Trusted execution environment running state integrity measurement method facing TrustZone block chain node

Abstract

The invention discloses a TrustZone block chain node-oriented trusted execution environment running state integrity measurement method, which relates to the field of computer technology and information security, and is composed of a strategy management module, an integrity measurement module, an evaluation module and a security log construction module. According to the method, the kernel, the static component, the trusted application and the system call in the trusted execution environment of the block chain node equipment can be measured, evaluated and recorded, and a complete log of the component and the event which influence the integrity during operation in the trusted execution environment is formed. The method is used for solving the problem that the integrity of the existing ARM TrustZone block chain node equipment is difficult to ensure when the equipment runs in the trusted execution environment, so that the node is trusted in the whole life cycle, and the integrity measurement of the running state of the TrustZone block chain node in the trusted execution environment is safely and efficiently realized.

Description

Technical Field

[0001] This application relates to the fields of computer technology and information security technology, specifically to a trusted protection technology for blockchain nodes based on the TrustZone trusted execution environment, and a method for measuring the runtime integrity of the trusted execution environment for TrustZone blockchain nodes. Background Technology

[0002] The rapid development of IoT and edge computing technologies has driven the widespread application of blockchain technology, with its nodes increasingly deployed in gateways, industrial terminals, and various resource-constrained embedded devices. However, these nodes typically need to be online for extended periods and continuously interact with external networks, undertaking security-sensitive tasks such as transaction verification, consensus participation, and key management. To protect critical code and data within these nodes, Trusted Execution Environment (TEE) technology has been introduced to provide hardware-level roots of trust and isolated execution environments. ARM TrustZone is particularly prevalent in embedded and IoT devices. This technology, by dividing the rich execution environment into a rich execution environment and a trusted execution environment, allows security services to run within an isolated domain, thereby mitigating the direct impact on sensitive data when the rich execution environment is attacked.

[0003] However, due to design and implementation limitations, ARM TrustZone does not provide common mechanisms for ensuring device and system security and trustworthiness, such as secure boot, runtime integrity protection, and remote authentication. This allows nodes to potentially compromise system trustworthiness during startup or operation—for example, by launching boot attacks using incomplete boot chains, tampered or rolled-back firmware and kernels; or by achieving continuous control during operation through vulnerability exploitation, memory corruption, and malicious component loading. If a node participates in consensus and transaction processing in an untrusted state, attackers may steal keys, forge transaction results, or interfere with the consensus process, thereby compromising the security and availability of the blockchain system. Therefore, improving node trustworthiness requires ensuring its security and trustworthiness throughout its entire lifecycle. Current technologies typically achieve this goal through secure boot, introducing integrity measurement mechanisms during the runtime phase, and combining this with remote proof to provide trustworthy measurement evidence to external verifiers.

[0004] For blockchain nodes using TrustZone, the above mechanism still has shortcomings: First, the secure boot scheme terminates the trusted chain after static image verification, making it difficult to continuously reflect runtime state changes; second, existing runtime integrity protection focuses primarily on objects within the rich execution environment, often lacking runtime integrity protection for critical components within the trusted execution environment, leading to the neglect of the trusted execution environment's state and consequently affecting node security services and overall trust assurance. Therefore, a method for runtime integrity protection of the trusted execution environment is needed for TrustZone devices, especially blockchain nodes. Summary of the Invention

[0005] In view of the above problems, this invention proposes a method for measuring the runtime integrity of TrustZone blockchain nodes in a Trusted Execution Environment (TEE). This method deploys a security measurement agent within the TEE kernel to selectively measure, locally evaluate, and securely record the kernel, static components, trusted applications, and system calls within the TEE under policy control, forming a complete log of components and events affecting runtime integrity within the TEE. This invention effectively solves the problem of unreliable node trust throughout its entire lifecycle caused by the difficulty in guaranteeing runtime integrity in the TEE of existing blockchain node devices based on ARM TrustZone technology, thereby improving the security and trustworthiness of TrustZone-based devices.

[0006] This invention provides a method for measuring the runtime integrity of a trusted execution environment for TrustZone blockchain nodes, including: I. A policy management module that supports runtime integrity measurement of trusted execution environments for TrustZone blockchain nodes, including: (1) Strategy design: A strategy consists of one or more strategy rules ( Each policy rule is composed of a triple, which contains an action () ), an event type ( ) and a set of optional conditions ( ):

[0007] Actions support four types: measure, ignore measure, evaluate, and ignore evaluation; The event types support six types: kernel loading, static component loading, trusted application loading, trusted application metadata inspection, trusted application invocation, and execution of system calls; Five optional conditions are supported: Trusted Application UUID, Target UUID, System Call ID, Trusted Application Command ID, and Remeasurement Period; (2) The steps for applying the strategy include: Step 1: During the trusted execution environment kernel image building process, the trusted third party compiles the policy set into a binary data file and embeds it into the image; Step 2: During the kernel initialization of the trusted execution environment, the binary data file is loaded and parsed. After that, each It is parsed into a structure and a linked list of structures is constructed and stored in the kernel memory area of ​​the trusted execution environment; Step 3: When an integrity event occurs, the security measurement agent subsystem sequentially traverses the structure linked list and uses a bitmask-based matcher to match the corresponding... And the first complete match Stop here; Step 4, the security measurement agent according to Statement Perform the corresponding operation.

[0008] II. A measurement module that supports runtime integrity measurement of trusted execution environments for TrustZone blockchain nodes, including: (1) Static measurement methods for runtime integrity measurement of TrustZone blockchain nodes' trusted execution environment, including: static measurement of the trusted execution environment kernel, static measurement of static components, static measurement of trusted applications, and static measurement of trusted application metadata: (1-1) Static metrics for the Trusted Execution Environment (TEE) kernel: After the TEE kernel is loaded into memory, the security metrics agent performs the following metrics: , , The key segments of kernel metadata are hashed independently, and the hash results of each segment are combined into a hash chain, the result is hashed and recorded. (1-2) Static measurement for static components: After the trusted execution environment kernel completes the static measurement, the security measurement agent measures and records the metadata of the loaded static components in sequence; (1-3) Static metrics for trusted applications: After the binary data of a trusted application is loaded into memory, the security metrics agent performs the following: , , Perform hash calculations independently for each segment, and finally combine the hash results of each segment into a hash chain, calculate the hash of the result, and record it. (1-4) Static measurement of trusted application metadata: After the static measurement of trusted application is completed, the security measurement agent hashes and records the metadata of trusted application: stack size, heap configuration and flag bit calculation results; (2) A dynamic measurement method for runtime integrity measurement of the trusted execution environment for TrustZone blockchain nodes, including: dynamic measurement for trusted application calls, dynamic measurement for communication between trusted applications, and dynamic measurement for system calls: (2-1) Dynamic measurement of trusted application calls: When a trusted application session is opened and a trusted application command is invoked, the call is intercepted and the data is parsed, including: the trusted application's UUID, command ID, and call parameters; after the call is completed, the parsed data and execution results are recorded; (2-2) Dynamic measurement of communication between trusted applications: When a session of a trusted application in kernel mode is opened and a command of a trusted application is invoked, the call is intercepted and the data is parsed, including: the UUID of the trusted application that initiates the call, the UUID of the trusted application that is called, the command ID and the call parameters; after the call is completed, the parsed data and the execution result are recorded. (2-3) Dynamic measurement of system calls: When a system call is triggered, the call is intercepted and the data is parsed, including: caller UUID, operation type, and call parameters; after the call is completed, the parsed data and execution result are recorded; (3) A time-based remeasurement method for runtime integrity measurement of TrustZone blockchain nodes' trusted execution environment: When a system call is triggered, the security metrics agent first checks if the timer has exceeded the set time interval. If it has, it will detect the error. and Each segment is hashed independently, compared with the baseline value, and the comparison result is recorded. Finally, the timer is restarted.

[0009] III. An evaluation module that supports runtime integrity measurement of trusted execution environments for TrustZone blockchain nodes, including: (1) Design of a reference value list to support the evaluation mechanism, wherein the reference value list consists of one or more reference values ​​( Each reference value is a triple, containing a component UUID ( ), an expected summary ( ) and a minimum acceptable version ( ):

[0010] (2) The application steps of the evaluation include: Step 1: During the construction of the trusted execution environment kernel image, the trusted third party first generates a list of reference values, then signs it with a private key, and finally compiles the list of reference values ​​and the signature together into a binary data file, and then embeds the data file and the signature verification public key into the image. Step 2: During the initialization of the trusted execution environment kernel, after the binary data file and signature verification public key are loaded, the signature is first verified. If the verification is successful, the signature is parsed within the trusted execution environment. After that, each It is parsed into a structure and a linked list of structures is constructed and stored in the kernel memory area of ​​the trusted execution environment; Step 3: When a local evaluation event occurs, the security metrics agent subsystem first uses the component UUID to sequentially traverse the linked list of structures to locate the corresponding event. ; Step 4, the security metric agent will calculate the summary and... Statement Compare and record the results; Step 5, the security metrics agent compares the component version with... Statement Compare the results and record them.

[0011] IV. A security log construction module that supports runtime integrity measurement of trusted execution environments for TrustZone blockchain nodes, including: (1) Security Measurement Log ( )design: It is a tamper-proof log structure used to store recorded integrity events; the log consists of a hash chain, with each entry ( ) is a quadruple:

[0012] Among them, event data ( ) represents the captured event-specific context, entry size ( ) represents the full length of this entry, and the evaluation result ( Stores the local evaluation results of this event, entry header ( ) is a quadruple:

[0013] Virtual PCR ( The hash value representing this entry is stored in this... In the middle, event types ( ) represents the type of this integrity event, hash( This stores the hash value of this entry, and the hash of the previous entry ( () represents the entry to which this entry is bound; (2) Virtual PCR )design: Four 32-byte blocks maintained for the security metrics agent For expansion The hash value, four Extend different types of events respectively Hash value: Used to store static measurement events of the trusted execution environment kernel; Used to store static measurement events of static components; Used to store static measurement events for trusted applications; Used to store dynamic measurement events.

[0014] The beneficial effects of the embodiments of this application are as follows: This application provides a method for runtime integrity measurement of the trusted execution environment for TrustZone blockchain nodes. By deploying a security measurement agent within the trusted execution environment, selective integrity measurement and evaluation are performed on the trusted execution environment kernel, static components, trusted applications, and system calls under policy control. A tamper-proof security log is constructed to record runtime integrity events. Therefore, this application provides runtime integrity assurance for TrustZone-based blockchain nodes throughout their entire lifecycle without relying on an untrusted rich execution environment.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0016] Figure 1 A schematic diagram of the system framework provided for an embodiment of this application; Figure 2 A workflow diagram provided for an embodiment of this application; Detailed Implementation To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0017] like Figure 1 The diagram shown is a schematic representation of the system framework of an embodiment of this application; as follows: Figure 2 As shown, the system using this embodiment includes two participants, identified by purple text in the diagram: (1) Participant 1 is a trusted third party. In this embodiment, it is assumed that the entity is trusted by other participants, its local execution environment is secure, all local programs and data are well protected, it can provide a customized trusted execution environment kernel image with an embedded security metric agent, it also maintains a list of reference values ​​for trusted execution environment kernels and trusted applications, and acts as a certificate authority to create and provide identities and issue certificates for devices and verifiers. (2) Participant 2 is a blockchain node device that supports TrustZone. It can be used to run consensus protocols. It supports secure boot and rich execution environment runtime integrity protection. It requires trusted execution environment runtime integrity measurement. It can establish a secure network connection with trusted third parties and support running a secure measurement agent. The following content uses the example of a blockchain administrator wanting to initialize and run a TrustZone-enabled blockchain node and perform runtime integrity metrics of the trusted execution environment to monitor its runtime state. Figure 1 The device architecture after applying this embodiment is shown. Figure 2 The detailed execution steps for this example are shown below: Step 1: The device registers with a trusted third party to obtain a key and certificate, as follows: The device registers with a trusted third party, which then generates the necessary data. (1) Generate the root key of the device ( / ), and use a key from a trusted third party ( ) Sign certificate ( ); (2) Generate policy groups to drive runtime integrity of the trusted execution environment; (3) Generate a list of reference metrics for trusted applications running in the trusted execution environment within the device. ), and use a private key ( )right sign; (4) Generate a trusted execution environment kernel image that supports runtime integrity protection (including a security measurement agent) for the trusted execution environment; at the same time, the image embeds and Used to verify signatures; (5) Finally, the trusted third-party generated device can start the image. And the keys used to perform secure boot and deploy them to the device.

[0018] Step 2, the device securely starts up and initializes the security measurement agent, the steps are as follows: (1) The equipment performs a safe startup process, from The system reads, verifies, loads, and executes the FSBL, SSBL, and ARM Trusted Firmware (ATF) respectively. Finally, the ATF verifies the signature of the Trusted Execution Environment kernel, and if it passes the verification, the Trusted Execution Environment kernel is loaded into the secure memory space allocated by the device for the Trusted Execution Environment. (2) Trusted execution environment kernel initialization, execution memory address allocation, operation context initialization and component loading process; (3) Security measurement agent initialization: (3-1) First, the security measurement agent operation handle and memory space initialization are performed. In the trusted execution environment kernel, the security measurement agent context allocation and storage structure initialization are performed first, including: initialization and The initialization operation module includes: a policy management module, a measurement module, an evaluation module, and a security log construction module. (3-2) Then, the security measurement agent data initialization is performed: The trusted execution environment kernel first reads multiple keys embedded in the image, including: and ; (3-3) The trusted execution environment kernel reads the policy group embedded in the image and stores it in the trusted execution environment memory as a linked list data structure; (3-4) Then load the embedded image. and use The signature is verified, and once verified, it is stored in the trusted execution environment memory as a linked list of data structures. (4) The security metrics agent performs static metrics for the kernel and static components: (4-1) The security measurement agent first obtains , , The start and end addresses of critical segments of the segment and kernel metadata are determined, and then SHA-256 hashes are performed independently on each segment. Finally, the hash results and the metadata of this integrity event, such as the event type, are recorded in a new... In the end, the calculation is performed. The SHA-256 hash result and extended middle; (4-2) The security measurement agent traverses the list of static components stored in the trusted execution environment kernel, obtains the metadata of each static component, and records it to a new file. In the end, the calculation is performed. The SHA-256 hash result and extended middle; (4-3) The security measurement agent will connect the trusted execution environment kernel. and The SHA-256 hash of the segment is stored in a special structure as a reference value for subsequent time-based recalculations.

[0019] 3. In step 3, the device begins operation, and trusted applications and services are dynamically loaded into memory for execution and invocation. This includes the following integrity events that trigger the security measurement agent: (1) Trusted application is loaded into memory for execution: When the binary data of a trusted application is about to be loaded into memory, the security measurement agent in the loader (such as OP-TEE) performs the following: When loading a binary file, the security metrics agent obtains its load address and reads its metadata from the file header, including stack size, heap configuration, and flags. Then, after the binary file is loaded into memory, the security metrics agent obtains the trusted application's... , , The start and end addresses of the segment are determined, and then SHA-256 hashes are performed independently on each. The hash results and the metadata of this integrity event are then recorded in a new... In the end, the calculation is performed. The SHA-256 hash result and extended In the middle; finally, the security measurement agent records the metadata of trusted applications in the same way to a new... In the end, the calculation is performed. The SHA-256 hash result and extended The measurement of trusted application loading events is completed within the framework; (2) Trusted application call: When a trusted application session is opened and a trusted application command is invoked, the security measurement agent first intercepts the call and parses the trusted application's UUID, command ID, and call parameters from the parameter structure of the invoked command. Then, it records these contents to a new... In the end, the calculation is performed. The SHA-256 hash result and extended The measurement of trusted application invocation events is completed within the framework; (3) Communication between trusted applications: When a session of a kernel-mode trusted application is opened and a command of a trusted application is invoked, the security measurement agent first intercepts the call and parses the following from the parameter structure of the invoked command: the UUID of the trusted application initiating the call, the UUID of the trusted application being called, the command ID, and the call parameters. Then, it records these contents into a new... In the end, the calculation is performed. The SHA-256 hash result and extended The measurement of trusted application invocation events is completed within the framework; (4) System call: When a system call is triggered, the call is intercepted and the data is parsed, including: the caller's UUID, the operation type, and the call parameters. Then, the SHA-256 hash value of the call parameters is calculated, and this information is recorded in a new... Afterwards, wait for the system call to complete; once the system call is complete, calculate the SHA-256 hash value of the returned parameters and parse the system call return value. Finally, record the hash value of the returned parameters and the system call return value in this... In the end, the calculation is performed. The SHA-256 hash result and extended The measurement of trusted application invocation events is completed in the middle.

[0020] In this way, administrators can deploy a blockchain node device that supports runtime integrity measurement of the TrustZone blockchain. By combining the secure boot mechanism and runtime integrity verification of the rich execution environment, they can ensure the security and trustworthiness of the TrustZone blockchain node throughout its entire lifecycle.

[0021] The above examples are only used to illustrate the technical methods of the present invention and are not intended to limit it. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention without departing from the spirit and scope of the present invention. The scope of protection of the present invention should be determined by the claims.

Claims

1. A method for measuring the runtime integrity of a trusted execution environment for TrustZone blockchain nodes, characterized in that: Design and implement a security metrics agent supporting the method in the trusted execution environment kernel supported by ARM TrustZone, the design including: A strategy management module that supports the method described above; A measurement module that supports the method described above; An evaluation module that supports the method described above; A security log building module that supports the method described above.

2. The policy management module for supporting runtime integrity measurement of a trusted execution environment for TrustZone blockchain nodes as described in claim 1, characterized in that, The module includes: (2-1) A strategy design supporting the module, the design comprising: A strategy consists of one or more strategy rules ( Each policy rule is composed of a triple, which contains an action () ), an event type ( ) and a set of optional conditions ( ): Actions support four types: measure, ignore measure, evaluate, and ignore evaluation; The event types support six types: kernel loading, static component loading, trusted application loading, trusted application metadata inspection, trusted application invocation, and execution of system calls; Five optional conditions are supported: Trusted Application UUID, Target UUID, System Call ID, Trusted Application Command ID, and Remeasurement Period; (2-2) A policy application step supporting the module, the step comprising: Step 1: During the trusted execution environment kernel image building process, the trusted third party compiles the policy set into a binary data file and embeds it into the image; Step 2: During the kernel initialization of the trusted execution environment, the binary data file is loaded and parsed. After that, each It is parsed into a structure and a linked list of structures is constructed and stored in the kernel memory area of ​​the trusted execution environment; Step 3: When an integrity event occurs, the security measurement agent subsystem sequentially traverses the structure linked list and uses a bitmask-based matcher to match the corresponding... And the first complete match Stop here; Step 4, the security measurement agent according to Statement Perform the corresponding operation.

3. The measurement module for supporting runtime integrity measurement of a trusted execution environment for TrustZone blockchain nodes as described in claim 1, characterized in that, The module includes: (3-1) A static measurement method supporting the module, the method comprising: (3-1-1) Static metrics for the Trusted Execution Environment (TEE) kernel: After the TEE kernel is loaded into memory, the security metrics agent performs the following metrics: , The key segments of kernel metadata are hashed independently, and the hash results of each segment are combined into a hash chain, the result is hashed and recorded. (3-1-2) For static measurement of static components, after the trusted execution environment kernel finishes static measurement, the security measurement agent measures and records the metadata of the loaded static components in sequence; (3-1-3) For static metrics of trusted applications, after the binary data of the trusted application is loaded into memory, the security metrics agent performs the following: , , Perform hash calculations independently for each segment, and finally combine the hash results of each segment into a hash chain, calculate the hash of the result, and record it. (3-1-4) Static measurement of trusted application metadata: After the static measurement of trusted application is completed, the security measurement agent hashes and records the metadata of trusted application: stack size, heap configuration and flag bit calculation results of trusted application. (3-2) A dynamic measurement method supporting the module, the method comprising: (3-2-1) For dynamic measurement of trusted application calls, when a trusted application session is opened and a trusted application command is invoked, the call is intercepted and the data is parsed, including: the trusted application's UUID, command ID, and call parameters; after the call is completed, the parsed data and execution results are recorded; (3-2-2) For dynamic measurement of communication between trusted applications, when a session of a trusted application in kernel mode is opened and a command of a trusted application is invoked, the call is intercepted and the data is parsed, including: the UUID of the trusted application that initiates the call, the UUID of the trusted application that is called, the command ID and the call parameters; after the call is completed, the parsed data and the execution result are recorded. (3-2-3) For dynamic measurement of system calls, when a system call is triggered, the call is intercepted and the data is parsed, including: caller UUID, operation type, and call parameters; after the call is completed, the parsed data and execution result are recorded; (3-3) A time-based remeasurement method supporting the module, the method comprising: When a system call is triggered, the security metrics agent first checks if the timer has exceeded the set time interval. If it has, it will flag the kernel or trusted applications. and Each segment is hashed independently, compared with the baseline value, and the comparison result is recorded. Finally, the timer is restarted.

4. The evaluation module for supporting runtime integrity measurement of a trusted execution environment for TrustZone blockchain nodes as described in claim 1, characterized in that, The module includes: (4-1) A reference value list design supporting the module, the design comprising: The reference value list consists of one or more reference values ​​( Each reference value is a triple, containing a component UUID ( ), an expected summary ( ) and a minimum acceptable version ( ): (4-2) An evaluation application step supporting the module, the step comprising: Step 1: During the construction of the trusted execution environment kernel image, the trusted third party first generates a list of reference values, then signs it with a private key, and finally compiles the list of reference values ​​and the signature together into a binary data file, and then embeds the data file and the signature verification public key into the image. Step 2: During the initialization of the trusted execution environment kernel, after the binary data file and signature verification public key are loaded, the signature is first verified. If the verification is successful, the signature is parsed within the trusted execution environment. After that, each It is parsed into a structure and a linked list of structures is constructed and stored in the kernel memory area of ​​the trusted execution environment; Step 3: When a local evaluation event occurs, the security metric agent subsystem first uses the component UUID to sequentially traverse the linked list of structures to locate the corresponding event. ; Step 4, the security metric agent will calculate the summary and... Statement Compare and record the results; Step 5, the security metrics agent compares the component version with... Statement Compare the results and record them.

5. A security log construction module for supporting runtime integrity measurement of a trusted execution environment for TrustZone blockchain nodes as described in claim 1, characterized in that, The module includes: (5-1) A security metric log ( The design is a tamper-proof log structure used to store recorded integrity events; the log consists of a hash chain, with each entry ( ) is a quadruple: Among them, event data ( ) represents the captured event-specific context, entry size ( ) represents the full length of this entry, and the evaluation result ( Stores the local evaluation results of this event, entry header ( ) is a quadruple: Virtual PCR ( The hash value representing this entry is stored in this... In the middle, event types ( ) represents the type of this integrity event, hash( This stores the hash value of this entry, and the hash of the previous entry ( () represents the entry to which this entry is bound; (5-2) A virtual PCR ( The design, which maintains four 32-byte blocks for the security metric agent, is described. For expansion The hash value, four Extend different types of events respectively Hash value: Used to store static measurement events of the trusted execution environment kernel; Used to store static measurement events of static components; Used to store static measurement events for trusted applications; Used to store dynamic measurement events.

Images