https://www.ichunqiu.com/battalion?t=1&r=70899
+ + + + + + + + + + +
可信赛题的创新与线上赛题目解说
作者：北京工业大学国家等级保护2.0与可信计算3.0攻关示范基地 胡俊
1.可信度量赛题部署裁决机制的创新
本次国赛初赛是我第6次提供可信计算赛题支持。在全国大学生信息安全竞赛中提供可信计算赛题则是第4次。以前的比赛主要精力是放在题目本身的设计，题目裁决机制做的比较随意。本次比赛我们准备参考可信3.0的设计思想，设计一个通用性更强的裁决机制，以方便开发更多种类型的可信赛题。
图1：2024年前可信赛题裁决机制原理
图2：2024年可信赛题裁决机制原理
2.“用户信息访问控制”赛题解题思路
except_rule，学生只要在这里判断数据项是否为salary，以及主客体属主是否一致，如两项均为是，则该项符合，except_rule函数返回1，用户即可获得自己薪水信息。except_rule函数的参考写法如下：int except_rule(char * record_name, char * read_user, char * record_user)
{
if(strcmp(record_name,”salary”)==0)
{
if((strcmp(read_user,record_user)==0)
return 1;
}
return 0;
}
3.“平台可信验证”赛题解题思路
memdb_find_first函数是可以查询到摘要值内容的。以trust_boot度量结果为例，具体方式如下：RECORD(GENERAL_RETURN,UUID) * policy; // 度量项数据结构
char * policy_name = “trust_boot”; // 度量项名称
DB_RECORD * db_record; //内存数据库的存储项
db_record = memdb_find_first(TYPE_PAIR(GENERAL_RETURN,UUID),
“name”,policy_name); //从内存数据库中找到度量项
policy=db_record->record;
policy->return_value中就是度量值。PCR新值 = SM3（PCR旧值|输入值）即可分别算出PCR7,PCR11和PCR14寄存器的预期值。TCM_ExAddPcrComposite来计算预期值，但了解了pcrValue计算的原理，完全可以使用sm3函数来自行完成计算。for(i=0; trust_policy[i].name!=NULL; i++)
// 循环处理所有的度量项
{
// 查找度量值
db_record = memdb_find_first(TYPE_PAIR(GENERAL_RETURN,UUID),
"name",trust_policy[i].name);
if(db_record == NULL)
return -EINVAL;
policy_digest = db_record->record;
// 针对度量项计算预期值
result = TCM_ExAddPcrComposite(pcr_result,trust_policy[i].value,
policy_digest->return_value);
printf("policy name : %s value :",policy_digest->name);
print_bin_data(policy_digest->return_value,32,16);
}
//获取pcr报告值
pcr_report=&(quote_report->pcrComp);
//对比pcr报告和pcr预期值，并根据对比结果设置不同返回值。
if((Memcmp(pcr_result->select.pcrSelect,
pcr_report->select.pcrSelect,3)==0)
&& (Memcmp(pcr_result->pcrValue,pcr_report->pcrValue,
pcr_report->valueSize)==0))
{
verify_result->name=dup_str("trust verify succeed",0);
}
else
{
verify_result->name=dup_str("trust verify fail",0);
}
4.未来的计划
“用户信息访问控制”选手解法
作者：浙江工业大学Stinger 黄宇鑫
操作内容：
-
修改 instance/server目录下策略文件record.list，补全表1中所有记录项对应的客体安全属性。 -
修改 src/record_acl/record_acl.c中except_rule函数，以在数据读取行为符合例外规则时返回1。
任务一：补全 record.list
record.list 文件，题目已经给了我们部分记录项的策略，我们需要补充的是 cell 和 email 这两个字段的策略。cell 字段要求 “员工管理权限内同级别、高级别或低一级别员工可查询”，email 字段要求 “员工管理权限内同级别、高级别、低一级别或低两个级别员工可查询”。cell 和 email 字段的访问控制要求：-
cell: 员工管理权限内同级别、高级别或低一级别员工可查询。 -
email: 员工管理权限内同级别、高级别、低一级别或低两个级别员工可查询。
record.list 文件末尾添加以下两项：{
"name":"cell",
"isleveladjust":1,
"isselfdefine":0,
"class":0,
"level_fix":0,
"level_adjust":0
},
{
"name":"email",
"isleveladjust":1,
"isselfdefine":0,
"class":0,
"level_fix":0,
"level_adjust":-1
}
任务二：实现 except_rule 函数
src/record_acl/record_acl.c 中的 except_rule 函数。观察函数及其被调用位置的提示信息.record_acl.c 文件，找到 except_rule 函数，发现这个函数的输入参数包含了记录项名称 (record_name)、读取用户 (read_user) 和记录所属用户 (record_user)。-
记录项名称是否为 “salary” -
读取用户是否与记录所属用户相同
int except_rule(char * record_name,char * read_user,char * record_user)
{
int ret;
// add except rule check here
if (strcmp(record_name, "salary") == 0 && strcmp(read_user, record_user) == 0) {
return 1;
}
return 0;
}
record_name 是否为 “salary”，如果是，则继续检查读取用户 (read_user) 是否与记录所属用户 (record_user) 相同。如果两个条件都满足，则说明符合例外规则，函数返回1。否则，函数返回0。编译与测试
/home/player/cube-userinfo-access/src目录下使用 make 命令编译代码，然后执行 sh record_access.sh 进行测试。观察脚本输出结果，确认不同用户读取数据时，实际获取的数据内容符合题目要求的访问控制策略。make会出现头文件丢失问题。[player@engine-1 record_acl]$ make
gcc -g -c -fPIC -DUSER_MODE -I/root/centoscloud/cube-1.3/proc/include -I/root/centoscloud/cube-1.3/include -I/home/player/cube-userinfo-acces/include record_acl.c
record_acl.c:13:25: fatal error: user_define.h: No such file or directory
#include "user_define.h"
compilation terminated.
make: *** [record_acl.o] Error 1
[player@engine-1 record_acl]$
include文件夹中存在对应的头文件，但无法读取。FLAGS= -g -shared -o
INCLUDE= -I$(CUBESYSPATH)/include -I$(CUBE_PATH)/include -I$(CUBEAPPPATH)/include
CFLAGS= -g -c -fPIC -DUSER_MODE $(INCLUDE)
CC=gcc
CCP=g++
PLUGIN=record_acl
PLUGIN_OBJ=
TEST_LIB= -L$(CUBELIBPATH)/lib -lmessage -lmemdb -lconnector -lstruct -lcrypto_func -lpthread
LOCALLIB=-L$(CUBEAPPPATH)/locallib/bin -lstring_func
main: lib$(PLUGIN).so
lib$(PLUGIN).so: $(PLUGIN).o $(PLUGIN_PROC_OBJ) $(INIT_DB_OBJ)
$(CC) $(FLAGS) lib$(PLUGIN).so $(PLUGIN).o $(PLUGIN_OBJ) $(TEST_LIB)
mv lib$(PLUGIN).so $(CUBEAPPPATH)/plugin
cp $(PLUGIN).cfg $(CUBEAPPPATH)/plugin
$(PLUGIN).o: $(PLUGIN).c $(PLUGIN).h
$(CC) $(CFLAGS) $(PLUGIN).c
clean:
rm -f lib$(PLUGIN).so
rm *.o *~
~/cube-userinfo-access发现[player@engine-1 cube-userinfo-access]$ ls
define exec_def include instance player.sh plugin record_access.sh run_cube.sh set_env.sh src
1.
export CUBEAPPPATH=/home/player/cube-userinfo-access
2.
cd ~/cube-userinfo-access
sh run_cube.sh
sh set_env.sh
sh record_access.sh 进行测试，符合预期。{
"return_code":"SUCCEED","return_info":"login succeed!
"}
enter user attach proc!
find user addr!
{
"name":"zhou","ID":"1005","department":"M","position":"CMO","YOF":3,"salary":0,"
cell":"**********","email":""}
enter user attach proc!
find user addr!
{
"name":"wang","ID":"1008","department":"R","position":"DM","YOF":4,"salary":2000
0,"cell":"**********","email":""}
exit the proc!
{
"return_code":"SUCCEED","return_info":"login succeed!
"}
enter user attach proc!
find user addr!
{
"name":"zhou","ID":"1005","department":"M","position":"CMO","YOF":3,"salary":350
00,"cell":"1350000000","email":"[email protected]"}
enter user attach proc!
find user addr!
{
"name":"wang","ID":"1008","department":"R","position":"DM","YOF":4,"salary":0,"c
ell":"**********","email":""}
exit the proc!
{
"return_code":"SUCCEED","return_info":"login succeed!
"}
enter user attach proc!
find user addr!
{
"name":"zhou","ID":"1005","department":"M","position":"CMO","YOF":3,"salary":0,"
cell":"**********","email":"[email protected]"}
enter user attach proc!
find user addr!
{
"name":"wang","ID":"1008","department":"R","position":"DM","YOF":4,"salary":0,"c
ell":"**********","email":""}
exit the proc!
提交答案
sh player.sh后得到正确答案。“平台可信认证”选手解法
作者：cameudis
instance/crypt_hub/cube_err.log文件，查看其中报错：[player@engine-1 src]$ cat ../instance/crypt_hub/cube_err.log
time: 0.078772 :warninfo: read aspect policy failed -1!time: 0.079465 :errinfo: tcm dev /dev/vtcm1 can't access!time: 0.079473 :errinfo: read plugin 2 error 14267620
time: 0.079508 :errinfo: can't find plugin libkey_manage.so!
time: 0.079513 :errinfo: read plugin 3 error 61
time: 0.079543 :errinfo: can't find plugin libkey_manage_server_emu.so!
time: 0.079546 :errinfo: read plugin 4 error 72
time: 0.079575 :errinfo: can't find plugin libkey_server_return.so!
time: 0.079579 :errinfo: read plugin 5 error 68
time: 8.091854 :errinfo: proc_router_send_msg: can't find local message target key_manage_server_emutime: 12.121621 :errinfo: proc_router_send_msg: can't find local message target key_manage_server_emutime: 16.161873 :errinfo: proc_router_send_msg: can't find local message target key_manage_server_emu
TCM_PATH, TCM_PLUGIN 和 APPPATH 三个环境变量，同时需要在 src 目录的 Makefile 中加入以上三个模块的编译。弯路
{
"name":"virtual_node",
"libname":"virtual_node",
"init_para":{
"node_type":1,
"node_name":"server",
"domain":"center"
}
}
{
"name":"tcm_init",
"libname":"tcm_libinit"
"init_para":{
"tcm_type":1,
"node_name":"server",
"dev_name":"/dev/vtcm1"
}
}
{
"name":"key_manage",
"libname":"key_manage"
}
{
"name":"key_manage_server_emu",
"libname":"key_manage_server_emu"
}
{
"name":"key_server_return",
"libname":"key_server_return"
}
...
[player@engine-1 platform_verify]$ find / -name "*pikcert_verify*" 2>/dev/null
/root/centoscloud/cube_tcmplugin/src/pikcert_verify
/root/centoscloud/cube_tcmplugin/src/pikcert_verify/pikcert_verify.o
/root/centoscloud/cube_tcmplugin/src/pikcert_verify/pikcert_verify.cfg
/root/centoscloud/cube_tcmplugin/src/pikcert_verify/pikcert_verify.c
/root/centoscloud/cube_tcmplugin/src/pikcert_verify/pikcert_verify.h
/root/centoscloud/cube_tcmplugin/plugin/pikcert_verify.cfg
/root/centoscloud/cube_tcmplugin/plugin/libpikcert_verify.so
[player@engine-1 platform_verify]$ ls /root/centoscloud/cube_tcmplugin/plugin/
README key_certify.cfg libexpandstruct_store.so libpik_casign.so libremotekey_gen.so localkey_gen.cfg pikcert_store.cfg sessionkey_switch.cfg
create_key.cfg key_check.cfg libkey_certify.so libpik_caverify.so libremotekey_send.so pcr_multirw.cfg pikcert_verify.cfg tcm_libinit.cfg
ekpub_expandsend.cfg libcreate_key.so libkey_check.so libpik_client.so libremotekey_store.so pcr_rw.cfg quote_report.cfg uuid_symm_crypt.cfg
ekpub_send.cfg libekpub_expandsend.so liblocalkey_gen.so libpikcert_store.so libsessionkey_switch.so pik_casign.cfg remotekey_gen.cfg
ekpub_store.cfg libekpub_send.so libpcr_multirw.so libpikcert_verify.so libtcm_libinit.so pik_caverify.cfg remotekey_send.cfg
expandstruct_store.cfg libekpub_store.so libpcr_rw.so libquote_report.so libuuid_symm_crypt.so pik_client.cfg remotekey_store.cfg
[player@engine-1 platform_verify]$ cd src/
[player@engine-1 src]$ ls
Makefile key_event_user key_manage_hack key_manage_server_emu key_server_return login_user quote_report_emu
key_event key_manage key_manage_server key_manage_user login_server policy_rw user_label
[player@engine-1 src]$
/home/player目录下搜索字符串PLUGIN，并将其中配置不正确的全都改成/home/player/platform_verify/plugin。代码编写
{
"type":"GENERAL_RETURN",
"subtype":"UUID"
}
{
"name":"trust_boot",
"return_value":"1b483aa95573a38b95f9f866ff7586ade43a686f165fd7875125583cf4a73de4",
}
{
"name":"linux_kernel",
"return_value":"7a4d7b56552b0d20c1f7566eacdfb5232e627c537aba89143a17fc7a92007f6a",
}
{
"name":"secure_mechanism",
"return_value":"660ca5ea8b7b7f4256d2bdf30a829da85820376020c1167ee232cc74ed6a126f",
}
{
"name":"secure_policy",
"return_value":"8b4877c3ffbda4dfe506785e8cbeedeb7364b50b2b8b4a0fc4c0d53a1bae0fc7",
}
geIbwkh8Ghef/NvTifbD8aMCzSaPDJN40IOfxqCP1eosLcVz3BGsZrMsM344R92dfm2TJf2Lfxu2ti/P9qYOWwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
81 e2 1b c2 48 7c 1a 17 9f fc db d3 89 f6 c3 f1 a3 02 cd 26 8f 0c 93 78 d0 83 9f c6 a0 8f d5 ea
2c 2d c5 73 dc 11 ac 66 b3 2c 33 7e 38 47 dd 9d 7e 6d 93 25 fd 8b 7f 1b b6 b6 2f cf f6 a6 0e 5b
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
geIbwkh8Ghef/NvTifbD8aMCzSaPDJN40IOfxqCP1eosLcVz3BGsZrMsM344R92dfm2TJf2Lfxu2ti/P9qYOW2LICP2RTORHe8PF5iKWi11fvq2kRX6RH6ANNEq6q4Bw
81 e2 1b c2 48 7c 1a 17 9f fc db d3 89 f6 c3 f1 a3 02 cd 26 8f 0c 93 78 d0 83 9f c6 a0 8f d5 ea
2c 2d c5 73 dc 11 ac 66 b3 2c 33 7e 38 47 dd 9d 7e 6d 93 25 fd 8b 7f 1b b6 b6 2f cf f6 a6 0e 5b
62 c8 08 fd 91 4c e4 47 7b c3 c5 e6 22 96 8b 5d 5f be ad a4 45 7e 91 1f a0 0d 34 4a ba ab 80 70
BYTE pcr7[] = {0x81,0xe2,0x1b,0xc2,0x48,0x7c,0x1a,0x17,0x9f,0xfc,0xdb,0xd3,0x89,0xf6,0xc3,0xf1,0xa3,0x02,0xcd,0x26,0x8f,0x0c,0x93,0x78,0xd0,0x83,0x9f,0xc6,0xa0,0x8f,0xd5,0xea};
BYTE pcr11[] = {0x2c,0x2d,0xc5,0x73,0xdc,0x11,0xac,0x66,0xb3,0x2c,0x33,0x7e,0x38,0x47,0xdd,0x9d,0x7e,0x6d,0x93,0x25,0xfd,0x8b,0x7f,0x1b,0xb6,0xb6,0x2f,0xcf,0xf6,0xa6,0x0e,0x5b};
BYTE pcr14[] = {0x62,0xc8,0x08,0xfd,0x91,0x4c,0xe4,0x47,0x7b,0xc3,0xc5,0xe6,0x22,0x96,0x8b,0x5d,0x5f,0xbe,0xad,0xa4,0x45,0x7e,0x91,0x1f,0xa0,0x0d,0x34,0x4a,0xba,0xab,0x80,0x70};
RECORD(GENERAL_RETURN,UUID) * verify_output(RECORD(TCM_KEY_DESC,VERIFY_DESC) * verify_desc,
RECORD(TCM_PIK_DESC,PCRQUOTE) * quote_report)
{
RECORD(GENERAL_RETURN,UUID) * verify_result;//待输出的验证结果
RECORD(GENERAL_RETURN,UUID) *policy_digest;
TCM_PCR_COMPOSITE * pcr_result; // 待计算的PCR值
TCM_PCR_COMPOSITE * pcr_report; // 报告中的PCR值
DB_RECORD * db_record;
UINT32 result;
pcr_result=Talloc0(sizeof(*pcr_result));
result = TCM_ExInitPcrComposite(pcr_result); //对PCR值进行初始化
if(result!=0)
return -EINVAL;
NAME2VALUE trust_policy[5] = {
{"trust_boot",7},
{"linux_kernel",11},
{"secure_mechanism",11},
{"secure_policy",14},
{NULL,0},
};
int i;
verify_result = Talloc0(sizeof(*verify_result));
if(verify_result == NULL)
return -ENOMEM;
Memcpy(verify_result->return_value,verify_desc->object_uuid,DIGEST_SIZE);
if(verify_desc->result!=0)
{
verify_result->name=dup_str("sign verify fail",0);
}
else
{
// 从报告中获取pcr值
pcr_report=&(quote_report->pcrComp);
printf("yy: size: %dn", pcr_report->valueSize);
// 与硬编码的三个值进行比较
if (!Memcmp(pcr_report->pcrValue, pcr7, 32) && !Memcmp((char*)(pcr_report->pcrValue)+32, pcr11, 32) && !Memcmp((char*)pcr_report->pcrValue+64, pcr14, 32)) {
verify_result->name=dup_str("trust verify succeed", 0);
} else {
verify_result->name=dup_str("trust verify fail", 0);
}
// Debug
int a=0, b=0, c=0;
if (!Memcmp(pcr_report->pcrValue, pcr7, 32)) {
printf("pcr7 passn");
}
if (!Memcmp(pcr_report->pcrValue+32, pcr11, 32)) {
printf("pcr11 passn");
}
if (!Memcmp(pcr_report->pcrValue+64, pcr14, 32)) {
printf("pcr14 passn");
}
}
return verify_result;
}
相关阅读
赛前热身第2期|「第十六届全国大学生信息安全竞赛」安全可信赛题
赛前热身第3期|「第十六届全国大学生信息安全竞赛」安全可信赛题
+ + + + + + + + + + +
原文始发于微信公众号（春秋伽玛）：官方WP | 可信赛题的创新与线上赛题目解说
