Secure communication method and apparatus

Abstract

Embodiments of the present specification provide a secure communication method and apparatus. In the secure communication method, a trusted control module in a trusted subsystem receives first authentication information from a measurement agent in a host, the first authentication information comprising a first signature. First verification is executed on the basis of the first signature, and it is determined at least on the basis of a verification result of the first verification whether the identity of the measurement agent can be trusted. When the identity of the measurement agent can be trusted, a measurement management instruction is encrypted, and an obtained first ciphertext instruction is provided for the measurement agent, so that the measurement agent is enabled to perform integrity computation on a measurement object in the host. A first timestamp and a first ciphertext computation result are received from the measurement agent. Verification of whether communication is secure is performed on the basis of the first timestamp, and the first ciphertext computation result is decrypted upon successful verification.

Description

Secure communication method and device

[0001] The present application claims priority to the Chinese patent application No. 202410431234.5, filed on April 10, 2024, and entitled "Secure communication method and device", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] One or more embodiments of the present specification relate to the field of computer technology, and in particular to a secure communication method and device. BACKGROUND

[0003] According to the latest development of trusted computing, the trusted control module and the measurement agent are located in different hosts respectively, wherein the trusted control module usually has a hardware trusted root and is the trust source point of the whole trusted computing system, and has functions such as trusted control, trusted judgment, integrity calculation and cryptography operation. The trusted control module can run independently, and itself usually has high security, which does not depend on the security of the host. The measurement agent itself is a piece of logical code deployed on the host, and the integrity of its own program, the security of the measurement result storage and transmission all depend on the security of the host. For a long time, there is a lack of an effective security implementation scheme and protection measure for the implementation of the measurement agent. Once the measurement agent is attacked or colludes with the host, resulting in the destruction of the logic of the measurement agent or the tampering of the measurement result, it will seriously affect the security of the whole trusted computing system. SUMMARY

[0004] One or more embodiments of the present specification describe a secure communication method and device, which can ensure the security and trust of the measurement agent during operation.

[0005] In a first aspect, a secure communication method is provided, which is executed by a trusted control module in a trusted subsystem, comprising:

[0006] receiving first authentication information from a measurement agent in a host, wherein the first authentication information contains a first signature;

[0007] performing a first verification based on the first signature, and determining whether the identity of the measurement agent is trusted based on at least the verification result of the first verification;

[0008] in the case that the identity of the measurement agent is trusted, encrypting a measurement management instruction, and providing the obtained first ciphertext instruction to the measurement agent, so that the measurement agent performs integrity calculation on a measurement object in the host;

[0009] receiving a first timestamp and a first ciphertext calculation result from the measurement agent;

[0010] verify whether the communication is safe based on the first timestamp, and in case of passing the verification, decrypt the first ciphertext calculation result.

[0011] In a second aspect, a secure communication method is provided, which is executed by a measurement agent in a host, comprising:

[0012] receiving second authentication information from a trusted control module in a trusted subsystem, wherein the second authentication information contains a second signature;

[0013] performing fourth verification based on the second signature, and determining whether the trusted control module is trusted based on at least a verification result of the fourth verification;

[0014] in case that the trusted control module is trusted, providing an initial timestamp to the trusted control module, so that the trusted control module performs verification of whether the communication is safe based on the initial timestamp;

[0015] receiving first ciphertext instructions and a second timestamp from the trusted control module;

[0016] verifying whether the communication is safe based on the second timestamp, and in case of passing the verification, decrypting the first ciphertext instructions and executing, to obtain a calculation result of integrity calculation on a measurement object in the host;

[0017] encrypting the calculation result, and providing the obtained first ciphertext calculation result to the trusted control module.

[0018] In a third aspect, a secure communication apparatus is provided, which is arranged in a trusted control module in a trusted subsystem, comprising:

[0019] a receiving unit, configured to receive first authentication information from a measurement agent in a host, wherein the first authentication information contains a first signature;

[0020] a performing unit, configured to perform first verification based on the first signature, and determine whether the measurement agent is trusted based on at least a verification result of the first verification;

[0021] a sending unit, configured to, in case that the measurement agent is trusted, encrypt measurement management instructions, and provide the obtained first ciphertext instructions to the measurement agent, so that the measurement agent performs integrity calculation on a measurement object in the host;

[0022] the receiving unit is further configured to receive a first timestamp and a first ciphertext calculation result from the measurement agent;

[0023] a verifying unit, configured to verify whether the communication is safe based on the first timestamp, and in case of passing the verification, decrypt the first ciphertext calculation result.

[0024] In a fourth aspect, a secure communication apparatus is provided, which is a measurement agent arranged in a host computer, comprising:

[0025] a receiving unit configured to receive second authentication information from a trusted control module in a trusted subsystem, wherein the second authentication information comprises a second signature;

[0026] a performing unit configured to perform a fourth verification based on the second signature, and determine whether the trusted control module is trusted based on a verification result of the fourth verification;

[0027] a sending unit configured to provide an initial timestamp to the trusted control module for the trusted control module to perform a verification of whether a communication is secure or not based on the initial timestamp, if the trusted control module is trusted;

[0028] the receiving unit is further configured to receive a first ciphertext instruction and a second timestamp from the trusted control module;

[0029] a verifying unit configured to perform a verification of whether the communication is secure or not based on the second timestamp, and decrypt and execute the first ciphertext instruction to obtain a calculation result of integrity calculation for a measurement object in the host computer, if the verification is passed;

[0030] an encrypting unit configured to encrypt the calculation result, and provide a first ciphertext calculation result to the trusted control module

[0031] In a fifth aspect, a computer readable storage medium is provided, which stores a computer program, and when the computer program is executed in a computer, the computer is caused to perform the method of the first or second aspect.

[0032] In a sixth aspect, a computing device is provided, which comprises a memory and a processor, and the memory stores executable code, and when the processor executes the executable code, the method of the first or second aspect is implemented.

[0033] The secure communication method and apparatus provided by one or more embodiments of the present specification can first verify the signature of the measurement agent by the trusted control module to determine whether the identity of the measurement agent is trusted, and in the case that the identity of the measurement agent is determined to be trusted, send the encrypted measurement management instruction to the measurement agent, and receive the timestamp and the encrypted calculation result returned by the measurement agent. Finally, in the case that the communication is determined to be secure based on the timestamp, the encrypted calculation result is decrypted. Thus, the security and trustworthiness of the measurement agent during operation can be ensured. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the drawings needed to be used in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present specification, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0035] FIG. 1 is a schematic diagram of communication between a traditional trusted control module and a measurement agent;

[0036] FIG. 2 is a schematic diagram of a secure communication method according to an embodiment;

[0037] FIG. 3 is a schematic diagram of a parsing method of measurement management instructions in an example;

[0038] FIG. 4 is a schematic diagram of a secure communication device according to an embodiment;

[0039] FIG. 5 is a schematic diagram of a secure communication device according to another embodiment. DETAILED DESCRIPTION

[0040] The solutions provided in the present specification will be described below with reference to the drawings.

[0041] As mentioned above, in order to ensure the security of trusted computing, the security of the measurement agent needs to be strengthened.

[0042] In the conventional technology, the security of the measurement agent is mainly strengthened in the following two ways: first, by configuring a whitelist to limit the access of the measurement agent to the host computer, however, this whitelist mechanism has obvious limitations and application inconvenience, and cannot ensure the security and trustworthiness of the measurement agent during running. Second, according to a pre-set memory access control rule table, the measurement agent loaded into the memory of the host computer is checked for corresponding permissions. Although this way can check whether the permissions of the measurement agent are tampered with before running, it does not solve the security threat of the untrusted host computer to the measurement agent itself, such as malicious tampering of measurement logic code, data grabbing, replacement and modification attacks, etc. In addition, this way also cannot ensure the security and trustworthiness of the measurement agent during running.

[0043] Considering the deficiencies of the existing solutions, in the embodiments of the present specification, an improved solution is proposed, in which the trusted control module ensures the security and trustworthiness of the measurement agent during the startup phase and the running phase by performing multiple verifications.

[0044] Figure 1 is a schematic diagram of communication between a conventional trusted control module and a measurement agent. In Figure 1, the entire trusted computing system includes a trusted subsystem and a host system (hereinafter referred to as a host). The trusted subsystem is a logically independent and self-operable secure system, which can send initialization management instructions, identity authentication management instructions, and measurement management instructions to the measurement agent in the host through the trusted control module. The measurement agent is a piece of logic code residing on the host, which can collect data of a measurement object and send the data to the trusted control module for integrity calculation of the measurement object. In other words, the trusted control module can achieve integrity calculation of the measurement object in the host by interacting with the measurement agent. The measurement object can include any of the following: a binary file of an application itself, an interrupt vector table of an executed system, a system call table, a dynamic link library file called by an application runtime, a key code segment in memory, etc. The first three can be referred to as static measurement objects, and the last two can be referred to as dynamic measurement objects.

[0045] Since the measurement agent is usually a piece of logic code deployed on the host, its security depends on the security of the host. Under the assumption that the host is not trusted, the trusted existence of the measurement agent poses a great challenge. The following describes the insecure transmission process.

[0046] Specifically, the trusted control module sends a measurement task start instruction to the measurement agent. After the measurement agent reads the relevant data of the measurement object through the system call layer, it does not consider whether the measurement agent is trusted at this moment due to the lack of security threat consideration of the host system, and by default sends the read data directly to the communication module in the trusted subsystem. Since the authenticity and integrity of the data forwarded by the measurement agent are not checked at this time, the authenticity of the subsequent measurement calculation, trusted judgment, and trusted control implementation results will be challenged, and thus the authenticity and integrity of the entire trusted subsystem execution results will be challenged.

[0047] Therefore, before the trusted control module and the measurement agent communicate, the present scheme first performs bidirectional identity authentication, and then performs subsequent secure communication, such as issuing measurement management instructions or transmitting data, under the condition that the bidirectional identity authentication is passed.

[0048] FIG. 2 shows a schematic diagram of a secure communication method according to an embodiment. In FIG. 2, the trusted control module has a first identity information SN_a, which can be a digital string used to uniquely identify the trusted control module. The measurement agent has a second identity information SN_b, which can also be a digital string used to uniquely identify the measurement agent. The length of the first identity information SN_a and the second identity information SN_b can be agreed by the trusted control module and the measurement agent.

[0049] It should be noted that before performing the secure communication method shown in FIG. 2, the two parties first perform an initialization operation, by which the trusted control module obtains the public key PK_B of the measurement agent, and the measurement agent obtains the public key PK_A of the trusted control module. In addition, the trusted control module can also generate a first challenge code Ra locally, and the measurement agent can generate a second challenge code Rb locally and provide it to the trusted control module. The first challenge code Ra and the second challenge code Rb are both random strings with an agreed length. In an embodiment, the measurement agent can provide the second identity information SN_b and the second challenge code Rb to the measurement agent together. In a more specific embodiment, the measurement agent can provide the splicing result of the second identity information SN_b and the second challenge code Rb: Rb|SN_b to the measurement agent.

[0050] As shown in FIG. 2, the method can include:

[0051] In step S202, the trusted control module generates second authentication information and provides it to the measurement agent.

[0052] In an example, the second authentication information can be a string TokenAB, which can include a signature Sa (i.e., a second signature). Of course, in practice, the second authentication information can also be other forms of information, which are not limited in the present specification.

[0053] In addition, the string TokenAB can also include the first identity information SN_a, the first challenge code Ra and the second challenge code Rb. In an example, the string TokenAB can be represented as: TokenAB = Sa|Ra|Rb|SN_a.

[0054] The signature Sa described above is obtained by the trusted control module using its own private key (i.e., the private key corresponding to the public key PK_A) to sign the first challenge code Ra, the second challenge code Rb and the second identity information SN_b, and its length can be agreed by the trusted control module and the measurement agent. In an example, the signature Sa can be represented as: Sa = Sign(Ra|Rb|SN_b).

[0055] Of course, in practice, the trusted control module can also send the splicing result: Ra|Rb|SN_b to the metric agent.

[0056] In step S204, the metric agent extracts the signature Sa from the second authentication information and performs signature verification.

[0057] The signature verification (i.e., the fourth verification) includes decrypting the signature Sa using the public key (public key PK_A) of the other party and determining whether the decryption result matches the splicing result of the first challenge code Ra, the second challenge code Rb, and the second identity information SN_b. The first challenge code Ra can be extracted from the second authentication information by the metric agent or provided directly to the metric agent by the trusted control module after generating the first challenge code Ra.

[0058] Specifically, a hash algorithm can be used to generate corresponding digest information for the splicing result of the first challenge code Ra, the second challenge code Rb, and the second identity information SN_b. Then determine whether the decryption result is the same as the generated digest information. If they are the same, the signature verification passes, otherwise the signature verification fails.

[0059] It should be understood that the signature verification passing indicates that the current communication process is trusted or the trusted control module is trusted, in other words, the transmission data in the current transmission process is secure.

[0060] Of course, in practice, to further ensure the identity security of the trusted control module, a second code value can also be extracted from the second authentication information to perform code value verification.

[0061] It should be understood that the second code value mentioned above is the unverified second challenge code extracted by the metric agent.

[0062] Regarding the extraction of the second code value, the metric agent can first determine the starting position of the second code value in the string TokenAB according to the length of the agreed signature Sa and the length of the first challenge code Ra, and then extract the corresponding substring as the second code value according to the length of the agreed second challenge code.

[0063] The code value verification (i.e., the fifth verification) includes determining whether the second code value is equal to the second challenge code Rb. If they are equal, the code value verification passes, otherwise the code value verification fails.

[0064] Of course, in practice, the metric agent also receives a splicing result: Ra|Rb|SN_b, from which the second identity information (i.e. a corresponding substring extracted from the splicing result according to the length of the second identity information) can be extracted to perform identity verification (i.e. the sixth verification), which includes: judging whether the second identity information is equal to the second identity information. If equal, the identity verification is passed, otherwise the identity verification is not passed.

[0065] It should be noted that the above code value verification and identity verification are passed, which indicates that the transmission data in this transmission process is complete and accurate.

[0066] In summary, in the case where the above signature verification is passed, or the above signature verification, code value verification and identity verification are all passed, it is determined that the trusted control module identity is trusted.

[0067] Step S206, in the case where the trusted control module identity is trusted, the metric agent sends the first authentication information to the trusted control module.

[0068] In one example, the first authentication information can be a string TokenBA, which can contain the signature Sb (i.e. the first signature). Of course, in practice, the first authentication information can also be other forms of information, which are not limited in the present specification.

[0069] In addition, the string TokenBA can also contain: the first challenge code Ra, the second identity information SN_b and the second challenge code Rb. In one example, the string TokenBA can be represented as: TokenBA=Sb|Rb|Ra|SN_b.

[0070] Wherein, the above signature Sb is signed by the metric agent using the private key (i.e. the private key corresponding to the public key PK_B) of the party, on the first challenge code Ra, the second challenge code Rb and the first identity information SN_a, and its length can be agreed by the trusted control module and the metric agent. In one example, the signature Sb can be represented as: Sb=Sign(Ra|Rb|SN_a).

[0071] It should be understood that the above first identity information SN_a is extracted by the metric agent from the string TokenAB, and the specific extraction method is similar to the extraction method of the first code value, which is not repeated here. Of course, in practice, the above first identity information SN_a can also be provided by the trusted control module to the metric agent when providing the first challenge code Ra to the metric agent.

[0072] Of course, in practice, the metric agent can also send the splicing result: Ra|Rb|SN_a to the trusted control module.

[0073] Step S208, the trusted control module extracts the signature Sb from the first authentication information, and performs signature verification.

[0074] The signature verification (i.e., the first verification) includes: decrypting the signature Sb using the public key of the other party (i.e., the public key PK_B), and determining whether the decryption result matches the spliced result of the first challenge code Ra, the second challenge code Rb, and the first identity information SN_a.

[0075] Specifically, a hash algorithm can be used to generate corresponding digest information for the spliced result of the first challenge code Ra, the second challenge code Rb, and the first identity information SN_a. Then determine whether the decryption result is the same as the generated digest information. If the same, the signature verification is passed, otherwise the signature verification is not passed.

[0076] It should be understood that the above signature verification passing indicates that the current communication process is trusted or the measurement agent is not tampered with, in other words, the transmission data in the current transmission process is secure.

[0077] Of course, in practice, in order to further ensure the identity security of the measurement agent, the first code value can also be extracted from the first authentication information to perform code value verification.

[0078] It should be understood that the above first code value is the unverified first challenge code extracted by the trusted control module.

[0079] Regarding the extraction of the above first code value, the trusted control module can first determine the starting position of the above first code value in the string TokenBA according to the length of the agreed signature Sb and the length of the second challenge code Rb, and then extract the corresponding substring as the above first code value according to the length of the agreed first challenge code.

[0080] The code value verification (i.e., the second verification) includes: determining whether the first code value is equal to the first challenge code Ra. If equal, the code value verification is passed, otherwise the code value verification is not passed.

[0081] Of course, in practice, when the trusted control module also receives the spliced result: Ra|Rb|SN_a, the first identity information can be extracted therefrom (i.e., according to the length of the first identity information, extract the corresponding substring from the spliced result) to perform identity verification (i.e., the third verification), which includes: determining whether the first identity information is equal to the first identity information. If equal, the identity verification is passed, otherwise the identity verification is not passed.

[0082] It should be noted that the above code value verification and identity verification passing indicate that the transmission data in the current transmission process is complete and accurate.

[0083] In summary, in the case that the signature verification passes, or in the case that the signature verification, the code value verification and the identity verification all pass, it is determined that the identity of the measurement agent is trusted.

[0084] Up to now, the mutual authentication between the trusted control module and the measurement agent is completed. In addition, since in the process of the mutual authentication, each party verifies the signature of the other party, it can be indirectly proved that the pre-embedded public key of the other party is trusted, and then the secure communication can be performed based on the public keys of both parties.

[0085] It should be further noted that the string TokenBA can also contain an initial timestamp SEQ_b randomly generated by the measurement agent and bound to the current session, so that the trusted control module can extract SEQ_b and cache it. In an example, the initial timestamp is specifically represented as a bit sequence or a byte sequence, which is also commonly referred to as an anti-replay sequence. After the start of the secure communication process, the trusted control module can verify whether the first measurement management instruction sent to the measurement agent is correctly parsed based on SEQ_b, and in the verification process, the correctness of the encryption logic and the signature logic of both parties is checked again to further enhance the security of the communication process. This is described in detail below.

[0086] FIG. 3 shows a schematic diagram of a parsing method of a measurement management instruction in an example. As shown in FIG. 3, the method can include the following steps:

[0087] In step S302, the trusted control module encrypts the measurement management instruction using the public key of the other party to obtain a first ciphertext instruction.

[0088] In an example, the first ciphertext instruction can be represented as: eCMDa = Enc(PK_B, CMD), where CMD is the measurement management instruction, and PK_B is the public key of the measurement agent pre-embedded in the local trusted control module.

[0089] In step S304, the trusted control module provides a second string to the measurement agent.

[0090] The target string can contain the first ciphertext instruction eCMDa and a second timestamp SEQ_a1, so that the second string can be represented as: eCMDa | SEQ_a1.

[0091] In an embodiment, the second timestamp SEQ_a1 is obtained by modifying the locally cached initial timestamp SEQ_b according to a modification manner agreed with the measurement agent. It should be understood that after modifying the initial timestamp SEQ_b, the trusted control module can cache the modified second timestamp SEQ_a1.

[0092] In a more specific embodiment, SEQ_a1 = SEQ_b + 1.

[0093] In another more specific embodiment, SEQ_a1 = t + SEQ_b, where t is a current time stamp obtained by the trusted control module, and SEQ_b is used to indicate a time period (e.g., 30 minutes or 1 hour, etc.).

[0094] In addition, the trusted control module can also provide the measurement agent with a signature sSa (i.e., a second target signature) of the second string, which is obtained by the trusted control module by signing the second string with a private key (i.e., a private key corresponding to the public key PK_A) of the trusted control module.

[0095] In step S306, the measurement agent extracts the second time stamp from the second string to verify whether the communication is secure or not.

[0096] In one embodiment, the above verification of whether the communication is secure or not includes modifying the locally generated initial time stamp SEQ_b in a modification manner agreed with the trusted control module to obtain a modification result, such as SEQ_b + 1. It is determined whether the second time stamp is equal to the modification result. If yes, it is determined that the current communication is secure, and thus the verification is passed. Otherwise, the verification is failed.

[0097] In another embodiment, the above verification of whether the communication is secure or not includes that the measurement agent obtains a current time stamp and determines whether the current time stamp is less than the second time stamp. If yes, it is determined that the current communication is secure, and thus the verification is passed. Otherwise, the verification is failed.

[0098] In addition, in the case that the measurement agent also receives the above signature sSa, the following target verification can also be performed: the signature sSa is decrypted with the public key (i.e., the public key PK_A) of the other party, and it is determined whether the decrypted result matches the splicing result of the first ciphertext instruction eCMD and the second time stamp.

[0099] Specifically, the splicing result of the first ciphertext instruction eCMD and the second time stamp can be used to generate corresponding digest information by using an agreed hash algorithm. Then it is determined whether the decrypted result is the same as the generated digest information. If yes, the above target verification is passed, otherwise the target verification is failed.

[0100] In step S308, in the case that the verification of whether the communication is secure or not is passed, the measurement agent decrypts and executes the first ciphertext instruction to obtain a calculation result Response for integrity calculation on the measurement object in the host.

[0101] In which, the measurement agent can decrypt the first ciphertext instruction by using a private key corresponding to the public key PK_B.

[0102] In step S310, the measurement agent provides the first string to the trusted control module.

[0103] The first string can include the first ciphertext calculation result eResponse and the first timestamp SEQ_a2, so that the first string can be expressed as: eResponse | SEQ_a2.

[0104] In one embodiment, the first timestamp SEQ_a2 is obtained by modifying an initial timestamp SEQ_b generated by the measurement agent according to a modification manner agreed with the trusted control module.

[0105] In a more specific embodiment, SEQ_a2 = SEQ_b + 1.

[0106] In another more specific embodiment, SEQ_a2 = t + SEQ_b, where t is the current timestamp obtained by the measurement agent.

[0107] In addition, the measurement agent can also provide the trusted control module with a signature sSb (i.e. the first target signature) of the second string, which is obtained by the measurement agent signing the first string using its own private key (i.e. the private key corresponding to the public key PK_B).

[0108] In step S312, the trusted control module extracts the first timestamp from the first string to verify whether the communication is secure or not.

[0109] In one embodiment, the verification of whether the communication is secure or not includes judging whether the first timestamp is equal to the second timestamp SEQ_a1 cached by the trusted control module. If they are equal, it is determined that the current communication is secure, so the verification is passed, otherwise the verification is not passed.

[0110] In another embodiment, the verification of whether the communication is secure or not includes: the measurement agent obtains the current timestamp, and judges whether the current timestamp is less than the first timestamp. If it is less than the first timestamp, it is determined that the current communication is secure, so the verification is passed, otherwise the verification is not passed.

[0111] In addition, in the case that the trusted control module also receives the signature sSb, it can also perform the following target verification: decrypt the signature sSb using the public key of the other party (i.e. the public key PK_B), and judge whether the decryption result matches the splicing result of the first ciphertext calculation result eResponse and the first timestamp.

[0112] Specifically, the splicing result of the first ciphertext calculation result eResponse and the first timestamp can be used to generate corresponding digest information using an agreed hash algorithm. Then judge whether the decryption result is the same as the generated digest information. If they are the same, the target verification is passed, otherwise the target verification is not passed.

[0113] Step S314, in the case that the verification of the communication security is passed, the trusted control module decrypts the first ciphertext calculation result.

[0114] Wherein, the trusted control module can decrypt the first ciphertext calculation result by using the private key corresponding to the public key PK_A.

[0115] It should be understood that the decryption of the first ciphertext calculation result by the trusted control module means that it determines that the first measurement management instruction sent to the measurement agent is correctly parsed, and all subsequent measurement management instructions and the transmission of measurement data can be directly encrypted by using the pre-embedded public keys (i.e. PK_A and PK_B) for transmission and communication.

[0116] The following describes the secure transmission or communication process.

[0117] The trusted control module encrypts the subsequent measurement management instructions by using the public key PK_B, and sends the obtained ciphertext instructions to the measurement agent. The measurement agent decrypts the ciphertext instructions by using the private key corresponding to the public key PK_B, and executes to obtain the plaintext calculation result. The measurement agent encrypts the plaintext calculation result by using the public key PK_A, and sends the obtained ciphertext calculation result to the trusted control module. The trusted control module decrypts the ciphertext calculation result by using the private key corresponding to the public key PK_A, and obtains the plaintext calculation result.

[0118] In summary, the secure communication method provided by the embodiments of the present specification can ensure that the identity of the measurement agent in the startup phase and the running phase is trusted. In addition, it can also ensure the secure data transmission between the trusted control module and the measurement agent. Finally, the present scheme also has good universality, and is of great significance for improving the security of the entire trusted computing system.

[0119] Corresponding to the above-mentioned secure communication method, one embodiment of the present specification also provides a secure communication device arranged in a trusted control module in a trusted subsystem. As shown in FIG. 4, the device can include:

[0120] The receiving unit 402 is configured to receive first authentication information from the measurement agent in the host computer, wherein the first authentication information includes a first signature.

[0121] The execution unit 404 is configured to perform a first verification based on the first signature, and determine whether the identity of the measurement agent is trusted based on at least the verification result of the first verification.

[0122] The sending unit 406 is configured to encrypt the measurement management instruction in the case that the identity of the measurement agent is trusted, and provide the obtained first ciphertext instruction to the measurement agent, so that the measurement agent performs integrity calculation on the measurement object in the host computer.

[0123] The receiving unit 402 is further configured to receive the first timestamp and the first ciphertext calculation result from the measurement agent.

[0124] The verifying unit 408 is configured to verify whether the communication is secure based on the first timestamp, and decrypt the first ciphertext calculation result if the verification is passed.

[0125] In an embodiment, the first authentication information further includes a first code value.

[0126] The executing unit 404 is further configured to perform a second verification, including judging whether the first code value is equal to a first challenge code generated locally by the trusted control module.

[0127] The executing unit 404 is specifically configured to:

[0128] If the first verification and the second verification are both passed, it is determined that the identity of the measurement agent is trusted.

[0129] In an embodiment, the first authentication information further includes first identification information.

[0130] The executing unit 404 is further configured to perform a third verification, including judging whether the first identification information is equal to first identity information of the trusted control module.

[0131] The executing unit 404 is further specifically configured to:

[0132] If the first verification and the third verification are both passed, it is determined that the identity of the measurement agent is trusted.

[0133] In an embodiment, the executing unit 404 is specifically configured to:

[0134] Decrypt the first signature by using the public key of the other party, and judge whether the decryption result matches a splicing result of the first identity information of the trusted control module, the first challenge code generated locally, and a second challenge code received from the measurement agent.

[0135] In an embodiment, the verifying unit 408 is specifically configured to:

[0136] Judge whether the first timestamp is equal to a second timestamp cached by the verifying unit 408, wherein the second timestamp is obtained by modifying an initial timestamp from the measurement agent according to a modification manner agreed with the measurement agent.

[0137] In an embodiment, the receiving unit 402 is further configured to receive a first target signature from the measurement agent.

[0138] The executing unit 404 is further configured to perform a target verification on the first target signature, including decrypting the second signature by using the public key of the other party, and judging whether the decryption result matches a splicing result of the first timestamp and the first ciphertext calculation result.

[0139] The verification unit 408 is specifically configured to:

[0140] In the case where the target verification passes, verification of whether the communication is secure or not is performed based on the first timestamp.

[0141] In one embodiment, the apparatus further includes:

[0142] The encryption unit 410 is configured to encrypt the second management instruction by using the public key of the opposite party to obtain a second ciphertext instruction.

[0143] The sending unit 406 is further configured to send the second ciphertext instruction to the measurement agent and obtain a second ciphertext calculation result returned by the measurement agent.

[0144] The decryption unit 412 is configured to decrypt the second ciphertext calculation result by using the private key of the self party.

[0145] The functions of each functional unit of the apparatus in the foregoing embodiments of the present specification can be realized by each step of the foregoing method embodiments, and thus, the specific working process of the apparatus provided by one embodiment of the present specification is not repeated here.

[0146] The secure communication apparatus provided by one embodiment of the present specification can ensure the security and trustworthiness of the measurement agent during running.

[0147] Corresponding to the secure communication method described above, one embodiment of the present specification further provides a secure communication apparatus, which is arranged in a measurement agent in a host computer. As shown in FIG. 5, the apparatus includes:

[0148] The receiving unit 502 is configured to receive second authentication information from a trusted control module in a trusted subsystem, wherein the second authentication information includes a second signature.

[0149] The execution unit 504 is configured to perform fourth verification based on the second signature, and determine whether the identity of the trusted control module is trusted based on at least a verification result of the fourth verification.

[0150] The sending unit 506 is configured to provide an initial timestamp to the trusted control module in the case where the identity of the trusted control module is trusted, so that the trusted control module performs verification of whether the communication is secure or not based on the initial timestamp.

[0151] The receiving unit 502 is further configured to receive a first ciphertext instruction and a second timestamp from the trusted control module.

[0152] The verification unit 508 is configured to perform verification of whether the communication is secure or not based on the second timestamp, and in the case where the verification passes, decrypt and execute the first ciphertext instruction to obtain a calculation result of integrity calculation on a measurement object in the host computer.

[0153] The encryption unit 510 is configured to encrypt the calculation result and provide the obtained first ciphertext calculation result to the trusted control module.

[0154] In one embodiment, the second authentication information further includes a second code value.

[0155] The execution unit 504 is further configured to perform a fifth verification, including judging whether the second code value is equal to the second challenge code generated locally by the measurement agent.

[0156] The execution unit 504 is specifically configured to:

[0157] In a case where the fourth verification and the fifth verification are both passed, it is determined that the identity of the trusted control module is trusted.

[0158] In one embodiment, the second authentication information further includes second identification information.

[0159] The execution unit 504 is further configured to perform a sixth verification, including judging whether the second identification information is equal to the second identity information of the measurement agent.

[0160] The execution unit 504 is further specifically configured to:

[0161] In a case where the fourth verification and the sixth verification are both passed, it is determined that the identity of the trusted control module is trusted.

[0162] In one embodiment, the execution unit 504 is specifically configured to:

[0163] The second signature is decrypted by using the public key of the other party, and it is judged whether the decryption result matches the splicing result of the second identity information of the measurement agent, the second challenge code generated locally, and the first challenge code received from the trusted control module.

[0164] In one embodiment, the verification unit 508 is specifically configured to:

[0165] The initial timestamp is modified according to the modification manner agreed with the trusted control module, and a modification result is obtained;

[0166] It is judged whether the second timestamp is equal to the modification result.

[0167] In one embodiment, the receiving unit 502 is further configured to receive a second target signature from the trusted control module.

[0168] The execution unit 504 is further configured to perform a target verification on the second target signature, including decrypting the second target signature by using the public key of the other party, and judging whether the decryption result matches the splicing result of the second timestamp and the first ciphertext instruction.

[0169] The verification unit 508 is specifically configured to:

[0170] In a case where the target verification passes, verification of whether communication is secure or not is performed based on the second timestamp.

[0171] In one embodiment, the apparatus further includes a decryption unit 512.

[0172] The receiving unit 502 is further configured to receive a second ciphertext instruction from the trusted control module.

[0173] The decryption unit 512 is configured to decrypt the second ciphertext instruction by using a private key of the local party and perform the second ciphertext instruction to obtain a second calculation result.

[0174] The encryption unit 510 is further configured to encrypt the second calculation result by using a public key of the opposite party and send the obtained second ciphertext calculation result to the trusted control module.

[0175] The functions of each functional unit of the apparatus described in the foregoing embodiments of the present specification can be implemented by each step of the foregoing method embodiments, and thus the specific working process of the apparatus provided in an embodiment of the present specification is not described herein.

[0176] The secure communication apparatus provided in an embodiment of the present specification can ensure that the trusted control module is secure and trusted.

[0177] According to another aspect, an embodiment also provides a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in connection with Figure 2 or Figure 3.

[0178] According to another aspect, an embodiment also provides a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in connection with Figure 2 or Figure 3.

[0179] Each embodiment in the present specification is described in a progressive manner, and the same or similar parts between each embodiment can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the medium or device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0180] The above describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order other than that described in the embodiments and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or advantageous.

[0181] The above detailed description has been given to further explain the purpose, technical solutions and beneficial effects of the present specification. It should be understood that the above description is only a specific embodiment of the present specification and is not used to limit the protection scope of the present specification. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present specification shall be included in the protection scope of the present specification.

Claims

1. A secure communication method, executed by a trusted control module in a trusted subsystem, comprising: receiving first authentication information from a metric agent in a host machine, the first authentication information including a first signature; performing a first verification based on the first signature, and determining whether the measurement proxy identity is authentic based at least on a verification result of the first verification; If the identity of the measurement agent is credible, encrypting the measurement management instruction and providing the obtained first ciphertext instruction to the measurement agent, so that the measurement agent performs integrity calculation on the measurement object in the host machine; receiving a first timestamp and a first ciphertext calculation result from the metric agent; Verify whether the communication is secure based on the first timestamp, and decrypt the first ciphertext calculation result if the verification passes.

2. The method according to claim 1, wherein The first authentication information further includes a first code value; and the method further includes: performing a second verification, including determining whether the first code value is equal to a first challenge code locally generated by the trusted control module; The determining whether the measurement proxy identity is credible includes: If both the first verification and the second verification are passed, it is determined that the measurement agent identity is credible.

3. The method according to claim 1, wherein The first authentication information further includes first identification information; and the method further includes: performing a third verification, including determining whether the first identification information is equal to the first identity information of the trusted control module; The determining whether the measurement proxy identity is credible includes: If both the first verification and the third verification are passed, it is determined that the measurement agent identity is credible.

4. The method according to claim 1, wherein The performing of the first verification includes: The first signature is decrypted using the other party's public key, and it is determined whether the decryption result matches a concatenation of the first identity information of the trusted control module, a locally generated first challenge code, and a second challenge code received from the measurement agent.

5. The method according to claim 1, wherein The verifying whether the communication is secure based on the first timestamp includes: Determine whether the first timestamp is equal to the second timestamp cached therein; wherein the second timestamp is obtained by modifying the initial timestamp from the measurement agent according to a modification method agreed upon with the measurement agent.

6. The method according to claim 1, further comprising: receiving a first target signature from the metric agent; Performing target verification on the first target signature, including decrypting the second signature using the other party's public key and determining whether the decrypted result matches a concatenation of the first timestamp and the first ciphertext calculation result; The verifying whether the communication is secure based on the first timestamp includes: When the target verification is passed, the communication security is verified based on the first timestamp.

7. The method according to claim 1, further comprising: Using the other party's public key, encrypt the second management instruction to obtain a second ciphertext instruction; Sending the second ciphertext instruction to the measurement agent and obtaining the second ciphertext calculation result returned by the measurement agent; Use the party's private key to decrypt the second ciphertext calculation result.

8. A secure communication method, performed by a metric agent in a host computer, comprising: receiving second authentication information from a trusted control module in the trusted subsystem, the second authentication information including a second signature; performing a fourth verification based on the second signature, and determining whether the identity of the trusted control module is credible based at least on a verification result of the fourth verification; If the identity of the trusted control module is trusted, providing the trusted control module with an initial timestamp so that the trusted control module can verify whether the communication is secure based on the timestamp; receiving a first ciphertext instruction and a second timestamp from the trusted control module; Verifying the security of communication based on the second timestamp, and if the verification passes, decrypting and executing the first ciphertext instruction to obtain a calculation result of integrity calculation for the measurement object in the host machine; The calculation result is encrypted, and the obtained first ciphertext calculation result is provided to the trusted control module.

9. The method according to claim 8, wherein The second authentication information further includes a second code value; and the method further includes: performing a fifth verification, including determining whether the second code value is equal to a second challenge code locally generated by the measurement agent; The determining whether the identity of the trusted control module is trustworthy includes: If both the fourth verification and the fifth verification are passed, it is determined that the identity of the trusted control module is trusted.

10. The method according to claim 8, wherein The second authentication information further includes second identification information; and the method further includes: performing a sixth verification, including determining whether the second identification information is equal to the second identity information of the measurement agent; The determining whether the identity of the trusted control module is trustworthy includes: If both the fourth verification and the sixth verification are passed, it is determined that the identity of the trusted control module is trusted.

11. The method according to claim 8, wherein The performing of the fourth verification includes: The second signature is decrypted using the other party's public key, and it is determined whether the decryption result matches a concatenation of the second identity information of the measurement agent, the locally generated second challenge code, and the first challenge code received from the trusted control module.

12. The method according to claim 8, wherein The verifying whether the communication is secure based on the second timestamp includes: Modify the initial timestamp according to the modification method agreed upon with the trusted control module to obtain a modification result; Determine whether the second timestamp is equal to the modification result.

13. The method according to claim 8, further comprising: receiving a second target signature from the trusted control module; Performing target verification on the second target signature, including decrypting the second target signature using the other party's public key and determining whether the decrypted result matches the concatenation of the second timestamp and the first ciphertext instruction; The verifying whether the communication is secure based on the second timestamp includes: When the target verification is passed, the communication security is verified based on the second timestamp.

14. The method according to claim 8, further comprising: receiving a second encrypted instruction from the trusted control module; Using the party's private key, decrypt the second ciphertext instruction and execute it to obtain a second calculation result; The second calculation result is encrypted using the other party's public key, and the obtained second ciphertext calculation result is sent to the trusted control module.

15. A secure communication device, comprising a trusted control module provided in a trusted subsystem, comprising: a receiving unit, configured to receive first authentication information from a measurement agent in a host machine, the first authentication information including a first signature; an execution unit, configured to perform a first verification based on the first signature, and determine whether the measurement proxy identity is credible based at least on a verification result of the first verification; a sending unit, configured to encrypt the measurement management instruction, if the identity of the measurement agent is credible, and provide the obtained first ciphertext instruction to the measurement agent, so that the measurement agent performs integrity calculation on the measurement object in the host machine; The receiving unit is further configured to receive a first timestamp and a first ciphertext calculation result from the measurement agent; A verification unit is used to verify whether the communication is secure based on the first timestamp, and decrypt the first ciphertext calculation result if the verification is successful.

16. The device according to claim 15, wherein The first authentication information further includes a first code value; The execution unit is further configured to perform a second verification, including determining whether the first code value is equal to a first challenge code locally generated by the trusted control module; The execution unit is specifically used for: If both the first verification and the second verification are passed, it is determined that the measurement agent identity is credible.

17. The device according to claim 15, wherein The first authentication information further includes first identification information; The execution unit is further configured to perform a third verification, including determining whether the first identification information is equal to the first identity information of the trusted control module; The execution unit is further specifically configured to: If both the first verification and the third verification are passed, it is determined that the measurement agent identity is credible.

18. The device according to claim 15, The receiving unit is further configured to receive a first target signature from the measurement agent; The execution unit is further configured to perform target verification on the first target signature, including decrypting the second signature using the other party's public key and determining whether the decryption result matches a concatenation of the first timestamp and the first ciphertext calculation result; The verification unit is specifically used for: When the target verification is passed, the communication security is verified based on the first timestamp.

19. The apparatus according to claim 15, further comprising: an encryption unit, configured to encrypt the second management instruction using the other party's public key to obtain a second ciphertext instruction; The sending unit is further configured to send the second ciphertext instruction to the measurement agent and obtain the second ciphertext calculation result returned by the measurement agent; The decryption unit is used to decrypt the second ciphertext calculation result using the private key of the party.

20. A secure communication device, a measurement agent provided in a host computer, comprising: A receiving unit, configured to receive second authentication information from a trusted control module in the trusted subsystem, the second authentication information including a second signature; an execution unit, configured to perform a fourth verification based on the second signature, and determine whether the identity of the trusted control module is credible based at least on a verification result of the fourth verification; a sending unit, configured to provide an initial timestamp to the trusted control module if the trusted control module is credible, so that the trusted control module can verify whether the communication is secure based on the initial timestamp; The receiving unit is further configured to receive a first ciphertext instruction and a second timestamp from the trusted control module; a verification unit, configured to verify the security of the communication based on the second timestamp, and, if the verification passes, decrypt and execute the first ciphertext instruction to obtain a calculation result of the integrity calculation performed on the measurement object in the host machine; The encryption unit is used to encrypt the calculation result and provide the obtained first ciphertext calculation result to the trusted control module.

21. The device according to claim 20, wherein The second authentication information further includes a second code value; The execution unit is further configured to perform a fifth verification, which includes determining whether the second code value is equal to a second challenge code locally generated by the measurement agent; The execution unit is specifically used for: If both the fourth verification and the fifth verification are passed, it is determined that the identity of the trusted control module is trusted.

22. The device according to claim 20, wherein The second authentication information further includes second identification information; The execution unit is further configured to perform a sixth verification, including determining whether the second identification information is equal to the second identity information of the measurement agent; The execution unit is further specifically configured to: If both the fourth verification and the sixth verification are passed, it is determined that the identity of the trusted control module is trusted.

23. The apparatus according to claim 20, further comprising: The receiving unit is further configured to receive a second encrypted instruction from the trusted control module; a decryption unit, configured to decrypt the second ciphertext instruction using the party's private key and execute the decryption to obtain a second calculation result; The encryption unit is further configured to encrypt the second calculation result using the other party's public key, and send the obtained second ciphertext calculation result to the trusted control module.

24. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 14.

25. A computing device comprising a memory and a processor, wherein: The memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 14 is implemented.

Images