CN116502188A - Method, device and system for remote attestation - Google Patents

Abstract

The application discloses a remote proving method, equipment and a system, and belongs to the technical field of information processing. The method comprises the following steps: the first network equipment acquires a first baseline file and a measurement log, wherein the first baseline file is generated by the second network equipment, the first baseline file is used for recording a reference value of software of the second network equipment under the trusted condition, and the measurement log is used for recording a measurement value of the software. And under the condition that the first baseline file and the measurement log are confirmed to be credible, the first network equipment remotely proves the software based on the first baseline file and the measurement log to obtain a remote proving result corresponding to the software, wherein the remote proving result corresponding to the software is used for indicating whether the software is credible or not. Because the first baseline file and the measurement log acquired by the first network equipment are generated by the second network equipment, the acquisition mode is intelligent, and therefore the remote proving method provided by the application is intelligent and high in flexibility.

Description

Method, device and system for remote attestation

technical field

The present application relates to the technical field of information processing, and in particular to a method, device and system for remote attestation.

Background technique

With the continuous development of information technology, information security issues have become the focus of attention, and remote certification has emerged as the times require. In the process of remote attestation, a remote attestation server (remote attestation server, RAS) initiates a challenge to a remote attestation client (remote attestation client, RAC), so as to remotely attest software of the RAC. When the RAS performs remote certification on the RAC software, the RAS needs to use the baseline file corresponding to the RAC software.

In the prior art, the baseline file corresponding to the RAC software is generated by a software compiler during the software compilation process. The generation method of the baseline file makes the remote attestation method provided by the prior art insufficiently intelligent and less flexible.

Contents of the invention

The present application provides a remote certification method, device and system to solve the problem that the remote certification method provided by the prior art is not smart enough and has low flexibility. The technical solution is as follows.

In the first aspect, a remote attestation method is provided. The method includes: the first network device acquires the first baseline file and the measurement log generated by the second network device. The first baseline file is used to record the baseline value of the software of the second network device in a trusted situation, and the measurement log is used to record the measurement value of the software. After confirming that the first baseline file and the measurement log are credible, the first network device performs remote certification on the software based on the first baseline file and the measurement log, and obtains a remote certification result corresponding to the software. The remote attestation result corresponding to the software is used to indicate whether the software is trustworthy.

Since the first network device confirms that the first baseline file and the measurement log are credible, it remotely certifies the software of the second network device based on the first baseline file and the measurement log. This guarantees the accuracy of the obtained remote attestation results. Since the first baseline file and measurement log obtained by the first network device are generated by the second network device, the acquisition method is relatively intelligent, so the remote attestation method provided by the embodiment of the present application is also relatively intelligent and flexible.

In a possible implementation manner, the first network device performs remote certification on the software based on the first baseline file and the measurement log, and before obtaining the remote certification result corresponding to the software, the method further includes: the first network device receives the information sent by the second network device credible baseline file check value, the baseline file check value is used to check whether the first baseline file is credible. The first network device calculates the reference value recorded in the first baseline file to obtain the first value. The first value is calculated in the same way as the baseline file checksum. The same calculation method means the same algorithm, or the same algorithm and calculation order. In response to the first numerical value being the same as the baseline file check value, the first network device confirms that the first baseline file is authentic.

The method of verifying whether the first baseline file is credible by using the check value of the baseline file is concise and accurate. The first network device will perform the subsequent remote attestation process only when it is verified that the first baseline file is credible. The accuracy of the obtained remote proof result is guaranteed. For the situation that the reference value recorded in the first baseline file is tampered with, the order between different reference values recorded in the first baseline file is tampered with, the reference value and the order between different reference values are all tampered with, through this The method will confirm that the first baseline file is not trusted. The first network device does not execute the subsequent remote attestation process.

In a possible implementation manner, the first network device performs remote certification on the software based on the first baseline file and the measurement log, and before obtaining the remote certification result corresponding to the software, the method further includes: the first network device receives the information sent by the second network device The credible measurement log verification value of the measurement log is used to verify whether the measurement log is credible. The first network device calculates the metric value recorded in the metric log to obtain the second value. The second number is calculated in the same way as the metrics log checksum. The same calculation method means the same algorithm, or the same algorithm and calculation order. In response to the second numerical value being the same as the metric log check value, the first network device confirms that the metric log is authentic.

The first network device will perform the subsequent remote attestation process only when the measurement log is confirmed to be credible through verification, which ensures the accuracy of the obtained remote attestation result. However, if the metric values recorded in the metric log are tampered with, the order of different metric values recorded in the metric log is tampered with, and the order of the metric values and different metric values is tampered with, the measurement will be confirmed in this way. Logs are not trustworthy. The first network device does not execute the subsequent remote attestation process.

In a possible implementation manner, the first baseline file and the measurement log have been encrypted with the private key of the second network device. The first network device remotely attests the software based on the first baseline file and the measurement log, and before obtaining the remote attestation result corresponding to the software, the method further includes: the first network device obtains the public key corresponding to the private key, and uses the public key to verify the first baseline Files and metrics logs are decrypted.

If the first network device can decrypt the first baseline file and the metric log with the public key, the first network device can confirm that the first baseline file and the metric log are encrypted with the private key of the second network device. Furthermore, it can be confirmed that the first baseline file and the measurement log are sent by the second network device. In this way, it is possible to detect in time that the first baseline file and the measurement log are maliciously replaced during the transmission process, and avoid affecting the subsequent remote attestation process.

In a possible implementation manner, the first network device remotely certifies the software based on the first baseline file and the metric log, and before obtaining the remote certifying result corresponding to the software, the method further includes: the first network device determines the metric recorded in the metric log The metric target corresponding to the value belongs to the subset of the metric target corresponding to the baseline value recorded in the first baseline file.

This implementation is used for the first network device to confirm whether the second network device is trustworthy, and to execute the subsequent remote attestation process if the second network device is trustworthy. In a case where the metric target corresponding to the metric value recorded in the metric log does not belong to the subset of the metric target corresponding to the baseline value recorded in the first baseline file, it is confirmed that the second network device is untrustworthy. The first network device may directly determine that the software of the second network device is untrustworthy without performing the subsequent remote attestation process.

In a possible implementation manner, the first network device performs remote certification on the software based on the first baseline file and the measurement log, and before obtaining the remote certification result corresponding to the software, the method further includes: the first network device receives the information sent by the second network device The stored first baseline file. The first network device determines that the stored first baseline file is the same as the first baseline file.

This implementation is used for the first network device to confirm whether the second network device is trustworthy, and to execute the subsequent remote attestation process if the second network device is trustworthy. If the stored first baseline file is different from the first baseline file acquired by the first network device, it indicates that the first baseline file has been tampered with during the storage process of the first baseline file by the second network device, thereby indicating that the second network device Not credible. The first network device may directly determine that the software of the second network device is untrustworthy without performing the subsequent remote attestation process.

In a possible implementation, the first network device acquires the first baseline file and the measurement log generated by the second network device, including: the first network device sends a challenge request to the second network device, and the challenge request is used to request the second The network device sends a first baseline file and a metric log. The first network device receives the first baseline file and the metric log sent by the second network device. This method of obtaining is simple and convenient.

In a possible implementation manner, the challenge request includes a reference challenge value. The first network device remotely attests the software based on the first baseline file and the measurement log, and before obtaining the remote attestation result corresponding to the software, the method further includes: the first network device receives the challenge value sent by the second network device, and determines the challenge value and the benchmark The challenge value is the same.

If the challenge value is the same as the reference challenge value, the first network device can confirm that the received first baseline file and metric log are sent in response to the challenge request, and are not other baseline files and metrics that the first network device has ever received log. Therefore, it can be confirmed that there is no replay attack, which prevents the replay attack from affecting the subsequent remote attestation process, and ensures the accuracy of the remote attestation process.

In a possible implementation, the first network device performs remote certification on the software based on the first baseline file and the measurement log, and before obtaining the remote certification result corresponding to the software, the method further includes: the first network device determines the sending time and the receiving time The time difference between them is not greater than the time threshold. The sending time is the time when the challenge request is sent, and the receiving time is the time when the first baseline file and the measurement log are received.

This implementation is used for the first network device to confirm whether the second network device is trustworthy, and to execute the subsequent remote attestation process if the second network device is trustworthy. In a case where the time difference between the sending time and the receiving time is greater than the time threshold, the first network device may determine that the second network device is untrustworthy. The first network device may directly determine that the software of the second network device is untrustworthy without performing the subsequent remote attestation process.

In a possible implementation, the software is running state software, and the data of the running state software is located in multiple memory pages included in the memory of the second network device, and the first baseline file is obtained by querying multiple memory pages by the second network device The data and spliced data are generated after being obtained by the software in the running state, and the software in the running state is at least one of user state software and kernel state software.

The software in the running state is located in the memory of the second network device, and the data of the software in the running state may be scattered in different memory pages of the memory. Therefore, the second network device needs to query each memory page to obtain data, and splicing to obtain the running state software. Therefore, the first baseline file corresponding to the software in the running state can be generated, and then the remote certification for the software in the running state can be realized.

In a possible implementation manner, the running state software is kernel state software, and the method further includes: the first network device acquires a second baseline file corresponding to the user state software of the second network device. The second baseline file is generated during compilation of the user mode software. The first network device performs remote certification on the user state software based on the second baseline file, and obtains a remote certification result corresponding to the user state software.

As mentioned above, the running software is located in the memory of the second network device. Wherein, during the process of loading the kernel state software into the memory, the kernel state software will be modified such as redirection and rewriting, so that the kernel state software before and after loading is inconsistent. Since the modification of the kernel state software is unpredictable, for the kernel state software, the first baseline file corresponding to the kernel state software can only be generated by the second network device after the kernel state software is loaded into the memory. However, during the process of loading the user state software into the memory, the user state software will not be modified, so the user state software is consistent before and after loading. Therefore, for the user mode software, the first baseline file corresponding to the user mode software may be generated by the second network device. The second baseline file corresponding to the user-mode software may also be generated during the compiling process of the user-mode software. Both the first baseline file and the second baseline file can be used to remotely certify the user mode software.

In the second aspect, a remote attestation method is provided. The method includes: the second network device generates a first baseline file corresponding to the software of the second network device, and the first baseline file is used to record a benchmark value of the software under a trusted condition. The second network device generates a measurement log corresponding to the software, where the measurement log is used to record the measurement value of the software. The second network device sends the first baseline file and the metric log to the first network device.

In a possible implementation manner, the metric value recorded in the metric log corresponds to a metric target. For any measurement target, the reference value corresponding to any measurement target in the first baseline file is different from the measurement value corresponding to any measurement target.

In this implementation manner, the second network device compares the first baseline file with the measurement values of each measurement target. Log only metrics that differ from the baseline in the first baseline file, resulting in a metrics log. Compared with the method of recording the measurement values of all measurement objects to obtain the measurement log, the method of recording after comparison can reduce the data volume of the measurement log and reduce the storage space required for the measurement log.

In a possible implementation manner, the second network device generating the metric log corresponding to the software includes: in response to confirming that the first baseline file is authentic, the second network device generating the metric log corresponding to the software.

After confirming that the first baseline file is credible, the second network device compares the first baseline file with the measurement values of each measurement target. The comparison process can be prevented from being affected by the fact that the first baseline file is untrustworthy, and the accuracy of the measurement log obtained through the comparison is ensured. Therefore, the accuracy of the subsequent remote attestation process is guaranteed.

In a possible implementation manner, the method further includes: the second network device calculates the reference value recorded in the first baseline file to obtain the check value of the baseline file. The check value of the baseline file is used to check whether the first baseline file is credible. The second network device sends the credible baseline file check value to the first network device.

In a possible implementation manner, the method further includes: the second network device calculates the metric value recorded in the metric log to obtain a verification value of the metric log. The measurement log verification value is used to verify whether the measurement log is credible. The second network device sends the credible metric log check value to the first network device.

In a possible implementation manner, the second network device sending the first baseline file and the metric log to the first network device includes: the second network device sending the first baseline file and the measurement log encrypted by the private key of the second network device to the first network device. A baseline file and metrics log.

In a possible implementation manner, the method further includes: the second network device sending the stored first baseline file to the first network device.

In a possible implementation manner, before the second network device sends the first baseline file and the measurement log to the first network device, the method further includes: the second network device receives a challenge request sent by the first network device. The challenge request is used to request the second network device to send the first baseline file and the measurement log.

In a possible implementation manner, the challenge request includes a reference challenge value, and the method further includes: the second network device sends the challenge value to the first network device, where the challenge value is the reference challenge value.

In a possible implementation manner, the software is running state software. The running state software is at least one of user state software and kernel state software. The second network device generates the first baseline file corresponding to the software of the second network device, including: the second network device queries multiple memory pages included in the memory of the second network device to obtain the data of the running state software. The second network device splices the data to obtain the software in the running state, and generates a first baseline file corresponding to the software in the running state.

In a third aspect, a device for remote attestation is provided, and the device includes an acquisition module and a remote attestation module. Wherein, the acquiring module is configured to acquire the first baseline file and the measurement log corresponding to the software of the second network device. The first baseline file and the metric log are generated by the second network device. The first baseline file is used to record the benchmark value of the software in a credible situation, and the measurement log is used to record the measurement value of the software. The remote attestation module is configured to perform remote attestation on the software based on the first baseline file and the metric log in response to confirming that the first baseline file and the metric log are credible, and obtain a remote attestation result corresponding to the software, and the remote attestation result corresponding to the software is used to instruct the software Is it credible.

In a possible implementation manner, the remote attestation module is further configured to receive a credible baseline file check value sent by the second network device, and the baseline file check value is used to check whether the first baseline file is credible. The reference value recorded in the first baseline file is calculated to obtain the first value. The first value is calculated in the same way as the baseline file checksum. The same calculation method means the same algorithm, or the same algorithm and calculation order. In response to the first value being the same as the check value of the baseline file, it is confirmed that the first baseline file is authentic.

In a possible implementation manner, the remote attestation module is further configured to receive a credible metric log verification value sent by the second network device. The measurement log verification value is used to verify whether the measurement log is credible. A calculation is performed on the metric value recorded in the metric log to obtain the second value. The second number is calculated in the same way as the metrics log checksum. The same calculation method means the same algorithm, or the same algorithm and calculation order. In response to the second value being the same as the metric log check value, it is confirmed that the metric log is authentic.

In a possible implementation manner, the first baseline file and the measurement log have been encrypted with the private key of the second network device. The remote certification module is also used to obtain the public key corresponding to the private key, and decrypt the first baseline file and the measurement log through the public key.

In a possible implementation manner, the remote attestation module is further configured to determine that the metric target corresponding to the metric value recorded in the metric log belongs to a subset of the metric target corresponding to the baseline value recorded in the first baseline file.

In a possible implementation manner, the remote attestation module is further configured to receive the stored first baseline file sent by the second network device. It is determined that the stored first baseline file is the same as the first baseline file.

In a possible implementation manner, the acquiring module is configured to send a challenge request to the second network device. The challenge request is used to request the second network device to send the first baseline file and the measurement log. The first baseline file and the measurement log sent by the second network device are received.

In a possible implementation manner, the remote attestation module is further configured to receive a challenge value sent by the second network device, and determine that the challenge value is the same as the reference challenge value.

In a possible implementation manner, the remote attestation module is further configured to determine that the time difference between the sending time and the receiving time is not greater than the time threshold. The sending time is the time when the challenge request is sent, and the receiving time is the time when the first baseline file and the measurement log are received.

In a possible implementation manner, the software is running state software. The data of the software in the running state is located in multiple memory pages included in the memory of the second network device. The first baseline file is generated by the second network device after querying multiple memory pages to obtain data, splicing the data to obtain running software. The running state software is at least one of user state software and kernel state software.

In a possible implementation manner, the running state software is kernel state software. The acquiring module is also used to acquire a second baseline file corresponding to the user-mode software of the second network device, and the second baseline file is generated during the compiling process of the user-mode software. The remote attestation module is also used to perform remote attestation on the user state software based on the second baseline file, and obtain a remote attestation result corresponding to the user state software.

In a fourth aspect, a device for remote attestation is provided, and the device includes a generating module and a sending module. Wherein, the generation module is used to generate the first baseline file corresponding to the software of the second network device, and the first baseline file is used to record the reference value of the software under the credible condition. The generation module is also used to generate a measurement log corresponding to the software, and the measurement log is used to record the measurement value of the software. The sending module is used to send the first baseline file and the measurement log to the first network device.

In a possible implementation manner, the metric value recorded in the metric log corresponds to a metric target. For any measurement target, the reference value corresponding to any measurement target in the first baseline file is different from the measurement value corresponding to any measurement target.

In a possible implementation manner, the generating module is configured to generate a metric log corresponding to the software in response to confirming that the first baseline file is credible.

In a possible implementation manner, the sending module is further configured to calculate the reference value recorded in the first baseline file to obtain the check value of the baseline file. The check value of the baseline file is used to check whether the first baseline file is credible. The credible baseline file check value is sent to the first network device.

In a possible implementation manner, the sending module is further configured to calculate the measurement value recorded in the measurement log to obtain the verification value of the measurement log. The measurement log verification value is used to verify whether the measurement log is credible. The trusted metric log check value is sent to the first network device.

In a possible implementation manner, the sending module is configured to send the first baseline file and the measurement log encrypted by the private key of the second network device to the first network device.

In a possible implementation manner, the sending module is further configured to send the stored first baseline file to the first network device.

In a possible implementation manner, the sending module is further configured to receive the challenge request sent by the first network device. The challenge request is used to request the second network device to send the first baseline file and the measurement log.

In a possible implementation manner, the challenge request includes a reference challenge value. The sending module is further configured to send a challenge value to the first network device, where the challenge value is a reference challenge value.

In a possible implementation manner, the software is running state software. The running state software is at least one of user state software and kernel state software. The generation module is used to query multiple memory pages included in the memory of the second network device to obtain the data of the software in the running state. Splicing data to get running software. Generate the first baseline file corresponding to the running state software.

In a fifth aspect, a device for remote attestation is provided, and the device includes: a network interface, a memory, and a processor. The network interface is used to receive or send data, the memory stores data and at least one instruction, and at least one instruction is loaded and executed by the processor, so that the remote attestation device implements the first aspect or any possible implementation of the first aspect , or the remote attestation method provided by the second aspect or any possible implementation manner of the second aspect.

In a sixth aspect, a remote attestation system is provided. The system includes a first network device and at least one second network device. The first network device is used to implement the remote attestation method provided by the first aspect or any possible implementation of the first aspect, and any second network device in at least one second network device is used to implement the second aspect or The remote attestation method provided by any possible implementation of the second aspect.

In a seventh aspect, a computer program (product) is provided. Computer programs (products) include: computer program codes. When the computer program code is executed by the computer, it causes the computer to execute the methods in the above aspects.

In an eighth aspect, a computer-readable storage medium is provided. A computer-readable storage medium stores programs or instructions. The methods in the above aspects are performed when programs or instructions are run on a computer.

In a ninth aspect, a chip including a processor is provided. The method is used for invoking and executing instructions stored in the memory from the memory, so that the communication device installed with the chip executes the methods in the above aspects.

In a tenth aspect, another chip is provided, including: an input interface, an output interface, a processor, and a memory. The input interface, the output interface, the processor and the memory are connected through internal connection paths. The processor is used to execute codes in the memory, and when the codes are executed, the processor is used to execute the methods in the above aspects.

Description of drawings

FIG. 1 is a schematic structural diagram of a remote attestation system provided by an embodiment of the present application;

FIG. 2 is a schematic structural diagram of another remote attestation system provided by the embodiment of the present application;

Fig. 3 is a schematic diagram of trustworthy storage of data provided by the embodiment of the present application;

FIG. 4 is a schematic diagram of conversion of static software to running software provided by the embodiment of the present application;

FIG. 5 is a flow chart of a remote attestation method provided by an embodiment of the present application;

FIG. 6 is a flowchart of another remote attestation method provided by the embodiment of the present application;

FIG. 7 is a schematic structural diagram of a remote attestation device provided by an embodiment of the present application;

Fig. 8 is a schematic structural diagram of another remote attestation device provided by the embodiment of the present application;

FIG. 9 is a schematic structural diagram of a remote attestation device provided by an embodiment of the present application.

Detailed ways

The terms used in the embodiments of the present application are only used to explain specific embodiments of the present application, and are not intended to limit the present application.

FIG. 1 is a schematic structural diagram of a remote attestation system provided by an embodiment of the present application. The embodiment of the present application provides a remote attestation method, which is applied in the implementation environment shown in FIG. 1 . The system shown in FIG. 1 includes a first network device 11 and at least one second network device 12 . The first network device 11 and each second network device 12 are connected in communication respectively. The first network device 11 is used for RAS as remote authentication. The steps performed by the first network device 11 serving as the RAS include acquiring the first baseline file and measurement log corresponding to the software of the second network device. In response to confirming that the first baseline file and the metric log are authentic, the software is remotely attested based on the first baseline file and the metric log. Wherein, the first baseline file is used to record the benchmark value of the software in a credible situation. Metric logs are used to record software metrics. In addition, each second network device 12 is used as a RAC for remote certification. The steps performed by the second network device 12 acting as a RAC include generating a first baseline file and a metric log. A first baseline file and a metric log are sent to a first network device. The number of second network devices 12 can be set according to actual needs. In this regard, this application does not make a limitation.

Fig. 2 is a schematic structural diagram of another remote attestation system provided by the embodiment of the present application. As shown in FIG. 2 , software with RAS function is installed in the first network device 11 , so that the first network device 11 can serve as a RAS for remote certification. The RAS function is used to implement the steps performed by the first network device 11 in the above description. Exemplarily, the first network device 11 may store the credible first baseline file, so as to be used in a subsequent remote attestation process. The user space in the second network device 12 has software with the RAC function, so that the second network device 12 can serve as a RAC for remote certification. The RAC function is used to implement the steps performed by the second network device 12 in the above description.

In addition, the second network device 12 also includes a rich execution environment (REE) kernel. The REE kernel includes a first metric module. The first measurement module is configured to generate a first baseline file and a measurement log corresponding to software requiring remote certification. The first measurement module stores the first baseline file in the REE kernel, and stores the measurement log in the user space. For example, the software is the static software in the file system shown in FIG. 2 , or the running software in the memory shown in FIG. 2 . RAS-capable software can fetch first baseline files from the REE kernel and metrics logs from user space. In some embodiments, the REE kernel stores a list of metric objects, and the REE kernel generates the first baseline file based on the list of metric objects. The measurement target list is also called the integrity measurement architecture (integrity measurement architecture, IMA) list, and the method embodiment below refers to the method embodiment for the measurement target list and the manner of generating the first baseline file based on the measurement target list.

Exemplarily, the second network device 12 further includes a trusted computing environment (trusted execution environment, TEE) kernel. The TEE core includes a second metrics module. The second measurement module is used to generate a baseline file check value. The check value of the baseline file is used to check whether the first baseline file is credible. Exemplarily, the second measurement module writes the check value of the baseline file into the platform configuration register (platform configuration register, PCR) of the trusted platform module (trusted platform module, TPM) chip, so as to ensure that the check value of the baseline file is not tamper. Exemplarily, the TPM chip has an interface. For example, the interface is the tpm_pcr_extend() interface. The second measurement module writes the check value of the baseline file into the PCR of the TPM chip through the interface.

Exemplarily, in the process of generating the check value of the baseline file, the second measurement module included in the TEE kernel performs superimposed calculation on the reference value included in the first baseline file according to a certain algorithm and calculation sequence to obtain the check value of the baseline file. Write the check value of the baseline file into the PCR of the TPM chip through the interface of the TPM chip. Wherein, an algorithm is a mathematical method for performing calculations. For example, as shown in FIG. 3 , the calculation sequence is reference value 1, reference value 2, . . . , reference value N. The second measurement module first writes the reference value 1 into a PCR. The reference value 1 is calculated according to a certain algorithm, and the calculation result 1 is obtained. After that, the reference value 2 is written into the same PCR. The calculation result 1 and the reference value 2 are calculated according to a certain algorithm, and the calculation result 2 is obtained. By analogy, the reference value N (N is an integer not less than 1) is written into the same PCR. Calculate the calculation result (N−1) and the reference value N according to a certain algorithm to obtain the calculation result N. The calculation result is the baseline file checksum.

In addition, for example, the first measurement module included in the REE kernel is also used to generate a measurement log check value. The measurement log verification value is used to verify whether the measurement log is credible. Wherein, the first measurement module superimposes and calculates the benchmark values of credible measurement log records according to a certain algorithm and calculation sequence. Write the calculated measurement log verification value into the PCR of the TPM chip through the interface of the TPM chip. The PCR storing the check value of the metric log and the PCR storing the check value of the baseline file are two different PCRs. Wherein, the method for the first measurement module to write the verification value of the measurement log into the PCR can refer to the method for writing the verification value of the baseline file into the PCR by the second measurement module above, and will not be repeated here.

In an exemplary embodiment, the software in the second network device that requires remote attestation is at least one of static software and running software. The static software is stored in the file system of the second network device. Exemplarily, the static software includes, but is not limited to, executable and linkable format (ELF) files, kernel image (kernel image, KI) files, and kernel object (kernel object, KO) files. Referring to Fig. 4, static software can be transformed into running software through linking process and loading process. Wherein, the linking process means that the dynamic linker of the operating system of the second network device loads the shared library according to the symbol definition of the shared object recorded in the static file during the running process, and then completes the redirection. The loading process refers to a process in which the loader of the operating system of the second network device copies the static software to the memory and runs it. Thus, the running state software located in the memory can be obtained. The file systems where the memory and the static software are located are two different storage locations in the second network device.

Exemplarily, the running state software is at least one of user state software and kernel state software. The user mode software is located in the user mode address space of the memory, and the kernel mode software is located in the kernel mode address space of the memory.

Based on the above systems shown in Figures 1-2, this embodiment of the present application provides a remote attestation method. The method is applied to the first network device and the second network device. The first network device is used for RAS as remote attestation, and the second network device is used for RAC as remote attestation. As shown in Fig. 5, the method includes the following steps 501-505.

In step 501, the second network device generates a first baseline file corresponding to the software of the second network device, and the first baseline file is used to record a benchmark value of the software under a trusted condition.

Wherein, a measurement object list corresponding to the software is stored in the second network device. The measurement target list is used to record at least one measurement target ID, and the measurement target ID is used to indicate the measurement target corresponding to the software. The measurement target corresponding to the software is also the target that needs to be measured when performing remote certification on the software. Exemplarily, software has a certain range of measurements. The measurement module corresponding to the software is determined based on the measurement range. For static software, the scope of measurement is the static software itself. The measurement target is all binary data included with static software. For user mode software, the measurement scope includes but not limited to process (process) and shared library (library). The measurement target includes but not limited to the code segment (text) of the process, the read-only data segment (read only data) of the process, the code segment of the shared library, and the read-only data segment of the shared library. For kernel state software, the scope of measurement includes but not limited to thread (thread), KI and KO, and the measurement target includes but not limited to code segment of thread, read-only data segment of thread, code segment of KI, read-only data of KI segment, KO's code segment, and KO's read-only data segment.

Exemplarily, the second network device generates the first baseline file corresponding to the software of the second network device, including: the second network device generates the first baseline file corresponding to the software based on the metric target list corresponding to the software when the software is trusted document. Exemplarily, the second network device determines at least one measurement target that needs to be measured based on the measurement target list when the second network device is trusted. A traversal is performed on each measurement target to measure each measurement target, so as to obtain the reference value corresponding to each measurement target. Afterwards, the benchmark values corresponding to each measurement target are recorded to obtain the first baseline file. The first baseline file includes a measurement target identifier and a reference value corresponding to the measurement target indicated by the measurement target identifier. There is a one-to-one correspondence between the metric target ID and the benchmark value. Wherein, when the second network device is credible, the software is also credible. The benchmark value corresponding to each measurement target recorded in the first baseline file is the benchmark value of the software in a credible situation.

For the manner in which the second network device confirms that the second network device is authentic, for example, the second network device performs trusted startup. Only when the second network device is trusted can the second network device be able to complete trusted startup. Therefore, if the second network device can complete trusted startup, it can be confirmed that the second network device is trustworthy. Exemplarily, within a first period of time after the trusted startup is completed, it is also confirmed that the second network device is trusted. The embodiment of the present application does not limit the duration of the first period, and the duration of the first period may be flexibly set according to experience or actual needs. In some implementations, trusted booting methods include but are not limited to secure booting or measured booting.

As for the manner in which the second network device measures the measurement target, for example, the measurement of each measurement target by the second network device means that the second network device calculates each measurement target according to a certain algorithm, and obtains the corresponding value. For example, when the software is credible, the calculated values corresponding to each measurement target are the reference values corresponding to each measurement target in the above description. It should be noted that the calculated values corresponding to each measurement target are equivalent to the fingerprint information of the measurement target. If a measurement target is tampered with, the calculated value corresponding to the measurement target is different from the base value corresponding to the measurement target. The embodiment of this application does not limit the algorithm. In some embodiments, the algorithm is a hash algorithm. The value corresponding to each measurement target calculated according to the hash algorithm is called a hash value, and the hash value is also called a hash value.

Exemplarily, for the case that the software is static software, the static software is directly obtained from the file system. Afterwards, the first baseline file corresponding to the static software can be generated in the manner described above. Or, as an example, for the case that the software is software in the running state, the second network device generates the first baseline file corresponding to the software of the second network device, including: the second network device queries multiple files included in the memory of the second network device Memory page, get the data of the running state software. The second network device splices the data to obtain the software in the running state, and generates a first baseline file corresponding to the software in the running state.

According to the description corresponding to FIG. 4 above, it can be seen that the software in the running state is located in the memory. Since the memory includes multiple memory pages, the second network device needs to query multiple memory pages. Data is obtained from at least one of the plurality of memory pages. The second network device splices the data to obtain the software in the running state, so as to form the measurement target of the software in the running state. Afterwards, the second network device can measure each measurement target in the manner described above to obtain the first baseline file. The process of obtaining the first baseline file will not be repeated here.

The foregoing manners of generating the first baseline file are examples, and are not intended to limit the manner of generating the first baseline file by the second network device. Exemplarily, after the second network device generates the first baseline file, the second network device may store the first baseline file. When the first baseline file needs to be used subsequently, the stored first baseline file is read.

It should be noted that although the first baseline file generated by the second network device is authentic, the first baseline file may be tampered with during the storage process of the first baseline file. The tampering of the first baseline file includes: at least one of the reference value recorded in the first baseline file and the arrangement order of the reference value in the first baseline file is tampered with. If the first baseline file is tampered with, the read first baseline file is different from the credible first baseline file generated by the second network device. Or the read first baseline file is not credible. Therefore, the embodiment of the present application needs to provide a verification method for the read first baseline file. In order to check whether the read first baseline file is credible. Avoid affecting the accuracy of the subsequent remote attestation process due to the untrustworthy first baseline file read. Exemplarily, the second network device calculates the benchmark value recorded in the credible first baseline file to obtain the check value of the baseline file. The check value of the baseline file is used to check whether the first baseline file is credible. During the calculation process, the second network device superimposes and calculates each benchmark value according to a certain algorithm and calculation sequence, so as to obtain the baseline file verification value.

Exemplarily, in the embodiment of the present application, after the baseline file check value is calculated, the baseline file check value is stored, and then read when the baseline file check value needs to be used. For example, the second network device stores the check value of the baseline file in a PCR of the TPM chip. This storage method can ensure that the check value of the baseline file is not tampered with. For another example, the second network device stores the check value of the baseline file in the TEE kernel. Although the TEE core cannot guarantee that the check value of the baseline file will not be tampered with, the reading speed of the TEE core is higher than that of the PCR, which can reduce the time required to read the check value of the baseline file and improve the reliability of the remote certification process. efficiency. And the performance loss of the PCR caused by reading the PCR can be avoided. In addition, the process of using the check value of the baseline file can be found later in the description, and will not be repeated here.

In step 502, the second network device generates a metric log corresponding to the software, and the metric log is used to record the metric value of the software.

With the operation of the second network device, the software of the second network device may be tampered with, and the trustworthiness of the software is unknown. That is to say, the second network device cannot confirm whether the software is authentic. If it cannot be confirmed whether the software is credible, the second network device generates a measurement log corresponding to the software based on the measurement target list corresponding to the software. Wherein, the second network device determines at least one measurement target that needs to be measured based on the measurement target list. At least one traversal is performed on at least one measurement target to perform at least one measurement on each measurement target to obtain a measurement value corresponding to each measurement target. Afterwards, a measurement log corresponding to the software is generated based on the measurement value corresponding to each measurement target. The measurement log includes a measurement target ID and a measurement value corresponding to the measurement target indicated by the measurement target ID, and the measurement target ID corresponds to the measurement value one by one.

In some implementation manners, the second network device records the measurement values corresponding to each measurement target to obtain a measurement log corresponding to the software. For example, the number of measurement targets is 10, and the second network device traverses each measurement target twice. Then the measurement log includes a one-to-one correspondence between 10 measurement target identifiers and 10 measurement values in the first traversal process, and a one-to-one correspondence between 10 measurement target identifications and 10 measurement values in the second traversal process.

In some other implementation manners, for any metric target, the benchmark value corresponding to any metric target in the first baseline file is different from the metric value corresponding to any metric log. That is to say, after the second network device obtains the measurement value corresponding to each measurement target, it will compare it with the first baseline file. That is, the measurement value corresponding to each measurement target is compared with the corresponding reference value of each measurement target in the first baseline file. If there is a difference, then record the measurement values corresponding to the different measurement targets, and obtain the measurement log corresponding to the software. Still taking the example that the number of measurement targets is 10 and the second network device traverses each measurement target twice. If during the two traversals, the metric value corresponding to only 1 of the 10 metric targets is different from the corresponding baseline value of the metric target in the first baseline file, the metric log only includes the corresponding 1 The metric target ID and 1 metric value in the first traversal process, and the corresponding metric target ID and 1 metric value in the 2nd traversal process.

Compared with the way of directly recording the metric values corresponding to each metric target, the way of only recording the metric values corresponding to different metric targets can reduce the amount of data in the metric log. This reduces the growth rate of the storage space occupied by the measurement log, and delays the occurrence of storage space explosion. Wherein, the storage space explosion phenomenon refers to that with the accumulation of the running time of the second network device, the storage space occupied by the measurement log continues to increase, resulting in an occupancy rate of the storage space being greater than an occupancy rate threshold, thereby causing a fault.

In an exemplary embodiment, for the method of only recording metric values corresponding to different metric targets, in response to confirming that the first baseline file is credible, the second network device regenerates a metric log corresponding to the software. That is to say, after confirming that the first baseline file is credible, the second network device compares the measurement value corresponding to each measurement target with the first baseline file, thereby generating a measurement log corresponding to the software. According to the description in step 501 above, it can be known that the embodiment of the present application may store the first baseline file. The first baseline file may be tampered with during the storage process, thus causing the read first baseline file to be untrustworthy. If the measurement value corresponding to each measurement target is compared with the untrusted first baseline file, the measurement log will be wrong. Since the remote attestation process needs to use the measurement log, an error in the measurement log will lead to an error in the remote attestation result obtained by the remote attestation process. Therefore, before comparing the metric value corresponding to each metric target with the first baseline file, the second network device needs to confirm that the read first baseline file is authentic. Avoid errors in measurement logs and ensure the accuracy of subsequent remote attestation results.

As for the manner in which the second network device confirms that the read first baseline file is authentic, for example, the second network device calculates the reference value recorded in the read first baseline file to obtain the first reference value. The calculation method of the first reference value is the same as that of the check value of the baseline file. The same calculation method means the same algorithm, or the same algorithm and calculation order. In response to the fact that the first reference value is the same as the check value of the baseline file, the second network device confirms that the read first baseline file is authentic. In response to the difference between the first reference value and the check value of the baseline file, the second network device confirms that the read first baseline file is not credible. Exemplarily, when it is confirmed that the read first baseline file is untrustworthy, the second network device may also send an alarm to the first network device. In some embodiments, the baseline file checksum used herein is the baseline file checksum stored in the TEE kernel.

In some implementations, the same calculation method means the same algorithm. Algorithms used in this manner are not affected by the order of computation. For example, the algorithm is multiplication. This method is applicable when the reference value recorded in the first baseline file may be tampered with but the arrangement order of the reference value will not be tampered with.

For example, the first baseline file includes 10 metric target identifiers and 10 benchmark values in one-to-one correspondence. The ten reference values are respectively reference value 1, reference value 2, . . . , reference value 10. The second network device sequentially multiplies the reference value 1 to the reference value 10 in the credible first baseline file to obtain the baseline file check value. The first network device may multiply the reference value 1 to the reference value 10 in the read first baseline file according to any calculation sequence to obtain the first reference value. If the first reference value is the same as the check value of the baseline file, it means that none of the reference values in the read first baseline file has been tampered with, and the read first baseline file is credible. If the first reference value is different from the check value of the baseline file, it indicates that at least one reference value in the read first baseline file has been tampered with, and the read first baseline file is not credible.

In some implementations, the same calculation means that both the algorithm and the calculation sequence are the same. Algorithms used in this manner are affected by the order of computation. For example, the algorithm is a hash algorithm. This method is applicable when the reference value and/or the arrangement order of the reference value recorded in the first baseline file may be tampered with.

For example, the first baseline file includes 10 metric target identifiers and 10 benchmark values in one-to-one correspondence. The ten reference values are respectively reference value 1, reference value 2, . . . , reference value 10. The second network device sequentially superimposes and calculates the reference value 1 to the reference value 10 in the credible first baseline file according to the hash algorithm to obtain the check value of the baseline file. The first network device also sequentially superimposes and calculates the reference value 1 to the reference value 10 in the read first baseline file according to the hash algorithm to obtain the first reference value. If the first reference value is the same as the check value of the baseline file, it means that neither the reference value nor the sequence of the reference values in the read first baseline file has been tampered with, and the read first baseline file is credible. If the first reference value is different from the check value of the baseline file, it means that the reference value and/or the arrangement order of the reference values in the read first baseline file has been tampered with, and the read first baseline file is not credible.

In addition, no matter which method is used to generate the measurement log, the second network device may write the measurement target identifier used to indicate the measurement target and the measurement value corresponding to the measurement target into the measurement log corresponding to the measurement sequence. Then, the order in which the measurement target identifiers are arranged in the measurement log (that is, the order in which the measurement values are arranged in the measurement log) is the measurement order. For example, the measurement log includes in sequence: the corresponding measurement target ID 1 and the measurement value 1, and the corresponding measurement target ID 2 and the measurement value 2. Then, it can be determined through the measurement log that the second network device has first performed measurement on the measurement target indicated by the measurement target identifier 1 . Then the measurement target indicated by the measurement target identification 2 is measured. Thus, the measurement log is not only used to record the measurement value of each measurement target, but also used to record the measurement sequence. Therefore, the measurement log can reflect the measurement process of the second network device.

The above manner of generating the measurement log is only an example, and does not limit the manner of generating the measurement log by the second network device. Exemplarily, after the second network device generates the metric log, the metric log is stored. When the measurement log needs to be used later, the stored measurement log is read.

It should be noted that although the metric log generated by the second network device is credible, the metric log may also be tampered with during the storage process. The tampering of the metric log includes: at least one of the metric value recorded in the metric log and the arrangement order of the metric value in the metric log is tampered with. If the metric log is tampered with, the read metric log is different from the credible metric log generated by the second network device. That is, the metric log cannot be trusted. As a result, the remote attestation result obtained by the remote attestation process using the metric log is also wrong. Therefore, the embodiment of the present application needs to provide a verification method for the read metric log, so as to verify whether the read metric log is credible, and avoid affecting the accuracy of the subsequent remote attestation process. In an exemplary embodiment, the second network device calculates the metric value recorded in the credible metric log to obtain the metric log verification value. The measurement log verification value is used to verify whether the measurement log is credible. During the calculation process, the second network device superimposes and calculates each measurement value according to a certain algorithm and calculation sequence, so as to obtain the measurement log verification value.

Exemplarily, in the embodiment of the present application, after the verification value of the measurement log is calculated, the verification value of the measurement log is further stored. Read it when you need to check the value using the metric log. For example, the second network device stores the metric log check value in the TEE kernel. For another example, the second network device stores the metric log check value in a PCR of the TPM chip, and this storage method can ensure that the metric log check value is not tampered with. It should be noted that, when both the baseline file check value and the measurement log check value are stored in the TPM chip, the baseline file check value and the measurement log check value need to be located in two different PCRs in the TPM chip , to avoid confusion between baseline file checksums and metric log checksums. For example, the TPM chip includes PCR_X and PCR_Y, the check value of the baseline file is located in PCR_X, and the check value of the measurement log is located in PCR_Y.

In addition, it should be noted that the execution sequence of step 501 and step 502 is not limited in this embodiment of the present application. The execution sequence of step 501 and step 502 may be determined according to experience or actual requirements.

Step 503, the second network device sends the first baseline file and the measurement log to the first network device.

Since the second network device has generated the first baseline file and the metric log through the above steps 501 and 502, the second network device may send the first baseline file and the metric log to the first network device. The embodiment of the present application does not limit the sending order of the first baseline file and the measurement log.

In an exemplary embodiment, the second network device sends the first baseline file and the measurement log to the first network device, including but not limited to the following three ways.

In a first sending manner, the first network device sends a challenge request to the second network device. The challenge request is used to request the second network device to send the first baseline file and the measurement log. The second network device receives the challenge request sent by the first network device, and sends the first baseline file and the measurement log to the second network device. That is to say, the second network device sends the first baseline file and the measurement log to the first network device based on the challenge request sent by the first network device.

Wherein, the first network device may send a challenge request to the second network device. Based on the challenge request, the second network device not only sends the read first baseline file to the first network device, but also sends the read metric log to the first network device. Alternatively, the first network device may send two different challenge requests to the second network device. One of the challenge requests is used to request the second network device to send the first baseline file, and the other challenge request is used to request the second network device to send the measurement log. Based on the two challenge requests, the second network device respectively sends the read first baseline file and the read metric log to the first network device.

In an exemplary embodiment, since both the read first baseline file and the read metric log may be untrustworthy, in addition to the read first baseline file and the read metric log , the second network device further sends at least one of the credible baseline file check value and the credible metric log check value to the first network device. In order for the first network device to use the received baseline file check value to check whether the received first baseline file is credible, and use the received metric log check value to check whether the received metric log is credible. In some embodiments, the second network device reads the baseline file check value from one PCR of the TPM chip and sends it, and reads the measurement log check value from another PCR of the TPM chip and sends it to ensure the sent baseline File checksums and metrics log checksums are trusted. In addition, for the manner in which the first network device performs verification, refer to the description in step 505 below, which will not be repeated here.

In the second sending manner, the second network device pushes the first baseline file and the measurement log to the first network device after confirming that the first baseline file and the measurement log are credible.

In some implementation manners, after the second network device generates the trusted first baseline file and the trusted metric log, it trustably stores the trusted first baseline file and the trusted metric log. That is, the credible first baseline file and the credible measurement log are stored in a tamper-proof storage location in the second network device. Then the second network device can confirm that both the first baseline file and the measurement log read from the storage location are authentic. Therefore, after the second network device reads and obtains the first baseline file and the measurement log, it only needs to push the read first baseline file and the measurement log to the first network device.

In some other implementation manners, the second network device confirms that the first baseline file is authentic within a second period of time after the first baseline file is generated. Verify that the metrics log is credible within a third time period after generating the metrics log. The embodiment of the present application does not limit the duration of the second period of time and the duration of the third period of time. Therefore, the second network device pushes the first baseline file to the first network device within a second period after generating the first baseline file, and pushes the metric log to the first network device within a third period after generating the metric log, thereby ensuring that the pushed Both the first baseline file and the metrics log are trusted.

In some other implementation manners, the second network device verifies whether the read first baseline file is authentic based on the baseline file verification value, and verifies whether the read metric log is authentic based on the metric log verification value. If it is confirmed to be credible, then push the read first baseline file and the read metric log to the first network device.

Wherein, the second network device verifies whether the read first baseline file is credible based on the check value of the baseline file, refer to the description in step 502 above, and will not be repeated here. During the process of the second network device verifying whether the read metric log is authentic based on the metric log verification value, the second network device calculates the metric value recorded in the read metric log to obtain a second reference value. The calculation method of the second reference value is the same as that of the measurement log verification value, and the same calculation method means the same algorithm, or the algorithm and the calculation sequence are the same. In response to the fact that the second reference value is the same as the check value of the metric log, the second network device confirms that the read metric log is authentic. In response to the fact that the second reference value is different from the check value of the metric log, the second network device confirms that the read metric log is not credible. If it is confirmed that the read metric log is not credible, the second network device may send an alarm to the first network device. Exemplarily, the metric log check value used here is the metric log check value stored in the TEE kernel.

Exemplarily, the same calculation method refers to the same algorithm. The algorithm is, for example, multiplication. Then, the algorithm used when calculating the second reference value is the same as the algorithm used when calculating the metric log verification value, and the calculation sequence may be different. Alternatively, the same calculation method means that both the algorithm and the calculation sequence are the same. Then, the algorithm and the calculation order used when calculating the second reference value are the same as the algorithm and calculation order used when calculating the verification value of the metric log. Exemplarily, the calculation order used is the order in which the measurement values are arranged in the measurement log.

In the third sending manner, the second network device pushes the first baseline file and the measurement log to other network devices after confirming that the first baseline file and the measurement log are credible. The first baseline file and the measurement log are credibly stored by other network devices, and the first baseline file and the measurement log are sent to the first network device by the other network device. Wherein, other network devices are network devices other than the first network device and the second network device.

Among them, for the trusted storage method of other network devices, please refer to the description of the second sending method above. Exemplarily, the first network device sends challenge requests to other network devices. Other network devices send the first baseline file and the metric log to the first network device based on the challenge request. For the way of sending the challenge request and other network devices based on the challenge request, please refer to the description in the first way of sending above, and will not repeat it here. Alternatively, other network devices push the first baseline file and the measurement log to the first network device. For the push method of other network devices, please refer to the description in the second sending method above, and will not repeat them here.

Step 504, the first network device acquires the first baseline file and the measurement log corresponding to the software of the second network device.

Since the second network device sends the first baseline file and the metric log to the first network device, the first network device will obtain the first baseline file and the metric log. Wherein, the sending mode adopted by the second network device is different, and the obtaining mode adopted by the first network device is also different. In an exemplary embodiment, the acquisition methods include the following three methods.

Corresponding to the acquisition manner 1 of the sending manner 1, the first network device receives the first baseline file and the measurement log sent by the second network device based on the challenge request. In addition, the first network device also receives at least one of the credible baseline file check value and the credible metric log check value sent by the second network device.

Corresponding to the acquisition manner 2 of the sending manner 2, the first network device receives the first baseline file and the measurement log pushed by the second network device.

Corresponding to the obtaining manner 3 of the sending manner 3, the first network device receives the first baseline file and the measurement log sent by other network devices based on the challenge request. Alternatively, the first network device receives the first baseline file and the measurement log pushed by other network devices.

Step 505, in response to confirming that the first baseline file and the metric log are credible, the first network device remotely certifies the software based on the first baseline file and the metric log, and obtains a remote attestation result corresponding to the software, and the remote attestation result corresponding to the software is used for Indicates whether the software is trusted.

Only when the first baseline file and the measurement log are credible, the first network device will remotely certify the software based on the first baseline file and the measurement log. Therefore, in an exemplary embodiment, before the first network device remotely certifies the software based on the first baseline file and the metric log, the first network device first needs to confirm whether the first baseline file and the metric log are trustworthy, see the following Step 5051.

Step 5051, the first network device confirms that the first baseline file and the measurement log are credible.

Wherein, the sending mode adopted by the second network device is different, and the confirmation mode adopted by the first network device is also different. In an exemplary embodiment, the confirmation manners include the following three types.

Corresponding to the confirmation mode one of the sending mode one, the first network device confirms that the first baseline file and the measurement log are credible based on at least one of the baseline file verification value and the measurement log verification value.

When the first network device receives the credible baseline file verification value sent by the second network device, the first network device calculates the reference value recorded in the received first baseline file to obtain the first value. The calculation method of the first value is the same as that of the check value of the baseline file, and the same calculation method means the same algorithm, or the algorithm and the calculation sequence are the same. For the manner in which the first network device calculates and obtains the first value, refer to the manner in which the second network device calculates and obtains the first reference value in step 502 above, and details are not repeated here.

In response to the first numerical value being the same as the baseline file check value, the first network device confirms that the first baseline file is authentic. This first baseline file can then be used in the remote attestation process. Or, in response to the fact that the first value is different from the check value of the baseline file, the first network device confirms that the first baseline file is not credible. Then the first baseline file is no longer used in the remote attestation process.

When the first network device receives the credible metric log verification value sent by the second network device, the first network device calculates the metric value recorded in the received metric log to obtain the second value. The calculation method of the second value is the same as that of the measurement log verification value, and the same calculation method means the same algorithm, or the same algorithm and the same calculation sequence. For the manner in which the first network device calculates and obtains the second value, refer to the manner in which the second network device calculates and obtains the second reference value in step 503 above, and details are not repeated here.

In response to the second numerical value being the same as the metric log check value, the first network device confirms that the metric log is authentic. Then the metric log can be used for the subsequent remote attestation process. In response to the second value being different from the metric log check value, the first network device confirms that the metric log is not authentic. Then the measurement log is no longer used for the subsequent remote attestation process.

It can be understood that the manner of verifying the first baseline file based on the verification value of the baseline file and the manner of verifying the measurement log based on the verification value of the measurement log are examples and are not intended to limit the verification manner. The first network device may also use other methods to verify whether the first baseline file and the measurement log are credible.

In an exemplary embodiment, in addition to confirming that the first baseline file and the metric log are authentic by step 5051, the first network device further performs the following step 5052- At least one of 5056 will be described below.

Step 5052, the challenge request sent by the first network device to the second network device includes a reference challenge value, the first network device receives the challenge value sent by the second network device, and determines that the challenge value is the same as the reference challenge value.

In the case that the challenge request includes a reference challenge value, after the second network device obtains the reference challenge value through the challenge request, the reference challenge value is used as the challenge value. When the second network device sends the first baseline file and the measurement log to the first network device, it will also send the challenge value, and then the first network device will receive the challenge value sent by the second network device. Exemplarily, the baseline challenge value is a randomly generated value.

Wherein, the function of the first network device comparing the challenge value with the reference challenge value is to determine whether there is a replay attack. A replay attack refers to a maliciously attacked network device stealing data that a second network device has sent to a first network device. After the first network device sends a new challenge request to the second network device, the maliciously attacked network device sends the stolen data to the first network device, thereby disguising the stolen data as the second network device based on the new challenge request. The challenge requests data sent to the first network device. In the case that the challenge request carries the reference challenge value, only the data sent to the first network device based on the new challenge request can carry the same challenge value as the reference challenge value. The data stolen by the maliciously attacked network device and sent to the first network device will not carry the same challenge value as the reference challenge value. Therefore, by comparing the challenge value with the baseline challenge value, it can be determined whether there is a replay attack.

Then, in response to the challenge value being the same as the reference challenge value, the first network device determines that the first baseline file and the measurement log are sent by the second network device based on the challenge request, and there is no replay attack. The software can continue to be remotely attested based on the first baseline files and metrics logs. In response to the challenge value being different from the baseline challenge value, there is a replay attack. The first network device no longer remotely attests to the software based on the first baseline file and the metric log.

In addition, according to the description in the first sending manner in step 502 above, it can be known that the number of challenge requests sent by the first network device to the second network device is one or two. In response to the first network device sending only one challenge request to the second network device, the second network device uses the reference challenge value in the challenge request as the challenge value. The challenge value, the first baseline file and the metric log are sent to the first network device. Or, in response to the first network device sending two challenge requests to the second network device, the second network device uses the reference challenge value in one of the challenge requests as the first challenge value. Send the first challenge value and the first baseline file to the first network device. The second network device also uses the reference challenge value in another challenge request as the second challenge value, and sends the second challenge value and the measurement log to the first network device.

Step 5053, the first network device determines that the time difference between the sending time and the receiving time is not greater than the time threshold, the sending time is the time when the first network device sends the challenge request to the second network device, and the receiving time is when the first network device receives the challenge request. The moment of the first baseline file and the metric log sent by the second network device.

The function of the first network device determining that the time difference is not greater than the time threshold is to determine whether the second network device is trustworthy. In response to the time difference being not greater than the time threshold, it indicates that the second network device is trusted. The first network device can continue to remotely attest the software based on the first baseline file and the metrics log. In response to the time difference being greater than the time threshold, it indicates that the second network device is untrustworthy. The first network device no longer remotely attests to the software based on the first baseline file and the metric log. Exemplarily, the first network device may consider that the software of the second network device is not trustworthy when the second network device is not trustworthy. Exemplarily, it may also be considered that the first baseline file and the measurement log sent by the second network device are also not credible.

Step 5054, the first network device determines that the metric target corresponding to the metric value recorded in the metric log belongs to the subset of the metric target corresponding to the baseline value recorded in the first baseline file.

Wherein, the measurement log includes a corresponding measurement target identifier and a measurement value. The measurement target corresponding to the measurement value is the measurement target indicated by the measurement target identifier corresponding to the measurement value. The first baseline file includes corresponding metric target identifiers and baseline values. The measurement target corresponding to the reference value is the measurement target indicated by the measurement target identifier corresponding to the reference value. The function of determining whether the first network device belongs to the subset is to determine whether the second network device is trustworthy. If the response belongs to the subset, it means that neither the measurement target list nor the measurement log on the second network device has been tampered with, and the second network device is trustworthy. The first network device can continue to remotely attest the software based on the first baseline file and the metrics log. If the response does not belong to the subset, it indicates that at least one of the measurement target list and the measurement log on the second network device has been tampered with, and the second network device is not trustworthy. The first network device no longer remotely attests to the software based on the first baseline file and the metric log. Exemplarily, the first network device may consider that the software of the second network device is not trustworthy when the second network device is not trustworthy. Exemplarily, it may also be considered that the first baseline file and the measurement log sent by the second network device are also not credible.

Step 5055, the first network device receives the stored first baseline file sent by the second network device, and determines that the stored first baseline file is the same as the first baseline file. In this case, in addition to sending the first baseline file and the measurement log to the first network device, the second network device also needs to send the stored first baseline file to the first network device.

The function of the first network device determining that the stored first baseline file is the same as that of the first baseline file is to determine whether the second network device is trustworthy. If the response is the same, it indicates that the first baseline file has not been tampered with during storage in the second network device, and the second network device is trustworthy. The first network device can continue to remotely attest the software based on the first baseline file and the metrics log. If the response is different, it indicates that the first baseline file has been tampered with during storage in the second network device, and the second network device is not trustworthy. The first network device no longer remotely attests to the software based on the first baseline file and the metric log. Exemplarily, the first network device may consider that the software of the second network device is not trustworthy when the second network device is not trustworthy. Exemplarily, it may also be considered that the first baseline file and the measurement log sent by the second network device are also not credible.

Step 5056, the first baseline file and the measurement log have been encrypted by the private key of the second network device. The first network device obtains the public key corresponding to the private key, and decrypts the first baseline file and the measurement log by using the public key.

Wherein, the function of the decryption by the first network device using the public key is to determine whether the first baseline file and the measurement log are replaced by a maliciously attacked network device during the transmission process. Since the private key of the second network device is used by the second network device, the data encrypted by the private key of the second network device can only be decrypted by the public key corresponding to the private key. Therefore, in response to the fact that the first network device can decrypt using the public key, it means that the first baseline file and the metric log are sent by the second network device, and the first baseline file and the metric log are not replaced during the transmission. The software can continue to be remotely attested based on the first baseline files and metrics logs. In response to the fact that the first network device cannot decrypt using the public key, it indicates that the first network device and the metric log have been replaced during transmission. The first network device no longer remotely attests to the software based on the first baseline file and the metric log.

It can be understood that, in addition to the first baseline file and the measurement log, the second network device also needs to send other data to the first network device (including but not limited to the above-mentioned challenge value, stored first baseline file, baseline file calibration verification value and metric log verification value), other data has also been encrypted by the private key of the second network device.

The embodiment of the present application does not limit the execution order of the above steps 5051-5056. Exemplarily, the first network device first executes steps 5052-5056, and then confirms that the first baseline file and the measurement log are credible through step 5051. Afterwards, the software is remotely attested based on the first baseline files and metrics logs.

Corresponding to the confirmation mode 2 of the sending mode 2, in response to the first network device confirming that the first baseline file and the metric log are sent by the second network device, the first network device confirms that the first baseline file and the metric log are credible. For example, the first baseline file and the metrics log may be encrypted by the private key of the second network device. If the first network device can decrypt using the public key corresponding to the private key, the first network device confirms that the first baseline file and the measurement log are sent by the second network device. For the reason, refer to the description in step 5056 above, which will not be repeated here.

Confirmation mode three corresponding to sending mode three, in response to the first network device confirming that the first baseline file and the metric log are sent by other network devices, the first network device confirms that the first baseline file and the metric log are credible. For example, first baseline files and metric logs may be encrypted by private keys of other network devices. If the first network device can decrypt using the public key corresponding to the private key, the first network device confirms that the first baseline file and the measurement log are sent by other network devices. For the reason, refer to the description in step 5056 above, which will not be repeated here.

After the first network device confirms that the first baseline file and measurement log are credible through any of the above confirmation methods, the first network device can remotely certify the software based on the first baseline file and measurement log, and the corresponding remote Attestation results are used to indicate whether software is trustworthy.

During the remote attestation process, the first network device compares the baseline value recorded in the first baseline file with the metric value recorded in the metric log. In response to the fact that the metric value corresponding to any metric target identifier in the metric log is different from the reference value corresponding to the metric target identifier in the first baseline file, the first network device obtains a remote attestation result indicating that the software is untrustworthy. Alternatively, in response to the fact that the metric values corresponding to each metric target identifier in the metric log are the same as the reference value corresponding to the metric target identifier in the first baseline file, the first network device obtains a remote attestation result indicating that the software is trustworthy.

Since the software in the embodiment of the present application may be the software in the running state, the embodiment of the present application can realize the remote certification of the software in the running state, so that the attack method against the running state software can be detected in time. Therefore, corresponding measures can be taken in time, thereby preventing the attack method against the software in the running state from affecting the security of the software in the running state and the second network device. In some implementations, the attack method against running state software includes but not limited to advanced persistent threat (advanced persistent threat, APT). APT is an attack method that injects malicious code into memory through a buffer overflow vulnerability. Because the APT will hide the malicious code through technical means, and this concealment can prevent the malicious code from being detected by the security mechanism of the second network device, so the APT can achieve the purpose of persistently invading the second network device. It can be seen that APT is highly concealed and harmful. Through the remote attestation method provided by the embodiment of the present application, the running state software is remotely attested, so that APT attacks can be discovered in time to ensure security.

In addition, in an exemplary embodiment, during the use of the second network device, it may be necessary to perform operation and maintenance (for example, hot patching) on the second network device, thereby causing the software of the second network device to be updated. Correspondingly, the second network device also needs to update the first baseline file and the check value of the baseline file. The second network device sends the updated baseline file and the updated baseline file check value to the first network device. In the subsequent remote attestation process for the updated software, the first network device will use the updated baseline file and the updated baseline file check value.

Exemplarily, before the second network device performs the update, the second network device determines whether the update is from a permitted administrator or program through a security mechanism. Security mechanisms include but are not limited to patch signature verification or administrator identity authentication. Make sure that the update is from an authorized administrator or program, and then perform the update.

In some implementations, the software is updated, for example, the metric range of the software is updated. Such an update may increase the metric target corresponding to the software and/or change the baseline value corresponding to the metric target. Exemplarily, if such an update causes a change in the baseline value corresponding to the measurement target, the second network device generates an updated baseline file and an updated baseline file check value based on the updated software. The updated baseline file check value is used to verify whether the updated baseline file is credible. For the generation method, refer to the description in step 501 above. Exemplarily, if the update only increases the metric target corresponding to the software, the second network device may not regenerate the updated baseline file and the updated baseline file check value. The second network device may generate a new benchmark value based on the added metric target, and record the metric target identifier indicating the added metric target corresponding to the new benchmark value in the first baseline file to obtain an updated baseline file. In addition, on the basis of the check value of the baseline file, the second network device performs superposition calculation in combination with the new reference value to obtain an updated check value of the baseline file.

In an exemplary embodiment, the above-mentioned software is the kernel state software included in the running state software, and the method further includes: the first network device obtains the second baseline file corresponding to the user state software of the second network device, and the second baseline file is based on the user state software. Generated by the compilation process of the software. The first network device performs remote certification on the user state software based on the second baseline file, and obtains a remote certification result corresponding to the user state software.

As mentioned above, the running software is located in the memory of the second network device. Among them, during the process of the kernel state software being linked and loaded into the memory, the kernel state software will be modified by the compiler (modification includes but not limited to redirection and rewriting, and such modification is different from malicious tampering, and such modification is allowed ), thus making the kernel mode software inconsistent before and after loading. Also, such modifications are unpredictable. Therefore, for the kernel state software, the first baseline file corresponding to the kernel state software can only be generated by the second network device after the kernel state software is linked and loaded into the memory. However, during the process of linking and loading the user state software into the memory, the user state software will not be modified, so the user state software is consistent before and after loading. Then, for the user mode software, the first baseline file corresponding to the user mode software may be generated by the second network device. The second baseline file corresponding to the user-mode software may also be generated during the compiling process of the user-mode software. Both the first baseline file and the second baseline file can be used to remotely certify the user state software.

Wherein, the manner of generating the second baseline file during the compiling process of the user state software may refer to the manner of generating the first baseline file by the second network device in step 502 above, and details are not repeated here. After the second baseline file is generated, the second baseline file may be configured on the first network device by means of manual configuration or the like. This configuration process may be completed prior to remote attestation by the first network device. In addition, for the case that the software is static software, the baseline file corresponding to the static software may be generated by the second network device, or may be generated during the compiling process of the static software.

Next, referring to FIG. 6 , an example is given to illustrate the overall process of the remote attestation method provided by the embodiment of the present application. The overall process includes the following four stages.

In the first stage, the second network device generates a first baseline file.

Step 601 , the first measurement module in the REE kernel measures the software based on the measurement object list stored in the REE kernel, and obtains a first baseline file. Store the first baseline file in the REE kernel.

Step 602, the first measurement module in the REE kernel sends the first baseline file to the second measurement module in the TEE kernel.

In step 603, the second measurement module in the TEE kernel generates a check value of the baseline file based on the first baseline file. Write the checksum value of the baseline file into PCR_X of the TPM chip.

In step 604, the second measurement module in the TEE kernel informs the first measurement module in the REE kernel that the baseline file check value has been generated.

In the second stage, the first network device acquires the first baseline file.

Step 605, the RAS of the first network device sends a challenge request 1 to the RAC of the second network device. The challenge request 1 includes a reference challenge value 1 .

Step 606, the RAC of the second network device acquires the first baseline file stored in the REE kernel (step 6061), and acquires the check value of the baseline file stored in PCR_X (step 6062). Let the benchmark challenge value 1 be the challenge value 1. The first baseline file, the check value of the baseline file, and the challenge value 1 are encrypted with the private key of the second network device, and an encryption result 1 is obtained.

Step 607, the RAC of the second network device sends the encryption result 1 to the RAS of the first network device.

Step 608, the RAS of the first network device verifies the encryption result 1 to obtain a credible first baseline file. Afterwards, the trusted first baseline file is stored.

Wherein, the verification process includes that the RAS of the first network device decrypts the encrypted result 1 through the private key of the second network device. Obtain the first baseline file, baseline file check value and challenge value 1. After confirming that the challenge value 1 is the same as the reference challenge value 1, it is determined whether the first baseline file is credible based on the check value of the baseline file. If it is confirmed that the first baseline file is credible, a credible first baseline file is obtained.

Step 609, the first network device receives the configured first baseline file, and the first baseline file is generated during software compilation.

It should be noted that the first network device may choose to obtain the first baseline file through steps 605-608. Alternatively, the first network device chooses to obtain the first baseline file through step 609 .

In the third stage, the second network device generates a metric log.

In step 610, the first measurement module of the REE core measures the software again based on the measurement object list stored in the REE core to obtain multiple measurement values.

Step 611 , the first measurement module of the REE kernel compares the first baseline file with multiple measurement values. Record the measurement value different from the first baseline file to obtain the measurement log, and send the measurement log to the user space.

Step 612, the user space stores the metric log.

Step 613 , the first measurement module of the REE core generates a measurement log check value based on the measurement log, and writes the measurement log check value into PCR_Y of the TPM chip.

In the fourth stage, the first network device obtains the measurement log, and performs remote certification based on the first baseline file and the measurement log.

Step 614, the RAS of the first network device sends a challenge request 2 to the RAC of the second network device. The challenge request 2 includes a reference challenge value 2 .

Step 615, the RAC of the second network device obtains the metric log stored in the user space (step 6151), obtains the check value of the metric log stored in PCR_Y (step 6152), and obtains the stored first baseline file from the REE kernel (step 6153). Then take the benchmark challenge value 2 as the challenge value 2. The measurement log, the verification value of the measurement log, the stored first baseline file, and the challenge value 2 are encrypted by using the private key of the second network device to obtain an encryption result 2 .

Step 616, the RAC of the second network device sends the encryption result 2 to the RAS of the first network device.

Step 617, the RAS of the first network device verifies the encryption result 2 to obtain a credible measurement log. Compare the measurement log with the first baseline file to obtain the remote attestation result, thereby completing the remote attestation.

Wherein, the verification process includes that the RAS of the first network device decrypts the encrypted result 2 through the private key of the second network device. Obtain the measurement log, the verification value of the measurement log, the stored first baseline file, and the challenge value 2. The first network device confirms that the time difference between the sending time of the challenge request 2 and the receiving time of the encrypted result 2 is not greater than the time threshold, the stored first baseline file is the same as the credible first baseline file, and the challenge value 2 is the same as the reference The challenge value is the same as 2 (the order of confirmation is not limited). Afterwards, the first network device confirms whether the metric log is credible based on the metric log check value. Remote attestation can be done if the metrics logs are confirmed to be trustworthy.

To sum up, in the embodiment of the present application, the first network device remotely certifies the software of the second network device based on the first baseline file and the measurement log after confirming that the first baseline file and the measurement log are credible, ensuring The resulting remote attests to the accuracy of the results. Since the first baseline file and measurement log obtained by the first network device are generated by the second network device, the acquisition method is relatively intelligent, so the remote attestation method provided by the embodiment of the present application is also relatively intelligent and has high flexibility .

The above describes the remote attestation method provided by the embodiment of the present application. Corresponding to the above method, the embodiment of the present application also provides a remote attestation device. Wherein, the apparatus is applied to the first network device. The apparatus is used to execute the remote attestation method executed by the first network device in FIG. 5 or FIG. 6 through various modules shown in FIG. 7 . As shown in FIG. 7 , the remote attestation device provided by the embodiment of the present application includes an acquisition module 701 and a remote attestation module 702 as follows.

Wherein, the acquisition module 701 is used to execute the above step 504 . The remote attestation module 702 is used to execute step 505 above.

In some implementations, the acquiring module 701 is used to execute step 605 and step 614 . The remote attestation module 702 is configured to perform step 608 and step 616 . In some other implementation manners, the obtaining module 701 is further configured to execute step 609 , and the remote certification module 702 is configured to execute step 616 .

The remote attestation device shown in Figure 7 is applied to the first network device. For the structure, the detailed process of interacting with the second network device, and the detailed process of completing remote attestation, please refer to the previous implementations related to Figures 1-6. The description of the example is not repeated here.

The embodiment of the present application also provides another remote attestation device. The device is applied to the second network device, and the device is used to execute the remote attestation method performed by the second network device in FIG. 5 or FIG. 6 through various modules shown in FIG. 8 . As shown in FIG. 8 , the remote attestation device provided by the embodiment of the present application includes the following generating module 801 and sending module 802 .

Wherein, the generation module 801 is used to execute the above step 501 and step 502, and the sending module 802 is used to execute the above step 503.

In some implementations, the generating module 801 is used to perform steps 601-604, 606, 610-613 and 615. The sending module 802 is configured to execute step 607 and step 616 . In some other implementation manners, the generating module 810 is configured to execute steps 610-613 and step 615, and the sending module 802 is configured to execute step 616.

The remote attestation device shown in FIG. 8 is applied to the second network device. For the structure and the detailed process of interacting with the first network device, please refer to the descriptions of the various embodiments related to FIGS. 1-6 above, which will not be repeated here. repeat.

To sum up, in the embodiment of the present application, the first network device remotely certifies the software of the second network device based on the first baseline file and the measurement log after confirming that the first baseline file and the measurement log are credible, ensuring The resulting remote attests to the accuracy of the results. Since the first baseline file and measurement log obtained by the first network device are generated by the second network device, the acquisition method is relatively intelligent, so the remote attestation method provided by the embodiment of the present application is also relatively intelligent and flexible.

It should be understood that, when the above-mentioned devices provided in Fig. 7 and Fig. 8 implement their functions, they are only illustrated by dividing the above-mentioned functional modules. In practical applications, the above-mentioned function allocation can be completed by different functional modules according to needs. , which divides the internal structure of the device into different functional modules to complete all or part of the functions described above. In addition, the device and the method embodiment provided by the above embodiment belong to the same idea, and the specific implementation process thereof is detailed in the method embodiment, and will not be repeated here.

FIG. 9 shows a schematic structural diagram of an exemplary remote attestation device 900 of the present application. As shown in FIG. 9 , the remote attestation device 900 includes at least one processor 901 , a memory 903 and at least one network interface 904 .

The processor 901 is, for example, a general-purpose central processing unit (Central Processing Unit, CPU), a digital signal processor (digital signal processor, DSP), a network processor (network processor, NP), a GPU, a neural network processor (neural-network processing units, NPU), data processing unit (Data Processing Unit, DPU), microprocessor or one or more integrated circuits or application-specific integrated circuits (application-specific integrated circuit, ASIC) for implementing the scheme of this application, programmable logic devices (programmable logic device, PLD), other general-purpose processors or other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, or any combination thereof. The PLD is, for example, a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof. A general purpose processor may be a microprocessor or any conventional processor or the like. It should be noted that the processor may be a processor supporting advanced RISC machines (ARM) architecture. It can implement or execute the various logical blocks, modules and circuits described in connection with the present disclosure. The processor can also be a combination of computing functions, for example, a combination of one or more microprocessors, a combination of DSP and a microprocessor, and so on.

Optionally, the remote attestation device 900 further includes a bus 902 . Bus 902 is used to communicate information between the various components of remote attestation device 900 . The bus 902 may be a peripheral component interconnect standard (peripheral component interconnect, PCI) bus or an extended industry standard architecture (extended industry standard architecture, EISA) bus or the like. The bus 902 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one line is used in FIG. 9 , but it does not mean that there is only one bus or one type of bus.

Memory 903 may be volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory. Among them, the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which acts as external cache memory.

By way of illustration and not limitation, many forms of ROM and RAM are available. For example, the ROM is a compact disc read-only memory (CD-ROM). RAM includes but not limited to static random access memory (static RAM, SRAM), dynamic random access memory (dynamic random access memory, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic Random access memory (double data date SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhancedSDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory ( direct rambus RAM, DR RAM).

Memory 903 may also be other types of storage devices that may store static information and instructions. Or other types of dynamic storage devices that can store information and instructions. Or it may be other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disc storage medium or other magnetic storage device, or can be used to carry or store instructions or data structure program code in the form of a program and any other medium that can be accessed by a computer, but is not limited thereto. The memory 903 exists independently, for example, and is connected to the processor 901 through the bus 902 . The memory 903 can also be integrated with the processor 901.

Network interface 904 uses any transceiver-like device for communicating with other devices or a communication network. The communication network may be an Ethernet, a radio access network (radio access network, RAN), or a wireless local area network (wireless local area network, WLAN), or the like. The network interface 904 may include a wired network interface, and may also include a wireless network interface. Specifically, the network interface 904 may be an Ethernet (Ethernet) interface, such as: Fast Ethernet (Fast Ethernet, FE) interface, Gigabit Ethernet (Gigabit Ethernet, GE) interface, Asynchronous Transfer Mode (Asynchronous TransferMode, ATM) interface, WLAN interface , the cellular network interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface or a combination thereof. In some embodiments of the present application, network interface 904 may be used for remote attestation device 900 to communicate with other devices.

In a specific implementation, as some implementation manners, the processor 901 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 9 . Each of these processors can be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).

In a specific implementation, as some implementation manners, the remote attestation device 900 may include multiple processors. Processor 901 and processor 905 as shown in FIG. 9 . Each of these processors can be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data such as computer program instructions.

In some implementations, the memory 903 is used to store program instructions 910 for implementing the solution of the present application, and the processor 901 can execute the program instructions 910 stored in the memory 903 . That is, the remote attestation device 900 can implement the method provided by the method embodiment through the processor 901 and the program instructions 910 in the memory 903, that is, the method performed by the first network device or the second network device in FIG. 5 or 6 method. One or more software modules may be included in the program instructions 910 . Optionally, the processor 901 itself may also store program instructions for executing the solutions of the present application.

In the specific implementation process, the remote attestation device 900 of the present application may correspond to the first network device for performing the above method, and the processor 901 in the remote attestation device 900 reads the instructions in the memory 903, so that the The shown remote attestation device 900 can execute all or part of the steps in the method embodiments.

The remote attestation device 900 may also correspond to the apparatus shown in FIG. 7 or FIG. 8 above, and each functional module in the apparatus shown in FIG. 7 or FIG. 8 is implemented by the software of the remote attestation device 900 . In other words, the functional modules included in the apparatus shown in FIG. 7 or FIG. 8 are generated after the processor 901 of the remote attestation device 900 reads the program instructions 910 stored in the memory 903 .

Wherein, each step of the method shown in FIG. 5 or 6 is completed by an integrated logic circuit of hardware in the processor of the remote attestation device 900 or an instruction in the form of software. The steps combined with the method embodiments disclosed in this application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor. The software module can be located in the random access memory, and the processor reads the information in the memory, and completes the steps of the above-mentioned method embodiments in combination with its hardware. To avoid repetition, no detailed description is given here.

In an exemplary embodiment, the embodiment of the present application provides a device for remote attestation. The device includes: including network interface, memory and processor. The network interface is used to receive or send data, and the memory stores data and at least one instruction. At least one instruction is loaded and executed by the processor, so that the remote attestation device implements the remote attestation method performed by the first network device or the second network device in FIG. 5 or 6 . Wherein, the data received or sent by the network interface and the data stored in the memory may refer to the descriptions corresponding to FIGS. 1-6 above, and will not be repeated here.

In an exemplary embodiment, the embodiment of the present application provides a remote attestation system. The system includes a first network device and at least one second network device. The first network device is communicatively connected to at least one second network device. The first network device is configured to execute the method executed by the first network device in FIG. 5 or 6 , and the second network device is configured to execute the method executed by the second network device in FIG. 5 or 6 .

In an exemplary embodiment, an embodiment of the present application provides a computer program (product). Computer programs (products) include: computer program codes. When the computer program code is run by the computer, it causes the computer to execute the remote attestation method executed by the first network device in FIG. 5 or 6 . Or, make the computer execute the method executed by the second network device in FIG. 5 or 6 .

In an exemplary embodiment, an embodiment of the present application provides a computer-readable storage medium. A computer-readable storage medium stores programs or instructions. When the program or instruction runs on the computer, the computer executes the method executed by the first network device in FIG. 5 or 6 above. Alternatively, the computer executes the method executed by the second network device in FIG. 5 or 6 above.

In an exemplary embodiment, the embodiment of the present application provides a chip. The chip includes a processor. The processor is used to call from the memory and execute the instructions stored in the memory, so that the device installed with the chip executes the method executed by the first network device in FIG. 5 or 6 . Or, make the device installed with the chip execute the method executed by the second network device in FIG. 5 or 6 .

In an exemplary embodiment, the embodiment of the present application provides another chip. The chip includes input interface, output interface, processor and memory. The input interface, the output interface, the processor and the memory are connected through internal connection paths. The processor is used to execute code in the memory. When the code is executed, the processor is configured to execute the method executed by the first network device in FIG. 5 or 6 . Alternatively, the processor is configured to execute the method executed by the second network device in FIG. 5 or 6 .

In the above embodiments, the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Instructions stored by computer-readable storage media may be transferred from one computer-readable storage medium to another computer-readable storage medium. For example, instructions may be transmitted from one web site, computer, server, or data center to another web site, computer, server, or or data center for transmission. The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a Solid State Disk).

In this application, terms such as "first" and "second" are used to distinguish the same or similar items with substantially the same effect and function. It should be understood that "first", "second", and "nth" do not have a logical or sequential dependency relationship, and the quantity and execution sequence are not limited. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.

It should also be understood that in each embodiment of the present application, the sequence numbers of the various processes do not mean the order of execution. The execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiment of the present application.

The term "at least one" in this application means one or more. The meaning of the term "plurality" in this application refers to two or more than two. For example, multiple second devices refer to two or more second devices. The terms "system" and "network" are often used interchangeably herein.

It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "and/or" is an associative relationship describing associated objects, indicating that there may be three kinds of relationships. For example, A and/or B may mean that A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" in this application generally indicates that the contextual objects are an "or" relationship.

It is to be understood that the terminology used in describing the various described examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various described examples and in the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context dictates otherwise Clearly instruct.

It should also be understood that the terms "if" and "if" may be construed to mean "when" ("when" or "upon") or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrases "if it is determined..." or "if [the stated condition or event] is detected" may be construed to mean "when determining" or "in response to determining... ” or “upon detection of [stated condition or event]” or “in response to detection of [stated condition or event]”.

The above descriptions are only examples of the present application, and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of this application shall be included within the scope of protection of this application.

Claims (23)

1. A method of remote attestation, the method comprising:

the method comprises the steps that a first network device obtains a first baseline file and a measurement log corresponding to software of a second network device, the first baseline file and the measurement log are generated by the second network device, the first baseline file is used for recording a reference value of the software under a trusted condition, and the measurement log is used for recording a measurement value of the software;

And in response to confirming that the first baseline file and the measurement log are trusted, the first network device remotely proves the software based on the first baseline file and the measurement log to obtain a remote proving result corresponding to the software, wherein the remote proving result corresponding to the software is used for indicating whether the software is trusted or not.

2. The method of claim 1, wherein the first network device remotely attests to the software based on the first baseline file and the metric log, and wherein prior to obtaining a remote attestation result corresponding to the software, the method further comprises:

the first network device receives a trusted baseline file check value sent by the second network device, wherein the baseline file check value is used for checking whether the first baseline file is trusted or not;

the first network equipment calculates the reference value recorded by the first baseline file to obtain a first numerical value, wherein the first numerical value and the baseline file check value are calculated in the same mode, and the same calculation mode is the same algorithm or the same algorithm and calculation sequence;

in response to the first value being the same as the baseline file verification value, the first network device validates that the first baseline file is authentic.

3. The method according to claim 1 or 2, wherein the first network device performs remote attestation on the software based on the first baseline file and the measurement log, and before obtaining a remote attestation result corresponding to the software, the method further comprises:

the first network equipment receives a trusted measurement log check value sent by the second network equipment, wherein the measurement log check value is used for checking whether the measurement log is trusted or not;

the first network equipment calculates the measurement value recorded by the measurement log to obtain a second numerical value, wherein the second numerical value and the measurement log check value are calculated in the same mode, and the same calculation mode is the same algorithm or the same algorithm and calculation sequence;

in response to the second value being the same as the metric log check value, the first network device confirms that the metric log is authentic.

4. A method according to any of claims 1-3, wherein the first baseline file and the metric log have been encrypted by a private key of the second network device, the first network device remotely proving the software based on the first baseline file and the metric log, and before obtaining a remote proving result corresponding to the software, the method further comprises:

And the first network equipment acquires a public key corresponding to the private key, and decrypts the first baseline file and the measurement log through the public key.

5. The method of any of claims 1-4, wherein the first network device remotely attests to the software based on the first baseline file and the metric log, and before obtaining a remote attestation result corresponding to the software, the method further comprises:

the first network device determines that a metrology target corresponding to a metrology value of the metrology log record belongs to a subset of metrology targets corresponding to a baseline value of the first baseline file record.

6. The method according to any one of claims 1-5, wherein the first network device performs remote attestation on the software based on the first baseline file and the measurement log, and before obtaining a remote attestation result corresponding to the software, the method further comprises:

the first network device receives a stored first baseline file sent by the second network device;

the first network device determines that the stored first baseline file is the same as the first baseline file.

7. The method of any of claims 1-6, wherein the first network device obtaining a first baseline file and a metrics log generated by a second network device comprises:

The first network device sends a challenge request to the second network device, the challenge request being used to request the second network device to send the first baseline file and the metric log;

the first network device receives the first baseline file and the measurement log sent by the second network device.

8. The method of claim 7, wherein the challenge request includes a benchmark challenge value; the first network device performs remote certification on the software based on the first baseline file and the measurement log, and before obtaining a remote certification result corresponding to the software, the method further includes:

the first network device receives the challenge value sent by the second network device, and determines that the challenge value is the same as the reference challenge value.

9. The method according to claim 7 or 8, wherein the first network device performs remote attestation on the software based on the first baseline file and the measurement log, and before obtaining a remote attestation result corresponding to the software, the method further comprises:

the first network device determines that a time difference value between a sending time and a receiving time is not greater than a time threshold, wherein the sending time is a time for sending the challenge request, and the receiving time is a time for receiving the first baseline file and the measurement log.

10. The method according to any one of claims 1 to 9, wherein the software is running software, data of the running software is located in a plurality of memory pages included in a memory of the second network device, the first baseline file is generated after the second network device queries the plurality of memory pages to obtain the data, and splices the data to obtain the running software, and the running software is at least one of user mode software and kernel mode software.

11. The method of claim 10, wherein the running software is the kernel mode software, the method further comprising:

the first network device obtains a second baseline file corresponding to user mode software of the second network device, wherein the second baseline file is generated in the compiling process of the user mode software;

and the first network equipment remotely proves the user mode software based on the second baseline file to obtain a remote proving result corresponding to the user mode software.

12. A method of remote attestation, the method comprising:

the method comprises the steps that a second network device generates a first baseline file corresponding to software of the second network device, wherein the first baseline file is used for recording a reference value of the software under a trusted condition;

The second network equipment generates a measurement log corresponding to the software, wherein the measurement log is used for recording the measurement value of the software;

the second network device sends the first baseline file and the metrics log to a first network device.

13. The method of claim 12, wherein the metric values of the metric log record correspond to metric targets, and wherein for any metric target, the reference value corresponding to any metric target in the first baseline file is different from the metric value corresponding to any metric target.

14. The method of claim 13, wherein the second network device generating the software-corresponding metric log comprises:

in response to confirming that the first baseline file is authentic, the second network device generates a metrics log corresponding to the software.

15. The method according to any one of claims 12-14, further comprising:

the second network equipment calculates a reference value of the first baseline file record to obtain a baseline file check value, wherein the baseline file check value is used for checking whether the first baseline file is credible or not;

The second network device sends a trusted baseline file check value to the first network device.

16. The method according to any one of claims 12-15, wherein the method further comprises:

the second network equipment calculates the measurement value recorded by the measurement log to obtain a measurement log check value, wherein the measurement log check value is used for checking whether the measurement log is credible or not;

the second network device sends a trusted metric log check value to the first network device.

17. The method of any of claims 12-16, wherein the second network device sending the first baseline file and the metrics log to a first network device comprises:

the second network device sends a first baseline file and a metrics log encrypted by a private key of the second network device to the first network device.

18. The method according to any one of claims 12-17, further comprising:

the second network device sends a stored first baseline file to the first network device.

19. The method of any of claims 12-18, wherein prior to the second network device sending the first baseline file and the metrics log to the first network device, the method further comprises:

The second network device receives a challenge request sent by the first network device, where the challenge request is used to request the second network device to send the first baseline file and the measurement log.

20. The method of claim 19, wherein the challenge request includes a benchmark challenge value, the method further comprising:

the second network device sends a challenge value to the first network device, the challenge value being the reference challenge value.

21. The method according to any one of claims 12-20, wherein the software is running software, the running software is at least one of user mode software and kernel mode software, and the second network device generates a first baseline file corresponding to the software of the second network device, including:

the second network device queries a plurality of memory pages included in a memory of the second network device to obtain data of the running state software;

and the second network equipment splices the data to obtain the running state software, and generates the first baseline file corresponding to the running state software.

22. A device for remote attestation, the device comprising a network interface, a memory, and a processor; the network interface is configured to receive or transmit data, and the memory stores data and at least one instruction that is loaded and executed by the processor to cause the remote attestation device to implement the method of remote attestation of any of claims 1-21.

23. A system for remote attestation, the system comprising a first network device for implementing the method of remote attestation of any of claims 1-11 and at least one second network device for implementing the method of remote attestation of any of claims 12-21.