WO2022028057A1

WO2022028057A1 - Tpm-based apparatus and method for multi-layer protection of server asset information

Info

Publication number: WO2022028057A1
Application number: PCT/CN2021/096401
Authority: WO
Inventors: 叶明洋; 王鹏; 张敏; 杨德晓; 付水论
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2020-08-07
Filing date: 2021-05-27
Publication date: 2022-02-10
Also published as: CN112016092A

Abstract

Provided in the present invention is a TPM-based apparatus for multi-layer protection of server asset information, the apparatus comprising a BMC, a CPU, a PCH, a BIOS, an access device, a first TPM and a second TPM. The BMC acquires first verification information of the access device by means of the PCH and the CPU, and the first TPM is used for verifying the first verification information of the access device; and the BIOS acquires second verification information and third verification information of the access device, and the second TPM is used for sequentially verifying the second verification information and the third verification information of the access device, wherein the verification of the second verification information is executed after the verification of the first verification information is passed, and the verification of the third verification information is executed after the verification of the second verification information is passed. Also provided in the present invention is a TPM-based method for multi-layer protection of server asset information. By means of the method, the model of the current access device can be examined and distinguished, such that the integrity, security and reliability of the current server are effectively protected.

Description

A device and method for multi-layer protection of asset information based on TPM server

This application claims the priority of the Chinese patent application filed on August 7, 2020 with the State Intellectual Property Office of China, the application number is 202010790430.3, and the invention title is "A device and method for multi-layer protection of asset information based on a TPM server", which The entire contents of this application are incorporated by reference.

technical field

The invention relates to the field of server asset information protection, in particular to a device and method for multi-layer protection of TPM server asset information.

Background technique

With the continuous development of information technology, most servers currently support TPM (Trusted Platform Module), which aims to protect system security. The TPM is a device or element that independently generates a key to encrypt and decrypt data, which can effectively prevent the data of the computer device or server device from being accessed by illegal users.

TPM is a trusted chip defined by the Trusted Computing Group (Trusted Computing Group), which uses asymmetric encryption algorithms internally to provide basic security-related functions of computer devices or server devices. TPM includes TPM1.2 and TPM2.0. TPM1.2 uses I2C (Inter-Integrated Circuit) protocol, which is generally connected to BMC (Baseboard Management Controller) on the server. TPM2.0 uses SPI (Serial Perripheral Interface, Serial Peripheral Interface) protocol, which generally interacts with the BIOS (Basic Input/Output System). The two can be used alone or complement each other. Through the configuration of the firmware, various security protections can be achieved for the system.

Under normal circumstances, for server hardware devices, TPM only verifies the access of the device to confirm whether the connected device is abnormally lost, and does not further distinguish the device. In the current design, it is generally The TPM1.2 chip is connected to the BMC to verify the access status of the access device; the TPM2.0 is connected to the BIOS to confirm whether the device is abnormally lost or maliciously damaged during the boot process, and protect the integrity of the current system sex.

However, the disadvantage of the prior art is that, on the one hand, the current access device model cannot be identified, and the problem of replacing devices of the same model cannot be avoided; The realization of multi-level protection of access equipment is not conducive to the three-dimensional and comprehensive protection of server asset information.

SUMMARY OF THE INVENTION

In order to solve the problems existing in the prior art, the present invention innovatively proposes a device and method for multi-layer protection of TPM server asset information, which effectively solves the problem that the server asset information cannot be protected in multiple layers due to the prior art, and effectively improves the It improves the reliability of server asset information protection.

A first aspect of the present invention provides a device for multi-layer protection based on TPM server asset information, including: BMC, CPU (Central Processing Unit, central processing unit), PCH (Platform Controller Hub, platform controller hub), BIOS, interface access device, the first TPM, and the second TPM, the data reading end of the BMC is connected to the PCH, and is used to obtain the first verification information of the access device through the PCH and the CPU, and the data communication end of the BMC is connected to the first TPM. The verification communication terminal of the BIOS is connected, and the first TPM is used to verify the first verification information of the access device; the data reading terminal of the BIOS is connected to the PCH to obtain the second verification information and the third verification information of the access device, The data communication terminal of the BIOS is connected to the verification communication terminal of the second TPM, and the second TPM is used to verify the second verification information and the third verification information of the access device in turn; the first enable control terminal of the PCH It is connected with the enabling terminal of the BIOS, and the second enabling control terminal is connected with the enabling terminal of the second TPM; wherein, the verification of the second verification information is performed after the verification of the first verification information is passed, and the verification of the second verification information is performed after the verification of the second verification information is passed. 3. Verification of verification information.

Optionally, the access device includes a memory and/or a PCIE (Peripheral Component Interface Express, bus and interface standard) device.

Optionally, the first verification information is presence information and spec (specification) information of the access device, the second verification information is the SN of the access device, and the third verification information is driver information of the access device.

Optionally, the data reading end of the BIOS and the data communication end share a port, that is, the BIOS and the second TPM share one SPI (Serial Peripheral Interface, serial peripheral interface) line, and the communication of the BIOS is selected by changing the frequency of the SPI line. object.

A second aspect of the present invention provides a method for multi-layer protection based on TPM server asset information, which is implemented on the basis of the device for multi-layer protection based on TPM server asset information described in the first aspect of the present invention, and specifically includes:

The BMC obtains the first verification information of the access device, and invokes the first TPM to verify the first verification information of the access device. If the verification passes, the server system starts normally, and if the verification fails, the server system cannot start normally;

The BIOS obtains the second verification information and the third verification information of the access device, calls the second TPM to verify the second verification information of the access device, and if the verification passes, calls the second TPM to verify the third verification information of the access device, if If the verification fails, verify the first verification information of the access device;

The second TPM verifies the third verification information of the access device. If the verification passes, the server system is powered on normally. If the verification fails, the first verification information of the access device is verified.

Optionally, the first verification information is presence information and spec information of the access device, the second verification information is the SN of the access device, and the third verification information is driver information of the access device.

Further, the verification of the first verification information is specifically: the first TPM obtains the presence information of the access device, and if the access device is in place, it continues to verify whether the spec information of the access device is consistent with the pre-stored spec information, if If they are consistent, the verification of the first verification information passes, and if they are inconsistent, the verification of the first verification information fails.

Optionally, the verification of the second verification information is specifically: the second TPM compares the acquired second verification information of the access device with the pre-stored second verification information to see if they are consistent, and if they are consistent, the second verification information is verified to pass, If not, the verification of the second verification information fails.

Optionally, the verification of the third verification information is specifically: the second TPM compares the acquired version number of the driver of the access device with the pre-stored version number of the driver of the access device, and if they are consistent, continues to verify the access device. Whether the driver of the input device can be executed, if it can be executed, the third verification information verification is passed, and if it cannot be executed or the comparison is inconsistent, the third verification information verification fails.

Optionally, when the verification information fails, the key needs to be entered when entering the system again.

The technical scheme adopted in the present invention includes the following technical effects:

1. The present invention effectively solves the problem that server asset information cannot be protected at multiple levels due to the prior art, and can screen the current access device model, avoid the problem of replacing devices of the same type, and ensure that the current access device will not be changed or destroyed. , so as to more effectively protect the integrity, security and reliability of the current server.

2. In the present invention, the BIOS and the second TPM share one SPI line, and by changing the frequency of the SPI line to select the communication object of the BIOS, the data reading end and the data communication end of the BIOS can share one port.

3. In the present invention, the first verification information, the second verification information, and the third verification information are verified in sequence, and when any verification fails, the verification needs to be performed again, which ensures the multi-level protection of the server asset information.

4. In the technical solution of the present invention, when the verification information fails, the key needs to be input when entering the system again, which further improves the reliability of server asset information protection.

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, On the premise of no creative work, other drawings can also be obtained from these drawings.

Fig. 1 is the structural schematic diagram of the device of Example 1 in the scheme of the present invention;

Fig. 2 is the schematic flow chart of the method of embodiment 2 in the scheme of the present invention;

3 is a schematic flowchart of step S11 in the method of Embodiment 2 in the solution of the present invention;

4 is a schematic flowchart of step S15 in the method of Embodiment 2 in the solution of the present invention;

FIG. 5 is a schematic flowchart of step S17 in the method of Embodiment 2 in the solution of the present invention;

FIG. 6 is a schematic flowchart of the method of Example 3 in the solution of the present invention.

detailed description

In order to clearly illustrate the technical features of the solution, the present invention will be described in detail below through specific embodiments and in conjunction with the accompanying drawings. The following disclosure provides many different embodiments or examples for implementing different structures of the invention. In order to simplify the disclosure of the present invention, the components and arrangements of specific examples are described below. Furthermore, the present invention may repeat reference numerals and/or letters in different instances. This repetition is for the purpose of simplicity and clarity and does not in itself indicate a relationship between the various embodiments and/or arrangements discussed. It should be noted that the components illustrated in the figures are not necessarily drawn to scale. Descriptions of well-known components and processing techniques and processes are omitted from the present invention to avoid unnecessarily limiting the present invention.

Example 1

As shown in FIG. 1 , the present invention provides a device for multi-layer protection of asset information of a TPM server, including: BMC1, CPU2, PCH3, BIOS4, access device 5, first TPM6, second TPM7, and data reading of BMC1 The fetching terminal is connected with PCH3, and is used to obtain the first verification information of the access device 5 through PCH3 and CPU2, the data communication terminal of BMC1 is connected with the verification communication terminal of the first TPM6, and the first TPM6 is used to verify the first verification information of the access device 5. A verification information; the data reading end of BIOS4 is connected to PCH3 to obtain the second verification information and third verification information of the access device 5, the data communication terminal of BIOS4 is connected to the verification communication terminal of the second TPM7, and the second TPM7 is used for Verify the second verification information and the third verification information of the access device 5 in turn; the first enable control end of PCH3 (send FLASH_CS signal) is connected with the enable end of BIOS4, and the second enable control end (send TPM_CS signal) and The enabling end of the second TPM7 is connected; wherein, the verification of the second verification information is performed after the first verification information is verified, and the verification of the third verification information is performed after the second verification information is verified.

The access device 5 includes several memories 51 and/or several PCIE devices 52 . The quantity of the memory 51 or the PCIE device 52 can be selected and adjusted according to the actual situation, which is not limited in the present invention.

The first verification information is the presence information and spec information of the access device 5 , the second verification information is the SN of the access device 5 , and the third verification information is the drive information of the access device 5 .

The first TPM6 is a TPM1.2 chip, and the second TPM7 is a TPM2.0 chip.

The data reading end of BIOS4 and the data communication end share one port, that is, BIOS4 and the second TPM7 share one SPI line, and the communication object of BIOS4 is selected by changing the frequency of the SPI line. Specifically, when the frequency of the SPI line is the first frequency, the BIOS4 communicates with the PCH3 through the SPI line to obtain the information of the access device; if the frequency of the SPI line is the second frequency, the BIOS4 communicates with the second TPM7 through the SPI line, and calls The second TPM 7 performs verification of the second verification information and the third verification information.

When the system is powered on, the BMC1 can capture the current status of the access device 5, obtain the access location and access status of each access device 5, and then use the I2C link to call the RSA algorithm in the first TPM6 (a kind of A widely used public key algorithm) to verify the obtained access status of the access device 5.

The BMC1 will use the IPMI (Intelligent Platform Management Interface) instruction to transmit the verification result of the first verification information to the BIOS4. If the first TPM6 verifies the first verification information of the current access device is correct, it can be powered on normally. If the verification fails, you need to enter the key when entering the system later, and give a change prompt message at the same time.

During the boot process, BIOS4 can interact with the device in turn to obtain the SN (Serial Number, product serial number) and other information (ie the second verification information) of the current device during the device initialization process, and submit it to the first device after reading this information. The second TPM7 chip is verified, and the BIOS4 verifies whether the current SN has been changed by calling the SM3 algorithm (domestic hash algorithm) in the second TPM7.

After the SN code verification of each access device is completed, the BIOS 4 will call the second TPM 7 to verify the driver (driver) loaded by the current access device 5 to ensure that the current access device 5 has not been maliciously damaged. Finally, all access devices are confirmed to be correct and then enter the system. If the verification fails, the key needs to be entered when entering the system, and a change prompt message is given at the same time.

It should be noted that, in the embodiment of the present invention, BIOS4 actually refers to BIOS FLASH (flash memory).

The invention effectively solves the problem that the server asset information cannot be protected in multiple layers due to the prior art, and can screen the current access device model, avoid the problem of replacing the same type of device, and ensure that the current access device will not be changed and destroyed, thereby More effectively protect the integrity, security and reliability of the current server.

In the present invention, the BIOS and the second TPM share one SPI line, and by changing the frequency of the SPI line to select the communication object of the BIOS, the data reading end and the data communication end of the BIOS can share one port.

Embodiment 2

As shown in FIG. 2 , the technical solution of the present invention should provide a method for multi-layer protection of asset information based on a TPM server, which is implemented on the basis of Embodiment 1 of the present invention, and specifically includes:

S11, the BMC obtains the first verification information of the access device, and invokes the first TPM to verify the first verification information of the access device;

S12, judging whether the first verification information is passed, if the judgment result is yes, then step S13 is executed, if the judgment result is no, then step S14 is executed;

S13, the server system is powered on normally;

S14, the server system cannot be powered on normally;

S15, the BIOS obtains the second verification information and the third verification information of the access device, and invokes the second TPM to verify the second verification information of the access device;

S16, judging whether the second verification information is passed, if the judgment result is yes, then execute step S17, if the judgment result is no, execute step S11;

S17, calling the second TPM to verify the third verification information of the access device;

S18, determine whether the third verification information is passed, if the determination result is yes, then go to step S19, if the determination result is no, then go to step S11;

S19, enter the server system.

The first verification information is the presence information and spec information of the access device, the second verification information is the SN of the access device, and the third verification information is the drive information of the access device.

In step S11, as shown in Figure 3, it specifically includes:

S111, the first TPM obtains the presence information of the access device;

S112, judging whether the access device is in place, if the judgment result is yes, execute step S113, if the judgment result is no, execute step S114;

S113, verify whether the spec information of the access device is consistent with the pre-stored spec information, if the judgment result is yes, execute step S115, if the judgment result is no, execute step S114;

S114, the first verification information verification fails;

S115, the verification of the first verification information is passed.

In step S113, the spec information includes manufacturer information and the like.

In steps S11-S14, when the system is powered on, the BMC can capture the current access device status, obtain the access location and access status of each access device, and then use the I2C link to call the first TPM The RSA algorithm (a widely used public key algorithm) verifies the obtained access status of the access device.

The BMC will pass the verification result of the first verification information to the BIOS using the IPMI command. If the first TPM verifies the first verification information of the current access device is correct, it can be powered on normally. Enter the key, and give the change prompt information at the same time.

In step S15, as shown in Figure 4, it specifically includes:

S151, the second TPM compares the acquired second verification information of the access device with the pre-stored second verification information to see if they are consistent; if the judgment result is yes, then step S152 is executed, and if the judgment result is no, step S153 is executed;

S152, the second verification information is verified and passed;

S153, the verification of the second verification information fails.

In steps S15-S16, during the booting process, the BIOS can interact with the device in turn to obtain information such as the SN (Serial Number, product serial number) of the current device (ie, the second verification information) in the process of device initialization. After receiving this information, submit it to the second TPM chip for verification. The BIOS verifies whether the current SN has been changed by calling the SM3 algorithm (domestic hash algorithm) in the second TPM. .

In step S17, as shown in Figure 5, it specifically includes:

S171, the second TPM compares the obtained version number of the driver of the access device with the pre-stored version number of the driver of the access device; if the judgment result is yes, then step S172 is executed; if the judgment result is no, execute Step S173;

S172, whether the driver program of the access device can be executed, if the judgment result is yes, then step S174 is executed, if the judgment result is no, then step S173 is executed;

S173, the third verification information verification fails;

S174, the verification of the third verification information is passed.

In steps S18-S19, after the SN code verification of each access device is completed, the BIOS will call the second TPM to verify the driver (driver) loaded by the current access device to ensure that the current access device has not been maliciously attacked. destroy. Finally, all access devices are confirmed to be correct and then enter the system. If the verification fails, the key needs to be entered when entering the system, and a change prompt message is given at the same time.

It should be noted that, each step in the embodiment of the present invention may be implemented by programming in a programming language, or may be implemented by other means, which is not limited in the present invention.

In the present invention, the first verification information, the second verification information and the third verification information are verified in sequence, and when any verification fails, the verification needs to be performed again, which ensures the multi-level protection of the server asset information.

Embodiment 3

As shown in FIG. 6 , the technical solution of the present invention should provide a method for multi-layer protection of asset information based on a TPM server, which is implemented on the basis of Embodiment 1 of the present invention, and specifically includes:

S11, the BMC acquires the first verification information of the access device, and invokes the first TPM to verify the first verification information of the access device,

S13, the server system is powered on normally;

S14, the server system cannot be powered on normally;

S16, judge whether the second verification information passes, if the judgment result is yes, then execute step S17, if the judgment result is no, then execute step S11;

S19, enter the server system.

S20, when the verification information fails, the key needs to be input when entering the system again.

In the technical solution of the present invention, when the verification information fails, the key needs to be input when entering the system again, which further improves the reliability of server asset information protection.

Although the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, they do not limit the scope of protection of the present invention. Those skilled in the art should understand that on the basis of the technical solutions of the present invention, those skilled in the art do not need to pay creative work. Various modifications or deformations that can be made are still within the protection scope of the present invention.

Claims

A device for multi-layer protection of asset information based on a TPM server, characterized in that it includes: BMC, CPU, PCH, BIOS, access equipment, a first TPM, and a second TPM, and a data reading end of the BMC is connected to the PCH , used to obtain the first verification information of the access device through the PCH and the CPU, the data communication terminal of the BMC is connected to the verification communication terminal of the first TPM, and the first TPM is used to verify the first verification information of the access device. The data reading end of the BIOS is connected with the PCH, obtains the second verification information and the third verification information of the access device, the data communication end of the BIOS is connected with the verification communication end of the second TPM, and the second TPM Used to verify the second verification information and the third verification information of the access device in turn; the first enabling control terminal of the PCH is connected to the enabling terminal of the BIOS, and the second enabling control terminal is connected to the enabling terminal of the second TPM. connection; wherein, the verification of the second verification information is performed after the first verification information is verified, and the verification of the third verification information is performed after the second verification information is verified.
The apparatus for multi-layer protection of TPM server asset information according to claim 1, wherein the access device includes a memory and/or a PCIE device.
The device for multi-layer protection based on TPM server asset information according to claim 1, wherein the first verification information is the presence information and spec information of the access device, the second verification information is the SN of the access device, and the first verification information is the SN of the access device. The third verification information is the driver information of the access device.
The device for multi-layer protection based on TPM server asset information according to claim 1, wherein the data reading end of the BIOS and the data communication end share a port, that is, the BIOS and the second TPM share an SPI line, and by changing the SPI The frequency of the line selects the communication object of the BIOS.
A method for multi-layer protection based on TPM server asset information, characterized in that it is implemented on the basis of any one of claims 1-4 based on the device for multi-layer protection of TPM server asset information, and specifically includes:

The BMC obtains the first verification information of the access device, and invokes the first TPM to verify the first verification information of the access device. If the verification passes, the server system starts normally, and if the verification fails, the server system cannot start normally;

The BIOS obtains the second verification information and the third verification information of the access device, calls the second TPM to verify the second verification information of the access device, and if the verification passes, calls the second TPM to verify the third verification information of the access device, if If the verification fails, verify the first verification information of the access device;

The second TPM verifies the third verification information of the access device. If the verification passes, the server system is powered on normally. If the verification fails, the first verification information of the access device is verified.
The method for multi-layer protection based on TPM server asset information according to claim 5, wherein the first verification information is the presence information and spec information of the access device, the second verification information is the SN of the access device, and the first verification information is the SN of the access device. The third verification information is the driver information of the access device.
The method for multi-layer protection based on TPM server asset information according to claim 6, wherein the verification of the first verification information is specifically: the first TPM obtains the presence information of the access device, if the access device is in place, Continue to verify whether the spec information of the access device is consistent with the pre-stored spec information. If the spec information is consistent, the first verification information verification passes, and if they are inconsistent, the first verification information verification fails.
The method for multi-layer protection based on TPM server asset information according to claim 5, wherein the verification of the second verification information is specifically: the second TPM compares the acquired second verification information of the access device with the pre-stored first verification information. The two verification information are compared to see if they are consistent. If they are consistent, the second verification information is verified to pass. If they are inconsistent, the second verification information fails to be verified.
The method for multi-layer protection based on TPM server asset information according to claim 6, wherein the verification of the third verification information is specifically: the second TPM compares the acquired version number of the driver of the access device with the pre-stored interface number. Check whether the version numbers of the driver of the input device are consistent. If they are consistent, continue to verify whether the driver of the access device can be executed. If it can be executed, the third verification information verification is passed. If it cannot be executed or the comparison is inconsistent, the third verification Information verification failed.
The method for multi-layer protection of asset information based on a TPM server according to any one of claims 5-9, wherein when the verification information fails, a key needs to be input when entering the system again.