Patent Grant
11017095
The present invention relates to the computer field, and in particular, to a method and an apparatus for trusted measurement of a cloud computing platform.
A cloud computing platform can allow a user to access, by using a ubiquitous, convenient, and on-demand network, a shared computing resource pool that can be dynamically configured. The shared computing resource pool includes network devices, servers, storage devices, applications, and services. The cloud computing platform can implement rapid provisioning and release of the foregoing configurable computing resources at relatively low management costs or with relatively low complexity of interaction between a user and a service provider.
After a user migrates data to the cloud computing platform, proprietary and control rights of the data are separated. The user is an owner of the data, and the control right of the data is transferred to a provider of the cloud computing platform. All resource-related operations such as data-related computing and storage are completed by the user by using the cloud computing platform. In this way, to really implement large-scale development and application of the cloud computing platform, a security problem of the cloud computing platform needs to be first resolved.
However, in the architecture shown in
This application provides an improved solution for trusted measurement of a cloud computing platform, so as to improve process transparency of trusted measurement of a cloud computing platform and increase a user's trust in the cloud computing platform.
According to a first aspect, this application provides a method for trusted measurement of a cloud computing platform. The method includes: receiving, by a third-party management and audit system, a current running indicator of software on a cloud computing platform, where the current running indicator of the software is signed by a trusted platform of the cloud computing platform by using a digital certificate issued by a certification authority (CA); obtaining, by the third-party management and audit system, a running security indicator of the software from a third-party assessment organization; and generating, by the third-party management and audit system, an audit report based on the current running indicator, signed by using the digital certificate, of the software and the running security indicator of the software, where the audit report indicates trustworthiness of the cloud computing platform.
The trusted third-party management and audit system performs trusted measurement on the cloud computing platform, and compares the running security indicator, obtained through assessment by the security organization, of the software with the original current running indicator that is of the software and that is obtained after trusted measurement is performed on the cloud computing platform, so as to obtain the audit report. In this way, a process of trusted measurement of the cloud computing platform is open and transparent. This avoids a prior-art risk that a current running indicator of software may be tampered with due to certificate replacement in a process for performing trusted measurement on a cloud computing platform by using an internal management and audit system, so that authenticity of trusted measurement of the cloud computing platform is improved, thereby increasing a user's trust in the cloud computing platform.
With reference to the first aspect, in a possible implementation of the first aspect, the current running indicator of the software is signed by the cloud computing platform by using the digital certificate issued by the CA.
With reference to the first aspect or the foregoing possible implementation of the first aspect, in another possible implementation of the first aspect, the current running indicator of the software carries an identifier of a virtual machine of the cloud computing platform, and the method further includes: receiving, by the third-party management and audit system, a correspondence between a user identifier and a virtual machine identifier; determining, by the third-party management and audit system based on the identifier of the virtual machine and the correspondence, a user corresponding to the identifier of the virtual machine; and sending, by the third-party management and audit system, the audit report to the user corresponding to the identifier of the virtual machine.
The identifier of the virtual machine of the cloud computing platform is carried in the current running indicator of the software. In this way, the third-party management and audit system can associate, based on the identifier of the virtual machine, the audit report with the user using the virtual machine, so that each user can obtain an audit report related to the user.
With reference to the first aspect or any one of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, the method further includes: receiving, by the third-party management and audit system, information about a running version of the software, and obtaining, by the third-party management and audit system, information about an assessment version of the software from the third-party assessment organization; and the generating, by the third-party management and audit system, an audit report based on the current running indicator of the software and the running security indicator of the software includes: generating, by the third-party management and audit system, the audit report based on the current running indicator of the software, the running security indicator of the software, the information about the running version of the software, and the information about the assessment version of the software.
The third-party management and audit system obtains the information about the assessment version of the software from the third-party security assessment organization, and stores, in the audit report, the information about the running version of the software on the cloud computing platform and the information about the assessment version of the software, where the audit report may be obtained by the user. This can avoid a prior-art problem that a running version and an assessment version provided by a provider of a cloud computing platform for software on the cloud computing platform are inconsistent.
With reference to the first aspect or any one of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, the method further includes: receiving, by the third-party management and audit system, a running log of the cloud computing platform sent by the cloud computing platform; and the generating, by the third-party management and audit system, an audit report based on the current running indicator of the software and the running security indicator of the software further includes: generating, by the third-party management and audit system, the audit report based on the current running indicator of the software, the running security indicator of the software, and the running log.
The third-party management and audit system stores the running log of the cloud computing platform in the audit report for user audit. In this way, a running parameter of the cloud computing platform is transparent, thereby increasing a user's trust in the cloud computing platform.
With reference to the first aspect or any one of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, the method further includes: receiving, by the third-party management and audit system, an operation log of the cloud computing platform sent by the cloud computing platform; and the generating, by the third-party management and audit system, an audit report based on the current running indicator of the software and the running security indicator of the software further includes: generating, by the third-party management and audit system, the audit report based on the current running indicator of the software, the running security indicator of the software, and the operation log.
The third-party management and audit system stores the operation log of the cloud computing platform in the audit report for user audit. In this way, a related operation performed by an administrator on the cloud computing platform is transparent, thereby increasing a user's trust in the cloud computing platform.
With reference to the first aspect or any one of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, before the receiving, by a third-party management and audit system, a current running indicator of software on a cloud computing platform, the method further includes: receiving, by the third-party management and audit system, a registration request sent by the cloud computing platform, where the registration request includes a digital certificate of the cloud computing platform; and sending, by the third-party management and audit system, acknowledgement information to the cloud computing platform, where the acknowledgement information indicates that the cloud computing platform is successfully registered with the third-party management and audit system.
With reference to the first aspect or any one of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, before the receiving, by a third-party management and audit system, a current running indicator of software on a cloud computing platform, the method further includes: receiving, by the third-party management and audit system, a registration request sent by the cloud computing platform, where the registration request includes a digital certificate of the trusted platform; and sending, by the third-party management and audit system, acknowledgement information to the cloud computing platform, where the acknowledgement information indicates that the trusted platform is successfully registered with the third-party management and audit system.
With reference to the first aspect or any one of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, the method further includes: sending, by the third-party management and audit system, the digital certificate to the CA, and receiving, by the third-party management and audit system, verification information, sent by the CA, of the digital certificate, where the verification information indicates whether the digital certificate is valid; and the generating, by the third-party management and audit system, an audit report based on the current running indicator of the software and the running security indicator of the software includes: generating, by the third-party management and audit system, the audit report of a cloud platform system based on the current running indicator of the software, the running security indicator of the software, and the verification information of the digital certificate.
With reference to the first aspect or any one of the foregoing possible implementations of the first aspect, in another possible implementation of the first aspect, the third-party management and audit system is a system located outside the cloud computing platform, the third-party management and audit system is provided by a trusted third party, the third-party management and audit system is connected to the cloud computing platform, and the third-party management and audit system is connected to the third-party assessment organization.
The third-party management and audit system is located on a system outside the cloud computing platform and is provided by the trusted third party. In this way, a process of trusted measurement of the cloud computing platform is more transparent, thereby increasing a user's trust in the cloud computing platform.
According to a second aspect, this application provides a method for trusted measurement of a cloud computing platform. The method includes: receiving, by a trusted evidence processing system, a current running indicator of software on a cloud computing platform, where the current running indicator of the software is signed by a trusted platform of the cloud computing platform by using a digital certificate issued by a certification authority (CA); and sending, by the trusted evidence processing system, the current running indicator of the software to a third-party management and audit system, so that the third-party management and audit system generates an audit report based on the current running indicator of the software and a running security indicator of the software, where the audit report indicates trustworthiness of the cloud computing platform.
The trusted third-party management and audit system performs trusted measurement on the cloud computing platform, and compares the running security indicator, obtained through assessment by a security organization, of the software with the original current running indicator that is of the software and that is obtained after trusted measurement is performed on the cloud computing platform, so as to obtain the audit report. In this way, a process of trusted measurement of the cloud computing platform is open and transparent. This avoids a prior-art risk that a current running indicator of software may be tampered with due to certificate replacement in a process for performing trusted measurement on a cloud computing platform by using an internal management and audit system, so that authenticity of trusted measurement of the cloud computing platform is improved, thereby increasing a user's trust in the cloud computing platform.
With reference to the second aspect, in a possible implementation of the second aspect, before the sending, by the trusted evidence processing system, the current running indicator of the software to a third-party management and audit system, the method further includes: signing, by the trusted evidence processing system, the measurement information by using a digital certificate of the cloud computing platform, where the digital certificate of the cloud computing platform is the digital certificate issued by the CA.
With reference to the second aspect or the foregoing possible implementation of the second aspect, in another possible implementation of the second aspect, the method further includes: sending, by the trusted evidence processing system, a correspondence between a user and a virtual machine to the third-party management and audit system, so that the third-party management and audit system determines a user based on obtained virtual machine identifier information and sends the audit report to the user.
The correspondence between a user and a virtual machine is sent to the third-party management and audit system. In this way, the third-party management and audit system can associate, based on an identifier of a virtual machine, the audit report with a user using the virtual machine, so that each user can obtain an audit report related to the user.
With reference to the second aspect or any one of the foregoing possible implementations of the second aspect, in another possible implementation of the second aspect, the method further includes: receiving, by the trusted evidence processing system, information about a running version of the software on the cloud computing platform; and sending, by the trusted evidence processing system, the information about the running version of the software to the third-party management and audit system.
The trusted evidence processing system sends the running version of the software to the third-party management and audit system, so that an assessment version of the software and the running version of the software on the cloud computing platform can be stored in the audit report for user audit. This can avoid a prior-art problem that a running version and an assessment version provided by a provider of a cloud computing platform for software on the cloud computing platform are inconsistent.
With reference to the second aspect or any one of the foregoing possible implementations of the second aspect, in another possible implementation of the second aspect, the method further includes: sending, by the feasible evidence processing system, a digital certificate of the trusted platform and the digital certificate of the cloud computing platform to the CA; receiving, by the feasible evidence processing system, verification information sent by the CA, where the verification information indicates whether the digital certificate of the trusted platform and the digital certificate of the cloud computing platform are valid; and sending, by the feasible evidence processing system, the verification information to the third-party management and audit system.
With reference to the second aspect or any one of the foregoing possible implementations of the second aspect, in another possible implementation of the second aspect, before the receiving, by a trusted evidence processing system, a current running indicator of software on a cloud computing platform, the method further includes: receiving, by the feasible evidence processing system, a registration request sent by the cloud computing platform, where the registration request includes the digital certificate of the trusted platform of the cloud computing platform; and sending, by the feasible evidence processing system, acknowledgement information to the third-party management and audit system, where the acknowledgement information indicates that the trusted platform is successfully registered with the feasible evidence processing system.
With reference to the second aspect or any one of the foregoing possible implementations of the second aspect, in another possible implementation of the second aspect, the third-party management and audit system is a system located outside the cloud computing platform, the third-party management and audit system is provided by a trusted third party, the third-party management and audit system is connected to the cloud computing platform, and the third-party management and audit system is connected to a third-party security assessment organization.
The third-party management and audit system is the system located outside the cloud computing platform and is provided by the trusted third party. In this way, a process of trusted measurement of the cloud computing platform is more transparent, thereby increasing a user's trust in the cloud computing platform.
According to a third aspect, this application provides an apparatus for trusted measurement of a cloud computing platform. The apparatus includes modules configured to execute the method in the first aspect.
According to a fourth aspect, this application provides an apparatus for trusted measurement of a cloud computing platform. The apparatus includes modules configured to execute the method in the second aspect.
According to a fifth aspect, this application provides a computer-readable storage medium. The computer-readable storage medium is configured to store program code used for trusted measurement of a cloud computing platform. The program code is used to execute a method instruction in the first aspect.
According to a sixth aspect, this application provides a computer-readable storage medium. The computer-readable storage medium is configured to store program code used for trusted measurement of a cloud computing platform. The program code is used to execute a method instruction in the second aspect.
In some implementations, the current running indicator of the software may be an integrity measurement value of the software, and the running security indicator of the software may be an integrity reference value.
In some implementations, the current running indicator of the software may include measurement information about trusted start of the software and measurement information about trusted running of the software.
In some implementations, the trusted evidence processing system may be a processing module of the cloud computing platform.
In embodiments of the present invention, the third-party management and audit system audits information about trusted measurement of the cloud computing platform, and the audit report may be audited by the user. In this way, a process of trusted measurement of the cloud computing platform is open and transparent, so that authenticity of trusted measurement of the cloud computing platform is improved, thereby increasing a user's trust in the cloud computing platform.
To describe the technical solutions in the embodiments of the present invention more clearly, the following briefly describes the accompanying drawings required for describing the embodiments of the present invention. Apparently, the accompanying drawings in the following description show merely some embodiments of the present invention, and a person of ordinary skill in the art may still derive other drawings from these accompanying drawings without creative efforts.
The following clearly describes the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.
The TCG defines “trusted” as follows: “When an entity implements a given target, if behavior of the entity is always as expected, the entity is trusted.” Based on the definition, trusted computing is distinguished from a current security technology. “Trusted” emphasizes that a result of behavior is expectable, but does not mean that the behavior is confirmed as secure. These are two different concepts. For example, a user knows that a computer of the user is infected with a virus, knows a time at which the virus initiates an attack, and understands a consequence caused by the virus attack. If the virus really runs in this way, the computer is trusted. Based on the definition provided by the TCG, “trusted” actually further includes reliability in fault-tolerant computing. Reliability ensures that performance of a hardware or software system is predictable.
In the prior art, to increase a user's trust in a cloud computing platform, a technology of trusted computing is introduced in a process for establishing trust between a verification server and the cloud computing platform. An important application of the technology of trusted computing is to protect software integrity. A TPM security chip is a key component for trusted computing. The TPM security chip uses a password technology as a core, has computing and storage functions, and supports data protection, identity authentication, integrity measurement, and the like. The TPM security chip can perform integrity measurement on software and provide a measurement report. In terms of physical security, the TPM security chip is capable of preventing an attack, tampering, and detection, and can prevent the TPM and internal data from being illegally attacked. In terms of technology security, the TPM uses a plurality of password and access control technologies. In terms of management security, the TPM belongs to a commercial password product in China. Development, production, sale, and use of the TPM are effectively managed based on the national commercial password product. These protection measures jointly ensure security of the TPM, so that the TPM can become roots of trust of hardware storage of the cloud computing platform and a trusted basis point of the cloud computing platform.
A cloud computing platform node may use, as roots of trust, a TPM security chip deployed in a BIOS or CPU. In accordance with a principle of “first measurement and then execution”, measurement, authentication, and trust are implemented level by level, to establish a chain of trust from the TPM security chip, to an operating system of the cloud computing platform, and then to running software, thereby implementing trusted measurement of the cloud computing platform.
To avoid a prior-art risk that measurement information may be tampered with because a provider may replace an internal digital certificate, after trusted measurement is performed on the cloud computing platform, a report on trusted measurement may be sent to a third-party management and audit system. The third-party management and audit system generates an audit report, increasing a user's trust in the cloud computing platform. With reference to
210. A third-party management and audit system receives a registration request sent by a cloud computing platform, and completes a registration process from a trusted evidence processing system to the third-party management and audit system.
Specifically, the registration request includes a digital certificate of the cloud platform and a digital certificate of a trusted platform. The third-party management and audit system may receive two registration requests sent by the trusted evidence processing system of the cloud computing platform, where the two registration requests include the digital certificate of the cloud computing platform and the digital certificate of the trusted platform, respectively. Alternatively, the third-party management and audit system may receive one registration request sent by the trusted evidence processing system of the cloud computing platform, where the registration request includes both the digital certificate of the cloud computing platform and the digital certificate of the trusted platform.
220. The third-party management and audit system sends a digital certificate of the cloud computing platform and a digital certificate of a trusted platform to a CA.
Specifically, the third-party management and audit system sends the digital certificate of the cloud computing platform and the digital certificate of the trusted platform to the CA, to verify validity of the digital certificates.
230. The trusted evidence processing system sends a correspondence between a user identifier and a virtual machine identifier to the third-party management and audit system.
240. A computing node sends a current running indicator of software on the cloud computing platform and information about a running version of the software to the trusted evidence processing system.
Specifically, the current running indicator of the software is signed by using the digital certificate of the trusted platform, and the digital certificate used by the trusted platform to sign measurement information of the software is a digital certificate issued by the CA.
In some embodiments, the computing node may further send a running log of the cloud computing platform and an operation log of the cloud computing platform to the trusted evidence processing system.
It should be understood that the current running indicator of the software may include start measurement data of the software and running measurement data of the software. Because the current running indicator of the software includes different types of measurement data, time cycles of sending, by the computing node, measurement information to the trusted evidence processing system may also be different. For example, the start measurement data of the software may be directly sent to the trusted evidence processing system after the software is started, where a quantity of sending times may be 1; and the running measurement data of the software may be sent to the trusted evidence processing system based on a preset cycle after a running status of the software is measured. The running log of the cloud computing platform and the operation log of the cloud computing platform may also be sent to the trusted evidence processing system in a manner the same as that used for the running measurement data of the software.
It should be further understood that, to make the third-party management and audit system operate in a performance-first operating mode, the feasible evidence processing system may further store the current running indicator of the software sent by the computing node, and then send the current running indicator of the software to the third-party management and audit system at the same time.
250. The third-party management and audit system receives the current running indicator of the software, measurement information of the software, and carried virtual machine identifier information sent by the trusted evidence processing system.
In some embodiments, in an embodiment, the current running indicator of the software may be further signed by using the digital certificate of the cloud platform.
260. The third-party management and audit system receives a running security indicator of the software and information about an assessment version of the software that are sent by a third-party assessment organization.
In some embodiments, in an embodiment, the assessment information of the software may include a digital fingerprint of the software.
270. The third-party management and audit system generates an audit report based on the current running indicator of the software, the running security indicator of the software, the information about the running version of the software, and the information about the assessment version of the software.
It should be understood that the audit report may be sent by the third-party management and audit system to a user corresponding to a virtual machine identifier, or may be sent by the third-party management and audit system to an audit report bulletin board for a user to view. This is not specifically limited in the present invention.
With reference to
The first receiving module 310 is configured to receive a current running indicator of software on a cloud computing platform, where the measurement information is signed by a trusted platform of the cloud computing platform by using a digital certificate issued by a certification authority (CA).
The first obtaining module 320 is configured to obtain a running security indicator of the software from a third-party assessment organization.
The generation module 330 is configured to generate an audit report based on the current running indicator of the software received by the receiving module and the running security indicator of the software obtained by the obtaining module, where the audit report indicates trustworthiness of the cloud computing platform.
A trusted third-party management and audit system performs trusted measurement on the cloud computing platform, and compares the running security indicator, obtained through assessment by the security organization, of the software with the original current running indicator that is of the software and that is obtained after trusted measurement is performed on the cloud computing platform, so as to obtain the audit report. In this way, a process of trusted measurement of the cloud computing platform is open and transparent. This avoids a prior-art risk that a current running indicator of software may be tampered with due to certificate replacement in a process for performing trusted measurement on a cloud computing platform by using an internal management and audit system, so that authenticity of trusted measurement of the cloud computing platform is improved, thereby increasing a user's trust in the cloud computing platform.
The first receiving module 410 is configured to receive a current running indicator of software on a cloud computing platform, where the current running indicator of the software is signed by a trusted platform of the cloud computing platform by using a digital certificate issued by a certification authority (CA).
The first sending module 420 is configured to send the current running indicator of the software to a third-party management and audit system, so that the third-party management and audit system generates an audit report based on the current running indicator of the software and a running security indicator of the software, where the audit report indicates trustworthiness of the cloud computing platform.
The trusted third-party management and audit system performs trusted measurement on the cloud computing platform, and compares the running security indicator, obtained through assessment by a security organization, of the software with the original current running indicator that is of the software and that is obtained after trusted measurement is performed on the cloud computing platform, so as to obtain the audit report. In this way, a process of trusted measurement of the cloud computing platform is open and transparent. This avoids a prior-art risk that a current running indicator of software may be tampered with due to certificate replacement in a process for performing trusted measurement on a cloud computing platform by using an internal management and audit system, so that authenticity of trusted measurement of the cloud computing platform is improved, thereby increasing a user's trust in the cloud computing platform.
The communications interface 540 is configured to: receive a current running indicator of software on a cloud computing platform, where the current running indicator of the software is signed by a trusted platform of the cloud computing platform by using a digital certificate issued by a certification authority (CA); and obtain a running security indicator of the software from a third-party assessment organization.
The processor 520 is configured to generate an audit report based on the current running indicator of the software and the running security indicator of the software, where the audit report indicates trustworthiness of the cloud computing platform.
It should be understood that, in this embodiment of the present invention, the processor 520 may be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute a related program to implement the technical solution provided in this embodiment of the present invention.
It should be further understood that the communications interface 540 uses a transceiver apparatus such as, but not limited to, a transceiver, to implement communication between the apparatus 500 and another device or communications network.
The memory 510 may include a read-only memory and a random access memory, and provide the instruction and data for the processor 520. A part of the processor 520 may further include a non-volatile random access memory. For example, the processor 520 may further store device type information.
In addition to a data bus, the bus system 550 may include a power bus, a control bus, a status signal bus, and the like. However, for clear description, various types of buses are marked as the bus system 550 in the figure.
In an implementation process, the steps in the foregoing method may be performed by using an integrated logic circuit of hardware in the processor 520 or an instruction in a form of software. The steps of trusted measurement disclosed with reference to the embodiments of the present invention may be directly performed by a hardware processor, or may be performed by hardware in the processor and a software module. The software module may be located in a mature storage medium in the art, such as a random memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, or a register. The storage medium is located in the memory 510. The processor 520 reads information from the memory 510 and performs the steps of the foregoing method by using the hardware of the processor 520. To avoid repetition, details are not described herein again.
A trusted third-party management and audit system performs trusted measurement on the cloud computing platform, and compares the running security indicator, obtained through assessment by the security organization, of the software with the original current running indicator that is of the software and that is obtained after trusted measurement is performed on the cloud computing platform, so as to obtain the audit report. In this way, a process of trusted measurement of the cloud computing platform is open and transparent. This avoids a prior-art risk that a current running indicator of software may be tampered with due to certificate replacement in a process for performing trusted measurement on a cloud computing platform by using an internal management and audit system, so that authenticity of trusted measurement of the cloud computing platform is improved, thereby increasing a user's trust in the cloud computing platform.
The communications interface 640 is configured to: receive a current running indicator of software on a cloud computing platform, where the current running indicator of the software is signed by a trusted platform of the cloud computing platform by using a digital certificate issued by a certification authority (CA); and send the current running indicator of the software to a third-party management and audit system, so that the third-party management and audit system generates an audit report based on the current running indicator of the software and a running security indicator of the software, where the audit report indicates trustworthiness of the cloud computing platform.
It should be understood that, in this embodiment of the present invention, the processor 620 may be a general central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute a related program to implement the technical solution provided in this embodiment of the present invention.
It should be further understood that the communications interface 640 uses a transceiver apparatus such as, but not limited to, a transceiver, to implement communication between the apparatus 600 and another device or communications network.
The memory 610 may include a read-only memory and a random access memory, and provide the instruction and data for the processor 620. A part of the processor 620 may further include a non-volatile random access memory. For example, the processor 620 may further store device type information.
In addition to a data bus, the bus system 650 may include a power bus, a control bus, a status signal bus, and the like. However, for clear description, various types of buses are marked as the bus system 650 in the figure.
In an implementation process, the steps in the foregoing method may be performed by using an integrated logic circuit of hardware in the processor 620 or an instruction in a form of software. The steps of the method for trusted measurement disclosed with reference to the embodiments of the present invention may be directly performed by a hardware processor, or may be performed by hardware in the processor and a software module. The software module may be located in a mature storage medium in the art, such as a random memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, or a register. The storage medium is located in the memory 610. The processor 620 reads information from the memory 610 and performs the steps of the foregoing method by using the hardware of the processor 620. To avoid repetition, details are not described herein again.
The trusted third-party management and audit system performs trusted measurement on the cloud computing platform, and compares the running security indicator, obtained through assessment by a security organization, of the software with the original current running indicator that is of the software and that is obtained after trusted measurement is performed on the cloud computing platform, so as to obtain the audit report. In this way, a process of trusted measurement of the cloud computing platform is open and transparent. This avoids a prior-art risk that a current running indicator of software may be tampered with due to certificate replacement in a process for performing trusted measurement on a cloud computing platform by using an internal management and audit system, so that authenticity of trusted measurement of the cloud computing platform is improved, thereby increasing a user's trust in the cloud computing platform.
It should be understood that, in the embodiments of the present invention, “B corresponding to A” indicates that B is associated with A, and B may be determined based on A. However, it should further be understood that determining A based on B does not mean that B is determined based on A only; that is, B may also be determined based on A and/or other information.
It should be understood that the term “and/or” in this specification describes only an association relationship for describing associated objects and represents that three relationships may exist. For example, A and/or B may represent the following three cases: A exists, both A and B exist, and B exists. In addition, the character “/” in this specification generally indicates an “or” relationship between the associated objects.
It should be understood that sequence numbers of the foregoing processes do not mean execution sequences in various embodiments of the present invention. The execution sequences of the processes should be determined according to functions and internal logic of the processes, and should not be construed as any limitation on the implementation processes of the embodiments of the present invention.
A person of ordinary skill in the art may be aware that, in combination with the examples described in the embodiments disclosed in this specification, units and algorithm steps may be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed by hardware or software depends on particular applications and design constraint conditions of the technical solutions. A person skilled in the art may use different methods to implement the described functions for each particular application, but it should not be considered that the implementation goes beyond the scope of the present invention.
It may be clearly understood by a person skilled in the art that, for the purpose of convenient and brief description, for a detailed working process of the foregoing described system, apparatus, and unit, reference may be made to a corresponding process in the foregoing method embodiments, and details are not described herein again.
In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the described apparatus embodiment is merely an example. For example, the unit division is merely logical function division and may be other division in actual implementation. For example, a plurality of units or components may be combined or integrated into another system, or some features may be ignored or not performed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections may be implemented by using some interfaces. The indirect couplings or communication connections between the apparatuses or units may be implemented in electronic, mechanical, or other forms.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of network units. Some or all of the units may be selected based on actual requirements to achieve the objectives of the solutions of the embodiments.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each of the units may exist alone physically, or two or more units are integrated into one unit.
When the functions are implemented in the form of a software functional unit and sold or used as an independent product, the functions may be stored in a computer-readable storage medium. Based on such an understanding, the technical solutions of the present invention essentially, or the part contributing to the prior art, or some of the technical solutions may be implemented in a form of a software product. The computer software product is stored in a storage medium, and includes several instructions for instructing a computer device (which may be a personal computer, a server, a network device, or the like) to perform all or some of the steps of the methods described in the embodiments of the present invention. The foregoing storage medium includes: any medium that can store program code, such as a USB flash drive, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disc.
The foregoing descriptions are merely specific implementations of the present invention, but are not intended to limit the protection scope of the present invention. Any variation or replacement readily figured out by a person skilled in the art within the technical scope disclosed in the present invention shall fall within the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 201610109021.6 | Feb 2016 | CN | national |
This application is a continuation of International Application No. PCT/CN2016/097668, filed on Aug. 31, 2016, which claims priority to Chinese Patent Application No. 201610109021.6, filed on Feb. 26, 2016. The disclosures of the aforementioned applications are hereby incorporated by reference in their entireties.
| Number | Name | Date | Kind |
|---|---|---|---|
| 9294282 | Potlapally | Mar 2016 | B1 |
| 20100083349 | Xiao et al. | Apr 2010 | A1 |
| 20110219434 | Betz | Sep 2011 | A1 |
| 20120179904 | Dunn et al. | Jul 2012 | A1 |
| 20120216244 | Kumar | Aug 2012 | A1 |
| 20120265976 | Spiers | Oct 2012 | A1 |
| 20120266252 | Spiers et al. | Oct 2012 | A1 |
| 20130097601 | Podvratnik | Apr 2013 | A1 |
| 20130191643 | Song | Jul 2013 | A1 |
| 20150127795 | Jagana | May 2015 | A1 |
| 20150134965 | Morenius | May 2015 | A1 |
| 20150256341 | Ye et al. | Sep 2015 | A1 |
| 20150347264 | Mohammed | Dec 2015 | A1 |
| 20170078314 | Mohanty | Mar 2017 | A1 |
| 20170161505 | Campagna | Jun 2017 | A1 |
| 20180365045 | Hakala | Dec 2018 | A1 |
| 20180365430 | Ye | Dec 2018 | A1 |
| Number | Date | Country |
|---|---|---|
| 101043338 | Sep 2007 | CN |
| 101242297 | Aug 2008 | CN |
| 101477602 | Jul 2009 | CN |
| 101800642 | Aug 2010 | CN |
| 103843303 | Jun 2014 | CN |
| 2011146305 | Nov 2011 | WO |
| 2014039497 | Mar 2014 | WO |
| Entry |
|---|
| Liang Lulu et al, Third-party based cloud platform trusted evaluation framework. Proceedings of the 7th Information Security Vulnerability Analysis and Risk Assessment Conference, Apr. 23, 2015, 3 pages. |
| Number | Date | Country | |
|---|---|---|---|
| 20180365430 A1 | Dec 2018 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/CN2016/097668 | Aug 2016 | US |
| Child | 16111230 | US |
