CN111858114B

CN111858114B - Device starting exception handling and device starting control method, device and system

Info

Publication number: CN111858114B
Application number: CN201910365274.3A
Authority: CN
Inventors: 付颖芳; 肖鹏
Original assignee: Alibaba Group Holding Ltd
Current assignee: Alibaba Group Holding Ltd
Priority date: 2019-04-30
Filing date: 2019-04-30
Publication date: 2024-06-14
Anticipated expiration: 2039-04-30
Also published as: CN111858114A

Abstract

The invention discloses a device start exception handling method, device and system. Wherein the method comprises the following steps: detecting equipment starting abnormality in the trusted measurement process; identifying whether the device start-up anomaly is caused by a predetermined cause; and if the identification result is yes, controlling the equipment to process the equipment starting abnormality in a mode corresponding to the preset reason so as to ensure the system safety of the equipment and/or the normal processing of the equipment on the service.

Description

Device starting exception handling and device starting control method, device and system

Technical Field

The invention relates to the field of secure computing, in particular to a device start exception handling method, a device start control device and a system.

Background

With the popularity of computer applications, hardware attacks are becoming increasingly rampant, as are security (e.g., integrity assurance) of systems (alternatively referred to as platforms and systems). The measurement is a technical means for protecting the integrity of the platform and the system: at certain specific moments, the target is measured to obtain certain information (such as hash value of the file) of the target, and the value of the information is compared with a standard value recorded in advance, so that whether the integrity of the target is damaged or not is judged. Metrics are implemented based on trusted systems, and currently there are two main technologies involved in the trusted systems (or referred to as platforms and systems), namely, a trusted platform control module (Trusted Platform Control Module, abbreviated as TPCM) and a trusted platform module (Trusted Platform Module, abbreviated as TPM). However, in the process of executing platform and system integrity measurement calculation, when the abnormal starting of the equipment is found, the measures adopted by the two technologies are generally as follows: either the start is terminated or the alarm is authorized to enter the protected mode, but this process suffers from the following disadvantages: for example, when the anomaly is due to hacking, if a certain protection mode is started, sensitive data will be leaked; when the abnormality is caused by configuration, if the starting is forbidden, the abnormality can cause the processing of the influence business. Therefore, in the related art, in the trusted measurement process, there is a problem that abnormal starting of the device cannot be handled correspondingly, which results in that the system is not safe, and normal handling of the service is affected.

In view of the above problems, no effective solution has been proposed at present.

Disclosure of Invention

The embodiment of the invention provides a device starting exception handling method, a device starting control method, a device starting exception handling device and a device starting control system, which at least solve the technical problem that in the related technology, in the trusted measurement process, the abnormal starting of the device cannot be handled correspondingly, so that the system is unsafe or the normal handling of a service is affected.

According to an aspect of the embodiment of the present invention, there is provided a device start-up exception handling method, including: detecting equipment starting abnormality in the trusted measurement process; identifying whether the device start-up anomaly is caused by a predetermined cause; and under the condition that the identification result is yes, controlling the equipment to process the equipment starting abnormality in a mode corresponding to the preset reason so as to ensure the safety of a system where the equipment is located and/or the normal processing of the equipment on the service.

According to another aspect of the embodiment of the present invention, there is provided a device start control method, including: measuring equipment to be started to obtain a measurement result; verifying whether the measurement result is normal; under the condition that the verification result is that the measurement result is abnormal, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator; and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a system administrator, after the configuration of the system administrator is updated normally, controlling the equipment to start normally, otherwise, controlling the equipment to start or inhibit starting in an alarm protection mode.

According to still another aspect of the embodiment of the present invention, there is provided a device start control method, including: the trusted measurement main body measures the equipment to be started to obtain a measurement result; the trusted verification main body verifies whether the measurement result is normal or not; under the condition that the verification result is that the measurement result is abnormal, the trusted audit subject identifies whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator; and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a system administrator, the trusted control main body controls the equipment to start normally after the configuration of the system administrator is updated normally, otherwise, controls the equipment to start or inhibit starting in an alarm protection mode.

According to an aspect of an embodiment of the present invention, there is provided an apparatus for processing device startup exception, including: the detection module is used for detecting equipment starting abnormality in the trusted measurement process; a first identifying module for identifying whether the device start-up abnormality is caused by a predetermined cause; and the first control module is used for controlling the equipment to process the equipment starting abnormality in a mode corresponding to the preset reason under the condition that the identification result is yes so as to ensure the system safety of the equipment and/or the normal processing of the equipment on the service.

According to another aspect of an embodiment of the present invention, there is provided an apparatus start-up control device including: the measurement module is used for measuring the equipment to be started to obtain a measurement result; the verification module is used for verifying whether the measurement result is normal or not; the second identifying module is used for identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator or not under the condition that the verification result is that the measurement result is abnormal; and the second control module is used for controlling the equipment to start normally after the configuration of the system administrator is updated normally under the condition that the identification result is that the equipment starts abnormally and is caused by the configuration abnormality of the system administrator, otherwise controlling the equipment to start or inhibit starting in an alarm protection mode.

According to still another aspect of the embodiment of the present invention, there is provided a device start control system including: the system comprises a trusted measurement main body, a trusted verification main body, a trusted audit main body and a trusted control main body, wherein the trusted measurement main body is used for measuring equipment to be started to obtain a measurement result; the trusted verification body is used for verifying whether the measurement result is normal or not; the trusted audit body is used for identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator or not under the condition that the verification result of the trusted verification body is abnormal; the trusted control main body is used for controlling the equipment to start normally after the configuration of the system administrator is updated normally under the condition that the equipment start abnormality is caused by the configuration abnormality of the system administrator as the identification result of the trusted audit main body, otherwise, controlling the equipment to start or prohibit to start in an alarm protection mode.

According to an aspect of an embodiment of the present invention, there is provided a storage medium storing a program, wherein the program, when executed by a processor, causes the processor to perform the method of any one of the above.

According to an aspect of an embodiment of the present invention, there is provided a processor for running a program, where the program when run causes the processor to perform the method of any one of the above.

According to an aspect of an embodiment of the present invention, there is provided a computer apparatus including: a memory and a processor, the memory storing a computer program; the processor is configured to execute a computer program stored in the memory, where the computer program when executed causes the processor to perform the method of any one of the above.

In the embodiment of the invention, in the trusted measurement process, the equipment starting abnormality is detected; identifying whether the device start-up anomaly is caused by a predetermined cause; and under the condition that the identification result is yes, controlling the equipment to process the equipment starting abnormality in a mode corresponding to the preset reason so as to ensure the system safety of the equipment and/or the normal processing of the equipment to the service, thereby achieving the purpose of processing the equipment starting abnormality in a mode corresponding to the preset reason of the equipment starting abnormality under the condition of the equipment starting abnormality, further realizing the technical effects of ensuring the system safety of the equipment and/or the normal processing of the equipment to the service, and further solving the technical problems that in the related technology, in the trusted measurement process, the abnormal starting of the equipment cannot be correspondingly processed, or the system is unsafe, and then the normal processing of the service is influenced.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute a limitation on the application. In the drawings:

FIG. 1 is a schematic diagram of a TPM device initiating a trust chain in the related art;

FIG. 2 is a schematic diagram of a TPCM device initiating a chain of trust transfer in the related art;

FIG. 3 is a flowchart of a device-initiated exception handling method according to embodiment 1 of the present invention;

FIG. 4 is a flow chart of device-initiated exception handling provided in accordance with a preferred embodiment of the present invention;

fig. 5 is a flowchart of a device start-up control method according to embodiment 2 of the present invention;

FIG. 6 is a flow chart of a preferred device start-up control method according to embodiment 2 of the present invention;

Fig. 7 is a flowchart of a device abnormal start control method in accordance with a preferred embodiment of the present invention;

FIG. 8 is a block diagram showing the configuration of a device-initiated exception handling apparatus according to embodiment 3 of the present invention;

fig. 9 is a block diagram of the structure of the device start-up control apparatus according to embodiment 4 of the present invention;

Fig. 10 is a block diagram of the structure of a device start control system according to embodiment 5 of the present invention;

fig. 11 is a block diagram of the structure of a computer device according to embodiment 6 of the present invention.

Detailed Description

In order that those skilled in the art will better understand the present invention, a technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in which it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, shall fall within the scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the invention described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

First, partial terms or terminology appearing in the course of describing embodiments of the application are applicable to the following explanation:

Safety of the system: the security of the system is a broad understanding of an overall execution environment, and may be understood as the security of the platform and (specific) system, for example, may refer to a basic input/output system (Base Input Output System, abbreviated as BIOS) of a device, and hardware firmware, an operating system Loader (Operation System Loader, abbreviated as OS Loader), and other software and hardware platforms and systems are complete and legal. For specific description of the technical solution, the following embodiments take "platform and system" as examples to describe the system.

Trusted computing: trusted computing (Trusted Computing) is a widely used trusted computing platform in computing and communication systems supported by hardware-based security modules to improve the security of the system as a whole.

Trusted platform module (Trusted Platform Module, TPM)/trusted platform control module (Trusted Platform Control Module, TPCM) (TPM/TPCM): security chips that provide integrity and authenticity assurance for evidence are typically physically and strongly bound to computing platforms.

Confidence measures: at certain specific moments, the target is measured to obtain certain information (such as hash value of the file) of the target, and the value of the information is compared with a standard value recorded in advance, so that whether the integrity of the target is damaged or not is judged.

Metric computation a process of performing a metric operation (e.g., a hash operation) on a metric object.

And (3) firmware: refers to a program stored in hardware that cannot be easily modified, and also refers broadly to the underlying hardware in which some of the above programs reside.

Example 1

There are two main technologies related to a trusted system (or referred to as a platform and a system) in the related art, namely a trusted platform control module (Trusted Platform Control Module, abbreviated as TPCM) and a trusted platform module (Trusted Platform Module, abbreviated as TPM). TPM and TPCM initiation metric computation are described below, respectively.

(1) TPM-initiated metric computation

The trusted platform module (Trusted Platform Module, TPM) in the trusted computing group (Trusted Computer Group, abbreviated TCG) specification is the hardware root of trust of the trusted computing platform, and the TPM is a secure chip that provides protected secure storage, cryptographic computing capabilities. The TPM is physically connected to the computing platform and to the CPU via an external bus, for example, a PC platform is directly cured on the motherboard and connected via an LPC bus.

The TCG specification gives a definition of trusted: an entity is always operating in a predictable manner for a particular target. The core mechanism of the trusted computing is to construct a trusted computing environment through a trust chain mechanism, and whether the current running entity is trusted is based on whether the previous running process of the system is trusted or not. FIG. 1 is a schematic diagram of a TPM device start trust chain in the related art, as shown in FIG. 1, based on the trust relationship, if the system starts from an initial trust root, the trust can be maintained in a transitive manner at each transition of the platform computing environment, so that a first-level verification first-level trust chain is established on the computing platform, and the computing environment is always trusted, so that the computing environment can be trusted by a local user or a remote entity.

In the TCG specification, a measurement value PCRi of each item is stored in a storage, an extension value of the measurement value is stored in a TPM, PCRi new=hash (PCRi Old value to add).

(2) TPCM initiation metric computation

Fig. 2 is a schematic diagram of a related art TPCM device initiating trust chain delivery, and as shown in fig. 2, the flow of TPCM initiation metric calculation includes the following steps:

1) The TPCM is electrified, whether the self firmware of the TPCM is legal or not is self-checked, if the self firmware is legal, the step 2) is executed, otherwise, the power-off or the alarm is executed;

2) Verifying the BMC and the BIOS, if the verification is passed, the step 3) is performed, otherwise, the machine is turned off or an alarm is given;

3) Powering up the main board;

4) Verifying platform integrity; and 5) if the verification is passed, otherwise, shutting down or alarming.

5) Verifying an OS loader; step 6) if the verification is passed, otherwise, shutting down or alarming;

6) Verifying an OS Kernel, wherein the step 7) is performed when the OS Kernel passes the verification, and otherwise, shutting down or alarming;

7) Dynamic metric verification vTPCM;

8) Dynamic metrics verify the application system.

However, in the process of executing platform and system integrity measurement calculation, when the abnormal starting of the equipment is found, the measures adopted by the two technologies are generally as follows: either the start-up is terminated or the alarm grant enters a protected mode start-up. However, such a process may cause a problem that abnormal starting of the device cannot be handled correspondingly, resulting in an unsafe system, and thus normal handling of the service is affected. Because the cause of the start-up abnormality is not discriminated specifically, for example, whether it is an abnormal start-up caused by hacking or an abnormal start-up caused by incorrect configuration by a system administrator is not discriminated. This may lead to two types of problems: (1) The real reason of the abnormality can not be identified, if the abnormality is caused by a hacker, but the system administrator ignores the existence of the abnormality, if the normal starting of the authorization mode is performed, sensitive data is not protected, and if the authorization alarm or the protection mode is performed, the continuity of the service can not be ensured; (2) If the system administrator misjudges that the system administrator is a hacker, the device is prohibited from starting, and normal operation of the service is delayed.

Based on this, in the embodiment of the present application, a method embodiment of a device start exception handling method is provided, and the embodiment of the device start exception handling method provided in embodiment 1 of the present application may be executed in a mobile terminal, a computer terminal, or a similar metric calculation device. Fig. 3 is a flowchart of a device-initiated exception handling method according to embodiment 1 of the present application, as shown in fig. 3, the flowchart including the steps of:

step S302, detecting equipment starting abnormality in a trusted measurement process;

As an alternative embodiment, the execution subject may be a trusted audit subject for determining device start-up anomalies and identifying the cause of the device start-up anomalies. The trusted audit body can be an independent trusted audit body or a functional entity attached to other entity devices, and can be flexibly selected according to requirements.

As an alternative embodiment, in the trusted measurement process, when measuring the device, the measurement is performed on hardware and software of the device, and in the process of starting the device, if the measurement result shows abnormality, for example, the measurement result shows abnormality when the hardware and/or the software of the device is abnormal, the device can be considered to be abnormal in starting.

As an alternative embodiment, when detecting the device start-up abnormality, various detection manners may be adopted, for example, detection may be implemented by comparing, for example, when measuring the hardware of the device, if the measurement result is inconsistent with the predetermined measurement result, the measurement result of the hardware of the device is determined to be abnormal, so as to determine that the device start-up abnormality. The software of the device may also adopt the similar comparison detection mode, which is not described herein.

Step S304, identifying whether the equipment starting abnormality is caused by a preset reason;

As an alternative embodiment, the device start-up abnormality may be caused by a plurality of abnormality causes, and the characteristics represented by the plurality of abnormality causes may be different, so that when the cause of the device start-up abnormality is identified, which cause is caused may be determined according to the characteristics represented by the abnormality causes.

As an alternative embodiment, since the causes of the device start-up abnormality may include a plurality of causes, the cause of the abnormality may be checked from a certain cause, for example, whether the abnormality of the device is caused by a certain predetermined cause may be first identified based on some characteristics exhibited by the abnormality of the device. The predetermined cause may be a cause that is common or causes abnormal starting of the device, or a cause that is specific to a certain feature. The most probable cause is preferentially identified from among a plurality of causes of abnormality, and the speed and accuracy of identifying the cause of abnormality can be improved to some extent.

And step S306, if the identification result is yes, the control equipment processes the equipment starting abnormality in a mode corresponding to a preset reason so as to ensure the safety of a system where the equipment is located and/or the normal processing of the equipment on the service.

As an alternative embodiment, after determining the cause of the abnormal start of the device, the specific cause of the abnormality may be directly determined, and the abnormal start of the device may be processed in a manner corresponding to the specific cause of the abnormality. For example, it may be determined whether the abnormality cause allows the device to continue to boot, and if the device is allowed to continue to boot, a boot mode corresponding to the abnormality cause may be determined. No matter what processing mode is adopted to process the abnormal starting of the equipment, the safety of a system where the equipment is located and/or the normal processing of the equipment on the service are required to be ensured. It should be noted that, the security of the system includes that the hardware in the system is secure, the software of the system is also secure, and some data stored in the system is not leaked, etc. The ensuring that the device normally processes the service may also include various types, for example, ensuring continuity of the service, ensuring no delay to the service, and the like.

As an alternative embodiment, in the process of trusted measurement, device start-up anomalies are more commonly divided into two cases, one is that the device is hacked to the device start-up anomalies, and one is that a configuration anomaly of a system administrator causes the device start-up anomalies. When it is determined whether or not an abnormality in the start-up of the device is caused by a predetermined cause selected in the above embodiment, the two causes are as follows: hacking to device start-up abnormality and configuration abnormality of a system administrator to cause device start-up abnormality can be used as the above-indicated predetermined cause to preferentially determine whether it is the cause of device start-up abnormality.

As an alternative embodiment, explanation will be given taking as an example that the predetermined cause of the device start-up abnormality is a configuration abnormality of a system administrator. In the case where the predetermined cause is a configuration abnormality of a system administrator, when identifying whether or not a device start-up abnormality is caused by the predetermined cause, various means may be employed, for example, the following means may be employed: acquiring an operation behavior log of a system administrator; auditing whether the operation behaviors of a system administrator exist according to the operation behavior log; and in the event that the audit result is that there is no operational activity of the system administrator, determining that the device start-up anomaly is caused by other reasons than the predetermined reason. This mode will be described below.

As an alternative embodiment, various ways may be used in obtaining a log of the operation behavior of a system administrator. The system administrator logs the operation or configuration of the system with associated operational behavior and logs detailed operational details or configuration details. For example, when a system administrator updates or modifies a metric policy of a device, a corresponding operation behavior log records a specific updated version, a specific modified parameter, and the like. Therefore, the operation behavior log of the system administrator is important, so that in order to ensure the security of the operation behavior log in the system management, an authorized entity is required to save, check or call the operation behavior log.

As an alternative embodiment, when the operation behavior log of the system administrator is obtained, the obtaining of the operation behavior log of the system administrator may be implemented through a trusted module. For example, the acquisition of the operation behavior log of the system administrator may be implemented in the following manner: receiving an operation behavior log of a system administrator encrypted by a trusted module by adopting an encryption key of a public-private symmetric key; decrypting the encrypted operation behavior log of the system administrator by adopting a decryption key corresponding to the public and private symmetric key to obtain the operation behavior log of the system administrator. Before receiving the operation log of the system administrator encrypted by the trusted module by the encryption key of the public and private symmetric key, the system administrator can carry out mutual identity confirmation with the trusted module, and the operation log in the system management encrypted by the trusted module is allowed to be received under the condition that both sides confirm the trusted.

As an alternative embodiment, when the encryption key is used to encrypt the operation behavior log in the system management sent by the trusted module, multiple encryption manners may be adopted, where the encryption manner is mainly used to further ensure the security of transmission on the premise of ensuring that the trusted module is reliable as the provider of the operation behavior log of the system administrator. When the encryption mode is selected, in order to guarantee the reliability of transmission again, an encryption mode of public and private symmetric keys with higher confidentiality security level can be adopted, namely, the encryption key of the trusted module is symmetrical to the decryption key for decrypting the operation behavior log after receiving the operation behavior log in system management, so that the security of transmission is guaranteed to a higher degree.

As an alternative embodiment, when auditing whether there is an operation behavior of the system administrator according to the operation behavior log, since the operation behaviors in the system management may include a plurality of kinds, when auditing whether there is an operation behavior of the system administrator, it may be possible to separately audit whether there is a plurality of kinds of operation behaviors. For example, auditing whether there is an operational behaviour of a system administrator based on an operational behaviour log may include at least one of: auditing whether a system administrator has login behavior; whether the audit system administrator has configured behavior of the measurement strategy for the trusted measurement; whether the audit system administrator has configured behavior of the verification policy for the trusted metrics, and whether the audit system administrator has updated behavior of the firmware for the trusted metrics.

As an alternative embodiment, if the login behavior of the system administrator does not exist when the login behavior of the system administrator is audited, the operation behavior of the system administrator can be directly determined to be not exist; when the audit system administrator has the configuration behavior of the measurement strategy of the trusted measurement, the configuration record of the measurement strategy of the trusted measurement can be determined according to the presence or absence of the configuration record of the measurement strategy of the trusted measurement in the operation behavior log, and if the configuration record exists, the configuration behavior of the measurement strategy of the trusted measurement can be determined; when the audit system administrator has the configuration behavior of the verification strategy for the trusted measurement, the configuration record for configuring the verification strategy for the trusted measurement can be also existed in the operation behavior log, if the configuration record exists, the configuration behavior of the verification strategy for the trusted measurement can be determined; if the audit system administrator has updated behavior of the firmware with the trusted metric, it may determine that the update behavior of the firmware with the trusted metric has been performed according to whether an update record for updating the firmware with the trusted metric exists in the operation behavior log.

As an alternative embodiment, after auditing whether there is an operation action of the system administrator according to the operation action log, in a case where the auditing result is that there is no operation action of the system administrator, it is determined that the device start-up abnormality is caused by other reasons than the predetermined reasons. I.e. if the audit result indicates that there is no operational behaviour of the system administrator, it is directly possible to exclude that the device abnormal start is caused by the above-mentioned predetermined reasons, i.e. that the device abnormal start is caused by other reasons than the predetermined reasons.

As an alternative embodiment, after auditing whether the operation behavior of the system administrator exists according to the operation behavior log, if the identification result is that the operation behavior of the system administrator exists, the validity of the measured object in the trusted measurement process is audited; under the condition that the audit result is that the measured object is legal in the trusted measurement process, determining that the equipment starting abnormality is caused by a preset reason; and/or in the event that the audit result is that the measured object is not legal in the trusted measurement process, determining that the device start-up anomaly is caused by other reasons than the predetermined reason. When the validity of the measured object is audited in the trusted measurement process, specifically, whether the strategy and the firmware of the measured object are the same as those of the standby strategy and the firmware or not can be audited, and if the audit result is the same, the equipment starting abnormality is determined to be caused by a preset reason. For example, when the validity of the device is measured, whether the software and/or hardware of the device are identical to the pre-stored standby software and/or hardware can be audited, and if the auditing result is identical, the device starting abnormality is determined to be caused by the preset reason. Therefore, if the identification result is that the operation behavior of the system administrator exists, if the measured object is legal in the trusted measurement process, determining that the equipment starting abnormality is caused by the configuration abnormality of the system administrator; and in the case that the identification result is that the operation behavior of the system administrator exists, if the measured object is illegal in the trusted measurement process, it can be determined that the device starting abnormality is not caused by the configuration abnormality of the system administrator, namely, is determined to be caused by other abnormality reasons.

As an alternative embodiment, when the predetermined cause is a configuration abnormality of a system administrator, other causes other than the predetermined cause may include hacking. In the case where the device start-up abnormality is caused by a configuration abnormality of a system administrator, controlling the device to process the device start-up abnormality in a manner corresponding to a predetermined cause may include: after the abnormal configuration is modified to the normal configuration, the control device is started normally. In the case where the device initiation exception is caused by hacking, in this optional embodiment, it further includes: the control device processes the device start-up exception in a manner corresponding to hacking, wherein the control device processes the device start-up exception in a manner corresponding to hacking comprising: the control device starts or prohibits starting in the alarm protection mode.

Through the embodiment, in the trusted measurement process, the equipment starting abnormality is detected; identifying whether the device start-up anomaly is caused by a predetermined cause; if the identification result is yes, the control device processes the device starting abnormality in a mode corresponding to the preset reason so as to ensure the system safety where the device is located and/or the normal processing of the service by the device, thereby achieving the purpose of processing the device starting abnormality in a mode corresponding to the preset reason of the device starting abnormality under the condition of the device starting abnormality, further realizing the technical effects of ensuring the system safety where the device is located and/or the normal processing of the service by the device, and further solving the technical problems that in the related technology, in the trusted measurement process, the abnormal starting of the device cannot be correspondingly processed, and the normal processing of the service is affected because the system is not safe.

In this embodiment, a preferred embodiment of a method for processing device start-up exception is further provided, and it should be noted that in this preferred embodiment, it may be assumed that the system at least includes: trusted metrics principal, trusted verification principal, trusted auditing principal, trusted control principal, system administrator (it should be noted that these several principals may be done by different entities or undertaken by the same entity). Any operation behavior of the system administrator is recorded in the system log, for example, the latest strategy configuration or updated firmware is recorded and stored; the operation behavior log of the system administrator, the configured strategy and the updated firmware are all protected safely and accessed in an authorized manner.

In a preferred embodiment of the present invention, a method for identifying whether a device start-up exception is due to a hacker or a configuration exception of a system administrator is specifically provided, and fig. 4 is a flowchart of device start-up exception handling provided according to a preferred embodiment of the present invention, as shown in fig. 4, where the flowchart includes the following steps:

1. the starting abnormality is found in the starting process of the equipment;

2. The trusted audit body audits the operation behavior log of a system administrator;

3. The trusted audit subject audits whether the system administrator has operation, for example, the following method can be adopted:

a, mutual identity identification is carried out between a trusted audit main body and a trusted module (namely the TPM/TPCM);

b, if the mutual identification is passed, the trusted module signs the operation behavior log private key and encrypts the operation behavior log private key by using the trusted audit main body public key, and feeds back the operation behavior log private key to the trusted audit main body, otherwise, the communication is terminated;

c, decrypting the encrypted operation behavior log by the trusted audit body, wherein the signing operation behavior log is really from the trusted module;

d. Audit is no corresponding operational behavior, such as whether recent system administrators have logged in? Is there a measure policy, check policy's configuration behavior? Is there firmware update behavior? And the like (note: the operation behavior audit does not limit the method), if not, the step 6 is entered, and if not, the step 4 is entered.

4. The trusted audit body audits the strategy and firmware legitimacy of the measured object;

5. discriminating whether the audit is legal? The auditing may be by the following method: if the strategy and firmware of the measured object are the same as those of the standby strategy and firmware, the step 7 is entered, otherwise, the step 6 is entered;

6. Hacking is the mechanism;

7. the system administrator.

In the preferred embodiment, the operation behavior of the system administrator is audited by introducing the trusted audit body to identify whether the equipment starting abnormality is caused by a hacker or a configuration abnormality from the system administrator, so that the specific reason of the equipment starting abnormality can be determined, a processing mode corresponding to the specific reason can be provided for the equipment, and the equipment starting abnormality is processed.

Example 2

In accordance with an embodiment of the present invention, there is also provided a method embodiment of a device start control method, it being noted that the steps shown in the flowchart of the figures may be performed in a computer system, such as a set of computer executable instructions, and that, although a logical sequence is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than what is shown or described herein.

The method embodiment provided in embodiment 2 of the present application may be executed in a mobile terminal, a computer terminal or a similar trusted computing device. Fig. 5 is a flowchart of a device start-up control method according to embodiment 2 of the present application, as shown in fig. 5, the flowchart including the steps of:

step S502, measuring equipment to be started to obtain a measurement result;

As an alternative embodiment, the main body for performing the above steps may be a computer terminal, for example, a smart phone, a mobile phone, a tablet computer, a notebook computer, a smart watch, or the like. The execution body of the above steps may be a separate chip for executing the trusted measurement, or may be a network device such as a server for executing the trusted measurement function.

As an alternative embodiment, when measuring the device to be started, the hardware and/or software of the device to be started may be measured, and the hardware of the device may include physical firmware of the device, for example, may be a display card, a memory, a processor, and the like; the software of the device may include system software of the device and application software of the device, for example, the system software may be software when the system is running, and the application software may be corresponding software when the device uses some applications. Thus, measuring the device may obtain the measurement results of the above-included aspects.

Step S504, verifying whether the measurement result is normal;

as an alternative embodiment, since the measurement result obtained by measuring the device may have multiple measurement results, when verifying whether the measurement result of the device is normal, if there is some aspect of abnormal measurement result in the multiple measurement results, it may be determined that the measurement result of the device is abnormal. Only if the measurement results of all aspects of the device are normal, confirming that the measurement results of the device are normal.

Step S506, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator or not under the condition that the verification result is that the measurement result is abnormal;

As an alternative embodiment, in the case that the verification result is that the measurement result is abnormal, the cause of the device start-up abnormality is identified, for example, whether the device start-up abnormality is caused by a configuration abnormality of a system administrator is identified. Because the configuration abnormality of the administrator is more common and easier to find than other complicated abnormalities, whether the configuration abnormality is caused by the configuration abnormality of the system administrator is preferentially eliminated or confirmed, the identification efficiency can be improved to a certain extent, and effective control over equipment starting is realized.

In step S508, when the identification result is that the device start abnormality is caused by the configuration abnormality of the system administrator, after the configuration update of the system administrator is normal, the control device starts normally, otherwise, the control device starts or prohibits starting in the alarm protection mode.

As an alternative embodiment, in the case that the device start abnormality is caused by the configuration abnormality of the system administrator as a result of the identification, a notification may be sent to the system administrator to notify the system administrator to reconfigure, so that after the configuration is normal, the control device is started normally. When a notification is sent to a system administrator to reconfigure, an account and a password logged in by the system administrator can be set before the system administrator performs reconfiguration, and when the input account and password are correct, the identity in the system management is determined to be legal, so that the system administrator is allowed to reconfigure. By setting an account and a password mode, the identity of a system administrator is verified, and the safety of configuration on equipment is improved to a certain extent.

As an alternative embodiment, the control device starts or prohibits starting in the alarm protection mode in case the recognition result is not that the device start abnormality is caused by a configuration abnormality of the system administrator. It should be noted that, the start-up in the alarm protection mode may be to notify the system administrator in an alarm manner, and then start up in the protection mode. The protection mode is an untrusted mode environment, but protects sensitive data, such as by encrypting the sensitive data to start the device.

As an alternative embodiment, the identification of whether the device start-up exception is caused by a configuration exception of a system administrator may be performed in a variety of ways, for example, the following ways may be used to identify: firstly, calling an operation behavior log of a system administrator through a trusted module; then, according to the operation behavior log, whether the equipment starting abnormality is caused by the configuration abnormality of the system administrator or not is identified.

As an alternative embodiment, when the trusted module calls the operation behavior log of the system administrator, the operation behavior log of the calling system administrator is sent to the trusted module, the trusted module can encrypt the operation behavior log of the system administrator by adopting the encryption key of the public and private symmetric key to obtain the encrypted operation behavior log of the system administrator, and then the trusted module transmits the encrypted operation behavior log of the system administrator to the calling requester. Before the trusted module transmits the encrypted operation behavior log of the system administrator to the call requester, the trusted module and the call requester can perform mutual identity confirmation, and communicate after the identity confirmation to transmit the operation behavior log in system management. After the call requester receives the encrypted operation behavior log of the system administrator, the encrypted operation behavior log is decrypted by adopting a decryption key corresponding to the encryption key of the public and private symmetric key, so that the required operation behavior log is obtained. And the encryption and decryption modes are adopted for transmission, and the transmission safety is further ensured on the premise of protecting the reliability of the operation behavior log.

As an alternative embodiment, when the device start-up abnormality is caused by the configuration abnormality of the system administrator according to the operation behavior log, since the operation behavior log may include a plurality of operation behaviors of the system administrator, when the device start-up abnormality is caused by the configuration abnormality of the system administrator, the device start-up abnormality may be identified according to whether the operation behaviors of the system administrator exist in the operation behavior log, for example, whether the operation behaviors are respectively included in the operation behavior log may be respectively identified according to whether the operation behaviors are respectively included in the operation behavior log. For example, identifying from the operational behavior log whether the device start-up exception is caused by a configuration exception of a system administrator may include at least one of: identifying whether a system administrator has login behavior according to the operation behavior log, and determining that the system administrator is caused by abnormal configuration when the identification result is that the system administrator has login behavior; identifying whether the system administrator has the configuration behavior of the measurement strategy of the trusted measurement according to the operation behavior log, and determining that the configuration abnormality of the system administrator is caused when the identification result is that the system administrator has the configuration behavior of the measurement strategy of the trusted measurement; identifying whether a system administrator has the configuration behavior of the verification strategy for the trusted measurement according to the operation behavior log, and determining that the configuration abnormality of the system administrator is caused when the identification result is the configuration behavior of the verification strategy for the trusted measurement; and identifying whether the system administrator has the updating behavior of the firmware with the trusted measurement according to the operation behavior log, and determining that the system administrator is caused by the configuration abnormality when the identification result is that the firmware with the trusted measurement has the updating behavior.

As an alternative embodiment, after identifying whether the device start-up exception is caused by a configuration exception of a system administrator, further comprising: and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a non-system administrator, determining that the equipment starting abnormality is caused by hacking, and controlling the equipment to start or prohibit to start in an alarm protection mode.

In this embodiment, there is also provided a preferred device start-up control method, and fig. 6 is a flowchart of a preferred device start-up control method according to embodiment 2 of the present invention, as shown in fig. 6, the flowchart including the steps of:

step S602, the trusted measurement main body measures the equipment to be started to obtain a measurement result;

step S604, the trusted verification main body verifies whether the measurement result is normal;

step S606, if the verification result is that the measurement result is abnormal, the trusted audit body identifies whether the equipment starting abnormality is caused by the configuration abnormality of the system administrator;

in step S608, when the identification result is that the device start abnormality is caused by the configuration abnormality of the system administrator, the trusted control body controls the device to start normally after the configuration of the system administrator is updated normally, otherwise, the control device starts or prohibits starting in the alarm protection mode.

As an alternative embodiment, the trusted measurement body, the trusted verification body, the trusted audit body and the trusted control body may exist in different hardware or software entities separately, and of course, at least two of the trusted measurement body, the trusted verification body, the trusted audit body and the trusted control body are integrated in one entity, that is, the entities may exist separately or exist in an integrated form, and the specific existing form is not limited.

By means of the embodiment and the preferred embodiment, if the verification result is that the measurement result is abnormal, whether the equipment starting abnormality is caused by the configuration abnormality of the system administrator is identified, and if the verification result is that the equipment starting abnormality is caused by the configuration abnormality of the system administrator, after the configuration of the system administrator is updated normally, the equipment is controlled to start normally, otherwise, the equipment is controlled to start or prohibit to start in an alarm protection mode, the purpose that the equipment starting abnormality can be processed in a mode corresponding to the equipment starting abnormality is achieved under the condition that the equipment starting abnormality, and therefore the technical effects of ensuring the system safety of the equipment and/or the normal processing of the equipment to the service are achieved, and further the technical problems that in the related technology, in the trusted measurement process, the equipment starting abnormality cannot be correspondingly processed, so that the system is not safe or the normal processing of the service is affected are solved.

In a preferred embodiment of the present invention, there is also provided an abnormal start-up control method of an apparatus, fig. 7 is a flowchart of the abnormal start-up control method of an apparatus according to the preferred embodiment of the present invention, as shown in fig. 7, the flowchart including the steps of:

1. starting equipment;

2. Self-checking a trusted module firmware;

3. is the trusted module self-checked through? Step 4, if yes, otherwise, step 12;

4. a trusted metrics body (e.g., a trusted module or CPU) metrics the object being measured (e.g., software and/or hardware of the device, etc.);

5. Is the trusted verification principal verifying that the device metric is normal? If so, executing the step 11), otherwise executing the step 6);

6. the trusted audit body calls a trusted module to audit an operation behavior log of an administrator;

7. identify if the abnormal start is the administrator? If not, executing the step 12), otherwise executing the step 8);

8. The trusted control main body alarms to inform an administrator of reconfiguration;

9. The administrator inputs the authorization password, if not, executing the step 12), otherwise executing the step 10);

10. An administrator reconfigures the metrology strategy or updates the firmware of the object being measured;

11. the trusted control body allows the device to start up normally;

12. the trusted control main body alarms, and the equipment alarm protection mode starts or prohibits equipment starting.

In the device abnormal start-up identification method and the device abnormal start-up control method provided in the above preferred embodiments, by introducing the operation line of the system administrator of the trusted audit subject, whether the device start-up abnormality is caused by a configuration abnormality from a hacker or from the system administrator is identified; and then, according to the abnormal starting identification result obtained by the trusted audit main body, the trusted control main body controls the equipment to enter a corresponding starting mode: if the abnormal starting of the equipment is not what the hacker does, the equipment is started normally to ensure the continuity of the service; if the abnormal starting of the equipment is the result of a hacker, the equipment starts or prohibits starting in an alarm data protection mode so as to avoid sensitive information leakage.

It should be noted that, for simplicity of description, the foregoing method embodiments are all described as a series of acts, but it should be understood by those skilled in the art that the present invention is not limited by the order of acts described, as some steps may be performed in other orders or concurrently in accordance with the present invention. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily required for the present invention.

From the description of the above embodiments, it will be clear to a person skilled in the art that the method according to the above embodiments may be implemented by means of software plus the necessary general hardware platform, but of course also by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising several instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method of the various embodiments of the present invention.

Example 3

According to an embodiment of the present invention, there is also provided an apparatus for processing an apparatus start-up abnormality for implementing the apparatus start-up abnormality processing method of embodiment 1 described above, fig. 8 is a block diagram of an apparatus start-up abnormality processing apparatus according to embodiment 3 of the present invention, as shown in fig. 8, including: the detection module 82, the first identification module 84, and the first control module 86 will be described below as the device start-up abnormality processing apparatus.

A detection module 82, configured to detect a device start-up anomaly in the trusted measurement process; a first identifying module 84, connected to the detecting module 82, for identifying whether the device start-up abnormality is caused by a predetermined cause; the first control module 86 is connected to the first identification module 84, and is configured to control the device to process the device start exception in a manner corresponding to a predetermined cause, so as to ensure the security of the system in which the device is located and/or normal processing of the service by the device, if the identification result is yes.

It should be noted that the detection module 82, the first identification module 84 and the first control module 86 correspond to steps S302 to S306 in the above embodiment 1, and the modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to those disclosed in the above embodiment 1. It should be noted that the above modules may be run in a computer terminal as part of the apparatus.

Example 4

According to an embodiment of the present invention, there is also provided an apparatus start-up control device for implementing an apparatus start-up control method of embodiment 2 described above, fig. 9 is a block diagram of an apparatus start-up control device according to embodiment 4 of the present invention, as shown in fig. 9, including: the measurement module 92, the verification module 94, the second identification module 96 and the second control module 98, the device start control means will be described below.

A measurement module 92, configured to measure a device to be started, and obtain a measurement result; a verification module 94, connected to the measurement module 92, for verifying whether the measurement result is normal; a second identifying module 96, connected to the verifying module 94, for identifying whether the device start-up abnormality is caused by the configuration abnormality of the system administrator when the verification result is that the measurement result is abnormal; the second control module 98 is connected to the second identification module 96, and is configured to control the device to start normally after the configuration of the system administrator is updated normally when the identification result indicates that the device starts abnormally to be caused by the configuration abnormality of the system administrator, or to control the device to start or prohibit the device from starting in the alarm protection mode.

It should be noted that the above-mentioned measurement module 92, verification module 94, second identification module 96 and second control module 98 correspond to steps S502 to S508 in embodiment 2, and the modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to those disclosed in embodiment 2. It should be noted that the above modules may be run in a computer terminal as part of the apparatus.

Example 5

According to an embodiment of the present invention, there is also provided an apparatus start control system for implementing an apparatus start control method of the above embodiment 2, fig. 10 is a block diagram of an apparatus start control system according to embodiment 5 of the present invention, as shown in fig. 10, the apparatus start control system including: the trusted metrics entity 102, the trusted verification entity 104, the trusted audit entity 106, and the trusted control entity 108, the device boot control system is described below.

A trusted measurement body 102, configured to measure a device to be started, and obtain a measurement result; a trusted verification body 104, connected to the trusted measurement body 102, for verifying whether the measurement result is normal; a trusted audit body 106, connected to the trusted verification body 104, and configured to identify whether the device startup exception is caused by a configuration exception of a system administrator when a verification result of the trusted verification body is an abnormal measurement result; the trusted control main body 108 is connected to the trusted audit main body 106, and is used for controlling the equipment to start normally after the configuration of the system administrator is updated normally under the condition that the identification result of the trusted audit main body is that the equipment starts abnormally and is caused by the configuration abnormality of the system administrator, otherwise, the control equipment starts or prohibits starting in an alarm protection mode.

It should be noted that the trusted metrics body 102, the trusted verification body 104, the trusted audit body 106 and the trusted control body 108 correspond to steps S602 to S608 in embodiment 2, and the modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to those disclosed in embodiment 2. It should be noted that the above modules may be run in a computer terminal as part of the apparatus.

Example 6

An embodiment of the present invention may provide a computer apparatus, fig. 11 is a block diagram of a structure of a computer apparatus according to embodiment 6 of the present invention, and as shown in fig. 11, the computer apparatus 110 includes: a memory 112 and a processor 114, the memory storing a computer program; a processor for executing a computer program stored in the memory, the computer program executing the method of any one of the above when running.

The memory may be used to store software programs and modules, such as program instructions/modules corresponding to the security hole detection method and apparatus in the embodiments of the present invention, and the processor executes the software programs and modules stored in the memory, thereby executing various functional applications and data processing, that is, implementing the data security processing method described above. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory may further include memory remotely located with respect to the processor, the remote memory being connectable to the computer terminal or the network device through a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

In an alternative embodiment, the processor may call the information stored in the memory and the application program through the transmission device to execute the program code of the following steps: detecting equipment starting abnormality in the trusted measurement process; identifying whether the device start-up anomaly is caused by a predetermined cause; and under the condition that the identification result is yes, the control equipment processes the equipment starting abnormality in a mode corresponding to a preset reason so as to ensure the safety of a system where the equipment is positioned and/or the normal processing of the equipment on the service.

Optionally, the above processor may further execute program code for: in the case where the predetermined cause is a configuration abnormality of a system administrator, identifying whether or not the device start-up abnormality is caused by the predetermined cause includes: acquiring an operation behavior log of a system administrator; auditing whether the operation behaviors of a system administrator exist according to the operation behavior log; in the event that the audit result is that there is no operational activity by the system administrator, it is determined that the device start-up anomaly is caused by another cause other than the predetermined cause.

Optionally, the above processor may further execute program code for: under the condition that an auditing result is that the operation behavior of a system administrator exists, auditing the validity of the measured object in the trusted measurement process; under the condition that the audit result is that the measured object is legal in the trusted measurement process, determining that the equipment starting abnormality is caused by a preset reason; and/or in the event that the audit result is that the measured object is not legal in the trusted measurement process, determining that the device start-up anomaly is caused by other reasons than the predetermined reason.

Optionally, the above processor may further execute program code for: the obtaining the operation behavior log of the system administrator comprises the following steps: receiving an operation behavior log of a system administrator encrypted by a trusted module by adopting an encryption key of a public-private symmetric key; decrypting the encrypted operation behavior log of the system administrator by adopting a decryption key corresponding to the public and private symmetric key to obtain the operation behavior log of the system administrator.

Optionally, the above processor may further execute program code for: auditing whether the operation behaviors of the system administrator exist according to the operation behavior log comprises at least one of the following steps: auditing whether a system administrator has login behavior; whether the audit system administrator has configured behavior of the measurement strategy for the trusted measurement; whether the audit system administrator has configured behavior of the verification policy for the trusted metrics, and whether the audit system administrator has updated behavior of the firmware for the trusted metrics.

Optionally, the above processor may further execute program code for: other reasons for non-predetermined reasons include hacking.

Optionally, the above processor may further execute program code for: the controlling of the device to handle the device start-up abnormality in a manner corresponding to the predetermined cause includes: after the abnormal configuration is modified to the normal configuration, the control device is started normally.

Optionally, the above processor may further execute program code for: the control device processes the device start-up exception in a manner corresponding to hacking, wherein the control device processes the device start-up exception in a manner corresponding to hacking comprising: the control device starts or prohibits starting in the alarm protection mode.

In another alternative embodiment, the processor may call the information stored in the memory and the application program through the transmission means to execute the program code of the following steps: measuring equipment to be started to obtain a measurement result; verifying whether the measurement result is normal; under the condition that the verification result is that the measurement result is abnormal, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator; and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of the system administrator, after the configuration update of the system administrator is normal, the control equipment is started normally, otherwise, the control equipment is started or prohibited from being started in an alarm protection mode.

Optionally, the above processor may further execute program code for: identifying whether the device start-up exception is caused by a configuration exception of a system administrator includes: calling an operation behavior log of a system administrator through a trusted module; based on the log of operational behavior, it is identified whether the device start-up anomaly is caused by a configuration anomaly of a system administrator.

Optionally, the above processor may further execute program code for: and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a non-system administrator, determining that the equipment starting abnormality is caused by hacking, and controlling the equipment to start or prohibit to start in an alarm protection mode.

In yet another alternative embodiment, the processor may call the information stored in the memory and the application program through the transmission device to execute the program code of the following steps: the trusted measurement main body measures the equipment to be started to obtain a measurement result; the trusted verification main body verifies whether the measurement result is normal; under the condition that the verification result is that the measurement result is abnormal, the trusted audit subject identifies whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator; and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of the system administrator, the trusted control main body controls the equipment to start normally after the configuration of the system administrator is updated normally, otherwise, the control equipment starts or prohibits starting in an alarm protection mode.

Optionally, the above processor may further execute program code for: at least one of the trusted metrics body, the trusted verification body, the trusted audit body, and the trusted control body are integrated into one entity.

By the computer equipment, the purpose of processing the equipment starting abnormality in a mode corresponding to the equipment starting abnormality is achieved under the condition of the equipment starting abnormality, so that the technical effects of ensuring the system safety of the equipment and/or normally processing the service by the equipment are achieved, and the technical problems that in the related technology, in the trusted measurement process, the abnormal starting of the equipment cannot be correspondingly processed, the system is unsafe or the normal processing of the service is influenced are solved.

Example 7

The embodiment of the invention also provides a storage medium. Alternatively, in the present embodiment, the above-described storage medium may be used to store the program code executed by the methods provided in the above-described embodiments 1 and 2.

Alternatively, in this embodiment, the storage medium may be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

Optionally, in one implementation of the present embodiment, the storage medium is configured to store program code for performing the steps of: detecting equipment starting abnormality in the trusted measurement process; identifying whether the device start-up anomaly is caused by a predetermined cause; and under the condition that the identification result is yes, the control equipment processes the equipment starting abnormality in a mode corresponding to a preset reason so as to ensure the safety of a system where the equipment is positioned and/or the normal processing of the equipment on the service.

Optionally, the storage medium is further arranged to store program code for performing the steps of: in the case where the predetermined cause is a configuration abnormality of a system administrator, identifying whether or not the device start-up abnormality is caused by the predetermined cause includes: acquiring an operation behavior log of a system administrator; auditing whether the operation behaviors of a system administrator exist according to the operation behavior log; in the event that the audit result is that there is no operational activity by the system administrator, it is determined that the device start-up anomaly is caused by another cause other than the predetermined cause.

Optionally, the storage medium is further arranged to store program code for performing the steps of: under the condition that an auditing result is that the operation behavior of a system administrator exists, auditing the validity of the measured object in the trusted measurement process; under the condition that the audit result is that the measured object is legal in the trusted measurement process, determining that the equipment starting abnormality is caused by a preset reason; and/or in the event that the audit result is that the measured object is not legal in the trusted measurement process, determining that the device start-up anomaly is caused by other reasons than the predetermined reason.

Optionally, the storage medium is further arranged to store program code for performing the steps of: the obtaining the operation behavior log of the system administrator comprises the following steps: receiving an operation behavior log of a system administrator encrypted by a trusted module by adopting an encryption key of a public-private symmetric key; decrypting the encrypted operation behavior log of the system administrator by adopting a decryption key corresponding to the public and private symmetric key to obtain the operation behavior log of the system administrator.

Optionally, the storage medium is further arranged to store program code for performing the steps of: auditing whether the operation behaviors of the system administrator exist according to the operation behavior log comprises at least one of the following steps: auditing whether a system administrator has login behavior; whether the audit system administrator has configured behavior of the measurement strategy for the trusted measurement; whether the audit system administrator has configured behavior of the verification policy for the trusted metrics, and whether the audit system administrator has updated behavior of the firmware for the trusted metrics.

Optionally, the storage medium is further arranged to store program code for performing the steps of: other reasons for non-predetermined reasons include hacking.

Optionally, the storage medium is further arranged to store program code for performing the steps of: the controlling of the device to handle the device start-up abnormality in a manner corresponding to the predetermined cause includes: after the abnormal configuration is modified to the normal configuration, the control device is started normally.

Optionally, the storage medium is further arranged to store program code for performing the steps of: the control device processes the device start-up exception in a manner corresponding to hacking, wherein the control device processes the device start-up exception in a manner corresponding to hacking comprising: the control device starts or prohibits starting in the alarm protection mode.

Optionally, in another implementation of the present embodiment, the storage medium is configured to store program code for performing the steps of: measuring equipment to be started to obtain a measurement result; verifying whether the measurement result is normal; under the condition that the verification result is that the measurement result is abnormal, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator; and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of the system administrator, after the configuration update of the system administrator is normal, the control equipment is started normally, otherwise, the control equipment is started or prohibited from being started in an alarm protection mode.

Optionally, the storage medium is further arranged to store program code for performing the steps of: identifying whether the device start-up exception is caused by a configuration exception of a system administrator includes: calling an operation behavior log of a system administrator through a trusted module; based on the log of operational behavior, it is identified whether the device start-up anomaly is caused by a configuration anomaly of a system administrator.

Optionally, the storage medium is further arranged to store program code for performing the steps of: and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a non-system administrator, determining that the equipment starting abnormality is caused by hacking, and controlling the equipment to start or prohibit to start in an alarm protection mode.

Optionally, in another implementation of the present embodiment, the storage medium is configured to store program code for performing the steps of: the trusted measurement main body measures the equipment to be started to obtain a measurement result; the trusted verification main body verifies whether the measurement result is normal; under the condition that the verification result is that the measurement result is abnormal, the trusted audit subject identifies whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator; and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of the system administrator, the trusted control main body controls the equipment to start normally after the configuration of the system administrator is updated normally, otherwise, the control equipment starts or prohibits starting in an alarm protection mode.

Optionally, the storage medium is further arranged to store program code for performing the steps of: at least one of the trusted metrics body, the trusted verification body, the trusted audit body, and the trusted control body are integrated into one entity.

The foregoing embodiment numbers of the present invention are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

In the foregoing embodiments of the present invention, the descriptions of the embodiments are emphasized, and for a portion of this disclosure that is not described in detail in this embodiment, reference is made to the related descriptions of other embodiments.

In the several embodiments provided in the present application, it should be understood that the disclosed technology may be implemented in other manners. The above-described embodiments of the apparatus are merely exemplary, and are merely a logical functional division, and there may be other manners of dividing the apparatus in actual implementation, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some interfaces, units or modules, or may be in electrical or other forms.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied essentially or in part or all of the technical solution or in part in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a usb disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely a preferred embodiment of the present invention and it should be noted that modifications and adaptations to those skilled in the art may be made without departing from the principles of the present invention, which are intended to be comprehended within the scope of the present invention.

Claims

1. A device start-up exception handling method, comprising:

Detecting equipment starting abnormality in the trusted measurement process;

Identifying whether the device start-up anomaly is caused by a predetermined cause;

If the identification result is yes, controlling the equipment to process equipment starting abnormality in a mode corresponding to the preset reason so as to ensure the system safety of the equipment and the normal processing of the equipment on the service;

Wherein, in the case where the predetermined cause is a configuration abnormality of a system administrator, identifying whether or not a device start-up abnormality is caused by the predetermined cause includes: acquiring an operation behavior log of a system administrator; auditing whether the operation behaviors of the system administrator exist according to the operation behavior log; in the event that the audit result is that there is no operational behaviour of the system administrator, determining that the device start-up anomaly is caused by a reason other than the predetermined reason;

wherein the method further comprises: under the condition that an auditing result is that the operation behavior of the system administrator exists, auditing the validity of the measured object in the trusted measurement process; under the condition that the audit result is that the measured object is legal in the trusted measurement process, determining that the equipment starting abnormality is caused by the preset reason; in the case that the audit result is that the measured object is illegal in the trusted measurement process, determining that the equipment starting abnormality is caused by other reasons than the preset reasons;

Wherein other reasons than the predetermined reasons include hacking;

wherein controlling the device to process the device start-up exception in a manner corresponding to the predetermined cause includes: after the abnormal configuration is modified into the normal configuration, controlling the equipment to start normally;

Wherein the method further comprises: controlling the device to process the device start exception in a manner corresponding to hacking, wherein controlling the device to process the device start exception in a manner corresponding to hacking includes: and controlling the equipment to start or inhibit starting in an alarm protection mode.

2. The method of claim 1, wherein obtaining the system administrator's operational behavior log comprises:

Receiving an operation behavior log of the system administrator after the trusted module is encrypted by an encryption key of a public-private symmetric key;

and decrypting the encrypted operation behavior log of the system administrator by adopting a decryption key corresponding to the public and private symmetric key to obtain the operation behavior log of the system administrator.

3. The method of claim 1, wherein auditing whether the system administrator's operational behavior exists based on the operational behavior log comprises at least one of:

Auditing whether the system administrator has login behavior; auditing whether the system administrator has configuration behaviors of the measurement strategy of the trusted measurement; auditing whether the system administrator has the configuration behavior of the verification policy of the trusted metric, and auditing whether the system administrator has the updating behavior of the firmware of the trusted metric.

4. A device start-up control method, characterized by comprising:

measuring equipment to be started to obtain a measurement result;

verifying whether the measurement result is normal;

under the condition that the verification result is that the measurement result is abnormal, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator;

When the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a system administrator, after the configuration of the system administrator is updated normally, controlling the equipment to start normally, otherwise, controlling the equipment to start or inhibit starting in an alarm protection mode;

wherein identifying whether the device start-up exception is caused by a configuration exception of a system administrator comprises: invoking an operation behavior log of the system administrator through a trusted module; according to the operation behavior log, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator;

wherein the method further comprises: and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a non-system administrator, determining that the equipment starting abnormality is caused by hacking, and controlling the equipment to start or prohibit to start in an alarm protection mode.

5. A device start-up control method, characterized by comprising:

the trusted measurement main body measures the equipment to be started to obtain a measurement result;

The trusted verification main body verifies whether the measurement result is normal or not;

Under the condition that the verification result is that the measurement result is abnormal, the trusted audit subject identifies whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator;

Under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a system administrator, the trusted control main body controls the equipment to start normally after the configuration of the system administrator is updated normally, otherwise controls the equipment to start or inhibit starting in an alarm protection mode;

Wherein the method further comprises: and under the condition that the identification result of the trusted audit body is that the equipment starting abnormality is caused by the configuration abnormality of a non-system administrator, the trusted audit body determines that the equipment starting abnormality is caused by hacking, and the trusted control body controls the equipment to be started or prohibited from being started in an alarm protection mode.

6. The method of claim 5, wherein at least one of the trusted metrics entity, the trusted verification entity, the trusted audit entity, and the trusted control entity are integrated into one entity.

7. A device start-up exception handling apparatus, comprising:

The detection module is used for detecting equipment starting abnormality in the trusted measurement process;

A first identifying module for identifying whether the device start-up abnormality is caused by a predetermined cause;

The first control module is used for controlling the equipment to process equipment starting abnormality in a mode corresponding to the preset reason under the condition that the identification result is yes so as to ensure that the system where the equipment is located is safe for normal processing of the equipment on the service;

Wherein the first identifying module is configured to identify, in a case where the predetermined cause is a configuration abnormality of a system administrator, whether a device start abnormality is caused by the predetermined cause, including: acquiring an operation behavior log of a system administrator; auditing whether the operation behaviors of the system administrator exist according to the operation behavior log; in the event that the audit result is that there is no operational behaviour of the system administrator, determining that the device start-up anomaly is caused by a reason other than the predetermined reason;

Wherein, the first identification module is further configured to: under the condition that an auditing result is that the operation behavior of the system administrator exists, auditing the validity of the measured object in the trusted measurement process; under the condition that the audit result is that the measured object is legal in the trusted measurement process, determining that the equipment starting abnormality is caused by the preset reason; in the case that the audit result is that the measured object is illegal in the trusted measurement process, determining that the equipment starting abnormality is caused by other reasons than the preset reasons;

Wherein other reasons than the predetermined reasons include hacking;

Wherein the device is further for: controlling the device to process the device start exception in a manner corresponding to hacking, wherein controlling the device to process the device start exception in a manner corresponding to hacking includes: and controlling the equipment to start or inhibit starting in an alarm protection mode.

8. A device start-up control apparatus, characterized by comprising:

The measurement module is used for measuring the equipment to be started to obtain a measurement result;

The verification module is used for verifying whether the measurement result is normal or not;

The second identifying module is used for identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator or not under the condition that the verification result is that the measurement result is abnormal;

The second control module is used for controlling the equipment to start normally after the configuration of the system administrator is updated normally under the condition that the identification result is that the equipment starts abnormally and is caused by the configuration abnormality of the system administrator, otherwise controlling the equipment to start or inhibit starting in an alarm protection mode;

Wherein the second identification module is further configured to: invoking an operation behavior log of the system administrator through a trusted module; according to the operation behavior log, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator;

Wherein the device is further for: and under the condition that the identification result is that the equipment starting abnormality is caused by the configuration abnormality of a non-system administrator, determining that the equipment starting abnormality is caused by hacking, and controlling the equipment to start or prohibit to start in an alarm protection mode.

9. A device start-up control system, comprising: a trusted metrics body, a trusted verification body, a trusted auditing body, and a trusted control body, wherein,

The trusted measurement main body is used for measuring equipment to be started to obtain measurement results;

The trusted verification body is used for verifying whether the measurement result is normal or not;

The trusted audit body is used for identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator or not under the condition that the verification result of the trusted verification body is abnormal;

The trusted control main body is configured to control the device to start normally after the configuration of the system administrator is updated normally when the identification result of the trusted audit main body is that the device starts abnormally and is caused by the configuration abnormality of the system administrator, otherwise control the device to start or prohibit to start in an alarm protection mode

Wherein the trusted audit body is further to: invoking an operation behavior log of the system administrator through a trusted module; according to the operation behavior log, identifying whether the equipment starting abnormality is caused by the configuration abnormality of a system administrator;

under the condition that the identification result of the trusted audit body is that the equipment starting abnormality is caused by the configuration abnormality of a non-system administrator, the trusted audit body determines that the equipment starting abnormality is caused by hacking, and the trusted control body controls the equipment to be started or prohibited from being started in an alarm protection mode.

10. A storage medium storing a program, wherein the program, when executed by a processor, causes the processor to perform the method of any one of claims 1 to 6.

11. A processor for running a program, wherein the program when run causes the processor to perform the method of any one of claims 1 to 6.

12. A computer device, comprising: a memory and a processor, wherein the memory is configured to store,

The memory stores a computer program;

The processor being operative to execute a computer program stored in the memory, the computer program when run causes the processor to perform the method of any one of claims 1 to 6.