to have been hit and no measurement is required; if the return value is less than n, the policy is considered to have been hit and the file is to be measured.

[0078] As a variation of the above method, a threat score can also be set for each file. This score reflects the degree of harm caused to the system if the file is tampered with. The `security.measure` attribute can be extended to include two attributes: one indicating the file's threat level (level), and the other indicating its threat score (score). Finally, the threat scores of untampered files are summed to obtain a final total score, which identifies the system's trusted programs. A higher score indicates a higher level of trustworthiness. A trust threshold can be set on the server side; when the system's trust score exceeds the threshold, the system is considered trustworthy.

[0079] This disclosure also provides a trust measurement apparatus for performing the trust measurement method provided in any of the above embodiments. Figure 4 As shown, the device includes: The first acquisition module 41 is used to acquire the target accessed file that currently triggers the measurement mechanism in the computer system; The second acquisition module 42 is used to acquire the extended attributes of the target accessed file and the measurement strategy corresponding to the target accessed file; The third acquisition module 43 is used to acquire newly added extended attributes in the measurement strategy; The fourth acquisition module 44 is used to acquire the file to be measured based on the extended attributes of the target accessed file and the newly added extended attributes; The measurement module 45 is used to perform a trust measurement on the file to be measured.

[0080] In an optional embodiment, the fourth acquisition module 44 is used for: Obtain the first attribute name of the extended attribute and the second attribute name of the newly added extended attribute; Find the initial file to be measured from the target accessed file whose first attribute name is the same as the second attribute name; Find the file to be measured from the initial file to be measured where the attribute value corresponding to the first attribute name is less than or equal to the attribute value corresponding to the second attribute name.

[0081] In an optional embodiment, the fourth acquisition module 44 is used for: When the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are both expressed in characters, the file in the initial file to be measured that has the same attribute value corresponding to the first attribute name and the same attribute value corresponding to the second attribute name is taken as the file to be measured. When both the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are expressed numerically, the file whose attribute value corresponding to the first attribute name is less than or equal to the attribute value corresponding to the second attribute name in the initial file to be measured is taken as the file to be measured.

[0082] In an optional embodiment, the device is also used for: After performing a trust measurement on the file to be measured, obtain the pre-configured threat score of the file to be measured; The trustworthiness of the computer system is obtained by summing the threat scores.

[0083] In an optional embodiment, the device is also used for: Retrieve the minimum set of metric files specified by the administrator, the extended attributes that the files need to be tagged, and the metric policy configured with the newly added extended attributes; Based on the extended attributes, the files in the computer system that belong to the minimum metric file set are marked; The tagged files in the computer system are written to the file system, and the measurement policy is written to the kernel.

[0084] In one optional embodiment, the minimum metric file set includes N types of files. Files belonging to the same type of file in the N types of files are marked with the same extended attributes. The difference between the attribute value of the extended attribute to be marked for the (M+1)th type of file in the minimum metric file set and the attribute value of the extended attribute to be marked for the Mth type of file is 1. The security impact of tampering with the Mth type of file on the computer system is greater than the security impact of tampering with the (M+1)th type of file on the computer system, where M≤N.

[0085] In an optional embodiment, the extended attributes that the files need to be tagged also include a threat score, and files belonging to the same class of files in the N categories have different threat scores in the extended attributes.

[0086] The trust measurement device and the trust measurement method provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0087] This disclosure also provides an electronic device for performing the above-described trust measurement method. Please refer to... Figure 5 It illustrates a schematic diagram of an electronic device provided by some embodiments of this disclosure. For example... Figure 5 As shown, the electronic device 5 includes: a processor 500, a memory 501, a bus 502, and a communication interface 503. The processor 500, the communication interface 503, and the memory 501 are connected via the bus 502. The memory 501 stores a computer program that can run on the processor 500. When the processor 500 runs the computer program, it executes the reliability measurement method provided in any of the foregoing embodiments of this disclosure.

[0088] The memory 501 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this device network element and at least one other network element is achieved through at least one communication interface 503 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0089] Bus 502 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 501 is used to store programs. After receiving an execution instruction, the processor 500 executes the program. The reliability measurement method disclosed in any of the foregoing embodiments of this disclosure can be applied to the processor 500, or implemented by the processor 500.

[0090] The processor 500 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 500 or by instructions in software form. The processor 500 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 501. The processor 500 reads the information in memory 501 and, in conjunction with its hardware, completes the steps of the above method.

[0091] The electronic device provided in this disclosure and the trust measurement method provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they employ, operate, or implement.

[0092] This disclosure also provides a computer-readable storage medium corresponding to the medium-credibility measurement method provided in the foregoing embodiments. The computer-readable storage medium is an optical disc, on which a computer program (i.e., a computer program product) is stored. When the computer program is run by a processor, it executes the medium-credibility measurement method provided in any of the foregoing embodiments.

[0093] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0094] The computer-readable storage medium provided in the above embodiments of this disclosure and the reliability measurement method provided in the embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0095] This disclosure also provides a computer program product; please refer to [reference needed]. Figure 6 The computer program product 600 carries program code, namely computer program 601. The instructions included in the computer program 601 can be used to execute the steps of the reliability measurement method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0096] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0097] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0098] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0099] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0100] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0101] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0102] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0103] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A trust measurement method, characterized by, The method comprises the following steps: acquiring a target accessed file of a current trigger metric mechanism in a computer system; acquiring an extended attribute of the target accessed file and a metric policy corresponding to the target accessed file; acquiring a new extended attribute in the metric policy; acquiring a file to be measured based on the extended attribute of the target accessed file and the new extended attribute; performing trusted measurement on the file to be measured.

2. The method of claim 1, wherein, The acquiring of the file to be measured based on the extended attribute of the target accessed file and the new extended attribute comprises the following steps: acquiring a first attribute name of the extended attribute and a second attribute name of the new extended attribute; finding an initial file to be measured with the same first attribute name and second attribute name from the target accessed file; finding the file to be measured with an attribute value corresponding to the first attribute name being less than or equal to an attribute value corresponding to the second attribute name from the initial file to be measured.

3. The method of claim 2, wherein, The finding of the file to be measured with the attribute value corresponding to the first attribute name being less than or equal to the attribute value corresponding to the second attribute name from the initial file to be measured comprises the following steps: in a case that the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are both expressed by characters, taking a file with the same attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name in the initial file to be measured as the file to be measured; in a case that the attribute value corresponding to the first attribute name and the attribute value corresponding to the second attribute name are both expressed by numerical values, taking a file with the attribute value corresponding to the first attribute name being less than or equal to the attribute value corresponding to the second attribute name in the initial file to be measured as the file to be measured.

4. The method of claim 1, wherein, After the trusted measurement on the file to be measured, the method further comprises the following steps: acquiring a threat score of the file to be measured pre-configured; summing the threat score to obtain a trusted degree of the computer system.

5. The method of claim 1, wherein, The method further comprises the following steps: acquiring a minimum file set to be measured, an extended attribute of a file to be marked, and a metric policy configured with a new extended attribute indicated by an administrator; marking a file belonging to the minimum file set to be measured in the computer system based on the extended attribute; writing the file marked in the computer system into a file system, and writing the metric policy into a kernel.

6. The method of claim 5, wherein, The minimum file set to be measured comprises N types of files, the extended attribute of a file belonging to a same type of file in the N types of files is the same, a difference between an attribute value of the extended attribute of a file to be marked of an (M+1)th type of file and an attribute value of the extended attribute of a file to be marked of an Mth type of file is 1, a security impact of the Mth type of file after being tampered with on the computer system is greater than a security impact of the (M+1)th type of file after being tampered with on the computer system, and M≤N.

7. The method of claim 6, wherein, The extended attribute of the file to be marked further comprises a threat score, and the threat scores of the extended attributes of the files belonging to the same type of file in the N types of files are different.

8. A trust metric device, comprising: The method comprises the following steps: A first obtaining module is configured to obtain a target accessed file triggering a measurement mechanism in a computer system; A second obtaining module is configured to obtain an extended attribute of the target accessed file and a measurement policy corresponding to the target accessed file; A third obtaining module is configured to obtain a newly added extended attribute in the measurement policy; A fourth obtaining module is configured to obtain a file to be measured based on the extended attribute of the target accessed file and the newly added extended attribute; A measurement module is configured to perform a trusted measurement on the file to be measured.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program, when executed by the processor, is arranged to perform the method of any one of claims 1 to 8. The processor executes the computer program to implement the steps of the method in any one of claims 1-7.

10. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to implement the steps of the method in any one of claims 1-7.

11. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to implement the steps of the method in any one of claims 1-7.

Images