CN105468978B - A kind of creditable calculation password platform suitable for electric system universal computing platform - Google Patents

Abstract

The present invention provides a trusted computing cryptographic platform suitable for a general computing platform in an electric power system. The cryptographic platform includes: a trusted computing cryptographic module and a trusted software system; the trusted computing cryptographic module includes a trusted measurement root, The trusted storage root and the trusted reporting root are the starting points of the platform trust chain transfer; the trusted software system includes: a trusted computing password driver module, a measurement module and an audit module, providing operating systems and application software with trusted computing An interface to the cryptographic platform. The trusted computing cryptographic module is the root of trust, which provides a trusted environment for the operation of the trusted computing cryptographic platform. The trusted software system is the core of the trusted computing cryptographic platform's functions and services, and provides protection for the management of the trusted computing cryptographic platform. The invention can provide functions such as static measurement, dynamic measurement, white list and access control for the business system, and ensures the credibility, identification and controllability of the software by managing the source and operation of the system software.

Description

A Trusted Computing Cryptographic Platform Applicable to the General Computing Platform of Electric Power System

technical field

The invention relates to the technical field of trusted computing, in particular to a trusted computing cryptographic platform suitable for a general computing platform of an electric power system.

Background technique

The root cause of the insecurity of the information system is due to the simplification of the PC structure and the lack of verification of the processes and programs in the system, resulting in the arbitrary execution of executable programs and processes without authorization and the implementation of malicious behaviors, while traditional firewalls, anti-viruses, IDS are all based on peripheral blocking and post-event upgrade of the virus code base, and cannot actively defend and actively defend.

Trusted computing structurally solves the vulnerability problem brought about by the simplification of the personal computer architecture by introducing a trusted chip on the hardware. Based on the hardware chip, a complete chain of trust is built from the power-on of the platform to the execution of the application program. , first-level authentication, first-level trust, and first-level trust. Uncertified programs cannot be executed, so that the information system can achieve self-immunity and build an information system with a high security level.

Contents of the invention

In order to overcome the deficiencies of the above-mentioned prior art, the present invention provides a trusted computing and encryption platform suitable for the general computing platform of the electric power system. Provide business systems with a whitelist-based immune mechanism for malicious code in business systems, provide a trusted boot mechanism for operating systems, and have their own protection and management mechanisms for security policies. By managing the source and operation of the system software, the software is guaranteed to be credible, identifiable and controllable, and the resource access of the key modules and processes of the program is controlled according to the preset configuration strategy, so as to realize the detection of known/unknown malicious codes Active defense reduces the risk of executable programs being damaged or tampered with, and ensures the safe and stable operation of executable programs.

The solution adopted to achieve the above purpose is:

A trusted computing cryptographic platform applicable to a general computing platform of an electric power system, the cryptographic platform comprising: a trusted computing cryptographic module and a trusted software system;

The trusted computing cryptographic module includes a trusted measurement root, a trusted storage root, and a trusted reporting root, which are the starting point of the platform trust chain transmission;

The trusted software system includes: a trusted computing cryptographic driver module, a measurement module and an audit module, which provide an interface for using a trusted computing cryptographic platform for the operating system and application software.

Preferably, the trusted computing cryptographic module includes a hardware board form and a software form;

The form of the hardware board includes: an execution engine, a non-volatile storage unit, a volatile storage unit, a random number generator, a cryptographic algorithm engine, a key generator and a timer, providing hardware passwords for trusted software systems Algorithm and policy storage, protection and update mechanism;

The software form provides a password algorithm and policy storage, protection and update mechanism of the software form for the trusted software system.

Preferably, the trusted computing cryptographic driver module provides a driver for the trusted computing cryptographic module;

The measurement module is used to measure the integrity of subsequent software of the trusted computing cryptographic platform;

The follow-up software includes: a core dynamic loading module, a dynamic library, an uncontrollable operating system core, and an application program on the uncontrollable operating system;

The auditing module is used to intercept specific behaviors of upper-layer applications or uncontrollable operating systems, perform behavioral auditing and analysis, and trigger predetermined response actions.

Further, the integrity metrics include static metrics and dynamic metrics;

The content of the static measurement includes executable programs, dynamic libraries and kernel modules in the system. The static measurement performs hash calculation of the file content on the three types of files, and compares the calculation result with the expected result to judge the measurement whether the integrity of the object has been compromised;

The dynamic measurement is to complete the collection of the expected value of the measurement object before the start of the measurement object, and verify the measurement object during system operation according to the collected expected value.

Preferably, the trusted computing cryptographic platform provides a whitelist mechanism and mandatory access control based on security labels;

The white list mechanism is to generate a white list library by scanning the scanning interface during the software installation process, and judge whether to allow the program to run according to the white list library when the program is running;

The security label-based mandatory access control includes:

(1) HMI initiates a service access request;

(2) The trusted software system deployed on the SCADA server intercepts the request;

(3) Extract the subject security label from the first data packet of the request;

(4) Search for the corresponding service name in the port and service correspondence list according to the port number of the service;

(5) Find the corresponding object tag in the object tag list according to the service name;

(6) Exclusive OR operation is performed on the subject security label and the authority value in the object label;

(7) If the authority judgment is passed, release the data packet;

(8) Subsequent data of this request will be released directly, and authority judgment will not be performed.

Compared with the prior art, the present invention has the following beneficial effects:

(1) Ensure the credibility, identification and controllability of the software by managing the source and operation of the system software.

(2) It can control the resource access of key modules and processes of the program according to the preset configuration strategy.

(3) Realize active defense against known/unknown malicious codes, reduce the risk of executable programs being damaged or tampered with, and ensure the safe and stable operation of executable programs.

Description of drawings

Accompanying drawing 1: The architecture diagram of trusted computing cryptographic platform of the present invention;

Accompanying drawing 2: Composition of trusted computing cryptographic module of the present invention;

Accompanying drawing 3: static measurement system structural diagram of the present invention;

Accompanying drawing 4: the overall realization frame of dynamic measurement of the present invention;

Accompanying drawing 5: kernel key data measurement block diagram of the present invention;

Accompanying drawing 6: the block diagram of process running state measurement of the present invention;

Accompanying drawing 7: the measurement block diagram of the process system call behavior of the present invention;

Accompanying drawing 8: white list of the present invention-software installation control mechanism;

Accompanying drawing 9: Trusted computing cryptographic platform and process mandatory access relationship diagram of the present invention;

Accompanying drawing 10: Mandatory access control based on security label of the present invention.

Detailed ways

The specific embodiments of the present invention will be further described in detail below in conjunction with the accompanying drawings.

When the system starts, the trusted chip first measures the integrity of the BIOS, and compares the measurement result with the expected value collected during the initial operation of the system and stored in the trusted chip. If the results are consistent, it means that the BIOS has not been tampered with and is credible. The measurement code in the BIOS will measure the OS Loader (including the master boot sector MBR, the operating system boot sector, etc.), when it is determined that the OS Loader is credible In the case of the operating system, the loader of the operating system is executed. Before loading the operating system, OS Loader first measures the operating system and trusted computing cryptographic platform, and when it is judged to be credible, loads and executes the operating system and trusted computing cryptographic platform. After the operating system is started, the Trusted Computing Cryptographic Platform gains control and measures the integrity of the application startup and related configuration files. If the application and important configuration files are trusted, the operating system loads and executes the application. Through the above operations, the trusted computing platform establishes a complete trust chain consisting of BIOS, OS Loader, operating system, trusted computing cryptographic platform and applications for system startup, fundamentally eliminating the system from being damaged by implanting viruses and Trojan horses possibility.

During system operation, real-time detection of whether the system and process are in a credible state, system call behavior of the process, and kernel key data in the running state (such as system call table, interrupt descriptor table, key operation set Pointers, etc.), kernel code segment, process code segment, process shared library list, etc. are measured to detect whether the integrity of the system and process space has been tampered with. If the integrity is damaged, the system call behavior of the process will be blocked, thus effectively preventing the security risk of using system vulnerabilities to inject malicious code into the system and process space to conduct penetrating attacks on the system in a proactive defense manner.

●Composition and working principle of trusted computing cryptographic platform:

The trusted computing cryptographic platform is based on cryptographic technology and consists of trusted computing cryptographic modules and trusted software systems. The architecture is shown in Figure 1. Among them, the trusted computing cryptographic module is the root of trust, which provides a trusted environment for the operation of the trusted computing cryptographic platform. Assure.

The trusted computing cryptographic platform establishes a trusted chain throughout the system through bottom-up trusted support and layer-by-layer transfer of trust, and builds a trusted computing environment. The newly added trusted computing cryptographic module on the main board of the terminal is the trust root of the trusted platform, including the trusted measurement root, trusted storage root, and trusted reporting root, and is the starting point of the platform trust chain transfer. The root of trust for measurement is the root of trust for integrity measurement, the root of trust for storage is the root of trust for data storage protection, the root of trust for reporting is the root of trust for integrity reporting; The autonomous root of trust (RT) implements the integrity measurement and storage mechanism for the core components, and realizes the establishment of trusted guidance and trust chain. The trusted software system is the supporting software of the trusted computing cryptographic platform. It provides an interface for the operating system and application software to use the trusted computing cryptographic platform. At the same time, it also ensures the transmission of the trust chain on the software system. Applications running on a trusted computing platform complete trusted application functions and services in a trusted computing environment with the help of trusted services provided by the trusted computing cryptographic platform.

●Trusted Computing Cryptographic Module

The trusted computing cryptographic module has two forms of hardware board and software. According to the security requirement level of the server, different forms of trusted computing cryptographic modules are used, as shown in the following table:

Table 1 Trusted Computing Cryptographic Module Morphology

The trusted computing cryptographic module in the form of hardware boards provides hardware cryptographic algorithms and policy storage, protection and update mechanisms for trusted software systems:

(1) Cryptographic algorithm: provide high-performance SM2 and SM3 algorithms for trusted software systems;

(2) Policy protection: store the summary value of the trusted software system policy file, provide integrity protection for the policy file, and avoid malicious tampering;

(3) Trusted startup of the operating system: Provide the driver of the CPU real mode, and provide static measurement support for the kernel for the system boot phase.

The trusted computing cryptographic module in the form of software provides cryptographic algorithms and policy storage, protection and update mechanisms in the form of software for trusted software systems:

(1) Cryptographic algorithm: provide high-performance SM2 and SM3 algorithms for trusted software systems;

(2) Policy protection: protect the summary value of the trusted software system policy file, provide integrity protection for the policy file, and avoid malicious tampering.

Hardware board form trusted computing cryptographic module chip is composed of execution engine, non-volatile storage unit, volatile storage unit, random number generator, cryptographic algorithm engine, key generator, timer and other parts, as shown in Figure 2 As shown, these functional components are mapped to the address space of the on-chip CPU by the input-output bridge unit.

In the Trusted Computing cryptographic module solution, a power supply system independent of the CPU is designed, so the Trusted Computing cryptographic module can be started as the master device before the CPU, so that it can run as the master device and become the starting point of the entire system's trustworthiness measurement, including BIOS. For all the components, a chain of trust starting from the trusted computing cryptographic module is established.

The internal execution engine of the trusted computing cryptographic module is the operation execution unit of the trusted computing cryptographic module. The non-volatile storage unit inside the trusted computing cryptographic module is divided into three parts: program storage unit, data storage unit and trusted register group, and a total of 1280 bytes of NV registers are designed. Among them, the program storage unit stores firmware and control programs, and the data storage unit stores keys, certificates, logs and other confidential data. The trusted register group includes: module identification register, version number register, power supply and status management register, usage status register, Current user identification register, platform configuration register, platform binding register, user management register, non-volatile memory (NV).

The volatile storage units inside the trusted computing cryptographic module include: platform configuration registers and data buffers created during operations. When the user logs out, important data is stored in the non-volatile memory, and the user space in the volatile storage unit is cleared. Among them, the platform configuration register PCR is a group of registers set inside the trusted computing cryptographic module. There are 128 256-bit protected platform configuration registers (PCR) for storing integrity measurement values, which can be extended to 256.

The trusted computing cryptographic module realizes the judgment function of access control to hardware resources by controlling the judgment engine. The ruling result or signal is sent to the trusted computing platform through the GPIO signal line.

●Trusted software system

As a part of trusted computing cryptographic platform, trusted software system consists of the following components: trusted computing cryptographic driver module, measurement module and audit module. The trusted software system mainly realizes the transfer of trust chain and the measurement and audit of application software and uncontrollable operating system. The trusted computing cryptographic driver module completes the management function of the trusted computing cryptographic module device and provides the driver, which is provided by the trusted computing cryptographic module chip manufacturer. The measurement module in the trusted software system mainly implements the integrity measurement of the subsequent software by the trusted computing cryptographic platform. These software include: core dynamic loading modules, application programs, dynamic libraries, uncontrollable operating system cores, and applications, etc.

Software integrity measurement includes the following three processes:

1) When releasing the application program or its update, the software supplier provides a list of hash values corresponding to the executable files (referring to files containing codes) that make up the application program, and signs each hash value. After the application is installed or updated, the operating system will synchronize the "file-hash value pair" that has passed the signature verification to the application summary database (ADDB). The database should be secured with a storage master key.

2) The core of the operating system calls the trusted computing cryptographic module to request the trusted computing cryptographic module to measure the corresponding file before the program file or the shared library file is executed. The trusted computing cryptographic module performs a hash operation on the specified file and returns the calculation result. If an integrity report is required for the application, the hash value calculated above also needs to be stored in a specific PCR and recorded in the Metric Storage Log (SML).

3) The operating system compares the hash value calculated by the trusted computing cryptographic module with the expected value stored in the ADDB, and executes the corresponding code if they match, or terminates the execution of the application program.

The main function of the audit module in the trusted software system is to intercept specific behaviors of upper-layer applications or uncontrollable OS, conduct behavior audit and analysis, and trigger predetermined response actions.

When the upper layer application or uncontrollable operating system needs to start the program, load the dynamic library or load the kernel module, etc., the audit module performs hash operation on the code segment of the behavior object (including executable program, dynamic library, kernel module), And verify whether its hash value is the same as the expected value, and judge whether to allow the behavior to continue according to the verification result.

For applications running directly on the trusted kernel, the audit point is directly set in the kernel. For uncontrollable operating systems, auditing can be realized by intercepting its system calls (generally through soft interrupts), interrupts, etc.

●Static metrics

Static measurement is a completeness-based characterization process for measurement objects by measurement agents using appropriate algorithms under the support of predetermined measurement strategies. As shown in Figure 3, the main tasks of static measurement are:

(1) Determine the expected assertion. Properly express the expected result of the measured object, that is, the integrity of the measured object.

(2) Develop a measurement strategy. Formulate a feasible measurement method to judge the integrity of the measurement object.

(3) Carry out measurement and judgment. According to the measurement results, the credibility of the measurement object is judged, and the judgment result is given.

The content of static measurement includes executable programs, dynamic libraries and kernel modules in the system. Static measurement performs hash calculation of the file content on the above three files, and compares the calculation result with the expected result to ensure its credibility.

Use hash operation on the code segment of the measurement object (including executable program, dynamic library, kernel module), and verify whether the hash value is the same as expected, so as to judge whether the integrity of the measurement object is damaged.

Measuring method for executable programs: When starting a program, first intercept the information of the program, call the algorithm to calculate the hash value of the code segment of the program, and compare the calculated hash value with the expected value, so as to judge the Whether the executable program has been tampered with.

Dynamic library measurement method: When loading a dynamic library (including the dynamic library necessary for program startup, and the dynamic library dynamically loaded at runtime, etc.), the system will map the dynamic library to the memory through the mapping function. If the dynamic library is already in the memory , there is no need for a reload and thus no measurement. When loading the dynamic library for the first time, first intercept the information of the dynamic library, call the algorithm to calculate the hash value of the program code segment, and compare the calculated hash value with the expected value to judge whether the executable program is been tampered with. When the program exits, it will release some dynamic libraries used by itself, but there will still be some dynamic libraries resident in the system memory for use by other programs and will not be released, so when the program is restarted, these dynamic libraries already resident in the memory Libraries do not need to be measured again.

Module measurement method: module loading includes two situations: first, when the Linux system starts, it needs to load the modules necessary for the operating system to start and run. In the second type, after the system is started, the operating system will dynamically load the required modules when the system is required (for example, when a USB flash drive is inserted). These two cases are not treated differently for the Linux system kernel, that is, no matter which way the module is loaded, it is handled by the same system call (ie sys_init_module() system call). Therefore, the module measurement is at the system call. When the module is loaded, the system call will intercept the module's code segment, length and other information, and then pass this information to the measurement agent, and the measurement agent will calculate the hash value of the module, and Compare with the expected value to determine whether the module has been tampered with.

●Dynamic metrics

On the basis of the static measurement function to ensure the credibility of the initial state of the system operating object, the dynamic measurement mechanism completes the collection of the expected value of the measurement object before the measurement object is started, and verifies its state during system operation according to the collected expected value. As shown in Figure 4, the dynamic measurement mechanism can measure the key data of the kernel in the running state and the process status of the process. Among them, the measurement objects include the code segment of the operating system kernel, the read-only data segment, the key jump table and the process code segment of the application layer. In addition to providing support for the trusted proof mechanism, the kernel measurement function mainly serves the self-protection mechanism of the trusted software system, and the application measurement function mainly serves the access control mechanism.

(1) Kernel key data metrics

Kernel key data metrics are shown in Figure 5.

Measurement object: by default, the code segment, read-only data segment, and key jump table of the kernel are measured by default, which are static and unchanged data during the normal operation of the operating system. The caller of the measurement mechanism can specify its own measurement object through the registration interface.

Measurement timing: By default, the method of timing measurement is adopted, and the measurement is performed every certain time slot; the measurement can also be triggered through the query interface.

Measurement method: TSB starts the kernel thread, calculates the integrity check value of the measurement object by using the Hash function interface provided by TCM, and compares it with the benchmark value.

(2) Process measurement process

The process environment metrics are shown in Figure 6.

Metric Objects: Code segments of the application process and associated shared libraries.

Measurement timing: timing measurement; measurement can also be manually triggered by the user.

Measurement method: The dynamic measurement module will record the system call flow of the specified application and its associated process, analyze and learn, and generate a system call-level execution graph (Execution Graph) that describes the legal call rules, so that the process's Abnormal behavior is measured and reported.

(3) Process Behavior Metrics

Process behavior metrics are shown in Figure 7.

Metric object: System calls issued by the process.

Measurement timing: real-time measurement when the system call occurs.

Measurement method: The measurement engine monitors the system call behavior in real time, and judges each system call behavior. If the execution rule is met, the call is allowed; if the execution rule is violated, the call is blocked.

●White list

The trusted computing cryptographic platform provides a software installation interface (for the software installation package), and the application program is installed through this interface. During the software installation process, the whitelist library is generated by scanning the interface, allowing the execution program released by the installation to run. The software installation whitelist is generated as shown in Figure 8.

There are two ways to install the client software, which are software installation with acquisition authority and software installation without acquisition authority. Through these two methods, the installation permission can be controlled at different granularities.

Software installation with acquisition authority: When the client is used as an acquisition terminal, you can grant the client the "software acquisition" authority through the management center, and then use the program installation interface of the client to perform installation operations, and the execution programs installed through the interface will be automatically added to the Native whitelist library, and can be executed immediately. At the same time, the installed software whitelist (except the system whitelist) can be exported as a policy file through the interface, and then reported to the management center for approval to other clients.

Software installation without collection permission: By default, the client has no collection permission. At this time, only the template software issued by the management center is allowed to be installed through the software installation interface, and the execution program installed through the template will be automatically added to the network whitelist library and can be executed immediately.

● Mandatory access control based on security labels

The enforcement control function added on the basis of the trusted computing encryption platform function is shown in Figure 9, and the part marked in green is the process of adding enforcement control.

Combined with the business characteristics of the security label of the power dispatching control system and the functional characteristics of the mandatory access system of the trusted software system, the security label judgment system in the power dispatching control system is combined with the mandatory access control system of the trusted software system, and the system access request Through the double judgment of two kinds of access control, a dual-backup mandatory access control system is formed. Among them, the trusted software system provides high-intensity access control at the kernel level, and the security label system provides second-gradient access control at the application level. Thoroughly solve the safety hazards currently faced by the safety label system.

The business process of the mandatory access control system added to the trusted software system is shown in Figure 10.

(1) HMI initiates a service access request

(2) The trusted software system deployed on the SCADA server intercepts the request

(3) Extract the subject security label from the first packet of the request

(4) Find the corresponding service name in the port and service correspondence list according to the port number of the service

(5) Find the corresponding object tag in the object tag list according to the service name

(6) XOR the subject security label and the authority value in the object label

(7) If the authority judgment is passed, release the data packet

(8) Subsequent data of this request will be released directly, and authority judgment will not be performed.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application rather than to limit the scope of protection thereof. Although the present application has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: After reading this application, those skilled in the art can still make various changes, modifications or equivalent replacements to the specific implementation methods of the application, but these changes, modifications or equivalent replacements are all within the protection scope of the pending claims of the application.

Claims (2)

1. a kind of creditable calculation password platform suitable for electric system universal computing platform, which is characterized in that the password is flat Platform includes: creditable calculation password module and trusted software system；

The creditable calculation password module includes credible measurement root, trusted storage root, credible report root, is platform transitive trust Starting point；

The trusted software system includes: creditable calculation password drive module, metric module and Audit Module, be operating system and Application software provides the interface for using creditable calculation password platform；

The creditable calculation password platform provides white list mechanism and the forced symmetric centralization based on safety label；

The white list mechanism be in software installation process by scan interface scanning generate white list library, program operation when according to Determine whether that program is run according to the white list library；

The forced symmetric centralization based on safety label includes:

(1) man-machine initiation service access request；

(2) the trusted software system being deployed on SCADA server intercepts and captures this request；

(3) main body safety label is extracted from first data packet of request；

(4) corresponding service name is found in port and service corresponding lists according to the port numbers of service；

(5) corresponding object label is found in object list of labels according to service name；

(6) authority credentials in main body safety label and object label is subjected to XOR operation；

(7) if permission judgement passes through, clearance data packet；

(8) follow-up data of this request will directly let pass, and not carry out permission judgement；

The creditable calculation password drive module provides driving for the creditable calculation password module；

The metric module is used for the integrity measurement to the creditable calculation password platform subsequent software；

The subsequent software includes: core dlm (dynamic loading module), dynamic base, uncontrollable operating system kernel and uncontrollable behaviour Make the application program in system；

The Audit Module is used to intercept and capture the specific behavior of upper layer application or uncontrollable operating system, carries out behavior auditing and divides Analysis, and trigger scheduled response action；

The integrity measurement includes staticametric and dynamic measurement；

The content of the staticametric includes executable program, dynamic base and kernel module in system, and staticametric is to described Executable program, the dynamic base and the kernel module carry out the Hash calculation of file content, and by calculated result and expection As a result compare, to judge whether the integrality of measure object wrecks；

The dynamic measurement is to start the preceding collection completed to measure object desired value, and the expection according to collection in measure object Value verifies measure object in system operation.

2. creditable calculation password platform as described in claim 1, which is characterized in that the creditable calculation password module includes hard Part board form and software forms；

The hardware board form includes: enforcement engine, non-volatile memory cells, volatile memory cell, random number generation Device, cryptographic algorithm engine, key generator and timer provide the cryptographic algorithm of hardware for trusted software system and strategy are deposited Storage, protection and update mechanism；

The software forms provide the cryptographic algorithm and policy store of software forms, protection and update machine for trusted software system System.