WO2022028057A1 - Appareil à base de tpm et procédé de protection multicouche d'informations d'actifs de serveur - Google Patents

Appareil à base de tpm et procédé de protection multicouche d'informations d'actifs de serveur Download PDF

Info

Publication number
WO2022028057A1
WO2022028057A1 PCT/CN2021/096401 CN2021096401W WO2022028057A1 WO 2022028057 A1 WO2022028057 A1 WO 2022028057A1 CN 2021096401 W CN2021096401 W CN 2021096401W WO 2022028057 A1 WO2022028057 A1 WO 2022028057A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
information
access device
verification information
tpm
Prior art date
Application number
PCT/CN2021/096401
Other languages
English (en)
Chinese (zh)
Inventor
叶明洋
王鹏
张敏
杨德晓
付水论
Original Assignee
苏州浪潮智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州浪潮智能科技有限公司 filed Critical 苏州浪潮智能科技有限公司
Publication of WO2022028057A1 publication Critical patent/WO2022028057A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38—Information transfer, e.g. on bus
    • G06F13/382—Information transfer, e.g. on bus using universal interface adapter
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication

Definitions

  • the invention relates to the field of server asset information protection, in particular to a device and method for multi-layer protection of TPM server asset information.
  • TPM Trusted Platform Module
  • TPM is a trusted chip defined by the Trusted Computing Group (Trusted Computing Group), which uses asymmetric encryption algorithms internally to provide basic security-related functions of computer devices or server devices.
  • TPM includes TPM1.2 and TPM2.0.
  • TPM1.2 uses I2C (Inter-Integrated Circuit) protocol, which is generally connected to BMC (Baseboard Management Controller) on the server.
  • TPM2.0 uses SPI (Serial Perripheral Interface, Serial Peripheral Interface) protocol, which generally interacts with the BIOS (Basic Input/Output System). The two can be used alone or complement each other. Through the configuration of the firmware, various security protections can be achieved for the system.
  • TPM only verifies the access of the device to confirm whether the connected device is abnormally lost, and does not further distinguish the device.
  • the TPM1.2 chip is connected to the BMC to verify the access status of the access device; the TPM2.0 is connected to the BIOS to confirm whether the device is abnormally lost or maliciously damaged during the boot process, and protect the integrity of the current system sex.
  • the disadvantage of the prior art is that, on the one hand, the current access device model cannot be identified, and the problem of replacing devices of the same model cannot be avoided;
  • the realization of multi-level protection of access equipment is not conducive to the three-dimensional and comprehensive protection of server asset information.
  • the present invention innovatively proposes a device and method for multi-layer protection of TPM server asset information, which effectively solves the problem that the server asset information cannot be protected in multiple layers due to the prior art, and effectively improves the It improves the reliability of server asset information protection.
  • a first aspect of the present invention provides a device for multi-layer protection based on TPM server asset information, including: BMC, CPU (Central Processing Unit, central processing unit), PCH (Platform Controller Hub, platform controller hub), BIOS, interface access device, the first TPM, and the second TPM, the data reading end of the BMC is connected to the PCH, and is used to obtain the first verification information of the access device through the PCH and the CPU, and the data communication end of the BMC is connected to the first TPM.
  • BMC Central Processing Unit, central processing unit
  • PCH Plate Controller Hub, platform controller hub
  • BIOS interface access device
  • the data reading end of the BMC is connected to the PCH, and is used to obtain the first verification information of the access device through the PCH and the CPU
  • the data communication end of the BMC is connected to the first TPM.
  • the verification communication terminal of the BIOS is connected, and the first TPM is used to verify the first verification information of the access device; the data reading terminal of the BIOS is connected to the PCH to obtain the second verification information and the third verification information of the access device, The data communication terminal of the BIOS is connected to the verification communication terminal of the second TPM, and the second TPM is used to verify the second verification information and the third verification information of the access device in turn; the first enable control terminal of the PCH It is connected with the enabling terminal of the BIOS, and the second enabling control terminal is connected with the enabling terminal of the second TPM; wherein, the verification of the second verification information is performed after the verification of the first verification information is passed, and the verification of the second verification information is performed after the verification of the second verification information is passed. 3. Verification of verification information.
  • the access device includes a memory and/or a PCIE (Peripheral Component Interface Express, bus and interface standard) device.
  • PCIE Peripheral Component Interface Express, bus and interface standard
  • the first verification information is presence information and spec (specification) information of the access device
  • the second verification information is the SN of the access device
  • the third verification information is driver information of the access device.
  • the data reading end of the BIOS and the data communication end share a port, that is, the BIOS and the second TPM share one SPI (Serial Peripheral Interface, serial peripheral interface) line, and the communication of the BIOS is selected by changing the frequency of the SPI line. object.
  • SPI Serial Peripheral Interface, serial peripheral interface
  • a second aspect of the present invention provides a method for multi-layer protection based on TPM server asset information, which is implemented on the basis of the device for multi-layer protection based on TPM server asset information described in the first aspect of the present invention, and specifically includes:
  • the BMC obtains the first verification information of the access device, and invokes the first TPM to verify the first verification information of the access device. If the verification passes, the server system starts normally, and if the verification fails, the server system cannot start normally;
  • the BIOS obtains the second verification information and the third verification information of the access device, calls the second TPM to verify the second verification information of the access device, and if the verification passes, calls the second TPM to verify the third verification information of the access device, if If the verification fails, verify the first verification information of the access device;
  • the second TPM verifies the third verification information of the access device. If the verification passes, the server system is powered on normally. If the verification fails, the first verification information of the access device is verified.
  • the first verification information is presence information and spec information of the access device
  • the second verification information is the SN of the access device
  • the third verification information is driver information of the access device.
  • the verification of the first verification information is specifically: the first TPM obtains the presence information of the access device, and if the access device is in place, it continues to verify whether the spec information of the access device is consistent with the pre-stored spec information, if If they are consistent, the verification of the first verification information passes, and if they are inconsistent, the verification of the first verification information fails.
  • the verification of the second verification information is specifically: the second TPM compares the acquired second verification information of the access device with the pre-stored second verification information to see if they are consistent, and if they are consistent, the second verification information is verified to pass, If not, the verification of the second verification information fails.
  • the verification of the third verification information is specifically: the second TPM compares the acquired version number of the driver of the access device with the pre-stored version number of the driver of the access device, and if they are consistent, continues to verify the access device. Whether the driver of the input device can be executed, if it can be executed, the third verification information verification is passed, and if it cannot be executed or the comparison is inconsistent, the third verification information verification fails.
  • the key needs to be entered when entering the system again.
  • the present invention effectively solves the problem that server asset information cannot be protected at multiple levels due to the prior art, and can screen the current access device model, avoid the problem of replacing devices of the same type, and ensure that the current access device will not be changed or destroyed. , so as to more effectively protect the integrity, security and reliability of the current server.
  • the BIOS and the second TPM share one SPI line, and by changing the frequency of the SPI line to select the communication object of the BIOS, the data reading end and the data communication end of the BIOS can share one port.
  • the first verification information, the second verification information, and the third verification information are verified in sequence, and when any verification fails, the verification needs to be performed again, which ensures the multi-level protection of the server asset information.
  • Fig. 1 is the structural schematic diagram of the device of Example 1 in the scheme of the present invention.
  • Fig. 2 is the schematic flow chart of the method of embodiment 2 in the scheme of the present invention.
  • step S11 in the method of Embodiment 2 in the solution of the present invention
  • step S15 is a schematic flowchart of step S15 in the method of Embodiment 2 in the solution of the present invention
  • FIG. 5 is a schematic flowchart of step S17 in the method of Embodiment 2 in the solution of the present invention.
  • FIG. 6 is a schematic flowchart of the method of Example 3 in the solution of the present invention.
  • the present invention provides a device for multi-layer protection of asset information of a TPM server, including: BMC1, CPU2, PCH3, BIOS4, access device 5, first TPM6, second TPM7, and data reading of BMC1
  • the fetching terminal is connected with PCH3, and is used to obtain the first verification information of the access device 5 through PCH3 and CPU2,
  • the data communication terminal of BMC1 is connected with the verification communication terminal of the first TPM6, and the first TPM6 is used to verify the first verification information of the access device 5.
  • a verification information the data reading end of BIOS4 is connected to PCH3 to obtain the second verification information and third verification information of the access device 5, the data communication terminal of BIOS4 is connected to the verification communication terminal of the second TPM7, and the second TPM7 is used for Verify the second verification information and the third verification information of the access device 5 in turn;
  • the first enable control end of PCH3 (send FLASH_CS signal) is connected with the enable end of BIOS4, and the second enable control end (send TPM_CS signal) and The enabling end of the second TPM7 is connected; wherein, the verification of the second verification information is performed after the first verification information is verified, and the verification of the third verification information is performed after the second verification information is verified.
  • the access device 5 includes several memories 51 and/or several PCIE devices 52 .
  • the quantity of the memory 51 or the PCIE device 52 can be selected and adjusted according to the actual situation, which is not limited in the present invention.
  • the first verification information is the presence information and spec information of the access device 5
  • the second verification information is the SN of the access device 5
  • the third verification information is the drive information of the access device 5 .
  • the first TPM6 is a TPM1.2 chip
  • the second TPM7 is a TPM2.0 chip.
  • BIOS4 and the data communication end share one port, that is, BIOS4 and the second TPM7 share one SPI line, and the communication object of BIOS4 is selected by changing the frequency of the SPI line. Specifically, when the frequency of the SPI line is the first frequency, the BIOS4 communicates with the PCH3 through the SPI line to obtain the information of the access device; if the frequency of the SPI line is the second frequency, the BIOS4 communicates with the second TPM7 through the SPI line, and calls The second TPM 7 performs verification of the second verification information and the third verification information.
  • the BMC1 can capture the current status of the access device 5, obtain the access location and access status of each access device 5, and then use the I2C link to call the RSA algorithm in the first TPM6 (a kind of A widely used public key algorithm) to verify the obtained access status of the access device 5.
  • TPM6 a kind of A widely used public key algorithm
  • the BMC1 will use the IPMI (Intelligent Platform Management Interface) instruction to transmit the verification result of the first verification information to the BIOS4. If the first TPM6 verifies the first verification information of the current access device is correct, it can be powered on normally. If the verification fails, you need to enter the key when entering the system later, and give a change prompt message at the same time.
  • IPMI Intelligent Platform Management Interface
  • BIOS4 can interact with the device in turn to obtain the SN (Serial Number, product serial number) and other information (ie the second verification information) of the current device during the device initialization process, and submit it to the first device after reading this information.
  • the second TPM7 chip is verified, and the BIOS4 verifies whether the current SN has been changed by calling the SM3 algorithm (domestic hash algorithm) in the second TPM7.
  • the BIOS 4 will call the second TPM 7 to verify the driver (driver) loaded by the current access device 5 to ensure that the current access device 5 has not been maliciously damaged. Finally, all access devices are confirmed to be correct and then enter the system. If the verification fails, the key needs to be entered when entering the system, and a change prompt message is given at the same time.
  • BIOS4 actually refers to BIOS FLASH (flash memory).
  • the invention effectively solves the problem that the server asset information cannot be protected in multiple layers due to the prior art, and can screen the current access device model, avoid the problem of replacing the same type of device, and ensure that the current access device will not be changed and destroyed, thereby More effectively protect the integrity, security and reliability of the current server.
  • the BIOS and the second TPM share one SPI line, and by changing the frequency of the SPI line to select the communication object of the BIOS, the data reading end and the data communication end of the BIOS can share one port.
  • the technical solution of the present invention should provide a method for multi-layer protection of asset information based on a TPM server, which is implemented on the basis of Embodiment 1 of the present invention, and specifically includes:
  • the BMC obtains the first verification information of the access device, and invokes the first TPM to verify the first verification information of the access device;
  • step S12 judging whether the first verification information is passed, if the judgment result is yes, then step S13 is executed, if the judgment result is no, then step S14 is executed;
  • the BIOS obtains the second verification information and the third verification information of the access device, and invokes the second TPM to verify the second verification information of the access device;
  • step S18 determine whether the third verification information is passed, if the determination result is yes, then go to step S19, if the determination result is no, then go to step S11;
  • the first verification information is the presence information and spec information of the access device
  • the second verification information is the SN of the access device
  • the third verification information is the drive information of the access device.
  • step S11 as shown in Figure 3, it specifically includes:
  • the first TPM obtains the presence information of the access device
  • the spec information includes manufacturer information and the like.
  • the BMC can capture the current access device status, obtain the access location and access status of each access device, and then use the I2C link to call the first TPM
  • the RSA algorithm (a widely used public key algorithm) verifies the obtained access status of the access device.
  • the BMC will pass the verification result of the first verification information to the BIOS using the IPMI command. If the first TPM verifies the first verification information of the current access device is correct, it can be powered on normally. Enter the key, and give the change prompt information at the same time.
  • step S15 as shown in Figure 4, it specifically includes:
  • step S151 the second TPM compares the acquired second verification information of the access device with the pre-stored second verification information to see if they are consistent; if the judgment result is yes, then step S152 is executed, and if the judgment result is no, step S153 is executed;
  • the BIOS can interact with the device in turn to obtain information such as the SN (Serial Number, product serial number) of the current device (ie, the second verification information) in the process of device initialization. After receiving this information, submit it to the second TPM chip for verification. The BIOS verifies whether the current SN has been changed by calling the SM3 algorithm (domestic hash algorithm) in the second TPM. .
  • SN Serial Number, product serial number
  • the BIOS verifies whether the current SN has been changed by calling the SM3 algorithm (domestic hash algorithm) in the second TPM.
  • step S17 as shown in Figure 5, it specifically includes:
  • the second TPM compares the obtained version number of the driver of the access device with the pre-stored version number of the driver of the access device; if the judgment result is yes, then step S172 is executed; if the judgment result is no, execute Step S173;
  • step S172 whether the driver program of the access device can be executed, if the judgment result is yes, then step S174 is executed, if the judgment result is no, then step S173 is executed;
  • steps S18-S19 after the SN code verification of each access device is completed, the BIOS will call the second TPM to verify the driver (driver) loaded by the current access device to ensure that the current access device has not been maliciously attacked. destroy. Finally, all access devices are confirmed to be correct and then enter the system. If the verification fails, the key needs to be entered when entering the system, and a change prompt message is given at the same time.
  • each step in the embodiment of the present invention may be implemented by programming in a programming language, or may be implemented by other means, which is not limited in the present invention.
  • the invention effectively solves the problem that the server asset information cannot be protected in multiple layers due to the prior art, and can screen the current access device model, avoid the problem of replacing the same type of device, and ensure that the current access device will not be changed and destroyed, thereby More effectively protect the integrity, security and reliability of the current server.
  • the BIOS and the second TPM share one SPI line, and by changing the frequency of the SPI line to select the communication object of the BIOS, the data reading end and the data communication end of the BIOS can share one port.
  • the first verification information, the second verification information and the third verification information are verified in sequence, and when any verification fails, the verification needs to be performed again, which ensures the multi-level protection of the server asset information.
  • the technical solution of the present invention should provide a method for multi-layer protection of asset information based on a TPM server, which is implemented on the basis of Embodiment 1 of the present invention, and specifically includes:
  • the BMC acquires the first verification information of the access device, and invokes the first TPM to verify the first verification information of the access device,
  • step S12 judging whether the first verification information is passed, if the judgment result is yes, then step S13 is executed, if the judgment result is no, then step S14 is executed;
  • the BIOS obtains the second verification information and the third verification information of the access device, and invokes the second TPM to verify the second verification information of the access device;
  • step S16 judge whether the second verification information passes, if the judgment result is yes, then execute step S17, if the judgment result is no, then execute step S11;
  • step S18 determine whether the third verification information is passed, if the determination result is yes, then go to step S19, if the determination result is no, then go to step S11;
  • each step in the embodiment of the present invention may be implemented by programming in a programming language, or may be implemented by other means, which is not limited in the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

La présente invention concerne un appareil à base de module de plateforme de confiance (TPM) destiné à la protection multicouche d'informations d'actifs de serveur, l'appareil comprenant un contrôleur de gestion de carte de base (BMC), une unité centrale de traitement (CPU), un canal de recherche de mobile (PCH), un système d'entrée et de sortie basique (BIOS), un dispositif d'accès, un premier TPM et un second TPM. Le BMC acquiert des premières informations de vérification du dispositif d'accès au moyen du PCH du de la CPU, et le premier TPM est utilisé pour vérifier les premières informations de vérification du dispositif d'accès ; et le BIOS acquiert des deuxièmes informations de vérification et des troisièmes informations de vérification du dispositif d'accès, et le second TPM est utilisé pour vérifier séquentiellement les deuxièmes informations de vérification et les troisièmes informations de vérification du dispositif d'accès, la vérification des deuxièmes informations de vérification étant exécutée après que la vérification des premières informations de vérification est passée, et la vérification des troisièmes informations de vérification étant exécutée après que la vérification des deuxièmes informations de vérification est passée. La présente invention concerne également un procédé à base de TPM destiné à la protection multicouche d'informations d'actifs de serveur. Au moyen du procédé, le modèle du dispositif d'accès actuel peut être examiné et distingué, de telle sorte que l'intégrité, la sécurité et la fiabilité du serveur actuel sont efficacement protégées.
PCT/CN2021/096401 2020-08-07 2021-05-27 Appareil à base de tpm et procédé de protection multicouche d'informations d'actifs de serveur WO2022028057A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010790430.3 2020-08-07
CN202010790430.3A CN112016092A (zh) 2020-08-07 2020-08-07 一种基于tpm服务器资产信息多层保护的装置及方法

Publications (1)

Publication Number Publication Date
WO2022028057A1 true WO2022028057A1 (fr) 2022-02-10

Family

ID=73500235

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/096401 WO2022028057A1 (fr) 2020-08-07 2021-05-27 Appareil à base de tpm et procédé de protection multicouche d'informations d'actifs de serveur

Country Status (2)

Country Link
CN (1) CN112016092A (fr)
WO (1) WO2022028057A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210111892A1 (en) * 2020-12-22 2021-04-15 Anjo Lucas Vahldiek-Oberwagner Scalabe attestation for trusted execution environments
WO2024027889A1 (fr) 2022-08-01 2024-02-08 Telefonaktiebolaget Lm Ericsson (Publ) Procédés et appareil de gestion de ressources de communication d'un réseau de communication sans fil pour une utilisation radar

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112016092A (zh) * 2020-08-07 2020-12-01 苏州浪潮智能科技有限公司 一种基于tpm服务器资产信息多层保护的装置及方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190034620A1 (en) * 2017-07-31 2019-01-31 Dell Products, L.P. System shipment lock
CN109902491A (zh) * 2019-02-28 2019-06-18 苏州浪潮智能科技有限公司 一种服务器的安全运算管理架构及服务器
CN110377346A (zh) * 2019-06-29 2019-10-25 苏州浪潮智能科技有限公司 一种支持tpm和tpcm的兼容主板及系统上电开机方法
CN111399919A (zh) * 2020-03-06 2020-07-10 苏州浪潮智能科技有限公司 一种服务器的启动方法、系统、电子设备及存储介质
CN112016092A (zh) * 2020-08-07 2020-12-01 苏州浪潮智能科技有限公司 一种基于tpm服务器资产信息多层保护的装置及方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190034620A1 (en) * 2017-07-31 2019-01-31 Dell Products, L.P. System shipment lock
CN109902491A (zh) * 2019-02-28 2019-06-18 苏州浪潮智能科技有限公司 一种服务器的安全运算管理架构及服务器
CN110377346A (zh) * 2019-06-29 2019-10-25 苏州浪潮智能科技有限公司 一种支持tpm和tpcm的兼容主板及系统上电开机方法
CN111399919A (zh) * 2020-03-06 2020-07-10 苏州浪潮智能科技有限公司 一种服务器的启动方法、系统、电子设备及存储介质
CN112016092A (zh) * 2020-08-07 2020-12-01 苏州浪潮智能科技有限公司 一种基于tpm服务器资产信息多层保护的装置及方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210111892A1 (en) * 2020-12-22 2021-04-15 Anjo Lucas Vahldiek-Oberwagner Scalabe attestation for trusted execution environments
WO2024027889A1 (fr) 2022-08-01 2024-02-08 Telefonaktiebolaget Lm Ericsson (Publ) Procédés et appareil de gestion de ressources de communication d'un réseau de communication sans fil pour une utilisation radar

Also Published As

Publication number Publication date
CN112016092A (zh) 2020-12-01

Similar Documents

Publication Publication Date Title
WO2022028057A1 (fr) Appareil à base de tpm et procédé de protection multicouche d'informations d'actifs de serveur
US10839080B2 (en) Hardware-enforced firmware security
US9742568B2 (en) Trusted support processor authentication of host BIOS/UEFI
US10754955B2 (en) Authenticating a boot path update
US11843705B2 (en) Dynamic certificate management as part of a distributed authentication system
JP6026462B2 (ja) ポイントツーポイント相互接続システム上のセキュアな環境初期化命令の実行
US11256797B2 (en) Remote attestation for multi-core processor
CN105205401B (zh) 基于安全密码芯片的可信计算机系统及其可信引导方法
JP5607546B2 (ja) 保護された動作モードの間にシステムアクセスを制御するための方法および装置
US8341393B2 (en) Security to extend trust
CN111158767B (zh) 基于bmc的服务器安全启动方法及装置
US11829478B2 (en) Full server recovery architecture for cloud bare metal instances
TW200414051A (en) Encapsulation of a TCPA trusted platform module functionality within a server management coprocessor subsystem
US20220067165A1 (en) Security measurement method and security measurement device for startup of server system, and server
EP4116851A1 (fr) Procédé de mesure de confiance et appareil associé
CN110659498A (zh) 可信计算度量方法及其系统、计算机可读存储介质
CN111651769A (zh) 获取安全启动的度量方法和装置
US20230009470A1 (en) Workspace-based fixed pass-through monitoring system and method for hardware devices using a baseboard management controller (bmc)
US11809876B2 (en) Trusted platform module protection for non-volatile memory express (NVMe) recovery
US11734457B2 (en) Technology for controlling access to processor debug features
CN110781517B (zh) 一种bios与bmc沟通实现数据交互的方法
CN114510751A (zh) 一种基于处理器安全核的硬件防替换装置和方法
WO2021037344A1 (fr) Dispositif sécurisé et système informatique
US20230010283A1 (en) System and method for device authentication using a baseboard management controller (bmc)
CN113496036A (zh) 安全组件和预加载方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21852281

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21852281

Country of ref document: EP

Kind code of ref document: A1