Built-in characterization and measurement engine for virtual functions

Abstract

The present invention relates to an embedded characterization and measurement engine (CME1) for a virtual function (VF) in an infrastructure (I), which is configured to: - when the virtual function (VF) is instantiated in the infrastructure (I) and executed in the infrastructure (I), calculate a fingerprint (F1) based on static characteristics (C1), which static characteristics (C1) are extracted from the whole or part (P1) of the virtual function (VF); - perform local attestation (A1) by comparing the fingerprint (F1) with an initial fingerprint (F0) or send the fingerprint (F1) to a remote verification device (V) for remote attestation (A2); and - if the fingerprint (F1) differs from the initial fingerprint (F0), send a notification (N1, N2) to an external entity (E) for future action (Ac).

Description

[Technical Field]

[0001] The present invention relates to an embedded characterization and measurement engine for virtual functions. The present invention also relates to a computer-implemented invocation method for invoking virtual functions. Such an embedded characterization and measurement engine may be used in non-limiting examples for any secure integrity check of virtual functions. [Background technology]

[0002] Currently, virtualization technology using virtual functions is primarily used in cloud services and telecommunication network services to meet the requirements of scalability, flexibility, reliability, and rapid service creation. However, this new technology also brings new security challenges. One malicious virtual function can attack virtual functions residing on the same physical host. A method to control this threat, known to those skilled in the art, is to perform an integrity check of all virtual functions executed on the physical host. This integrity check is performed at the boot time of the virtual function, during the instantiation of the virtual function and before the virtual function is executed in its execution environment. The virtual function is not yet running. This integrity check, called secure boot, can be remotely verified using a remote attestation process in which the integrity values ​​of all single parts of the virtual function are combined in a report and sent to a remote verification device, which verifies the integrity values ​​of the virtual functions according to pre-stored values ​​on a remote server, called a high-quality measurement.

[0003] One problem with this prior art is that this verification of the integrity value against high-quality measurements during boot time is no longer possible during configuration time and during runtime, when virtual functions are executed after instantiation, because some configurations, addresses, and data may change during these phases. Therefore, the integrity value calculated during configuration time or runtime is different from the high-quality measurements. Therefore, it does not detect modifications and tampering of virtual functions by malware during configuration time and runtime.

[0004] It is an object of the present invention to provide a built-in characterization and measurement engine for virtual functions that solves the above-mentioned problems. Summary of the Invention

[0005] To this end, an embedded characterization and measurement engine for virtual functions in the infrastructure is provided, the embedded characterization and measurement engine comprising: Calculating a fingerprint based on static characteristics of a virtual function when the virtual function is instantiated and executed within the infrastructure, the static characteristics being extracted from the entire virtual function or a portion of the virtual function; - performing local attestation by comparing said fingerprint with an initial fingerprint or transmitting said fingerprint to a remote verification device for remote attestation; - if the fingerprint differs from the initial fingerprint, sending a notification to an external entity for further action.

[0006] As will be seen in more detail, since the fingerprint is based on static properties, the static properties do not change during instantiation of the virtual function or during configuration or runtime, and thus the fingerprint can be used to check the integrity of different sensitive portions of the virtual function when executed based on a comparison with an initial pre-stored fingerprint based on the same static properties.

[0007] According to non-limiting embodiments of the present invention, the built-in characterization and measurement engine for virtual functions further includes the following properties:

[0008] In a non-limiting embodiment, the portion of the virtual function is a loop of the virtual function that is executed frequently and / or a portion that, if tampered with, affects the security of the virtual function.

[0009] In non-limiting embodiments, the static properties include static data, and / or static source addresses, and / or static jump addresses, and / or recursive call graphs.

[0010] In a non-limiting embodiment, the fingerprint calculation is - calculating a characterization pattern that is a mapping of values ​​of each of these static characteristics with corresponding data regions or code regions for the static data and / or static source addresses and / or static jump addresses or a digital representation of the graph of the recursive call graph; - Computing a hash of the characterization pattern.

[0011] A computer-implemented download method for downloading a virtual function in an infrastructure is also provided, the computer-implemented download method comprising: downloading a computer program product associated with the virtual function using an initial fingerprint of the virtual function and an embedded characterization and measurement engine according to any of the aforementioned characteristics, or a reference to an embedded characterization and measurement engine according to any of the aforementioned characteristics.

[0012] According to a non-limiting embodiment of the present invention, the computer-implemented download method for downloading a virtual function within an infrastructure further includes the following characteristics.

[0013] In a non-limiting embodiment, the computer-implemented downloading method includes: - further comprising configuring the embedded characterization and measurement engine by setting parameters associated with the virtual function, the parameters including an indication as to whether static properties are extracted from the entire virtual function or from a portion thereof, and which portion is relevant.

[0014] In a non-limiting embodiment, the parameters further include an indication of the maximum duration of the setup phase when invoking the virtual function.

[0015] A characterization and measurement engine for virtual functions is also provided, the characterization and measurement engine comprising: Detecting static properties within the virtual function when the virtual function is executed; - calculating an initial fingerprint based on said static characteristics, said static characteristics being extracted from the whole or part of the virtual function; - storing said initial fingerprint.

[0016] The characterization and measurement engine is also called a test characterization and measurement engine. The characterization and measurement engine monitors the data, addresses, and calls generated by the virtual functions VF as they are executed in all possible execution cases during the initial phase.

[0017] According to a non-limiting embodiment of the present invention, the characterization and measurement engine for virtual functions further includes the following properties:

[0018] In a non-limiting embodiment, the portion is a loop of the virtual function that is executed frequently and / or a portion that, if tampered with, affects the security of the virtual function.

[0019] In non-limiting embodiments, the static properties include static data, and / or static source addresses, and / or static and jump addresses, and / or recursive call graphs.

[0020] In a non-limiting embodiment, the calculation of the initial fingerprint is: - calculating an initial characterization pattern, which is a mapping of values ​​of each of these static characteristics with corresponding data regions or code regions for the static data and / or static source addresses and / or static jump addresses or a digital representation of the graph of the recursive call graph; - Computing a hash of said initial characterization pattern.

[0021] Also provided is a computer-implemented invocation method for invoking a virtual function within an infrastructure, the invocation including a configuration phase and an execution phase that is performed after the configuration phase, the computer-implemented invocation method comprising: - initiating said virtual function within said infrastructure by first executing said configuration phase; - calculating a fingerprint of said virtual function along with the execution of said configuration phase by an embedded characterization and measurement engine corresponding to said virtual function; - comparing said fingerprint with an initial fingerprint during a configuration phase; - if the fingerprint differs from the initial fingerprint at the end of the configuration phase, sending a first notification to an external entity for future action; -If not, - executing an execution phase; - calculating, by said embedded characterization and measurement engine, fingerprints of said virtual functions along with the execution of said execution phase; - comparing said fingerprint with said initial fingerprint during said execution phase; - if the fingerprint during the execution phase differs from said initial fingerprint, sending a second notification to said external entity for future action; If not, restarting the execution of the boot.

[0022] According to a non-limiting embodiment of the present invention, the computer-implemented invocation method for invoking a virtual function within an infrastructure further includes the following characteristics.

[0023] In a non-limiting embodiment, the fingerprint comparison is a local proof performed by the embedded characterization and measurement engine.

[0024] In a non-limiting embodiment, the fingerprint comparison is a remote attestation performed by a remote verification device.

[0025] In a non-limiting embodiment, the end of the configuration phase is determined by the value of the fingerprint reaching the value of the initial fingerprint during the configuration phase, or by the duration of the configuration phase reaching a maximum duration.

[0026] In a non-limiting embodiment, the fingerprint is based on static characteristics, which are extracted from all or part of the virtual function.

[0027] In a non-limiting embodiment, the initial characterization pattern is in the form of a matrix that represents data regions and code regions with specific values ​​for each of these static properties.

[0028] In a non-limiting embodiment, the computer-implemented activation method further includes transmitting the fingerprint to the remote verification device.

[0029] In a non-limiting embodiment, the characterization pattern is in the form of a matrix that represents data regions and code regions with specific values ​​for each of these static properties.

[0030] In a non-limiting embodiment, the test characterization and measurement engine is software or hardware or a combination of both.

[0031] In a non-limiting embodiment, the embedded characterization and measurement engine is software or hardware or a combination of both.

[0032] In a non-limiting embodiment, the computer-implemented activation method further includes transmitting the fingerprint to the remote verification device.

[0033] Also provided is a computer program product for a computer comprising a set of instructions which, when loaded into said computer, cause the computer to carry out a computer-implemented activation method characterized by any of the aforementioned properties.

[0034] Also provided is a non-transitory machine-readable medium having stored thereon instructions that, when executed by a processor, cause the processor to perform a computer-implemented activation method characterized by any of the foregoing properties.

[0035] Also provided is a computer program product for a computer comprising a set of instructions which, when loaded into said computer, causes the computer to carry out a computer-implemented downloading method characterized by any of the aforementioned properties.

[0036] Also provided is a non-transitory machine-readable medium having stored thereon instructions that, when executed by a processor, cause the processor to perform a computer-implemented downloading method characterized in any of the foregoing. [Brief explanation of the drawings]

[0037] Some embodiments of methods and / or systems according to embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which: [Figure 1] FIG. 1 is a schematic diagram illustrating an embedded characterization and measurement engine for virtual functions that has as input the static characteristics of the virtual functions and as output a characteristic pattern in the form of a mapping matrix, in accordance with a non-limiting embodiment of the present invention. [Figure 2] 2 is a schematic diagram illustrating an infrastructure that hosts the virtual functions associated with the embedded characterization and measurement engine of FIG. 1, according to a non-limiting embodiment. FIG. [Figure 3] 2 is a schematic organizational diagram of a computer-implemented download method for downloading virtual functions using the embedded characterization and measurement engine or with reference to the characterization and measurement engine of FIG. 1, according to a non-limiting embodiment. [Figure 4]FIG. 2 is a schematic diagram of a virtual function characterization and measurement engine configured to compute an initial fingerprint of a virtual function, according to a non-limiting embodiment of the present invention. [Figure 5] 1 is a schematic organizational diagram of a computer-implemented invocation method for a virtual function in an infrastructure, in accordance with a non-limiting embodiment of the present invention, in which invocation includes a configuration phase and an execution phase that is executed after the configuration phase. [Figure 6] 6 is a continuation of the organizational chart of FIG. 5, according to a non-limiting embodiment. [Figure 7] 5 is a schematic diagram illustrating a test phase in which the characterization and measurement engine of FIG. 4 is invoked or executed, and a configuration phase and a run phase in which the embedded characterization and measurement engine of FIG. 1 is invoked or executed, according to a non-limiting embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0038] In the following description, functions or constructions well known to those skilled in the art will not be described in detail since they would obscure the present invention in unnecessary detail.

[0039] The present invention relates to an embedded characterization and measurement engine CME1 for a virtual function VF in an infrastructure I, which embedded characterization and measurement engine CME1 will be described with reference to Figure 1. The present invention also relates to a computer-implemented download method 1 for downloading a virtual function VF in an infrastructure I, which computer-implemented download method 1 will be described with reference to Figure 3. The present invention also relates to a characterization and measurement engine CME0 for a virtual function VF, which characterization and measurement engine CME0 will be described with reference to Figure 4. The present invention also relates to a computer-implemented invocation method 2 for invoking a virtual function VF in an infrastructure I, which computer-implemented invocation method 2 will be described with reference to Figure 5.

[0040] The embedded characterization and measurement engine CME1 is associated with a virtual function VF within the infrastructure I, as shown in Figure 2. In a non-limiting embodiment, the embedded characterization and measurement engine CME1 is associated with one or more virtual functions VF. The following relates to one virtual function VF in a non-limiting example. In a non-limiting embodiment, the infrastructure I is a single computer, server, or cloud infrastructure.

[0041] In a non-limiting embodiment, the infrastructure I includes physical resources HDW, also called hardware, distributed on a physical layer L_Phy, a host operating system H_OS, applications App distributed on an application layer L_App, and services S on the application layer L_App.

[0042] Virtualization technology makes it possible to create virtual machines VM and / or containers Co that implement virtual functions VF within the infrastructure I. Virtual machines VM and containers Co are well known to those skilled in the art and will not be described here. These virtual functions can be implemented on any layer of the infrastructure I, which can also implement services S.

[0043] A virtual function VF contains one or more functions. To execute a virtual function VF, it must be instantiated. When a virtual function VF is instantiated, some parameters are configured, some functions are enabled according to some settings of the parameters, some links are enabled with other virtual functions VF, etc. A virtual function VF contains static and non-static properties, i.e., dynamic properties. Static properties, unlike non-static properties, do not change during instantiation and execution of the virtual function VF.

[0044] As shown in FIG. 1, the embedded characterization and measurement engine CME1: When a virtual function VF is instantiated in an infrastructure I and executed in said infrastructure I, a fingerprint F1 is calculated based on static characteristics C1, which are extracted from the whole or part P1 of the virtual function VF (function denoted by f10(CME1 F1, C1, P1, VF)). Thus, either all static characteristics C1 of the virtual function VF are taken into account, or only a part of the static characteristics C1 of the virtual function VF are taken into account.

[0045] In a non-limiting embodiment, the portion P1 of the virtual function VF is a loop of the virtual function VF that is executed frequently and / or a portion that, if tampered with, affects the security of the virtual function VF, and therefore the latter portion relates to particularly sensitive data or code.

[0046] In the non-limiting embodiment shown in FIG. 1, the static characteristic C1 is: -Static data C1_0, and / or - static source address C1_1, and / or - static jump address C1_2, and / or -Contains recursive call graph C1_3.

[0047] These are the same as the static characteristics C0 that will be mentioned later for the characterization and measurement engine CME0.

[0048] The built-in characterization and measurement engine CME1 therefore makes it possible to calculate a fingerprint F1 characterizing a virtual function VF and to measure this characterization by designing the mapping of each of the static properties as follows:

[0049] For static data, static source addresses, and static jump addresses, the fingerprint F1 is based on a characterization pattern CP1, which is a mapping between the value of each of these static characteristics C1 and a corresponding data region or code region, as shown in Figure 1. A data region or code region is a data address or code address, respectively. For a recursive call graph, the fingerprint F1 is based on a characterization pattern CP1, which is a digital representation of the graph of the recursive call graph, as shown in Figure 1. In a non-limiting example, the digital representation is a file having a graph description language (e.g., .dot).

[0050] In a non-limiting embodiment, for static data, static source addresses, and static jump addresses, the mapping is in the form of a matrix M1 that represents the data region of the static data, the code region of the static source, and the jump address, with specific values ​​for each of these static properties and their addresses. Thus, for static data, there is a corresponding specific value and an address that is a memory address. Thus, for static sources and jump addresses, there is a corresponding specific value and code address.

[0051] In a non-limiting example, specific values ​​are: - A value of 1 is for data that remains static, - Value 2 is for static source addresses, - Value 3 is for static jump addresses.

[0052] Thus, matrix M1 includes locations with these values ​​as shown in Figure 1 and their corresponding addresses, designated "a" in Figure 1. In a non-limiting embodiment, other locations in matrix M1 are represented with the value 0 and the corresponding addresses.

[0053] In a non-limiting embodiment, the fingerprint F1 of the matrix M1 can be generated using a cryptographic algorithm. In a non-limiting embodiment, the fingerprint F1 is a hash, designated h in FIG. 1, of the matrix M1. With respect to the recursive call graph, in a non-limiting embodiment, the fingerprint F1 is a hash of the digital representation, as shown in FIG. 1. This fingerprint F1 is compared to a high-quality measurement, the initial fingerprint F0, described below. Note that any variation of the characterizing pattern CP1 will produce a different fingerprint F1.

[0054] Therefore, the calculation of the fingerprint F1 is - Computation of a characterization pattern CP1 (shown as function f110(CME1,CP1,M1)) which is a mapping of the values ​​of each of these static characteristics C1 with the corresponding data or code region (both designated "a" in FIG. 1); - Calculation of a hash h of said characterizing pattern CP1 (function f120(CME1, h, CP1, M1) is shown). The value of hash h is the fingerprint F1.

[0055] Once the fingerprint F1 is calculated, the embedded characterization and measurement engine CME1 is configured to either perform local attestation A1 by comparing the fingerprint F1 with the initial fingerprint F0 (function denoted by f11(CME1, A1, F1, F0)), or to send the fingerprint F1 to a remote verification device V for remote attestation A2 (function denoted by f12(CME1, V, F1, A2)).

[0056] In a non-limiting embodiment, the embedded characterization and measurement engine CME1 is the root of trust for measurements, called RTM. It runs in parallel with the CPU used to execute the virtual functions VF. Therefore, since the embedded characterization and measurement engine CME1 is sensitive, in a non-limiting embodiment it is located in the trusted execution environment TEE of a processor belonging to the infrastructure I.

[0057] When the virtual function VF is instantiated and executed within the infrastructure I, the static characteristics do not change, so the value of the fingerprint F1 does not change. Therefore, if it changes, it is different from the initial fingerprint F0, which means that malware has tampered with the virtual function VF. The calculation of the initial fingerprint F0 will be explained later.

[0058] In a non-limiting embodiment, the embedded characterization and measurement engine CME1 is software or hardware or a combination of both. The hardware or software can be implemented in several ways.

[0059] The hardware may be a single dedicated processor, a single shared processor, or multiple individual processors, some of which may be shared. Explicit use of the term "processor" should not be construed to refer exclusively to hardware capable of executing software, and may implicitly include, but is not limited to, digital signal processor (DSP) hardware, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), read-only memory (ROM) for storing software, and non-volatile storage. Other hardware, conventional and / or custom, may also be included.

[0060] The software may be implemented by a suitably programmed computer program product, which comprises a set of instructions that, when loaded into a computer, causes the computer to perform the functions described for the embedded characterization and measurement engine CME1. The set of instructions may be loaded into a programming memory by reading a data carrier, such as a disk. The programming memory is a non-transitory computer-readable storage medium comprising instructions that, when executed by a computer, cause the computer to perform the functions described for the embedded characterization and measurement engine CME1. A service provider may also make the set of instructions available via a communications network, such as the Internet.

[0061] 3 illustrates a computer-implemented download method 1 for downloading a virtual function VF in infrastructure I. When a VF is instantiated, it is downloaded to infrastructure I.

[0062] Since the built-in characterization and measurement engine CME1 corresponds to at least a specific virtual function VF, when a developer wants to use a computer program product Pg1 associated with the virtual function VF, the developer must associate the computer program product Pg1 with the corresponding built-in characterization and measurement engine CME1. To this end, the computer-implemented download method 1 includes: downloading a computer program product Pg1 associated with said virtual function VF using an initial fingerprint F0 of said virtual function VF, a corresponding built-in characterization and measurement engine CME1 (step E10 indicated by F10(Pg1,VF,F0,CME1)), or - comprising a reference Ref to the corresponding embedded characterization and measurement engine CME1 step E10', denoted F10'(Pg1,VF,F0,Ref(CME1)), which in this case means that the embedded characterization and measurement engine CME1 is not embedded in the infrastructure I, but in a remote server.

[0063] In a non-limiting embodiment, the computer-implemented download method 1 further comprises a step E11 of configuring the embedded characterization and measurement engine CME1 by setting parameters Pa associated with the virtual function VF, the parameters Pa including an indication i1 as to whether the static property C1 is extracted from the whole virtual function VF or from a part P1, and for which part P1 it is concerned. Thus, when the embedded characterization and measurement engine CME1 is executed, it knows exactly whether the fingerprint F1 of the virtual function VF must be calculated for the whole virtual function VF or only for the part P1, and in the latter case for which part P1 it must be calculated.

[0064] In a non-limiting embodiment, the parameter Pa further includes an indication of the maximum duration t1 of a configuration phase Ph1 (described below) when activating the virtual function VF, the expiration of which indicates an anomaly, as will be seen below.

[0065] Note that when a reference Ref is used, if the embedded characterization and measurement engine CME1 is software, there is a call to this software when the VF is started, and if it is hardware, there is an execution of this hardware when the VF is started.

[0066] As described above, fingerprint F1 is compared with initial fingerprint F0. Initial fingerprint F0 is calculated by a characterization and measurement engine CME0 for virtual function VF, also referred to as test characterization and measurement engine CME0, shown in FIG. 4. The characterization and measurement engine CME0 provides initial fingerprint F0 based on an initial characterization pattern CP0 of virtual function VF, which is used as a high-quality measurement of virtual function VF. This high-quality measurement is further checked with fingerprint F1 based on a running characterization pattern CP1 generated during execution of instantiated virtual function VF using a certification process.

[0067] During the initial phase Ph0, also referred to as the test phase Ph0 shown in FIG. 7 of the virtual function VF, i.e., before downloading the virtual function VF onto the infrastructure I, and therefore before instantiation of the virtual function VF in the final infrastructure I, the characterization and measurement engine CME0 monitors the data, addresses, and calls generated by the virtual function VF as it executes in all possible execution cases. In all possible execution cases, this means entering all branches of the virtual function VF. During this test phase Ph0, an instantiation of the virtual function VF still exists, for example, on the developer's computer executing the test phase Ph0. To simplify FIG. 7, the matrix M0 (described below) is shown with white dots for 0 values ​​and gray dots for other values ​​in its different positions.

[0068] In particular, the test characterization and measurement engine CME0: - Finding a static property C0 in the virtual function VF when the virtual function VF is being executed (shown as function f20(CME0, C0, VF)); - calculating an initial fingerprint F0 based on said static characteristics C0, which are extracted from all or part P1 of a virtual function VF (the function f21(CME0, F0, C0, P1) is shown), - memorize said initial fingerprint F0 (function f22(CME0, F0, Mem) is shown);

[0069] In a non-limiting embodiment, the test characterization and measurement engine CMEO is software or hardware or a combination of both. The definitions of hardware and software described above for the embedded characterization and measurement engine CMEO can be applied to the test characterization and measurement engine CMEO.

[0070] Therefore, either all static properties C0 of the virtual function VF are considered, or only a part of the static properties C0 of the virtual function VF is considered.

[0071] The detection of the characteristic C0 is performed in all branches of the virtual function VF.

[0072] In the non-limiting embodiment shown in FIG. 1, the static characteristic C0 is: -Static data C0_0, and / or - static source address C0_1, and / or - static jump address C0_2, and / or -Contains the recursive call graph C0_3.

[0073] In a non-limiting embodiment, said portion P1 is a loop of the virtual function VF that is executed frequently and / or a portion that, if tampered with, affects the security of the virtual function VF, these latter portions being particularly related to sensitive data or code.

[0074] In a non-limiting example, a static source address may allow access to sensitive data such as a private key for authentication of a virtual function VF used as a network core function. Modification of this private key by an attacker may generate an error during authentication that ultimately locks down the network. In another non-limiting example, a static jump address may allow access to a portion of code where private key verification resides. In another non-limiting example, static data may be a configuration security flag that sets the level of security for a virtual function VF or enables certain protections that an attacker may be unable to modify.

[0075] It should be noted that the developer knows which parts, if tampered with, will affect the security of the virtual function VF.

[0076] For each virtual function VF used in the infrastructure I, the developer uses the characterization and measurement engine CME0 to calculate a corresponding initial fingerprint F0. Thus, there is only one characterization and measurement engine CME0 for multiple virtual functions VF.

[0077] For static data, static source addresses, and static jump addresses, the initial fingerprint F0 is based on an initial characterization pattern CP0, which is a mapping between the values ​​of each of these static characteristics C0 and the corresponding data or code region, as shown in Figure 2. A data region or a code region is a data address or a code address, respectively. For a recursive call graph, the initial fingerprint F0 is based on an initial characterization pattern CP0, which is a digital representation of the graph of the recursive call graph, as shown in Figure 2. In a non-limiting example, the digital representation is a file having a graph description language (e.g., .dot).

[0078] In a non-limiting embodiment, for static data, static source addresses, and static jump addresses, the mapping is in the form of a matrix M0 representing the data regions, code regions of the static source, and jump addresses, with specific values ​​for each of these static properties and their addresses. Thus, for a static source, a jump address, there is a corresponding specific value and code address.

[0079] In a non-limiting example, - A value of 1 is for data that remains static, - Value 2 is for static source addresses, - Value 3 is for static jump addresses.

[0080] Therefore, matrix M0 contains locations with these values ​​as shown in FIG. 4 and their corresponding addresses, designated "a" in FIG.

[0081] In a non-limiting embodiment, other locations in matrix M0 are represented by the value 0 and the corresponding address.

[0082] Thus, at the end of the testing phase Ph0, the resulting matrix M0 is limited to a selected portion P1 of the virtual function VF, in particular to its static properties.

[0083] The fingerprint of the matrix M0 can be generated using a cryptographic algorithm. In a non-limiting embodiment, the initial fingerprint F0 is a hash h (shown in FIG. 4) of the matrix M0. With respect to the recursive call graph, in a non-limiting embodiment, the initial fingerprint F0 is a hash of the digital representation. This initial fingerprint F0 is used as a high-quality measure. Note that any variation of the initial characterization pattern CP0 will produce a different initial fingerprint F0.

[0084] Therefore, the calculation of the initial fingerprint F0 is - Computation of an initial characterization pattern CP0 (function f210(CME0,CP0,M0) shown) which is a mapping of the values ​​of each of these static characteristics C1 with the corresponding data or code area (both referred to as "a" in FIG. 4); - Calculation of a hash h of said initial characterization pattern CP0 (function f220(CME0, h, CP0, M0) as shown). The value of hash h is the initial fingerprint F0, also called a quality measurement.

[0085] In the following, we describe the use of a high-quality measurement F0 to check the integrity of a virtual function VF when it is instantiated and executed within the infrastructure I.

[0086] When a virtual function VF is instantiated, ie, downloaded to the infrastructure I, the virtual function VF can be invoked, ie, the virtual function VF can be executed.

[0087] 5 illustrates a computer-implemented invocation method 2 for invoking a virtual function VF within an infrastructure I. The invocation includes a configuration phase Ph1 and an execution phase Ph2. The configuration phase Ph1 is distinct from boot time (because during boot time, the virtual function VF has not yet been started and executed), and the execution phase Ph2 is also referred to as runtime.

[0088] When executed during the configuration phase Ph1 and the execution phase Ph2, not all branches of the virtual function VF are executed, unlike in the test phase Ph0. According to the parameter Pa setting, there are only some branches, and these branches are limited to the selected static property C1 mentioned above.

[0089] As described below, a fingerprint F1 is calculated as the configuration phase Ph1 is performed, and this fingerprint F1 is compared with a high-quality measurement, which is the initial fingerprint F0, found during the testing phase Ph0. If the configuration phase Ph1 is completed correctly, then a fingerprint F1 is calculated as the execution phase Ph2 is performed, and this fingerprint F1 is compared with a high-quality measurement, which is the initial fingerprint F0, found during the testing phase Ph0.

[0090] After the virtual function VF has been instantiated and therefore downloaded into the infrastructure I, the computer-implemented invocation method 2 is executed.

[0091] Therefore, as shown in FIG. 5 and FIG. 6, the computer-implemented startup method 2 includes the following steps:

[0092] In step E20, shown as F20(VF, I, Ph1) in FIG. 5, a virtual function VF is launched within the infrastructure I, which is initiated by the execution of the configuration phase Ph1.

[0093] In step E21 (CME1, F1_0, VF, Ph1) shown in FIG. 5, the embedded characterization and measurement engine CME1 corresponding to the virtual function VF calculates the fingerprint F1_0 of the virtual function VF along with the execution of the configuration phase Ph1.

[0094] As mentioned before, the calculation of fingerprint F1_0 is - calculating the corresponding characterization pattern CP1_0 in the form of a matrix M1_0 (substep E210 denoted F210(CME1, CP1_0, M1_0)); - calculating the hash h of said matrix M1_0 (substep E210 denoted F210(CME1, h, M1_0)).

[0095] It should be noted that the matrix M1_0 corresponding to the characterizing pattern CP1_0 is initially filled with the value 0. Therefore, the matrix M1 is reconstructed along with the execution of the configuration phase Ph1.

[0096] Note that the same cryptographic function used to generate the initial fingerprint F0 is used here, a hash.

[0097] The characterization pattern CP1_0 is calculated during the configuration phase Ph1 and is therefore referred to herein as the characterization configuration pattern CP1_0. This characterization configuration pattern CP1_0 is generated taking into account the virtual functions VF in their surroundings in the infrastructure I, i.e., the configuration of data, physical resources allocated after instantiation, links to other virtual functions VF, etc. The absolute values ​​of the addresses should be different, but source addresses and jump addresses that were static remain static. The values ​​of data that remain static during the configuration phase Ph1 may have changed due to the configuration, but they remain static and their positions may differ due to the placement of virtual function VF resources.

[0098] Either the embedded characterization and measurement engine CME1 is in the infrastructure I or the infrastructure I contains a reference Ref to the embedded characterization and measurement engine CME1, which in a non-limiting example is in a remote server. In this latter case, if the embedded characterization and measurement engine CME1 is software, there is a call to the embedded characterization and measurement engine CME1, and if the embedded characterization and measurement engine CME1 is hardware, there is an execution of the embedded characterization and measurement engine CME1.

[0099] As mentioned above, the fingerprint F1_0 is based on a static property C1, which is extracted from the entire virtual function VF or from some part P1.

[0100] The entire virtual function VF means that CME1 follows all branches of the virtual function VF to calculate the fingerprint F1_0. The few parts P1 means that CME1 only goes through some branches of the virtual function VF. The advantage of going through only some parts P1 of the virtual function VF is that it reduces the duration of the setup phase Ph1.

[0101] Some of the parts P1 of the virtual function VF are loops of the virtual function VF that are executed often, which avoids considering some parts that are very specific and therefore not executed frequently, thus shortening the duration of the setup phase Ph1.

[0102] In conclusion, we must find a balance between the acceptable duration of the configuration phase Ph1 and the size of the matrix M1_0, which corresponds to the importance of the integrity check during this configuration phase Ph1. The smaller the size of the matrix M1_0, the less likely it is to be able to check attacks on some parts of the virtual function VF. However, the larger the size of the matrix M1_0, the longer the duration of the configuration phase Ph1.

[0103] In step E22, shown as F22(F1_0, F0, Ph1) in FIG. 5, during the configuration phase Ph1, the fingerprint F1_0 is compared with the initial fingerprint F0.

[0104] First, note that fingerprint F1_0 is false because its associated matrix M1_0 is filled with only zero values ​​(in a non-limiting example). Therefore, the comparison is false. All branches selected during test phase Ph0 are explored (those with sensitive data / code or those that are frequently executed). Matrix M1_0 is constructed during this exploration process. Comparisons are performed as the construction of matrix M1_0 progresses until fingerprint F1_0 corresponds to initial fingerprint F0. Once all selected branches have passed, matrix M1_0 is consequently updated with the static characteristics found in these branches. If there are regions in matrix M1_0 that are filled with zeros, this means that either the corresponding branch of a data or code region in matrix M1_0 was not selected during test phase Ph0 and therefore not explored during setup phase Ph1, or the corresponding branch has been modified, i.e., corrupted.

[0105] In a first non-limiting embodiment, the comparison is a local proof A1 performed by the built-in characterization and measurement engine CME1. The built-in characterization and measurement engine CME1 performs the comparison. Such a local proof A1 during the configuration phase Ph1 is shown in the center of Figure 7. To simplify Figure 7, the matrices M0 and M1_0 are shown with white dots for 0 values ​​and gray dots for other values ​​in their different positions.

[0106] Note that the initial fingerprint F0 is downloaded to the infrastructure I during the download of CME1, or during its invocation, or at runtime, when the virtual function VF is instantiated.

[0107] In a second non-limiting embodiment, the comparison is a remote attestation A2 performed by a remote verification device V. In this case, in a non-limiting embodiment, the fingerprint F1_0 is transmitted by the embedded characterization and measurement engine CME1 to said remote verification device V in FIG. 5 (step E21′, denoted F21′(CME1, V, F1_0)). Said remote verification device V comprises a processor configured to perform said comparison. Said remote verification device V is configured to periodically request the fingerprint F1_0. The remote verification device V has access to an initial fingerprint F0 stored in one of its memories (not shown). In this second non-limiting embodiment, the remote verification device V is active, since it periodically requests the fingerprint F1_0 to be transmitted in order to check the integrity of the virtual function VF.

[0108] If the fingerprint F1_0 differs from the initial fingerprint F0 at the end of the configuration phase Ph1 (branch A shown in Figure 5 or F1_0≠F0 shown in Figure 7), in step E23 shown in Figure 5 F23 (F1_0, F0, NOK, N1, E, RTR, Ac), a first notification N1 (shown in Figure 7) is sent to the external entity E for future action Ac.

[0109] The notification N1 is sent via the root of trust report RTR via a notification agent (not shown) of the infrastructure I. The first notification N1 indicates that there is an anomaly in the virtual function VF.

[0110] The future action Ac is defined according to a security policy set by a service provider that manages the service that includes the virtual function VF. In a non-limiting embodiment, the future action Ac is the invocation and / or dropping of the desinstantiation of the virtual function VF.

[0111] In a non-limiting embodiment, the external entity E is a remote verification device V that manages errors.

[0112] The end of the configuration phase Ph1 is determined by the F1_0 value of the fingerprint reaching the F0 value of the initial fingerprint during the configuration phase Ph1, or by the duration of the configuration phase Ph1 reaching the maximum duration t1. Thus, when the fingerprint F1_0 differs from the initial fingerprint F0 at the end of the configuration phase Ph1, it means that the maximum duration t1 has been reached.

[0113] Therefore, after this configuration phase Ph1, any difference between the fingerprint F1_0 and the fingerprint F0 is considered abnormal, meaning that the virtual function VF has been modified and is different from the initial virtual function VF with which the initial built-in characterization and measurement engine CME0 calculated the initial fingerprint F0. It can be inferred that it has been tampered with.

[0114] The following anomalies can be detected: malicious access to the location of the data of a virtual function VF from an unknown address, jumps to an unknown address, malicious modification of static data.

[0115] If one of these conditions occurs, the corresponding value in matrix M1_0 is changed to 0 and the fingerprint F1_0 is modified. In this case, the configuration phase Ph1 does not finish and activation is not possible.

[0116] If the F1_0 value of the fingerprint reaches the F0 value of the initial fingerprint (branch B shown in FIG. 5 or F1_0=F0 shown in FIG. 7), this means that the virtual function VF has not been corrupted until now. This means that the configuration phase Ph1 has been successfully completed. Therefore, the following steps are executed:

[0117] In step E24, shown as F24(VF, I, Ph2) in FIG. 5, the execution phase Ph2 of the invocation of the virtual function VF is executed.

[0118] 5, the embedded characterization and measurement engine CME1 corresponding to the virtual function VF calculates a fingerprint F1_1 of the virtual function VF along the execution of the execution phase Ph2. The same branches of the virtual function VF as those during the configuration phase Ph1 are searched for the calculation of the fingerprint F1_1.

[0119] As mentioned above, the calculation of the fingerprint F1_1 is - calculating the corresponding characterization pattern CP1_1 in the form of a matrix M1_1 (substep E250 denoted F250(CME1,CP1_1,M1_1)); - calculating the hash h of said matrix M1_1 (substep E251 denoted E251(CME1, h, M1_1)).

[0120] Note that the matrix M1_1 corresponding to the characterization pattern CP1_1 is the matrix M1_0 found at the end of the configuration phase Ph1. In contrast to the configuration phase Ph1, the matrix M1_0, referred to here as matrix M1_1, does not change during the execution phase Ph2, since the static properties do not change during this phase. Therefore, the matrix M1_1, which is calculated successively when passing through all selected branches of the virtual function VF, must not change during the execution phase Ph2. If it does change, i.e., if one of its values ​​changes at one of its positions, this means that the virtual function VF has been modified, i.e., corrupted.

[0121] Note that the same cryptographic function used to generate the initial fingerprint F0 is used here, a hash.

[0122] The characterization pattern CP1_1 is calculated during the execution phase Ph2 and is therefore referred to herein as the characterization execution pattern CP1_1.

[0123] Either the embedded characterization and measurement engine CME1 is in the infrastructure I or the infrastructure I contains a reference Ref to the embedded characterization and measurement engine CME1, which in a non-limiting example is in a remote server. In this latter case, if the embedded characterization and measurement engine CME1 is software, there is a call to the embedded characterization and measurement engine CME1, and if the embedded characterization and measurement engine CME1 is hardware, there is an execution of the embedded characterization and measurement engine CME1.

[0124] As mentioned above, the fingerprint F1_1 is based on static characteristics C1, which are extracted from the entire virtual function VF or from a portion P1. The advantage of going to only some portion P1 of the virtual function VF is that it also reduces the duration of the execution phase Ph2.

[0125] In step E26(F1_1, F0, Ph2) shown in FIG. 6, during the execution phase Ph2, the fingerprint F1 is compared with the initial fingerprint F0.

[0126] In a first non-limiting embodiment, the comparison is a local proof A1 performed by the embedded characterization and measurement engine CME1. Thus, the embedded characterization and measurement engine CME1 performs the comparison.

[0127] In a second non-limiting embodiment, the comparison is a remote attestation A2 executed by said remote verification device V. Such a remote attestation A2 during execution phase Ph2 is shown on the right side of Fig. 7. To simplify Fig. 7, matrices M0 and M1_1 are shown with white dots for 0 values ​​and grey dots for other values ​​in their different positions. In this case, in a non-limiting embodiment, the fingerprint F1_1 is sent by the embedded characterization and measurement engine CME1 to said remote verification device V (step E25' shown in F25'(CME1, V, F1_1) in Fig. 5).

[0128] If during the execution phase Ph2 the fingerprint F1_1 differs from the initial fingerprint F0 (branch D shown in Figure 6 or F1_1 ≠ F0 shown in Figure 7), it means that there is a problem, and therefore in step E27 shown in Figure 6 F27 (F1_1, F0, NOK, N2, E, RTR, Ac), a second notification N2 (shown in Figure 7) is sent to the external entity E for future action Ac.

[0129] The second notification N2 is sent via a notification agent (not shown) of the infrastructure I via the root of trust report RTR. The second notification N2 indicates that there is an anomaly in the virtual function VF. The second notification N2 can be the same as the first notification N1 or different.

[0130] The future action Ac is defined according to a security policy set by a service provider that manages the service that includes the virtual function VF. In a non-limiting embodiment, the future action Ac is the dropping of the launch or desinstantiation of the virtual function VF. In another non-limiting embodiment, the future action Ac is the isolation of the virtual function VF so as not to interrupt the implemented service, or the replacement of the virtual function VF with an identical virtual function VF based on the corrupted virtual function VF. It should be noted that the future action Ac in this execution phase Ph2 may be the same or different from that in the configuration phase Ph1.

[0131] Therefore, during this execution phase Ph2, any difference between fingerprint F1 and fingerprint F0 is considered anomalous, meaning that the virtual function VF has been modified and is different from the initial virtual function VF with which the test characterization and measurement engine CME0 calculated the initial fingerprint F0. It can be inferred that it has been tampered with.

[0132] The following anomalies can be detected: malicious access to the location of the data of the virtual function VF from an unknown address, jump to an unknown address, and malicious modification of static data. If one of these conditions appears, the corresponding value in the matrix M1_1 is changed to 0 and the fingerprint F1_1 is modified. In this case, the execution phase Ph2 does not finish and the launch cannot be resumed.

[0133] If the F1_1 value of the fingerprint is equal to the F0 value of the initial fingerprint (branch E shown in FIG. 6, or F1_1=F0 shown in FIG. 7), this means that the virtual function VF has not been corrupted until now. This means that the execution phase Ph2 has finished successfully and has not been interrupted. Therefore, the invocation is resumed at step E28, indicated by F28(F1_1, F0_0, OK, Ph2). Therefore, the virtual function VF is executed normally within the infrastructure I.

[0134] It should be noted that the computer-implemented startup method 2 can be performed by a computer program product, which includes a set of instructions that, when loaded into a computer, causes the computer to execute the computer-implemented startup method 2. Thus, the computer program product is embodied on a non-transitory computer-readable storage medium having a set of instructions stored thereon.

[0135] A computer program product may also be referred to as a program, software, software application, or code. A computer program product may be deployed in any form, including, but not limited to, as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0136] In non-limiting embodiments, the instructions, also referred to as program instructions, may be either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, microcode, firmware instructions, configuration data for an integrated circuit, or source code or object code written in any combination of one or more programming languages, including compilations of interpreted languages ​​such as procedural programming languages ​​or object-oriented programming languages.

[0137] In non-limiting embodiments, the non-transitory computer-readable storage medium is an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. In non-limiting examples, the computer-readable storage medium is a read-only memory such as a ROM, such as a PROM, an erasable programmable read-only memory such as an EPROM, a flash memory, a solid-state memory, a DVD, etc.

[0138] It should be noted that the computer-implemented downloading method 1 can also be performed by a computer program product.

[0139] The present invention is not limited to the above-described embodiments, and various modifications are possible without departing from the spirit of the present invention. All statements in this specification reciting principles, aspects, and embodiments of the present invention, as well as specific examples thereof, are intended to encompass equivalents. In this regard, the following can be said: In another non-limiting embodiment, a cryptographic function other than the hash h can be used to calculate the fingerprint F1 and the initial fingerprint F0. In a non-limiting embodiment, the integrity check can also be performed during boot time of the virtual function VF, i.e., during its instantiation, and therefore before execution of the virtual function VF if it is not yet running.

[0140] Thus, some embodiments of the present invention may include one or more of the following advantages: -Proposes a simple solution to the security challenges of proof-of-configuration and proof-of-execution for cybersecurity of infrastructures such as cloud infrastructures. -Allows detection of modifications and tampering during both the configuration phase Ph1 and the execution phase Ph2, and prevents resumption of the invocation of a tampered virtual function VF, When malware tampers with a virtual function (VF), the tamped virtual function (VF) can be replaced with another identical virtual function (VF) to avoid service interruptions, enabling real-time responsiveness in virtualized environments. -Providing a high level of security for the infrastructure, In contrast to the prior art, the present invention provides a security solution for checking virtual functions VF when they are placed in their execution environment and when they run.

Claims

1. An embedded characterization and measurement engine (CME1) for virtual functions (VF) in an infrastructure (I), said embedded characterization and measurement engine (CME1) comprising: - calculating a fingerprint (F1) based on static properties (C1) of said virtual function (VF) when said virtual function (VF) is instantiated in said infrastructure (I) and executed in said infrastructure (I), said static properties (C1) having been extracted from the whole or part (P1) of said virtual function (VF); - performing a local attestation (A1) by comparing said fingerprint (F1) with an initial fingerprint (F0) or sending said fingerprint (F1) to a remote verification device (V) for a remote attestation (A2); - an embedded characterization and measurement engine (CME1), configured to send a notification (N1, N2) to an external entity (E) for further action (Ac) if said fingerprint (F1) differs from said initial fingerprint (F0).

2. 2. The embedded characterization and measurement engine (CME1) of claim 1, wherein the portion (P1) of the virtual function (VF) is a loop of the virtual function (VF) that is executed frequently and / or a portion that, if tampered with, affects the security of the virtual function (VF).

3. The embedded characterization and measurement engine (CME1) of claim 1 or 2, wherein said static properties (C1) comprise static data, and / or static source addresses, and / or static jump addresses, and / or recursive call graphs.

4. The calculation of the fingerprint (F1) - said calculation of a characterization pattern (CP1) which is a mapping of the values ​​of each of these static characteristics (C1) with static data and / or static source addresses and / or static jump addresses or corresponding data areas (a) or code areas (a) for a digital representation of said graph of said recursive call graph; - said calculation of a hash (h) of said characterization pattern (CP1).

5. A computer-implemented download method (1) for downloading a virtual function (VF) in an infrastructure (I), the computer-implemented download method (1) comprising: - A computer-implemented downloading method (1), comprising: downloading a computer program product (Pg1) associated with a virtual function (VF) using an initial fingerprint (F0) of the virtual function (VF) and an embedded characterization and measurement engine (CME1) according to any one of claims 1 to 4, or a reference (Ref) to the embedded characterization and measurement engine (CME1) according to any one of claims 1 to 4.

6. The computer-implemented download method (1) includes:

6. The computer-implemented downloading method (1) of claim 5, further comprising: configuring the embedded characterization and measurement engine (CME1) by setting parameters (Pa) associated with the virtual functions (VF), the parameters (Pa) including an indication as to whether the static properties (C1) are extracted from the whole or parts (P1) of the virtual functions (VF) and which parts (P1) are involved.

7. 7. The computer-implemented downloading method (1) of claim 6, wherein said parameters (Pa) further comprise an indication of the maximum duration (t1) of a configuration phase (Ph1) when invoking said virtual function (VF).

8. A characterization and measurement engine (CME0) for a virtual function (VF), said characterization and measurement engine (CME0) comprising: - detecting a static property (C0) within said virtual function (VF) when said virtual function (VF) is being executed; - calculating an initial fingerprint (F0) based on said static characteristics (C0), said static characteristics (C0) being extracted from the whole or part (P1) of said virtual function (VF); A Characterization and Measurement Engine (CME0), configured to store said initial fingerprint (F0).

9. 9. The characterization and measurement engine (CME0) of claim 8, wherein the portion (P1) is a loop of the virtual function (VF) that is executed frequently and / or a portion that, if tampered with, affects the security of the virtual function (VF).

10. The characterization and measurement engine (CME0) according to claim 8 or 9, wherein said static properties (C0) comprise static data, and / or static source addresses, and / or static and jump addresses, and / or recursive call graphs.

11. The calculation of the initial fingerprint (F0) comprises: - said calculation of an initial characterization pattern (CP0) which is a mapping of the values ​​of each of these static characteristics (C0) with static data and / or static source addresses and / or static jump addresses or corresponding data areas (a) or code areas (a) for a digital representation of said graph of said recursive call graph; - said calculation of a hash (h) of said initial characterization pattern (CP0).

12. A computer-implemented invocation method (2) for invoking a virtual function (VF) in an infrastructure (I), said invocation comprising a configuration phase (Ph1) and an execution phase (Ph2) executed after said configuration phase (Ph1), said computer-implemented invocation method (2) comprising: - activating said virtual functions (VF) in said infrastructure (I) by first executing said configuration phase (Ph1); - calculating, by an embedded characterization and measurement engine (CME1) corresponding to said virtual function (VF), a fingerprint (F1) of said virtual function (VF) along said execution of said configuration phase (Ph1); - during said configuration phase (Ph1), comparing said fingerprint (F1) with an initial fingerprint (F0); - sending a first notification (N1) to an external entity (E) for future action (Ac) if said fingerprint (F1) differs from said initial fingerprint (F0) at the end of said configuration phase (Ph1); - If not, - executing said execution phase (Ph2); - calculating, along the execution of the execution phase (Ph2), by the embedded characterization and measurement engine (CME1), fingerprints (F1) of the virtual functions (VF); - during said execution phase (Ph2), comparing said fingerprint (F1) with said initial fingerprint (F0); - if during said execution phase (Ph2) said fingerprint (F1) differs from said initial fingerprint (F0), sending a second notification (N2) to said external entity (E) for future action (Ac); - if not, resuming said execution of said invocation; A computer-implemented startup method (2), comprising:

13. 13. The computer-implemented activation method (2) of claim 12, wherein the comparison of the fingerprint (F1) with a local attestation (A1) is performed by the embedded characterization and measurement engine (CME1).

14. 13. The computer-implemented activation method (2) of claim 12, wherein the comparison of the fingerprint (F1) with a remote attestation (A2) is performed by a remote verification device (V).

15. 15. A computer-implemented startup method (2) according to any one of claims 12 to 14, wherein the end of the configuration phase (Ph1) is determined by the value of the fingerprint (F1) reaching the value of the initial fingerprint (F0) during the execution of the configuration phase (Ph1) or by the duration of the configuration phase (Ph1) reaching a maximum duration (t1).

16. 16. The computer-implemented boot method (2) of any one of claims 12 to 15, wherein the fingerprint (F1) is based on static properties (C1), the static properties (C1) being extracted from the whole or part (P1) of the virtual function (VF).

Images