53 results about "Integrity measurement" patented technology

The invention relates to the technical field of data security, in particular to a mobile solid state disk data encryption storage method based on a trusted computing module. According to the method, integrity measurement is carried out on an operating environment through a trusted computing module, and a trusted measurement value is generated; generating a session-level encryption key based on the trusted magnitude; encrypting data using the key and storing key metadata; during data reading, correlation verification is carried out to determine whether decryption is authorized or not; and baseline adjustment can be triggered according to the measurement deviation. According to the invention, the data security of the mobile storage device is improved, and an environment-aware dynamic key management mechanism is realized.

The invention discloses a USB access safety control system, and particularly relates to the field of USB access electric digital data processing, which comprises an identification module, an isolation module, an encryption continuous transmission module, an auditing module and a kernel interrupt signal triggered by USB physical insertion, and the identification module is used for receiving the kernel interrupt signal and writing the kernel interrupt signal into the interrupt event buffer area, generating a to-be-analyzed interrupt data group, analyzing and generating identification notification information and pushing the identification notification information as a USB access snapshot data frame. Strong binding of USB device access identities, interval control of permission states and traceable closed management of behavior tracks are achieved by constructing a security context vector with device fingerprints, authorization group IDs and insertion timestamps as cores and forming a dynamic association verification path among isolation state judgment, behavior integrity measurement and chain audit account books. The key problems of equipment loopback cheating, permission mismatching, audit failure and the like are solved.

A process includes accessing from a managed node a plurality of integrity measurements that are generated by the managed node responsive to the managed node changing power states. The process includes determining whether the managed node has unexpectedly changed. Determining whether the managed node has unexpectedly changed includes identifying an algorithm that corresponds to the managed node. Determining whether the managed node has unexpectedly changed further includes applying the algorithm to the integrity measurements to generate an observed verification value for the managed node. Determining whether the managed node has unexpectedly changed further includes comparing the observed verification value with an expected verification value for the managed node. The process includes initiating a responsive action in response to determining that the managed node has unexpectedly changed.

The invention belongs to the field of network security, and relates to a method and a device for constructing a network security operating system, electronic equipment and a storage medium, and the method comprises the following steps: constructing an autonomously controllable improved microkernel infrastructure; based on the microkernel infrastructure, constructing a full-stack layered security control computing architecture base; constructing intelligent agent components, and deploying a multi-intelligent agent collaborative protection component system; integrating trusted computing and an integrity measurement verification system; performing dynamic adaptation and execution of multiple security policies; and a standardized safety evaluation and adaptive optimization closed loop is established. A trusted computing base is cut from a design source, so that the probability of occurrence of high-risk vulnerabilities is reduced; the real-time defense that the threat is changed and the strategy is changed is realized, and the blind area of the static strategy in resisting the unknown threat is made up; the malicious codes can be blocked before running, and the post passive situation that traditional security software only depends on a feature library for searching and killing is broken; and the contradiction between security capability solidification and threat dynamic evolution is fundamentally solved.

The invention discloses a trusted connection method, a power distribution terminal, a power distribution master station and a trusted connection system, and belongs to the technical field of trusted computing. The power distribution terminal is in communication connection with the power distribution master station, and the method comprises the steps that the power distribution terminal completes credible starting through an ESAM chip and generates an integrity measurement report; the power distribution terminal initiates a connection request to the power distribution master station and submits a signature integrity measurement report signed by the ESAM chip; the power distribution master station receives the signature integrity measurement report sent by the power distribution terminal; and the power distribution master station allows the power distribution terminal to access after verifying that the signature integrity measurement report passes. According to the embodiment of the invention, the credibility of the power distribution terminal from starting to operation can be effectively improved, and the safety access of the power distribution terminal and the power distribution master station is realized.

This invention discloses a method for measuring the integrity of a spaceborne embedded system based on link symbol topology. In the static injection phase, a linker script is configured to inject symbols at critical memory segment boundaries, generating hierarchical hybrid fingerprints and redundantly persisting them to non-volatile storage. In the dynamic verification phase, a lightweight program is started before the operating system takes over, performing hierarchical dual-dimensional and SEU-resistant temporal redundancy verification, supporting multi-container dedicated isolation verification. In the linkage blocking phase, anomalies are forcibly blocked and primary / backup linkage is triggered, collecting eight types of fault contexts and supporting on-orbit updates. This invention solves the problems of traditional hash methods failing to detect layout anomalies and high time consumption, reducing complexity to O(K), achieving sub-millisecond-level measurement decoupled from image volume, adapting to spaceborne radiation-resistant, cloud-native, and redundancy scenarios, and meeting the high reliability requirements of aerospace.

The present invention discloses a data security processing and remote attestation model protection system and method for machine learning, belonging to the fields of computer program analysis technology, information security, and data services. By combining the Pearson correlation coefficient, FP-Growth algorithm, and cosine similarity to fill missing values ​​in discrete data, SMOTE-based minority group oversampling, and constructing a measurement engine, the system inserts stubs into the machine learning model program code to complete the integrity measurement of the modeling process and modeling results. The present invention adopts the above-mentioned data security processing and remote attestation model protection system and method for machine learning, traversing the control flow graph of the static model program code through a breadth-first search method to calculate the trusted execution process measurement value of each sub-process, and comparing each measurement value with the trusted measurement value to verify the measurement result, thereby ensuring that the code and results during the modeling process have not been tampered with.

The application relates to the technical field of artificial intelligence and password security, and discloses a large language model privacy reasoning method and system capable of verifying no-log behavior and output integrity; the method first sends an encrypted question to the server by the client; the server loads a pre-compiled no-log reasoning program in a trusted execution environment, decrypts and reasons; the reasoning is completed, and zero is cleared; a joint hash value is obtained, a custom data field of a remote proof report is embedded, and a program integrity measurement value is obtained; finally, the response and the proof report are returned to the user. The user client compares the local joint hash value with the custom data in the proof, and verifies the program measurement value, so that it can be confirmed that the log function is not enabled in this reasoning, and the received model response is generated by the specified model for the question, and is not tampered with. The application first realizes double-verified guarantee of privacy and output credibility in large model services, and significantly improves the trust degree of the user for the AI system.

A remote attestation method, device, medium, electronic device and program product. The method comprises: loading a virtual machine image file of a first application, the virtual machine image file being used to deploy the first application in a first trusted execution environment, the virtual machine image file comprising a root file system, a joint file system and a kernel; starting the kernel and measuring the root file system to deploy the first application in the first trusted execution environment; measuring the kernel and a lower component of the kernel to obtain a first measurement value, and after the kernel is started, measuring the joint file system using an integrity measurement architecture in the kernel to obtain a second measurement value, so as to remotely attest the first application based on the first measurement value and the second measurement value. When remotely attesting the first application, the first measurement value and the second measurement value are generated based on the measurement results of the kernel and the lower component thereof and the joint file system above the kernel, so as to realize the measurement of the code and data at the application level.

The application relates to the technical field of mainboards, in particular to an industrial mainboard security starting method based on a hardware root of trust, which comprises the following steps: after the industrial mainboard is powered on and reset, a security control domain runs prior to a business processing domain, and a main processor is kept waiting for starting; the security control domain reads hardware root anchor credentials and an initial boot program, and sequentially performs integrity measurement and signature verification on the initial boot program and a later-stage boot program; after the verification passes, running key materials are derived based on a random seed, device private credentials and a later-stage boot program digest, a running private key is written into a restricted key area, and a running public key is written into a public storage area; when a boot update package exists, a firmware public key certificate, a boot image signature and a replacement identifier are verified, a boot image is loaded after the certificate is valid and the signature passes, starting proof information is generated, an access path is closed and the main processor is released; any verification failure enters a fault processing flow.

The invention discloses a firmware integrity measurement and remote certification method based on a DSP chip and an SM3 algorithm, and the method comprises the following steps: a presetting stage: in a protected secure storage area of the DSP chip, presetting a reference measurement value Hbenchmark generated based on a trusted firmware mirror image, and a cryptographic key material for signature; in the dynamic measurement and proof generation stage, when verification is needed, the DSP chip executes the following operations: (a) obtaining a dynamically generated random number Non; (b) performing integrity measurement on the current firmware code to be verified, and generating a dynamic measurement value Hcurrent; the integrity measurement comprises the following steps of: performing SM3 hash calculation on measurement data related to the current firmware state by adopting a parallel hash calculation strategy; the measurement data at least comprises the random number Non and one or more pieces of measurement metadata obtained based on the current firmware code data. The firmware verification is safe and efficient, the adaptation of the Internet of Things is tamper-proof and anti-replay, and the Internet of Things is efficient, anti-attack and credible.

The invention discloses a container trusted measurement and verification method in a confidential environment, and belongs to the technical field of information security. According to the method, a dual-system architecture in which calculation and protection components run in parallel is designed, TCMTPCM and vTPCM management modules and a trusted software base TSB are constructed and deployed in the protection components, protection and hardware trusted roots are provided for running containers in a confidential virtual machine in a confidential environment, and integrity measurement judgment of key content is carried out in the starting and running processes of the containers. Confidentiality, integrity and credibility of a user service container provided in the cloud service are realized. And finally, a dual verification mechanism for providing a service container is introduced, and a remote verification platform not only needs to verify the identity and integrity of a confidential virtual machine where the container is located, but also needs to verify the integrity of the container and the integrity of the container during operation based on the vTPCM in the virtual machine. The method can get rid of absolute dependence of a user on single hardware trust of a hardware trust provider, and integrity measurement and verification are carried out during container operation in a confidential environment.

The application discloses a kind of server's trusted startup design method, belong to information security and trusted computing technical field, server is powered on, and trusted root CPU core is started preferentially, and runs trusted startup program and initializes security environment;BIOS is carried out integrity measurement and verification, and other CPU core is released and runs BIOS after verification passes;By business CPU core loading boot program GRUB, and submitting trusted root CPU core for verification;Subsequently, operating system kernel image is loaded and hash measurement is executed, while combining the control flow information of kernel initialization phase to calculate path entropy value;Then memory image and disk image are segmented and compared, and mapping consistency coefficient is calculated;If verification passes, continue to start operating system;The application can effectively prevent tampered components in system startup chain from being loaded and running, and enhance the startup security and overall trustworthiness of server.

Embodiments of the present application provide a file integrity detection method and device, electronic equipment and storage medium, and relate to the technical field of computer, the method comprises: the kernel state responds to the file information of the to-be-detected file transmitted from the target file node to the kernel state, calling the target process bound by the target file node to process the file information, obtaining the detection result of the integrity of the to-be-detected file; wherein, the target file node is mounted in the security file system in the kernel, and the target process is the process in the integrity measurement architecture (IMA) in the kernel for file integrity detection; the kernel state returns the detection result to the user state. Through the embodiments of the present application, the problem of IMA integrity detection not being timely can be solved.

The invention relates to a trusted computing method and system for a heterogeneous fusion platform, and the method comprises the steps: defining trusted middleware through software, firstly carrying out the unified abstraction of all computing units in the platform, constructing a platform identity summary, decomposing a computing task into trusted task objects containing expected behavior portraits, and carrying out the unified abstraction of all computing units in the platform; and the behavior indexes during operation of each unit are collected in real time through the virtual trusted agent, the behavior indexes are compared with the expected portrait to generate a consistency judgment result, and the behavior integrity measurement register is dynamically updated. When verification is needed, the system collects multiple layers of evidences such as platform identity, behavior measurement, hardware certification and accelerator declaration to form a structured certification set, and a hierarchical unified certification report is generated after platform key signature. And after analyzing the report, the remote verification party issues a fine-grained credible token to the verified platform by comparing the credible reference value with the evaluation behavior compliance.

The invention relates to a self-verifying integrated circuit. A technique includes making, by a self-verification engine of an integrated circuit, measurements on the integrated circuit to provide hardware integrity measurements. The technique includes generating, by a self-verification engine, an observed fingerprint of the integrated circuit based on hardware integrity measurements and firmware integrity measurements. The technique includes validating, by a self-validation engine, the integrated circuit based on the observed fingerprint.

The application provides a program integrity verification system and method suitable for a read-only file system, relates to the technical field of read-only file system protection, and comprises the following steps: when a read-only file system image is made, the trusted program file of the read-only file system is subjected to integrity measurement to construct a hash tree, then the unique identification of the hash tree is recorded in the metadata of the trusted program file, and the hash tree is signed and saved; when the program file is loaded, when the program file is determined to be a trusted program file according to the unique identification, the corresponding hash tree is called according to the unique identification to perform signature authentication, the program page is subjected to integrity verification, and the program page is allowed to be loaded and run when the signature authentication and the integrity verification are passed. The beneficial effect is to protect the safety of the read-only file system and the program credibility, so that even if a malicious program attacks into the computer by using a system vulnerability, the malicious program cannot run in the read-only file system, and the safety and reliability of the read-only file system are ensured to a greater extent.

The application provides a container security execution method, device and storage medium, wherein the method comprises the following steps: establishing a main monitoring and a plurality of sub-monitorings based on an SGX, and managing a container through the main monitoring and the plurality of sub-monitorings; in response to the first start of a container system, performing integrity measurement on a structural file of the container system, calculating an integrity measurement value of the structural file of the container system, and saving the integrity measurement value as an integrity measurement base value of the container system to the main monitoring. The application solves the problem that containers in a same Network Namespace can access each other, solves the isolation problem between containers, limits the access ability of other containers to a runtime container by setting a container network whitelist, and prevents malicious attack behaviors of untrusted containers. The application solves the integrity and legality verification of a container runtime code segment and a stack function return address, and prevents problems such as tampering of the container runtime code segment and overflow of the stack function return address.

It is provided an apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry to execute the machine-readable instructions. The machine-readable instructions include instructions to record an entry into a virtual integrity register. The entry is based on a measurement of a module. The module is a part of a confidential computing environment. The machine-readable instructions further include instructions to load the module into a memory. The memory is accessible by the confidential computing environment. The machine-readable instructions further include instructions to record an entry of a log. The log comprises a load history. The entry comprises information about the loading of the module. The machine-readable instructions further include instructions to record an entry into an integrity measurement register. The entry being based on the recorded virtual integrity register entry.

The invention belongs to the technical field of information security, and discloses an online learning data security encryption and privacy protection method in a credential environment. Comprising the steps of detecting underlying hardware features of an equipment end through a micro-architecture probe, and loading a target national cryptographic algorithm library adaptive to a current hardware architecture based on a detection result; generating an integrity measurement value of the equipment based on the feature information of the target national cryptographic algorithm library, taking the integrity measurement value as a key generation factor, generating an equipment private key, and negotiating with a platform server by using the equipment private key to generate a session key; calling the target national secret algorithm library by taking the session key as a parameter, performing encryption protection on video data in the online learning data, and uploading the encrypted video data to a platform server; and efficient and safe online learning data encryption and privacy protection in a credential environment are realized.

The invention discloses an operating system kernel design method and device based on trust domain extension, and the method comprises the steps: obtaining a Rust-TPM library and a Rust-IMA library which are constructed based on a Rust language, and reducing security vulnerabilities and improving the reliability of codes through the security attribute of Rust; according to the method, an Asterias-IMA kernel is obtained on the basis of a Rust-TPM (Trusted Platform Module) library and a Rust-IMA library, and security vulnerabilities can be effectively reduced by the system kernel realized through Rust; the kernel is deployed on the Intel trust domain extension to obtain the kernel based on the trust domain extension, and the security of the system is enhanced by means of the isolation effect of the Intel trust domain extension. According to the method, the integrity measurement architecture function is realized again by utilizing the memory security characteristics of Rust and trust domain extension, so that the security of an operating system is greatly improved.

The application relates to the field of network security, in particular to an integrity measurement method and an integrity measurement device. The method comprises the following steps: a first measurement module performs integrity measurement on a second measurement module to obtain a first measurement result. Herein, the credibility of the first measurement module is higher than that of the second measurement module. The first measurement module receives a second measurement result sent by the second measurement module. The second measurement result is obtained by the second measurement module performing integrity measurement on an object to be measured. The first measurement module sends measurement result information to a proof module. The measurement result information is determined by the first measurement result and the second measurement result. The proof module determines whether the object to be measured passes the integrity verification according to the measurement result information. The method can improve the accuracy and reliability of the integrity measurement.

The invention relates to the technical field of computer system security, and particularly discloses an RAID (redundant array of independent disks) card and TPM (trusted platform module) chip collaborative system trusted startup method, which comprises the following steps: S1, after a system is powered on, starting by using a TPM chip as a trusted root, and executing integrity measurement to establish a trusted startup chain; s2, after BIOS verification is passed and before a bootLoader is loaded, the BIOS initiates integrity measurement and verification of the RAID card, and the measurement and verification of the RAID card at least comprise verification of firmware of the RAID card and feature values of a system hard disk connected with the firmware; s3, only after verification of the RAID card is passed, the system loads and executes subsequent BootLoader and an operating system kernel from a system disk on the RAID card, and starting is completed; s4, during normal operation of the system, the TPM chip performs periodic or triggered dynamic measurement on the RAID card and the system disk thereof through the system management bus, and executes a security processing strategy when the measurement is abnormal; and the trust chain is expanded to the storage subsystem, so that comprehensive security protection is realized.

The application provides a file granularity data reading method and device, electronic equipment and medium. The method comprises: obtaining a reading request, the reading request being used to indicate reading N data blocks in a file; wherein the file comprises M data blocks, N is less than M, M and N are positive integers; for each data block in the N data blocks, it is judged whether there is a page cache of the data block, if there is, after obtaining a measurement mark of the page cache as an update mark, it is determined that the page cache meets the integrity measurement; wherein the update mark is used to indicate that the page cache passes the integrity measurement; after it is determined that the page caches corresponding to the N data blocks all meet the integrity measurement, a reading result is fed back based on the page cache. The method provided by the application improves the security of file reading and the efficiency of integrity checking during reading, thereby being beneficial to improving user experience.

The invention discloses a TrustZone block chain node-oriented trusted execution environment running state integrity measurement method, which relates to the field of computer technology and information security, and is composed of a strategy management module, an integrity measurement module, an evaluation module and a security log construction module. According to the method, the kernel, the static component, the trusted application and the system call in the trusted execution environment of the block chain node equipment can be measured, evaluated and recorded, and a complete log of the component and the event which influence the integrity during operation in the trusted execution environment is formed. The method is used for solving the problem that the integrity of the existing ARM TrustZone block chain node equipment is difficult to ensure when the equipment runs in the trusted execution environment, so that the node is trusted in the whole life cycle, and the integrity measurement of the running state of the TrustZone block chain node in the trusted execution environment is safely and efficiently realized.

A data protection method and apparatus, and a device. A data storage apparatus provides a confidential storage service, wherein the service is a storage service having better security, and the service is designed to authenticate data access and enforce isolation to prevent data from unauthorized operations such as reading, tampering, or deletion. The service is further responsible for persistently storing confidential data, maintaining data integrity, and performing identity mapping for confidential computing tasks on a data access apparatus. The data storage apparatus obtains a first integrity measurement report, wherein the first integrity measurement report indicates a hardware environment and / or a software environment of the data access apparatus. Upon successfully verifying the data access apparatus on the basis of the first integrity measurement report, the data storage apparatus receives and processes a data access request sent by the data access apparatus. Achieving verification by means of the first integrity measurement report can ensure that data is processed in a relatively secure environment upon transmission to the data access apparatus, thereby effectively ensuring data security.

A method for creating a heterogeneous trusted execution environment, an apparatus, and a computing system are provided, and relate to the field of computer technologies. In an implementation, the method is applied to a computing device including a first processor and a second processor that are heterogeneous. The first processor creates a first security isolation entity based on a computing resource of the first processor; the first processor sends a first creation request to the second processor; the second processor creates a second security isolation entity based on a computing resource of the second processor in response to the first creation request; the first processor performs integrity measurement on the second security isolation entity on a side of the second processor; and the second processor performs integrity measurement on the first security isolation entity on a side of the first processor.

A system is provided that includes interface switching logic, machine-readable instructions, and processing switching logic for executing the machine-readable instructions. The machine-readable instructions include instructions for recording an entry in a virtual integrity register. The entry is based on a measurement of a module. The module is part of a confidential computing environment. The machine-readable instructions also include instructions for loading the module into memory. The confidential computing environment can access this memory. Furthermore, the machine-readable instructions include instructions for recording an entry in a log. The log contains a load history. The entry includes information about the module's loading. Finally, the machine-readable instructions include instructions for recording an entry in an integrity measurement register.The entry is based on the recorded entry in the virtual integrity register.

Reporting integrity measurement error distribution groups is provided. An apparatus may include at least one processor, and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to communicate, with a network device, information that may include one or more integrity distribution groups (IDGs) and corresponding distribution parameters. The apparatus may further perform positioning measurements for positioning integrity and determine one of the one or more IDGs based on at least one of the positioning measurements. A report is transmitted to the network device that may include at least one of the positioning measurements or an identifier of the determined IDG.

The invention discloses a photovoltaic data security guarantee method and system fusing trusted computing and a block chain, equipment and a medium. The method comprises the following steps: performing integrity measurement on photovoltaic acquisition equipment through a trusted measurement mechanism to generate an equipment measurement log; when the equipment credibility verification result is passed, encrypting photovoltaic data acquired by the photovoltaic acquisition equipment in the credible execution environment and generating a data abstract, and signing the data abstract through the credible platform module to form an encrypted data packet; extracting voucher information from the encrypted data packet, writing the voucher information into the block chain after the voucher information passes the verification of the smart contract to obtain an evidence storage receipt, and establishing an encrypted transmission channel after the identity authentication is passed; and transmitting the encrypted data packet through the encrypted transmission channel. The problems that in an existing data security guarantee method, integrity verification of collection equipment is not comprehensive, data processing lacks credible protection, identity authentication reliability is insufficient, transmission log traceability is poor, and stored data is prone to being tampered and difficult to recover are solved.