WO2022143429A1 - 计算机系统、可信功能组件及运行方法 - Google Patents

计算机系统、可信功能组件及运行方法 Download PDF

Info

Publication number
WO2022143429A1
WO2022143429A1 PCT/CN2021/140990 CN2021140990W WO2022143429A1 WO 2022143429 A1 WO2022143429 A1 WO 2022143429A1 CN 2021140990 W CN2021140990 W CN 2021140990W WO 2022143429 A1 WO2022143429 A1 WO 2022143429A1
Authority
WO
WIPO (PCT)
Prior art keywords
trusted
layer
measurement
measured
operating system
Prior art date
Application number
PCT/CN2021/140990
Other languages
English (en)
French (fr)
Inventor
邵萌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21914166.0A priority Critical patent/EP4258146A4/en
Publication of WO2022143429A1 publication Critical patent/WO2022143429A1/zh
Priority to US18/344,240 priority patent/US20230342472A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/572—Secure firmware programming, e.g. of basic input output system [BIOS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present application relates to the technical field of trusted computing, and in particular, to a computer system, a trusted functional component and an operating method.
  • Trusted computing technology can implant a cryptographic algorithm in a computer, and use the cryptographic algorithm to add a trustworthy measurement mechanism in each execution stage of the computer's running process to ensure the security of the computer.
  • the present application provides a computer system, a trusted functional component and an operating method, which can ensure the security of the trusted measurement and control of the computing component and the trusted functional component based on the trusted root.
  • the technical solutions provided by this application are as follows:
  • the present application provides a computer system, the computer system includes: a computing component and a trusted function component, and the trusted function component includes an out-of-band management chip; A trusted root is built in the management chip, and the computing component is measured based on the trusted root, and the computing component is controlled based on the trusted measurement result;
  • the security of the constructed root of trust can be guaranteed.
  • the trusted measurement and control of computing components and trusted functional components based on the trusted root can ensure the security of trusted measurement and control.
  • the out-of-band management chip has a security core; the security core is specifically used to build a root of trust in the security core by running the security firmware. Since the security core realizes physical isolation, the physical isolation can ensure the security within the security core. Therefore, the construction process of constructing the trusted root can be realized through the security core, and the security of the constructed trusted root can be further guaranteed.
  • the Root of Trust Metric Core (CRTM) used to build the Root of Trust is stored in the read-only memory of the out-of-band management chip. Since the CRTM is stored in the read-only memory, the read-only memory can only be accessed by the security core, and the read-only memory can only be read and cannot be written. When tampering, since the read-only memory does not support rewriting, malicious tampering of the executable code stored in the read-only memory can be prevented, the security of the CRTM stored in the read-only memory can be guaranteed, and the CRTM can be further guaranteed. The security of the built root of trust.
  • CRTM Root of Trust Metric Core
  • the security firmware includes a configuration specifically configured to perform trusted measurement on the computing component, and control the computing component based on the result of the trusted measurement on the computing component.
  • the measurement subject can be concentrated as much as possible
  • the object to be measured can be as close to the root of trust as possible, which can solve the problem that the measurement subject in the computing component is also the object to be measured, resulting in the confusion of the identity of the measurement subject and the object to be measured, and the blurred boundary between the trusted domain and the untrusted domain. It can further ensure the security of computing components.
  • the security firmware is specifically used to carry out credible measurement to at least two objects to be measured in the computing component, based on the credible measurement result of any object to be measured in the at least two objects to be measured, to any object to be measured. Take control.
  • the security firmware when used to perform credible measurement on at least two objects to be measured in the computing component, the credible measurement and the control process of the at least two objects to be measured will not depend on each other.
  • the chain-of-trust chain of transmission is changed to a centralized trusted topology structure centered on secure firmware, which can avoid the occurrence of a certain object to be measured in the computing component being attacked or tampered with, resulting in the breakage of the entire chain of trust.
  • the calculation component includes a plurality of objects to be measured.
  • the objects to be measured in the computing component include: the image file of the basic input/output device, the image file of the first operating system kernel, the image file of the boot layer of the first operating system, and the image file of the business application.
  • the object to be measured of the computing component also includes: the configuration file of the complex programmable logic device.
  • the security of starting and running of the complex programmable logic device can be ensured by performing credible measurement on the complex programmable logic device.
  • the secure firmware includes: a secure firmware boot layer, a secure firmware boot layer, and a secure firmware function layer.
  • the trusted measurement and control of the trusted functional components can also be performed, and the implementation methods include:
  • the out-of-band management chip is specifically used to run the secure firmware boot layer, and build a root of trust in the out-of-band management chip.
  • the secure firmware boot layer is also used to perform trust measurement on the secure firmware boot layer based on the The measurement result of the security firmware layer is used to control the secure firmware boot layer; the secure firmware boot layer is used to perform trusted measurement on the secure firmware functional layer based on the root of trust, and control the secure firmware functional layer based on the measurement results of the secure firmware functional layer. ;
  • the security firmware function layer is used to perform credible measurement on the object to be measured, and control other objects to be measured based on the credible measurement results of other objects to be measured. Other objects to be measured include the objects to be measured except the security firmware in the computer system object.
  • the out-of-band management chip has a security core, and the security core is specifically used for running security firmware.
  • the secure firmware boot layer, the secure firmware boot layer, and the secure firmware functional layer are all run by the secure core, so as to further ensure the security of the secure firmware boot layer, the secure firmware boot layer, and the secure firmware functional layer.
  • Running the security firmware through the security core can take advantage of the physical isolation advantage of the security core, so that the components running in the performance domain environment do not have the basis for overrunning the security domain, realizing the isolation protection of the security firmware, and ensuring that the computer has better security. .
  • the out-of-band management chip has a performance core that is used to run a second operating system of the computer.
  • the trusted function component further includes: a second operating system boot layer, a second operating system kernel layer, and a trusted application layer, and the performance core is used to run the second operating system boot layer, the second operating system kernel layer, and the trusted application program layer. letter application layer.
  • the implementation of the trusted measurement and control of the trusted functional components also includes:
  • the trusted function component further includes: a second operating system boot layer, a second operating system kernel layer, and a trusted application layer; the security firmware is also used to perform trust measurement on the second operating system boot layer based on the root of trust, and based on the The measurement result of the second operating system boot layer is used to control the second operating system boot layer; the second operating system boot layer is used to measure the trustworthiness of the second operating system kernel layer based on the root of trust, and based on the second operating system boot layer The measurement result of the kernel layer controls the second operating system kernel layer; the second operating system kernel layer is used to perform trusted measurement on the trusted application layer based on the root of trust, and based on the measurement result of the trusted application layer, Control the trusted application layer; the trusted application layer is used to receive out-of-band management signals from outside the computer system, and provide operation and maintenance services and/or security services based on the out-of-band management signals.
  • the second operating system kernel layer includes: a trusted software base module; the trusted software base module is used to obtain the first operating system kernel of the computing component, the application program, the second operating system kernel and the trusted functional component in the trusted function component. At least one credible model of the object to be measured in the application software, and based on the credible model of any object to be measured, the credible measurement of any object to be measured is performed, and the credible model of the object to be measured is used to reflect the reliability of the object to be measured.
  • the trust level, the trust model includes the measurement value and other parameters of the object to be measured.
  • the operation security of the second operating system can be further ensured, and the security of the computer maintained according to the trusted software base module can be further ensured.
  • the trusted model of the object to be measured is obtained through the trusted software base module, and the trusted measurement of the object to be measured is performed according to the trusted model. Since the trusted model includes a measurement value and one or more other parameters, it can be obtained from Multiple dimensions reflect the credibility of the object to be measured, which improves the accuracy of describing the credibility of the object to be measured. When the credibility of the object to be measured is measured according to the credibility model, the security of the object to be measured is improved. .
  • the second operating system kernel layer further includes one or more of the following: a trusted measurement policy management module, a trusted control policy management module, a trusted reference library management module, and trusted measurement result and log management module;
  • the trusted measurement policy management module is used to manage the measurement policies used in the trusted measurement process, and provide measurement policies to the measurement subject, which is used to perform trusted measurement on the object to be measured;
  • the trusted control policy management module is used to manage The control strategy to control the object to be measured according to the measurement result, and provide the control strategy to the measurement subject;
  • the trusted benchmark library management module is used to manage the measurement benchmark used to compare the measurement value of the object to be measured in the process of trusted measurement, and Provide measurement benchmarks to measurement subjects;
  • the trusted measurement results and log management module is used to record the trusted measurement results and information used to reflect the trusted measurement process.
  • the second operating system kernel layer further includes: trusted middleware, and the trusted middleware includes: a trusted measurement service module; the second operating system kernel layer has a function of performing trusted measurement on the trusted application layer based on the root of trust , through the trusted measurement service module based on the trusted root to perform the trusted measurement on the trusted application layer; the second operating system kernel layer is also used to perform trusted measurement on the trusted middleware based on the trusted root.
  • the measurement result of the middleware controls the trusted middleware.
  • the trusted middleware also includes one or more of the following: a remote security management proxy module, a remote trusted certification proxy module, and a trusted password service middleware;
  • the remote security management proxy module is used to communicate with the remote security operation and maintenance management center based on The connection to the trusted functional components provides remote security management services;
  • the remote trusted certification proxy module is used to provide remote trusted certification services for trusted functional components based on the connection with the remote security operation and maintenance management center;
  • the trusted password service intermediate The software is used to provide the computing component and the trusted functional component with the application program interface for using the cryptographic module.
  • the credible metric includes: the credible metric executed during the running of the object to be measured and the credible metric executed during the startup phase of the object to be measured; when the credible metric is executed during the running of the object to be measured, the control is used to indicate Whether the object to be measured continues to run; this control is used to indicate whether the object to be measured starts when credible measurement is performed in the startup phase of the object to be measured.
  • the trusted protection capability provided by the embodiments of the present application can cover the running period and the startup phase of the computing component and the trusted functional component.
  • the present application provides a trusted functional component of a computer system.
  • the trusted functional component includes: a baseboard management controller BMC chip, where a security firmware functional layer runs in the security core of the BMC chip;
  • the security firmware function layer constructs a root of trust in the BMC chip, and performs the trusted measurement on at least one object to be measured in the computing component of the computer system, based on the trusted measurement of any object to be measured in the at least one object to be measured As a result, any object to be measured is controlled; at least one object to be measured includes one or more of the following: a configuration file of a complex programmable logic device, an image file of a basic input/output device, an image file of the first operating system kernel, The image file of the boot layer of the first operating system and the image file of the business application.
  • the present application provides a trusted functional component of a computer system
  • the trusted functional component includes a baseboard management controller BMC chip
  • the BMC chip includes a security core and a performance core
  • the security core is used to start by running secure firmware Layer, build a root of trust in the BMC chip, perform trusted measurement on the trusted functional components and computing components of the computer system, and control the object to be measured based on the trusted measurement result of the object to be measured.
  • the objects to be measured include one or more of the following: an image file of the boot layer of the secure firmware, an image file of the functional layer of the secure firmware, an image file of the boot layer of the second operating system, an image file of the kernel layer of the second operating system, and an image file of the trust layer of the second operating system.
  • the image file of the application, the secure firmware boot layer and the secure firmware function layer are configured to be executed by the secure core
  • the second operating system boot layer, the second OS kernel layer and the trusted application layer are configured to be executed by the performance core.
  • the secure firmware boot layer is used to perform trusted measurement on the secure firmware boot layer based on the root of trust built in the BMC chip, and based on the measurement result of the secure firmware boot layer, the secure firmware boot layer is control; the secure firmware boot layer is used to perform credible measurement on the secure firmware functional layer based on the root of trust, and based on the measurement results of the secure firmware functional layer, the secure firmware functional layer is controlled; the secure firmware functional layer is used to measure the second
  • the operating system boot layer performs trust measurement, and controls the second operating system boot layer based on the trust measurement result of the second operating system boot layer; the second operating system boot layer is used for the second operating system based on the root of trust
  • the kernel layer performs trusted measurement, and controls the second operating system kernel layer based on the measurement result of the second operating system kernel layer; the second operating system kernel layer is used for trusting the trusted application layer based on the root of trust.
  • the trusted application layer is used to receive out-of-band management signals from outside the computer system, and provide operation and maintenance services based on the out-of-band management signals. / or security services.
  • the present application provides a computer system, the computer system includes: a remote security operation and maintenance management center, where the remote security operation and maintenance management center is used for the trusted function provided by the first aspect, the second aspect or the third aspect component, which provides remote centralized management services and operation and maintenance services.
  • the remote security operation and maintenance management center includes one or more of the following: a remote trusted certification center, a trusted policy and benchmark management center, and a platform security management and audit center;
  • the remote trusted certification center is used to provide computers with trusted challenges and Remote trusted certification service;
  • the trusted policy and benchmark management center is used to manage the trusted measurement policy, control policy and trusted benchmark library in the computer;
  • the platform security management and audit center is used to provide the boot layer trust in the computer.
  • the component provides a remote connection interface, a visual interface function of trusted measurement results, and a trusted log audit function.
  • the computer By configuring the remote security operation and maintenance management center for the computer, the computer provided by this application can cooperate with the remote security operation and maintenance management center to provide rich security operation and maintenance management capabilities and remote trusted certification service capabilities, so that it can be used in the trusted functional components of the computer system. Establish a credible and complete measurement subject and a credible software execution environment.
  • the present application provides a method for operating a computer system, the method comprising: an out-of-band management chip of the computer system constructs a root of trust in the out-of-band management chip by running secure firmware, and based on the root of trust
  • the computing component of the device performs trusted measurement, and controls the computing component based on the trusted measurement result; the computing component performs the operation indicated by the control based on the control of the out-of-band management chip.
  • the security of the constructed root of trust can be guaranteed.
  • the trusted measurement and control of computing components and trusted functional components based on the trusted root can ensure the security of trusted measurement and control.
  • the security core is specifically used to build a root of trust in the security core by running the security firmware.
  • the trusted metric root core used to build the root of trust is stored in the read-only memory of the out-of-band management chip.
  • the security firmware is specifically used to perform trusted measurement on the computing component, and control the computing component based on the trusted measurement result of the computing component.
  • the security firmware performs credible measurement on at least two objects to be measured in the computing component, and controls any object to be measured based on the trusted measurement result of any object to be measured in the at least two objects to be measured.
  • the objects to be measured in the computing component include: the image file of the basic input/output device, the image file of the first operating system kernel, the image file of the boot layer of the first operating system, and the image file of the business application program.
  • the object to be measured of the computing component further includes: a configuration file of a complex programmable logic device.
  • the secure firmware includes: a secure firmware boot layer, a secure firmware boot layer, and a secure firmware function layer.
  • credible measurement and control can also be performed on the credible functional components.
  • the method further includes: : The out-of-band management chip runs the secure firmware boot layer, and builds a root of trust in the out-of-band management chip.
  • the secure firmware boot layer performs trusted measurements on the secure firmware boot layer based on the root of trust.
  • the secure firmware boot layer Controls the secure firmware boot layer; the secure firmware boot layer performs trusted measurements on the secure firmware functional layer based on the root of trust, and controls the secure firmware functional layer based on the measurement results of the secure firmware functional layer; the secure firmware functional layer controls other
  • the object to be measured is credibly measured, and other objects to be measured are controlled based on the credible measurement results of other objects to be measured, and the other objects to be measured include objects to be measured in the computer system except the security firmware.
  • the out-of-band management chip has a security core; the security core is specifically used to run the security firmware boot layer, the security firmware boot layer and the security firmware function layer.
  • the out-of-band management chip has a performance core for running the second operating system.
  • the method further includes: the out-of-band management chip runs the second operating system boot layer, the second operating system kernel layer and the trusted application layer of the computer system; the security firmware performs the second operating system boot layer based on the trusted root.
  • Trust measurement based on the measurement result of the second operating system boot layer, controls the second operating system boot layer; the second operating system boot layer performs trust measurement on the second operating system kernel layer based on the root of trust, based on the The measurement result of the kernel layer of the second operating system controls the kernel layer of the second operating system; the kernel layer of the second operating system performs the trusted measurement of the trusted application layer based on the root of trust, and based on the measurement of the trusted application layer
  • the trusted application layer is controlled; wherein, the trusted application layer is configured to receive out-of-band management signals from outside the computer system, and provide operation and maintenance services and/or security services based on the out-of-band management signals.
  • the second operating system kernel layer includes: a trusted software base module.
  • the method further includes: the trusted software base module obtains the first operating system kernel of the computing component, the application program, the second operating system kernel in the trusted functional component, and the trusted model of at least one object to be measured in the trusted application software, And perform credible measurement on any object to be measured based on the credible model of any object to be measured, the credible model of the object to be measured is used to reflect the credibility of the object to be measured, and the credible model includes the measurement value of the object to be measured and other parameters.
  • the second operating system kernel layer further includes one or more of the following: a trusted measurement policy management module, a trusted control policy management module, a trusted reference library management module, and a trusted measurement result and log management module.
  • the method further includes one or more of the following operations: the trusted measurement policy management module manages the measurement policy used in the trusted measurement process, and provides the measurement policy to the measurement subject, and the measurement subject is used to perform trusted measurement on the object to be measured. ;
  • the trusted control strategy management module manages the control strategy for controlling the object to be measured according to the measurement results, and provides the control strategy to the measurement subject;
  • the comparative measurement benchmarks are provided to the measurement subject; the trusted measurement results and log management module records the trusted measurement results and information used to reflect the trusted measurement process.
  • the second operating system kernel layer further includes: trusted middleware, and the trusted middleware includes: a trusted measurement service module; correspondingly, the second operating system kernel layer performs a trustworthy application layer on the trusted root based on the root of trust.
  • the function of trust measurement is realized by the trust measurement service module based on the trust root to perform trust measurement on the trusted application layer.
  • the method further includes: the second operating system kernel layer performs trust measurement on the trusted middleware based on the root of trust, and controls the trusted middleware based on the measurement result of the trusted middleware.
  • the trusted middleware further includes one or more of the following: a remote security management agent module, a remote trusted certification agent module, and a trusted password service middleware; correspondingly, the method further includes one or more of the following: a remote Based on the connection with the remote security operation and maintenance management center, the security management agent module provides remote security management services for trusted functional components; the remote trusted certification agent module provides remote security management services for trusted functional components based on the connection with the remote security operation and maintenance management center. Trusted attestation service; trusted cryptographic service middleware provides computing components and trusted functional components with APIs for using cryptographic modules.
  • the credible metric includes: credible metric executed during the operation of the object to be measured and credible metric executed during the startup phase of the object to be measured; when the credible metric is executed during the running of the object to be measured, the control is used to indicate the object to be measured. Whether the measurement object continues to run; when the trusted measurement is executed in the startup phase of the object to be measured, the control is used to indicate whether the object to be measured is started.
  • the present application provides a method for operating a trusted functional component of a computer system.
  • the trusted functional component includes a baseboard management controller BMC chip.
  • the method includes: the BMC chip constructs a root of trust in the BMC chip by running the security firmware function layer of the computer, and performs credible measurement on at least one object to be measured in the computing component of the computer system, based on the at least one object to be measured in the object to be measured. The credible measurement result of any object to be measured is controlled, and any object to be measured is controlled.
  • At least one object to be measured includes one or more of the following: a configuration file of a complex programmable logic device, an image file of a basic input/output device, an image file of the first operating system kernel, and an image file of the first operating system boot layer and image files for business applications.
  • the present application provides a method for operating a trusted functional component of a computer system.
  • the trusted functional component includes a baseboard management controller BMC chip, and the BMC chip includes a security core and a performance core.
  • the method includes: a security core builds a trusted root in a BMC chip by running a secure firmware boot layer, performs trusted measurement on the trusted functional components and computing components of the computer system, and based on the trusted measurement result of the object to be measured, the measurement is performed. object to control.
  • the objects to be measured include one or more of the following: an image file of the boot layer of the secure firmware, an image file of the functional layer of the secure firmware, an image file of the boot layer of the second operating system, an image file of the kernel layer of the second operating system, and an image file of the trust layer of the second operating system.
  • the image file of the application, the secure firmware boot layer and the secure firmware function layer are configured to be executed by the secure core
  • the second operating system boot layer, the second OS kernel layer and the trusted application layer are configured to be executed by the performance core.
  • the process of performing trust measurement on the BMC chip includes: the secure firmware boot layer is based on the root of trust built in the BMC chip, performs trust measurement on the secure firmware boot layer, The measurement result controls the secure firmware boot layer; the secure firmware boot layer performs credible measurements on the secure firmware functional layer based on the root of trust, and controls the secure firmware functional layer based on the measurement result of the secure firmware functional layer; the secure firmware function The second operating system boot layer performs trusted measurement on the second operating system boot layer, and controls the second operating system boot layer based on the trusted measurement result of the second operating system boot layer; the second operating system boot layer is based on the root of trust.
  • the operating system kernel layer performs trust measurement, and controls the second operating system kernel layer based on the measurement results of the second operating system kernel layer; the second operating system kernel layer trusts the trusted application layer based on the root of trust.
  • the measurement based on the measurement results of the trusted application layer, controls the trusted application layer.
  • the trusted application layer receives out-of-band management signals from outside the computer system, and provides operation and maintenance services and/or security services based on the out-of-band management signals.
  • the present application provides a method for operating a computer system.
  • the method includes: a remote security operation and maintenance management center of the computer system provides a remote centralized management service and an operation and maintenance service for the trusted functional components provided by the first aspect, the second aspect or the third aspect.
  • the remote security operation and maintenance management center provides remote centralized management services and operation and maintenance services, including one or more of the following: the remote trusted certification center provides trusted challenges and remote trusted certification services for computers; The Trust Policy and Benchmark Management Center manages the trusted measurement policy, trusted control policy and trusted benchmark library in the computer; the Platform Security Management and Audit Center provides a remote connection interface for the trusted components of the boot layer in the computer, provides trusted Measurement results visualization interface function and trusted log audit function.
  • FIG. 1 is a schematic structural diagram of a computer provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a hardware platform provided by an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of another computer provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a computer system provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a centralized trusted topology structure provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of another computer system provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of another computer system provided by an embodiment of the present application.
  • FIG. 8 is a flowchart of a method for running a computer system provided by an embodiment of the present application.
  • Trusted computing is widely used in computers and is based on a trusted computing platform supported by cryptographic modules to improve the overall security of the computer.
  • the cryptographic module is a security chip that provides integrity and authenticity guarantees for the computer, and is generally strongly bound to the hardware platform of the computer through physical means.
  • the core function of the cryptographic module is to build three-dimensional functions of trusted computing based on autonomous cryptographic algorithms, including: platform integrity measurement and verification, platform trusted identity identification and authentication, and platform data protection.
  • the cryptographic module may be a trusted cryptographic module (trusted crypto module, TCM) or a trusted platform module (trusted platform module, TPM).
  • Trusted control refers to the control operation performed on the measurement object according to the trusted measurement result. Therefore, the trusted control can also be called control. Among them, when the measurement of the object to be measured passes, the original state of the object to be measured can be maintained, or the operation expected to be performed by the object to be measured before it is trusted to be measured can be performed. When the measurement of the object to be measured does not pass, the measurement can be processed.
  • the object takes security measures, for example, the computer can be controlled to reset, or the object to be measured can be controlled to be restarted, so as to avoid the security threat to the computer caused by the reason that the measurement fails.
  • Root of trust It is the source of trust in the trust measurement, and it is a component that must be trusted.
  • a trusted computing platform includes three trusted roots: root of trust for measurement (RTM), root of trusted storage (root of trust for storage, RTS) and root of trusted reporting (root of trust for reporting, RTR).
  • RTM root of trust for measurement
  • RTS root of trusted storage
  • RTR root of trusted reporting
  • the trusted measurement root is the root of trust that needs to be used when measuring operations are involved
  • the trusted storage root is the root of trust that needs to be used when storing operations
  • the trusted reporting root is the root of trust involved in reporting read and write The trusted root used for other operations.
  • Core root of trust for measurement It is an executable code for establishing a root of trust measurement, and a root of trust measurement can be established by running the root of trust measurement core.
  • the trusted measurement root core is the first piece of code executed after the trusted computing platform is powered on.
  • Trusted software base is an important part of the trusted computing system, and is designed based on the dual-system architecture idea of computing and protection coexisting.
  • the dual system at the software level is the host basic software and the trusted software base.
  • the trusted software base actively intercepts and measures when the host basic software is running, without modifying the original application, and implements active real-time protection by formulating policies, thereby destroying and preventing malicious software such as viruses or Trojans from entering the system, and achieving the security of active immune defense Effect.
  • Baseboard management controller widely used in server-type computer platform processors out-of-band management subsystem, its functions include virtual keyboard, mouse, display, power management control and remote operation and maintenance, etc. Monitoring of logistics information such as power supply voltage, temperature, fan status, and chassis status of the platform.
  • the baseboard management controller is the first component of the motherboard that is powered on.
  • BIOS Basic input/output system
  • I/O interface Basic input/output system
  • FIG. 1 is a schematic structural diagram of a computer provided by an embodiment of the present application.
  • the computer can be: any type of server, desktop and laptop.
  • the computer includes: a hardware platform 11 , a computing component 12 running on the hardware platform 11 , and a trusted function component 13 , and a communication connection is established between the hardware platform 11 , the computing component 12 , and the trusted function component 13 .
  • the hardware platform 11 includes various hardware required for the operation of the computer.
  • the hardware platform 11 includes: a processor 111, a memory 112, a communication interface 113, a bus 114, a cryptographic module 115, and the like.
  • the processor may be a general-purpose processor, for example, a central processing unit (central processing unit, CPU).
  • CPU central processing unit
  • the memory may include various types of memory.
  • the memory may include read only memory (ROM), and the memory may also include volatile memory (volatile memory), such as random-access memory (RAM).
  • volatile memory volatile memory
  • RAM random-access memory
  • the memory may also include non-volatile memory (non-volatile memory) such as NAND flash memory (flash), flash memory (flash memory), hard disk drive (HDD) or solid-state drive (SSD) .
  • flash non-volatile memory
  • flash memory flash memory
  • HDD hard disk drive
  • SSD solid-state drive
  • the memory may also include a combination of the above-mentioned types of memory.
  • the communication interface can be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, and other devices with a network access function.
  • the bus can be divided into address bus, data bus, control bus and so on.
  • the cryptographic module 115 may be TCM or TPM or the like.
  • the cryptographic module 115 may be a cryptographic chip or module that meets the standard requirements of the "GM/T 0013-2012 Trusted Computing Trusted Cryptographic Module Compliance Test Specification", and provides SM3, national cryptographic algorithm services for Non-volatile registers for storing metric values, and application command interface via serial peripheral interface (SPI) interface.
  • SPI serial peripheral interface
  • the computing component 12 is used to provide computing services to users.
  • the computing component 12 includes: a basic input output system (basic input output system, BIOS), a first operating system boot layer, a first operating system kernel, and business applications.
  • BIOS basic input output system
  • the business application is configured to receive a task request submitted by a user, execute the computing task requested by the task request according to the task request, and provide the user with a computing result.
  • the trusted functional component 13 is the first component that is powered on and runs on the computer, and is used to provide out-of-band management services for the computing component 12.
  • the out-of-band management service may include: controlling the state and behavior of the computing component 12 , providing operation and maintenance management capabilities for the computing component 12 , and performing trust measurement, trust control, and security operation and maintenance on the computing component 12 .
  • the trusted functional component 13 can perform trusted measurement and trusted control on the computing component 12 during the startup phase and the running phase of the computing component 12, so as to ensure the safe and trusted startup and operation of the computer.
  • the trusted function component 13 includes: an out-of-band management chip 131 .
  • the out-of-band management chip 131 runs an out-of-band management component 132 .
  • the out-of-band management chip 131 may be a baseboard management controller.
  • the trusted function component 13 is also referred to as a BMC trusted function component or a BMC out-of-band management system.
  • FIG. 3 is a schematic diagram of a computer system provided by an embodiment of the present application.
  • the computer system includes: a computing component 12 and a trusted function component 13
  • the trusted function component 13 includes an out-of-band management chip 131 .
  • An out-of-band management component 132 runs on the out-of-band management chip 131
  • the out-of-band management component 132 includes: security firmware 1321 .
  • the out-of-band management chip 131 is used to construct a root of trust in the out-of-band management chip 131 by running the security firmware 1321, perform trust measurement on the computing component 12 based on the root of trust, and perform trust measurement on the computing component 12 based on the trust measurement result.
  • control also called control.
  • the process of constructing the root of trust by running the security firmware 1321 may include: driving the cryptographic module 115 by running the security firmware 1321 , and constructing the root of trust in the out-of-band management chip 131 by the cryptographic module 115 .
  • the computing component 12 is configured to perform the operation indicated by the trusted control based on the trusted control of the out-of-band management chip 131 .
  • the root of trust in the out-of-band management chip 131, since the out-of-band management chip 131 has the characteristics of more secure hardware, the security of the built root of trust can be guaranteed, and the use of the root of trust can be ensured for computing.
  • Component 12 performs trust measurement and trust control security.
  • the credible metric includes: the credible metric executed during the running of the object to be measured and the credible metric executed during the startup phase of the object to be measured.
  • the trusted control is used to indicate whether the object to be measured continues to run.
  • the credible measurement and credible control of the to-be-measured object during the running period of the to-be-measured object can effectively ensure the security of the to-be-measured object during the running period.
  • the credible control is used to indicate whether the object to be measured is started, and the credible measurement and credible control of the object to be measured in the startup phase of the object to be measured can effectively ensure that the object to be measured is started.
  • the security of the object during the startup phase is used to indicate whether the object to be measured is started.
  • running the security firmware 1321 to build a root of trust is to realize the function of building a root of trust by running the CRTM in the security firmware 1321 .
  • the root of trust is the trust source of the entire trusted computing platform, after the out-of-band management subsystem is powered on, the CRTM can be automatically loaded into the executable memory area for execution, and the CRTM is started when the out-of-band management subsystem is powered on. The first piece of code to be executed after.
  • the out-of-band management chip 131 has a security core.
  • the operation of constructing the root of trust can be realized through the security core. That is, the security core is specifically used to build a root of trust in the security core by running the security firmware 1321 .
  • the CRTM can run in the security domain memory of the out-of-band management chip 131 .
  • the security firmware 1321 is also called security core firmware.
  • the security core realizes physical isolation, the physical isolation can ensure the security within the security core. Therefore, the construction process of constructing the trusted root can be realized through the security core, and the security of the constructed trusted root can be further guaranteed.
  • the CRTM is stored in a read only memory (ROM) of the out-of-band management chip 131 .
  • ROM read only memory
  • CRTMs are preset in read-only memory at the factory.
  • the read-only memory can only be accessed by the security core of the out-of-band management chip 131, and can only perform read operations but not write operations on the read-only memory.
  • the executable code is maliciously tampered with, since the read-only memory does not support rewriting, malicious tampering of the executable code stored in the read-only memory can be prevented, and the security of the CRTM stored in the read-only memory can be guaranteed. , which can further ensure the security of the root of trust constructed according to CRTM.
  • the process of performing the trusted measurement and the trusted control on the computing component 12 may be performed by the secure firmware 1321 .
  • the secure firmware 1321 includes: a secure firmware boot layer 1321a, a secure firmware boot layer 1321b, and a secure firmware function layer 1321c.
  • the secure firmware boot layer 1321a is a set including executable codes, and the set includes CRTM.
  • the secure firmware boot layer 1321a is also referred to as the secure core firmware boot layer.
  • the secure firmware boot layer 1321a is also called a secure core ROM code segment.
  • the secure firmware boot layer 1321b is run by the secure core
  • the secure firmware boot layer 1321b is also referred to as the secure core firmware boot layer.
  • the safety firmware function layer 1321c is also referred to as the safety core firmware function layer.
  • the secure firmware boot layer 1321b is a boot loader for booting the secure firmware function layer 1321c to start.
  • the image file of the secure firmware boot layer 1321b is stored in a non-volatile flash memory device outside the out-of-band management chip 131 .
  • the non-volatile flash memory device also has the functions of identifying and controlling the data access authority of the non-volatile flash memory device, encrypting the content and providing write protection for the content stored in the non-volatile flash memory device. function to improve the hardware security protection capability of the content stored in the non-volatile flash memory device, at this time, the non-volatile flash memory device is also referred to as a storage device with a hardware protection function.
  • the secure firmware functional layer 1321c is used to implement operations performed by the secure firmware 1321 on other components.
  • the image file of the security firmware function layer 1321c is stored in a non-volatile flash memory device outside the out-of-band management chip 131, such as a storage device with a hardware protection function.
  • the other components include software, firmware, and hardware in addition to security firmware 1321 .
  • the other component may be computing component 12 . Therefore, the process of performing trust measurement and trust control on the computing component 12 can be performed by the secure firmware function layer 1321c.
  • other components may include devices that the out-of-band management subsystem needs to connect to.
  • the functions of the security firmware function layer 1321c may include: implementing embedded multimedia card (embedded multimedia card, eMMC) interface drivers, SPI interface drivers, SPI type flash memory controller (serial peripheral interface flash controller, SFC) interface driver, CPU bus (also known as local bus) interface driver, Gigabit media access control (gigabit media access control, GMAC) interface driver, double rate (double data rate, DDR) memory interface driver, and peripheral component interconnect express (PCIe) bus interface driver, etc.
  • the interfaces corresponding to the above interface drivers are all interfaces that the trusted functional component 13 needs to use.
  • the eMMC interface is a standard flash management interface established by the Multimedia Card (MMC) Association.
  • MMC Multimedia Card
  • the eMMC interface is used to interface with an eMMC controller interface packaged in a non-volatile flash memory device, and the eMMC interface driver is used to drive and mount a storage device with a hardware protection function.
  • the SPI interface is a serial full-duplex synchronous communication bus interface, and is mainly used to read the content in the storage device of the BIOS 121 in the embodiment of the present application.
  • the SPI type flash memory controller is a highly customized serial interface based on the SPI interface according to the SPI type flash memory interface logic protocol, which is mainly used to connect the SPI type flash memory controller peripherals.
  • an SPI-type flash memory controller is used as a basic interface for integrating the cryptographic module 115 .
  • the local bus is a traditional data address multiplexing bus form.
  • the local bus uses a 60X bus 16-bit wide mode, which is mainly used as an out-of-band management chip 131 and a complex programmable logic device of the computer.
  • logic device, CPLD), CPLD is used as the logic controller of the power supply and circuit of the computer motherboard.
  • the PCIe interface is a high-speed serial computer expansion bus standard interface certified by the Peripheral Component Interconnect Special Interest Group (PCI-SIG), used for high-speed serial point-to-point dual-channel high-bandwidth transmission, connected by the PCIe interface
  • PCI-SIG Peripheral Component Interconnect Special Interest Group
  • the device exclusively shares the channel bandwidth and does not share the bus bandwidth.
  • a PCIe x1 physical interface (a PCIe interface) is used to establish a secure and trusted interaction channel between the trusted functional component 13 and the computing component 12.
  • the GMAC interface is mainly used to connect the out-of-band management chip 131 with the network interface controller device.
  • the DDR interface is a double-rate synchronous dynamic random access memory.
  • the DDR memory interface driver is used for application isolation and security protection for shared memory.
  • the hardware platform 11 may include a NAND flash memory, a BIOS, a dynamic random access memory (DRAM), a CPLD, and a cryptographic module 115 .
  • the NAND flash memory can be connected to the out-of-band management chip through the eMMC interface
  • the BIOS can be connected to the out-of-band management chip through the SPI interface
  • the DRAM can be connected to the out-of-band management chip through the DDR memory interface
  • the CPLD can be connected to the out-of-band management chip through the local bus.
  • the cryptographic module 115 may be connected to the out-of-band management chip 131 through an SFC interface.
  • the process of the secure firmware 1321 performing trust measurement and trust control on the computing component 12 may be performed by the secure firmware function layer 1321c. That is, the secure firmware function layer 1321c is specifically used to perform trusted measurement on the computing component 12, and based on the trusted measurement result on the computing component 12, perform trusted control on the computing component 12.
  • the calculation component 12 includes a plurality of objects to be measured.
  • the objects to be measured in the computing component 12 include: the image file of the BIOS 121, the image file of the first operating system kernel 122, the image file of the first operating system boot layer 123, and the image file of the business application 124. image file.
  • the object to be measured in the computing component 12 further includes: a configuration file of a complex programmable logic device (CPLD) 125.
  • CPLD complex programmable logic device
  • the configuration file of the complex programmable logic device 125 is used to configure the logic function of the complex programmable logic device 125 .
  • the security firmware function layer 1321c is configured to perform at least one object to be measured among the multiple objects to be measured. Trust Metrics and Trust Controls.
  • Fig. 5 is the schematic diagram that the security firmware function layer 1321c performs the credible measurement and credible control to the CPLD125, the BIOS 121, the first operating system kernel 122, the first operating system boot layer 123 and the business application program 124.
  • the measurement subject can be concentrated on the security firmware functional layer 1321c as much as possible, so that the object to be measured can be as close as possible to the root of trust, and it can be solved that the measurement subject in the computing component 12 is also the object to be measured, resulting in the measurement subject and the object to be measured.
  • Identity confusion and blurred boundaries between trusted domains and non-trusted domains can further ensure the security of the computing component 12 .
  • the credible measurement and the credible control process of the at least two objects to be measured can not be mutually dependent, and the The chain-of-trust chain of transmission in the related art is changed to a centralized trusted topology structure centered on the security firmware functional layer 1321c, which can avoid the occurrence of a certain object to be measured in the computing component 12 being attacked or tampered with, causing the entire chain of trust to break. Case.
  • the process of performing credible measurement on the object to be measured in the computing component is as follows: using the root of trust to measure the image file of the BIOS, then the BIOS measures the image file of the boot layer of the first operating system, and then the first The operating system boot layer performs trust measurement on the image file of the first operating system kernel. Therefore, the chain of trust in the related art is a chained chain of trust that is sequentially transmitted from the root of trust to the BIOS, the boot layer of the first operating system and the kernel of the first operating system.
  • the trusted functional component 13 Since the trusted functional component 13 is used to control the state and behavior of the computing component 12, and perform trusted measurement, trusted control, and security operation and maintenance on the computing component 12, the security and trusted attributes of the trusted functional component 13 become a
  • the security foundation of the trusted computing platform, ensuring the security of the software and firmware deployed and executed in the trusted functional component 13, is the primary problem that needs to be solved in building a trusted computing platform's security and trustworthy attributes. Therefore, in order to further improve the security of the computer, the trusted function component 13 itself can also be trusted to measure and control, and the implementation methods include:
  • the secure firmware boot layer 1321a is further configured to perform trusted measurement on the secure firmware boot layer 1321b based on the root of trust, and perform trustworthy control on the secure firmware boot layer 1321b based on the measurement result of the secure firmware boot layer 1321b.
  • the trusted control on the secure firmware boot layer 1321b includes: allowing the out-of-band management chip 131 to load and execute the secure firmware boot layer 1321b, and when the secure firmware boot layer 1321b is controlled
  • the trustworthy control on the secure firmware boot layer 1321b includes: not allowing the out-of-band management chip 131 to load and execute the secure firmware boot layer 1321b.
  • the secure firmware boot layer 1321b is used to perform trustworthy measurement on the secure firmware functional layer 1321c based on the root of trust, and perform trustworthy control on the secure firmware functional layer 1321c based on the measurement result of the secure firmware functional layer 1321c.
  • the credible control on the secure firmware functional layer 1321c includes: allowing the out-of-band management chip 131 to load and execute the secure firmware functional layer 1321c
  • the secure firmware functional layer 1321c is When the trustworthiness metric of 1321c is not passed
  • the trustworthy control on the secure firmware function layer 1321c includes: not allowing the out-of-band management chip 131 to load and execute the secure firmware function layer 1321c.
  • the security firmware functional layer 1321c is used to perform trusted measurement on other objects to be measured, and perform trusted control on other objects to be measured based on the trusted measurement results of other objects to be measured.
  • Other objects to be measured include objects to be measured except the security firmware 1321 in the computer system.
  • the other objects to be measured may be the objects to be measured in the computing component 12 , or the other objects to be measured may be the second operating system boot layer 1322 running on the out-of-band management chip 131 , or the like.
  • the credible control of other objects to be measured includes: allowing the other objects to be measured to be started or run, and when the credible measures of other objects to be measured do not pass,
  • the trusted control over other objects to be measured includes not allowing the other objects to be measured to be started or run.
  • multiple functional modules may be deployed in the secure firmware boot layer 1321a, secure firmware boot layer 1321b and secure firmware function layer 1321c, the secure firmware boot layer 1321a, secure firmware boot layer 1321b and secure firmware function layer
  • the above functions of the 1321c can be implemented through corresponding function modules.
  • One possible implementation is described below:
  • the secure firmware boot layer 1321a includes: a root of trust building module 1a1 and a first measurement module 1a2.
  • the trusted root building module 1a1 is used to build the trusted root.
  • the first measurement module 1a2 is used to perform trusted measurement and trusted control on the secure firmware boot layer 1321b.
  • the secure firmware boot layer 1321b includes: a first boot module 1b1 and a second measurement module 1b2.
  • the first boot module 1b1 is used for booting the secure firmware function layer 1321c to start.
  • the second measurement module 1b2 is used to perform trusted measurement and trusted control on the secure firmware function layer 1321c.
  • the secure firmware function layer 1321c includes: a trusted module service middleware 1c1 and a third measurement module 1c2.
  • the cryptographic module service middleware 1c1 is used to provide an application program interface using the cryptographic module 115, that is, the trusted module service middleware 1c1 is used to convert the function of the cryptographic module 115 into a driver, and convert the converted driver into an application program interface.
  • the form is provided to each module of the secure firmware function layer 1321c.
  • the third measurement module 1c2 is used to perform credible measurement and credible control on other objects to be measured.
  • the secure firmware functional layer 1321c can perform credible measurement and credible control on multiple objects to be measured, in order to ensure that the secure firmware functional layer 1321c can perform credible measurement and credible control of different objects to be measured.
  • the function of the third measurement module 1c2 can be realized by a plurality of sub-function modules.
  • the third measurement module 1c2 may include: a CPLD measurement module 1c21, a CPLD control function Module 1c22, BIOS measurement module 1c23, core trustworthy measurement and adjudication module 1c24 and platform trustworthy control module 1c25.
  • the CPLD measurement module 1c21 is used to perform credible measurement on the CPLD.
  • the CPLD control function module 1c22 is used to perform trusted control of the CPLD.
  • the BIOS measurement module 1c23 is used to perform credible measurement on the BIOS 121.
  • the core credibility measurement and adjudication module 1c24 is used to perform credibility measurement on the first operating system kernel 122 , the first operating system boot layer 123 and the business application program 124 .
  • the core trustworthiness measurement and adjudication module 1c24 is also used for public affairs in the security firmware function layer 1321c.
  • the core credibility measurement and adjudication module 1c24 is further configured to receive the respective objects to be measured sent by the CPLD measurement module 1c21, the CPLD control function module 1c22, and the BIOS measurement module 1c23, etc., and send the to-be-measured objects to the cryptographic module 115 , and the receiving cryptographic module 115 performs verification based on the metric value returned by the received object to be measured, generates a control command according to the verification result, and sends the control command to the platform trusted control module 1c25.
  • the platform trusted control module 1c25 is configured to perform trusted control on the corresponding measured object to be measured according to the control command. Among them, the measurement value is used to reflect the reliability of the object to be measured.
  • the objects to be measured may include image files (eg, binary files) and/or configuration files.
  • the object to be measured for the CPLD is the configuration file of the CPLD.
  • the object to be measured of the first operating system kernel 122 is the binary file of the first operating system kernel 122 .
  • the out-of-band management component 132 further includes: a second operating system boot layer 1322 , a second operating system kernel layer 1323 and a trusted application layer 1324 .
  • the second operating system boot layer 1322, the second operating system kernel layer 1323, and the trusted application layer 1324 are respectively introduced below:
  • the second operating system boot layer 1322 In addition to the function of booting the second operating system kernel layer 1323, the second operating system boot layer 1322 also has the function of: before booting the second operating system kernel layer 1323 to start The second operating system kernel layer 1323 performs trust measurement, and based on the measurement result of the second operating system kernel layer 1323, performs trust control on the second operating system kernel layer 1323 to control whether to start the second operating system kernel layer 1323.
  • the trusted control on the second operating system kernel layer 1323 includes: allowing the out-of-band management chip 131 to load and execute the second operating system kernel layer 1323, and when the trustworthiness metric for the second operating system kernel layer 1323 fails, the trustworthy control on the second operating system kernel layer 1323 includes: not allowing the out-of-band management chip 131 to load and execute the second operating system kernel layer 1323 .
  • the image file of the second operating system kernel layer 1323 is stored in a non-volatile flash memory device outside the out-of-band management chip 131, such as a storage device with a hardware protection function.
  • the second operating system kernel layer 1323 is also used to perform trust measurement on the trusted application layer 1324 based on the root of trust, and based on the trusted application The measurement results of the layer 1324 are used to perform trusted control on the trusted application layer 1324.
  • the trusted application layer 1324 includes one or more trusted applications.
  • a trusted application is an application that has been issued a digital certificate by the issuer and is managed for filing. After the trusted application is downloaded to the out-of-band management chip 131, the second operating system kernel layer 1323 executes the trusted application. credible measure.
  • the credible control of the credible application includes: allowing the credible application to enter the installation, upgrade or running process, and when the credible measure of the credible application fails , the trusted control of trusted applications includes: not allowing trusted applications to enter the installation, upgrade and running processes.
  • the trusted application layer 1324 is configured to receive out-of-band management signals from outside the computer system, and provide operation and maintenance services and/or security services based on the out-of-band management signals. As shown in FIG. 7, the trusted application layer 1324 includes one or more of the following trusted applications: a computer platform intelligent management system software set 1324a, a computer platform status and fault management software 1324b, a security module version upgrade management module 1324c, and a log Audit security operation and maintenance software 1324d.
  • the computer platform intelligent management system software set 1324a is a general term for out-of-band management, operation and maintenance function software.
  • the computer platform status and fault management software 1324b is software for performing status indication and fault processing on the computer platform by sensing information on the physical status of the computer platform, such as power and temperature.
  • the security module version upgrade management module 1324c is an application software that performs version upgrade management on the configuration file of the security firmware 1321 and the CPLD in the computing component 12, the binary file of the BIOS 121, and the binary file of the first operating system boot layer 123.
  • the function of the log auditing security operation and maintenance software 1324d is to audit the log files generated during the operation of the trusted functional component 13, and perform corresponding processing measures according to the instructions of the log information.
  • the second operating system boot layer 1322 is further included, and the security firmware 1321 is further configured to perform trust measurement on the second operating system boot layer 1322 based on the root of trust, and based on the second operating system boot layer 1322 The measurement result of the system boot layer 1322 performs trusted control on the second operating system boot layer 1322.
  • the trusted control on the second operating system boot layer 1322 includes: allowing the out-of-band management chip 131 to load and execute the second operating system boot layer 1322, when When the trust measurement of the second operating system boot layer 1322 fails, the trust control on the second operating system boot layer 1322 includes: not allowing the out-of-band management chip 131 to load and execute the second operating system boot layer 1322 .
  • the image file of the second operating system boot layer 1322 is stored in a non-volatile flash memory device outside the out-of-band management chip 131, such as a storage device with a hardware protection function.
  • the third measurement module 1c2 further includes: the second operating system boot layer measurement module 1c26 and The second operating system kernel measurement module 1c27.
  • the second operating system boot layer measurement module 1c26 is used to perform trust measurement on the second operating system boot layer 1322 .
  • the second operating system kernel measurement module 1c27 is used to perform credible measurement on the second operating system kernel.
  • the core credibility measurement and adjudication module 1c24 is also used to receive the object to be measured sent by the second operating system boot layer measurement module 1c26 and the second operating system kernel measurement module 1c27, and send the object to be measured to the cryptographic module 115.
  • the receiving cryptographic module 115 performs verification based on the metric value returned by the received object to be measured, generates a control command according to the verification result, and sends the control command to the platform trusted control module 1c25.
  • the platform trusted control module 1c25 is further configured to perform trusted control on the corresponding object to be measured according to the control command.
  • the second operating system boot layer 1322 includes: a second boot module 1322 a and a boot layer trusted component 1322 b.
  • the second boot module 1322a is used for booting the second operating system kernel layer 1323 to start.
  • the function of the second boot module 1322a can be implemented by standard open source Linux universal boot loader (universal boot loader, U-Boot) code.
  • the boot layer trusted component 1322b includes: a fourth measurement module 2b1.
  • the fourth measurement module 2b1 is used to perform trusted measurement on the second operating system kernel layer 1323 based on the root of trust, and perform trusted control on the second operating system kernel layer 1323 based on the measurement result of the second operating system kernel layer 1323 .
  • the second operating system kernel layer 1323 includes: a second operating system kernel 1323a and a kernel trusted component 1323b.
  • the second operating system kernel 1323a is used to implement the functions of the operating system kernel in the trusted function component 13 .
  • the functions of the second operating system kernel 1323a can be implemented by standard open source Linux operating system kernel codes.
  • the kernel trusted component 1323b includes: a fifth measurement module 3b1, the fifth measurement module 3b1 is used to perform trusted measurement on the trusted application layer 1324 based on the trusted root, and based on the trusted application The measurement results of the layer 1324 are used to perform trusted control on the trusted application layer 1324.
  • the kernel trusted component 1323b further includes: a trusted software base module 3b2.
  • the trusted software base module 3b2 is used to obtain the trusted model of at least one measurement object in the first operating system kernel of the computing component, the application program, the second operating system kernel in the trusted functional component 13, and the trusted application program, and In cooperation with the fifth measurement module 3b1, based on the trusted model of any to-be-measured object in the at least one measurement object, the reliability measurement is performed on any to-be-measured object.
  • the credibility model of the object to be measured is used to reflect the credibility of the object to be measured, and the credibility model includes the measurement value of the object to be measured and one or more other parameters.
  • the trusted software base module 3b2 may acquire the object to be measured, and perform modeling according to the object to be measured, so as to obtain a trusted model of the object to be measured.
  • the metric value can be obtained by the cryptographic module 115 by invoking the SM3 national cryptographic algorithm service according to the object to be measured.
  • the credible model of the object to be measured through the credible software base module 3b2, and perform credible measurement of the object to be measured according to the credible model. Since the credible model includes a metric value and one or more other parameters, it can Each dimension reflects the credibility of the object to be measured, which improves the accuracy of describing the credibility of the object to be measured. When the credibility of the object to be measured is measured according to the credibility model, the security of the object to be measured is improved.
  • the trusted measurement and trusted control can be performed in the loading stage, the startup stage and the running stage of the executable code running inside the trusted functional component 13, It can ensure the legitimacy and integrity of firmware and software code when loading, starting and running, and ensure that the firmware and software components running on the out-of-band management chip 131 have not been tampered with or implanted with malicious code, which further ensures the security of the computer .
  • the kernel trusted component 1323b further includes one or more of the following: a trusted measurement policy management module 3b3, a trusted control policy management module 3b4, a trusted reference library management module 3b5, and trusted measurement results and log management Module 3b6.
  • a trusted measurement policy management module 3b3, a trusted control policy management module 3b4, a trusted reference library management module 3b5, and trusted measurement results and log management Module 3b6 Each module is described below:
  • the credible measurement policy management module 3b3 is used to manage the measurement policies used in the credible measurement process, and provide the measurement subject with the measurement policy, and the measurement subject is used to perform the credible measurement of the object to be measured. And, corresponding to the kernel trusted component 1323b, it includes a trusted software base module 3b2, and the trusted measurement policy management module 3b3 is further configured to provide an interactive interface for interacting with the trusted software base module 3b2.
  • the management of the measurement policy by the trusted measurement policy management module 3b3 includes: enabling the measurement policy to be loaded, version upgrade and failback.
  • the measurement policy is used to indicate information such as the object to be measured and the measurement method used for credible measurement.
  • the measurement method is used to indicate the setting method of the object to be measured, the timing of the trusted measurement, and the cryptographic algorithm used for the trusted measurement.
  • Objects to be measured can include program code, data, and behavior.
  • the trusted control policy management module 3b4 is used to manage the control policy for performing trusted control on the object to be measured according to the measurement result, and provide the measurement subject with the control policy. And, corresponding to the kernel trusted component 1323b, it includes a trusted software base module 3b2, and the trusted control policy management module 3b4 is further configured to provide an interaction interface for interacting with the trusted software base module 3b2.
  • the management of the control policy by the trusted control policy management module 3b4 includes: enabling loading of the control policy, version upgrade and failback.
  • the control policy is used to indicate the control object of the trusted control (that is, the object to be measured to which the measurement result belongs) and the control scope, the state that the control object achieves through the trusted control, the way the control object responds according to the trusted control, and the The response of the object judges the execution effect of the trusted control.
  • the trusted reference library management module 3b5 is used to manage the measurement reference used for comparing the measurement value of the object to be measured in the trusted measurement process, and provide the measurement reference to the measurement subject.
  • the management of the metrics by the trusted reference library management module 3b5 includes: registering the metrics, enabling loading, version upgrade and failback. And, corresponding to the kernel trusted component 1323b, it includes a trusted software base module 3b2, and the trusted reference library management module 3b5 is also used to provide an interactive interface for interacting with the trusted software base module 3b2.
  • the credible measurement result and log management module 3b6 is used for recording the credible measurement result and the information for reflecting the credible measurement process.
  • the information used to reflect the credible measurement process includes the object to be measured.
  • the trusted measurement result includes information such as the measurement value generated by the cryptographic module 115 according to the object to be measured, and log content such as the verification result of verifying the information such as the measurement value.
  • the trusted measurement result and log management module 3b6 is also used to provide other modules with functional interfaces for managing measurement results and auditing logs.
  • the second operating system kernel layer 1323 further includes: trusted middleware 1323c.
  • the trusted middleware 1323c is used to provide services for the trusted application layer 1324.
  • the image file of the trusted middleware 1323c is stored in a non-volatile flash memory device outside the out-of-band management chip 131, such as a storage device with a hardware protection function.
  • the second operating system kernel layer 1323 it also includes a trusted middleware 1323c.
  • the trusted middleware 1323c is deployed between the second operating system kernel 1323a and the trusted application layer 1324.
  • the function of performing trust measurement on the trusted application layer 1324 based on the root of trust included in the operating system kernel layer 1323 is implemented by the trusted middleware 1323c performing trust measurement on the trusted application layer 1324 based on the root of trust.
  • the second operating system kernel layer 1323 is further configured to perform trusted measurement on the trusted middleware 1323c based on the root of trust, and perform trusted control on the trusted middleware 1323c based on the measurement result of the trusted middleware 1323c.
  • the trusted control of the trusted middleware 1323c includes: allowing the out-of-band management chip 131 to load and execute the trusted middleware 1323c, and when the trusted middleware 1323c is When the trusted metric of 1323c fails, the trusted control on the trusted middleware 1323c includes: not allowing the out-of-band management chip 131 to load and execute the trusted middleware 1323c.
  • the trusted middleware 1323c includes: a trusted measurement service module 3c1.
  • the second operating system kernel layer 1323 performs the trusted measurement process on the trusted application layer 1324 based on the root of trust
  • the trusted measurement service module 3c1 performs the trusted measurement on the trusted application layer 1324 based on the root of trust.
  • the trusted middleware 1323c further includes one or more of the following: a remote security management agent module 3c2, a remote trusted certification agent module 3c3, and a trusted cryptographic service middleware 3c4.
  • the remote security management agent module 3c2 is used to provide remote security management services for the trusted functional component 13 based on the connection with the remote security operation and maintenance management center 20 .
  • the remote trusted certification agent module 3c3 is used to provide the trusted functional component 13 with a remote trusted certification service based on the connection with the remote security operation and maintenance management center 20 .
  • the trusted cryptographic service middleware 3c4 is used to provide the computing component 12 and the trusted functional component 13 with an application program interface for using the cryptographic module.
  • the second operating system kernel layer 1323 further includes: a driver module for implementing an eMMC interface, a driver module for a PCIe bus interface, and a driver module for a DDR memory interface.
  • a driver module for implementing an eMMC interface a driver module for a PCIe bus interface
  • a driver module for a DDR memory interface a driver module for a DDR memory interface.
  • the second operating system boot layer 1322 further includes a boot layer trusted component 1322b
  • the second operating system kernel layer 1323 further includes a kernel trusted component 1323b and a trusted middleware 1323c
  • the version of the security module in the trusted application layer 1324 The upgrade management module 1324c is further configured to perform version upgrade management on the boot layer trusted component 1322b, the kernel trusted component 1323b and the trusted middleware 1323c.
  • the out-of-band management chip 131 includes a security core, and the security core can access all security domains on the out-of-band management chip 131 .
  • secure firmware 1321 is run by a secure core.
  • the secure firmware boot layer 1321a, the secure firmware boot layer 1321b and the secure firmware function layer 1321c are all run by the secure core to further ensure the security of the secure firmware boot layer 1321a, the secure firmware boot layer 1321b and the secure firmware function layer 1321c.
  • Running the security firmware 1321 through the security core can take advantage of the physical isolation advantage of the security core, so that the components running in the performance domain environment do not have the basis for overrunning the security domain, realizing the isolation protection of the security firmware 1321, and ensuring that the computer has better performance safety.
  • the out-of-band management chip 131 further includes a performance core, the security core is deployed in the security domain, and the performance core is deployed in the performance domain.
  • An isolation measure is set between the performance domain and the security domain, so that the performance domain cannot directly access the security domain.
  • the communication between the performance core and the safety core needs to be realized through the inter-core communication mechanism.
  • the performance domain includes the performance core and all hardware resources whose security attribute is the performance domain.
  • the performance domain performance core is started and controlled by the security core of the security domain, and can run the operating system software.
  • the out-of-band management chip 131 has a performance core, and the performance core is used to run the second operating system.
  • the performance core is used to run the second operating system.
  • the second operating system boot layer 1322, the second operating system kernel layer 1323, and the trusted application layer 1324 may be run by the performance core.
  • the cryptographic module 115 is a security device, the components run by the performance core cannot directly use the cryptographic module 115, and the interaction between the performance core and the cryptographic module 115 needs to be implemented through the security core.
  • the inter-core communication mechanism between the safety core and the performance core can be implemented through an interactive interface.
  • the interaction between the components running in the above performance core and the components running in the security core can be realized through the interaction interface.
  • the function of the secure firmware function layer 1321c, the function of the second operating system boot layer 1322, the function of the second operating system kernel layer 1323, and the function of the trusted middleware 1323c also include: for implementing the security core and the performance core The interactive interface driver for communication between them.
  • the computer system provided by the embodiment of the present application further includes: a remote security operation and maintenance management center 20 , and the computer and the remote security operation and maintenance management center 20 may be connected through a trusted network.
  • the remote security operation and maintenance management center 20 is a function set for remote centralized management and intelligent operation and maintenance of the security and trustworthy features of the computer.
  • the remote security operation and maintenance management center 20 can be deployed in an isolated manner from the remote operation and maintenance management center of the computer, so as to meet the requirements of isolated deployment.
  • the remote security operation and maintenance management center 20 and the computer's remote operation and maintenance management center can be deployed and run in different isolation domains of the same server system, or they can be deployed in independent server systems with different security attribute isolation domains respectively.
  • the maintenance management center 20 and the remote operation and maintenance management center of the computer are connected through a trusted network connection architecture.
  • the remote security operation and maintenance management center 20 may include one or more of the following: a remote trusted certification center 201 , a trusted policy and benchmark management center 202 , and a platform security management and audit center 203 .
  • the remote trusted certification center 201 is used to provide trusted challenge and remote trusted certification services for computers.
  • the trusted policy and benchmark management center 202 is the centralized management terminal of the trusted measurement policy, trusted control policy and trusted benchmark library in the computer, and can realize remote distribution, update management, version management of trusted policy and trusted benchmark library Services such as auditing and failover.
  • the platform security management and audit center 203 is used to provide remote connection interface, firmware and software upgrade management and version management functions, platform key management function, trusted measurement result visualization interface function and trusted log audit function for the trusted components of the boot layer.
  • the remote security management proxy module 3c2 and the remote trusted certification proxy module 3c3 in the trusted middleware 1323c are used to cooperate with the remote security operation and maintenance management center 20 .
  • the trusted application may be software that issues digital certificates and records and manages through the remote security operation and maintenance management center 20 at the time of issuance, and the trusted application may be delivered to a remote site through the remote security operation and maintenance management center 20 through a trusted network
  • the security management agent module 3c2 the remote security management agent module 3c2 performs the trusted measurement on the trusted application, and when the trusted measurement passes, it is allowed to enter the installation and running process.
  • the trusted application When the trusted measurement fails, the trusted application is not allowed to enter the installation and running process, and the failure of the trusted measurement can be fed back to the remote security operation and maintenance management center 20 to prompt the administrator to update the trusted firmware and upgrade. Deployment behavior to make decisions.
  • the second operating system boot layer 1322 is also used to establish the network interface controller driver and middleware, so as to facilitate the establishment of the trusted function component 13 and the remote security operation and maintenance management center Secure connection between 20.
  • the computer By configuring the remote security operation and maintenance management center 20 for the computer, the computer provided in the embodiment of the present application can cooperate with the remote security operation and maintenance management center 20 to provide rich security operation and maintenance management capabilities and remote trusted certification service capabilities, so that the computer system can In the trust function component 13, a trustworthy and complete measurement subject and trustworthy software execution environment are established.
  • the security of the constructed root of trust can be guaranteed .
  • the trusted measurement and trusted control are performed on the computing components and trusted functional components based on the trusted root, which can ensure the security of the trusted measurement and trusted control.
  • the trusted protection capability provided by the embodiments of the present application can cover the running period and startup phase of computing components and trusted functional components by performing trusted measurement and trusted control of the object to be measured during the running period and the startup phase.
  • the out-of-band management chip in the embodiment of the present application is the BMC
  • the physical isolation advantage of the security core of the BMC can be used, and the computer can be isolated and protected in a complete and stable manner, and compared with related technologies, it has higher security protection ability.
  • the embodiments of the present application also provide a method for running a computer system.
  • the method can be applied to the computer system provided by the embodiments of the present application.
  • the operating method of the computer system includes: an out-of-band management chip of the computer system constructs a root of trust in the out-of-band management chip by running secure firmware, and performs trust measurement on computing components of the computer system based on the trust root, and based on the trust measurement As a result, the computing component is controlled; the computing component performs the operation indicated by the control based on the control of the out-of-band management chip.
  • the security of the constructed root of trust can be guaranteed.
  • the trusted measurement and control of computing components and trusted functional components based on the trusted root can ensure the security of trusted measurement and control.
  • FIG. 8 is a flowchart of a method for running a computer system provided by an embodiment of the present application. As shown in Figure 8, the method includes:
  • Step 801 the out-of-band management chip of the computer system builds a root of trust in the out-of-band management chip by running the security firmware.
  • the security core is specifically used to build a root of trust in the security core by running the security firmware.
  • the secure firmware includes: a secure firmware boot layer, and the out-of-band management chip can build a root of trust in the out-of-band management chip by running the secure firmware boot layer.
  • the trusted metric root core used to build the root of trust is stored in the read-only memory of the out-of-band management chip.
  • Step 802 The out-of-band management chip measures the trusted functional components of the computer system according to the root of trust.
  • the secure firmware includes: a secure firmware boot layer, a secure firmware boot layer, and a secure firmware function layer.
  • credible measurement and control can also be performed on the credible functional components.
  • the implementation process includes: the secure firmware boot layer performs trustworthy measurements on the secure firmware boot layer based on the root of trust, and controls the secure firmware boot layer based on the measurement results of the secure firmware boot layer; the secure firmware boot layer is based on the root of trust.
  • the firmware function layer performs trusted measurement, and controls the security firmware function layer based on the measurement results of the security firmware function layer; the security firmware function layer performs trusted measurement on other objects to be measured, based on the trusted measurement of other objects to be measured.
  • other objects to be measured are controlled, and the other objects to be measured include objects to be measured except the security firmware in the computer system.
  • the out-of-band management chip has a security core; the security core is specifically used to run the security firmware boot layer, the security firmware boot layer and the security firmware function layer.
  • the out-of-band management chip also has a performance core, and the performance core is used to run the second operating system.
  • the out-of-band management chip runs a second operating system boot layer, a second operating system kernel layer, and a trusted application layer of the computer system.
  • step 802 further includes: the security firmware performs a trustworthy measurement on the boot layer of the second operating system based on the root of trust, and controls the boot layer of the second operating system based on the measurement result of the boot layer of the second operating system;
  • the boot layer of the second operating system performs trust measurement on the kernel layer of the second operating system based on the root of trust, and controls the kernel layer of the second operating system based on the measurement result of the kernel layer of the second operating system;
  • the kernel layer of the second operating system is based on the
  • the trusted root measures the trusted application layer, and controls the trusted application layer based on the measurement result of the trusted application layer.
  • the trusted application layer is used for receiving out-of-band management signals from outside the computer system, and providing operation and maintenance services and/or security services based on the out-of-band management signals.
  • the second operating system kernel layer includes: a trusted software base module.
  • the implementation process of step 802 further includes: the trusted software base module obtains at least one of the first operating system kernel, the application program, the second operating system kernel in the trusted functional component, and the trusted application software of the computing component to be pending
  • the credible model of the object is measured, and the credible measurement of any object to be measured is performed based on the credible model of any object to be measured.
  • the trustworthy model of the object to be measured is used to reflect the trustworthiness of the object to be measured, and the trustworthy model includes the measurement value and other parameters of the object to be measured.
  • the second operating system kernel layer further includes one or more of the following: a trusted measurement policy management module, a trusted control policy management module, a trusted reference library management module, and a trusted measurement result and log management module.
  • the method further includes one or more of the following operations: the trusted measurement policy management module manages the measurement policy used in the trusted measurement process, and provides the measurement policy to the measurement subject, and the measurement subject is used to perform trusted measurement on the object to be measured. ;
  • the trusted control strategy management module manages the control strategy for controlling the object to be measured according to the measurement results, and provides the control strategy to the measurement subject;
  • the comparative measurement benchmarks are provided to the measurement subject; the trusted measurement results and log management module records the trusted measurement results and information used to reflect the trusted measurement process.
  • the second operating system kernel layer further includes: trusted middleware.
  • the trusted middleware includes: a trusted measurement service module; correspondingly, the second operating system kernel layer has a function of performing trusted measurement on the trusted application layer based on the trusted root, and the trusted measurement service module is based on the trusted root.
  • the trusted application layer implements the trusted measurement
  • the implementation process of step 802 further includes: the second operating system kernel layer performs the trusted measurement on the trusted middleware based on the trusted root, and based on the measurement result of the trusted middleware , to control trusted middleware.
  • the trusted middleware further includes one or more of the following: a remote security management proxy module, a remote trusted certification proxy module, and a trusted cryptographic service middleware; correspondingly, the implementation process of this step 802 further includes one of the following or multiple operations: the remote security management agent module provides remote security management services for trusted functional components based on the connection with the remote security operation and maintenance management center; the remote trusted certification agent module is based on the connection with the remote security operation and maintenance management center to provide The trusted functional component provides remote trusted certification services; the trusted cryptographic service middleware provides the computing component and the trusted functional component with an application program interface for using the cryptographic module.
  • Step 803 The out-of-band management chip performs trust measurement on the computing component of the computer system based on the root of trust, and controls the computing component based on the trust measurement result.
  • the security firmware is specifically used to perform trusted measurement on the computing component, and control the computing component based on the trusted measurement result of the computing component.
  • the security firmware can perform credible measurement on at least two objects to be measured in the computing component, and control any object to be measured based on the credible measurement result of any object to be measured in the at least two objects to be measured .
  • the objects to be measured in the computing component include: the image file of the basic input/output device, the image file of the first operating system kernel, the image file of the boot layer of the first operating system, and the image file of the business application program.
  • the object to be measured of the computing component further includes: a configuration file of a complex programmable logic device.
  • Step 804 The computing component performs the operation indicated by the control based on the control of the out-of-band management chip.
  • the credible metric includes: credible metric executed during the operation of the object to be measured and credible metric executed during the startup phase of the object to be measured; when the credible metric is executed during the running of the object to be measured, the control is used to indicate the object to be measured. Whether the measurement object continues to run; when the trusted measurement is executed in the startup phase of the object to be measured, the control is used to indicate whether the object to be measured is started.
  • the constructed root of trust in the operating method of the computer system provided by the embodiment of the present application, by constructing the root of trust in the out-of-band management chip, since the out-of-band management chip has the characteristics of more secure hardware, the constructed root of trust can be guaranteed. security. Moreover, the trusted measurement and trusted control are performed on the computing components and trusted functional components based on the trusted root, which can ensure the security of the trusted measurement and trusted control. At the same time, the trusted protection capability provided by the embodiments of the present application can cover the running period and startup phase of computing components and trusted functional components by performing trusted measurement and trusted control of the object to be measured during the running period and the startup phase.
  • the out-of-band management chip in the embodiment of the present application is the BMC
  • the physical isolation advantage of the security core of the BMC can be used, and the computer can be isolated and protected in a complete and stable manner, and compared with related technologies, it has higher security protection ability.
  • Embodiments of the present application also provide a method for running a trusted functional component of a computer system.
  • the trusted functional component includes a BMC chip.
  • the method includes: the BMC chip constructs a root of trust in the BMC chip by running the security firmware function layer of the computer, and performs credible measurement on at least one object to be measured in the computing component of the computer system, based on the at least one object to be measured in the object to be measured. The credible measurement result of any object to be measured is controlled, and any object to be measured is controlled.
  • At least one object to be measured includes one or more of the following: a configuration file of a complex programmable logic device, an image file of a basic input/output device, an image file of the first operating system kernel, and an image file of the first operating system boot layer and image files for business applications.
  • the trusted root in the BMC chip, since the BMC chip has the characteristics of more secure hardware, the security of the constructed trusted root can be guaranteed. Moreover, the trusted measurement and control of computing components and trusted functional components based on the trusted root can ensure the security of trusted measurement and control.
  • the secure firmware function layer to perform credible measurement and credible control on at least one object to be measured in the computing component, compared with the credible measurement and credible control process for the object to be measured in the computing component in the related art,
  • the measurement subject can be concentrated on the security firmware functional layer as much as possible, so that the object to be measured can be as close to the root of trust as possible, and it can solve the problem that the measurement subject in the computing component is also the object to be measured, resulting in the identity confusion and trustworthiness of the measurement subject and the object to be measured.
  • the problem of blurred boundaries between domains and untrusted domains can further ensure the security of computing components.
  • Embodiments of the present application also provide a method for running a trusted functional component of a computer system.
  • the trusted functional component includes a BMC chip, and the BMC chip includes a security core and a performance core.
  • the method includes: a security core builds a trusted root in a BMC chip by running a secure firmware boot layer, performs trusted measurement on the trusted functional components and computing components of the computer system, and based on the trusted measurement result of the object to be measured, the measurement is performed. object to control.
  • the objects to be measured include one or more of the following: an image file of the boot layer of the secure firmware, an image file of the functional layer of the secure firmware, an image file of the boot layer of the second operating system, an image file of the kernel layer of the second operating system, and an image file of the trust layer of the second operating system.
  • the image file of the application, the secure firmware boot layer and the secure firmware function layer are configured to be executed by the secure core
  • the second operating system boot layer, the second OS kernel layer and the trusted application layer are configured to be executed by the performance core.
  • the process of the BMC chip performing the credible measurement includes the following processes:
  • the secure firmware boot layer Based on the root of trust built in the BMC chip, the secure firmware boot layer performs trusted measurement on the secure firmware boot layer, and controls the secure firmware boot layer based on the measurement results of the secure firmware boot layer;
  • the secure firmware boot layer performs credible measurement on the secure firmware functional layer based on the root of trust, and controls the secure firmware functional layer based on the measurement result of the secure firmware functional layer;
  • the security firmware function layer performs trusted measurement on the second operating system boot layer, and controls the second operating system boot layer based on the trusted measurement result of the second operating system boot layer;
  • the second operating system boot layer performs trust measurement on the second operating system kernel layer based on the root of trust, and controls the second operating system kernel layer based on the measurement result of the second operating system kernel layer;
  • the second operating system kernel layer performs the trusted measurement on the trusted application layer based on the root of trust, and controls the trusted application layer based on the measurement result of the trusted application layer;
  • the trusted application layer receives out-of-band management signals from outside the computer system, and provides operation and maintenance services and/or security services based on the out-of-band management signals.
  • the security of the constructed root of trust can be guaranteed.
  • the trusted measurement and control of computing components and trusted functional components based on the trusted root can ensure the security of trusted measurement and control.
  • the computer can be properly isolated and protected, and it has a higher security protection capability than related technologies.
  • the secure firmware functional layer to perform credible measurement and credible control on at least one object to be measured in the computing component, compared with the credible measurement and credible control process for the object to be measured in the computing component in the related art,
  • the measurement subject can be concentrated on the security firmware functional layer as much as possible, so that the object to be measured can be as close to the root of trust as possible, and it can solve the problem that the measurement subject in the computing component is also the object to be measured, resulting in the identity confusion and trustworthiness of the measurement subject and the object to be measured.
  • the problem of blurred boundaries between domains and untrusted domains can further ensure the security of computing components.
  • the present application also provides a method for operating a computer system.
  • the method includes: a remote security operation and maintenance management center of the computer system provides a remote centralized management service and an operation and maintenance service for the trusted functional component provided by the embodiment of the present application.
  • the remote security operation and maintenance management center provides remote centralized management services and operation and maintenance services, including one or more of the following:
  • the remote trusted certification center provides trusted challenge and remote trusted certification services for computers
  • the trusted policy and benchmark management center manages the trusted measurement policy, trusted control policy and trusted benchmark library in the computer
  • the platform security management and audit center provides a remote connection interface for the trusted components of the boot layer in the computer, a function of visual interface of trusted measurement results, and a function of trusted log auditing.
  • the remote centralized management service and operation and maintenance service are provided by the remote security operation and maintenance management center, so that the computer provided by the embodiment of the present application can cooperate with the remote security operation and maintenance management center to provide rich security operation and maintenance management capabilities and remote trusted certification service capabilities, thereby A reliable and complete measurement subject and a trusted software execution environment are established in the trusted functional components of the computer system.
  • the embodiments of the present application provide a computer.
  • the computer includes a hardware platform including: a processor, a memory, a communication interface, a bus, a cryptographic module, and the like.
  • the processor, the communication interface, the memory and the cryptographic module are connected to each other through a bus.
  • a computer program is stored in the memory.
  • the processor executes the computer program, the computer device implements the method provided by the embodiments of the present application.
  • the implementation manner and structure of the computer please refer to the corresponding contents in the foregoing contents of the embodiments of the present application.
  • the present application also provides a computer-readable storage medium.
  • the computer-readable storage medium may be a non-transitory readable storage medium.
  • the computer is used to execute the present invention.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, SSDs).
  • the present application also provides a computer program product, where the computer program product includes computer instructions, and when executed by a computer device, the computer device executes the method provided by the embodiments of the present application.
  • the terms “first”, “second” and “third” are only used for description purposes, and cannot be understood as indicating or implying relative importance.
  • the term “at least one” refers to one or more, and the term “plurality” refers to two or more, unless expressly limited otherwise.

Abstract

一种计算机系统、可信功能组件及运行方法，属于可信计算技术领域。该计算机系统包括：计算组件（12）和可信功能组件（13），可信功能组件（13）包括带外管理芯片（131）；带外管理芯片（131）用于通过运行安全固件（1321），在带外管理芯片（131）中构建可信根，基于可信根对计算组件（12）进行可信度量，基于可信度量结果对计算组件（12）进行控制；计算组件（12）用于基于带外管理芯片（131）的控制，执行带外管理芯片（131）的控制指示的操作。该计算机系统能够保证根据可信根进行可信度量和控制的安全性。

Description

计算机系统、可信功能组件及运行方法 技术领域
本申请涉及可信计算技术领域，特别涉及一种计算机系统、可信功能组件及运行方法。
背景技术
若计算机缺乏用于保护计算机安全的安全机制，会使得整个计算机较容易被攻击，导致计算机运行在不可控状态。因此，需要对计算机采取安全措施，以提高计算的安全性。
目前，通常采用可信计算技术对计算机的安全进行保护。可信计算技术可以在计算机中植入密码算法，并使用该密码算法在计算机运行过程中各个执行阶段加入可信度量机制，以保障计算机的安全。
但是，目前对计算机进行可信度量的安全性较差。
发明内容
本申请提供了一种计算机系统、可信功能组件及运行方法，能够保证基于可信根对计算组件和可信功能组件进行可信度量和控制的安全性。本申请提供的技术方案如下：
第一方面，本申请提供了一种计算机系统，该计算机系统包括：计算组件和可信功能组件，可信功能组件包括带外管理芯片；带外管理芯片用于通过运行安全固件，在带外管理芯片中构建可信根，基于可信根对计算组件进行可信度量，基于可信度量结果对计算组件进行控制；计算组件用于基于带外管理芯片的控制，执行控制指示的操作。
在本申请提供的计算机系统中，通过在带外管理芯片中构建可信根，由于带外管理芯片具有硬件更安全的特点，能够保证构建的可信根的安全性。并且，基于可信根对计算组件和可信功能组件进行可信度量和控制，能够保证可信度量和控制的安全性。
其中，带外管理芯片具有安全核；安全核具体用于通过运行安全固件，在安全核中构建可信根。由于安全核实现了物理隔离，该物理隔离能够保证安全核内的安全性。因此，通过该安全核实现构建可信根的构建过程，能够进一步保证构建的可信根的安全性。
在一种可实现方式中，用于构建可信根的可信度量根核心(CRTM)存储在带外管理芯片的只读存储器中。由于CRTM存储在只读存储器中，只读存储器只能被安全核访问，且只能对只读存储器执行读操作不能执行写操作，当想要对该只读存储器中存储的可执行代码进行恶意篡改时，由于该只读存储器不支持再次写入，能够防止对该只读存储器中存储的可执行代码的恶意篡改，能够保证该只读存储器中存储的CRTM的安全性，能够进一步保证根据CRTM构建的可信根的安全性。
在一种可实现方式中，安全固件包括具体用于对计算组件进行可信度量，基于对计算组件的可信度量结果，对计算组件进行控制。
此时，通过使用安全固件对计算组件中的至少一个待度量对象进行可信度量和控制，相较于相关技术中计算组件中待度量对象的可信度量和控制过程，能够将度量主体尽量集中在安全固件上，使得待度量对象能够尽量靠近可信根，能够解决因计算组件中的度量主体也是待度量对象，导致度量主体和待度量对象身份混淆及可信域与非可信域边界模糊的问题，能够进一步保证计算组件的安全性。
并且，安全固件具体用于对计算组件中的至少两个待度量对象进行可信度量，基于对至少两个待度量对象中的任一个待度量对象的可信度量结果，对任一个待度量对象进行控制。
并且，当安全固件用于对计算组件中的至少两个待度量对象进行可信度量时，能够使对该至少两个待度量对象的可信度量和控制过程不会互相依赖，将相关技术中链式传递的信任链改成了以安全固件为中心的集中式可信拓扑结构，能够避免出现计算组件中某一个待度量对象被攻击或篡改，导致整个信任链断裂的情况。
其中，计算组件中包括多个待度量对象。例如，计算组件中的待度量对象包括：基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
并且，计算组件的待度量对象还包括：复杂可编程逻辑器件的配置文件。通过对复杂可编程逻辑器件进行可信度量，能够保证该复杂可编程逻辑器件的启动和运行的安全性。
安全固件包括：安全固件启动层、安全固件引导层和安全固件功能层。为进一步提高计算机的安全性，也可以对可信功能组件进行可信度量和控制，其实现方式包括：
带外管理芯片具体用于运行安全固件启动层，在带外管理芯片中构建可信根，安全固件启动层还用于基于可信根对安全固件引导层进行可信度量，基于对安全固件引导层的度量结果，对安全固件引导层进行控制；安全固件引导层用于基于可信根对安全固件功能层进行可信度量，基于对安全固件功能层的度量结果，对安全固件功能层进行控制；安全固件功能层用于对待度量对象进行可信度量，基于对其他待度量对象的可信度量结果，对其他待度量对象进行控制，其他待度量对象包括计算机系统中除安全固件外的待度量对象。
在一种可实现方式中，带外管理芯片具有安全核，安全核具体用于运行安全固件。例如，安全固件启动层、安全固件引导层和安全固件功能层均由安全核运行，以进一步保证安全固件启动层、安全固件引导层和安全固件功能层的安全性。
通过安全核运行安全固件，能够利用安全核的物理隔离优势，使得性能域环境中运行的组件不具备向安全域越权的基础，实现对安全固件的隔离保护，保证了计算机具备更好的安全性。
在一种可实现方式中，带外管理芯片具有性能核，该性能个用于运行计算机的第二操作系统。例如，可信功能组件还包括：第二操作系统引导层、第二操作系统内核层和可信应用程序层，该性能核用于运行第二操作系统引导层、第二操作系统内核层和可信应用程序层。
为进一步提高计算机的安全性，对可信功能组件进行可信度量和控制的实现方式还包括：
可信功能组件还包括：第二操作系统引导层、第二操作系统内核层和可信应用程序层；安全固件还用于基于可信根对第二操作系统引导层进行可信度量，基于对第二操作系统引导层的度量结果，对第二操作系统引导层进行控制；第二操作系统引导层用于基于可信根对第二操作系统内核层进行可信度量，基于对第二操作系统内核层的度量结果，对第二操作系统内核层进行控制；第二操作系统内核层用于基于可信根对可信应用程序层进行可信度量，基于对可信应用程序层的度量结果，对可信应用程序层进行控制；可信应用程序层用于接收来自计算机系统外部的带外管理信号，基于带外管理信号提供运维服务和/或安全服务。
其中，第二操作系统内核层包括：可信软件基模块；可信软件基模块用于获取计算组件的第一操作系统内核、应用程序、可信功能组件中的第二操作系统内核和可信应用软件中至少一个待度量对象的可信模型，并基于任一待度量对象的可信模型对任一待度量对象进行可 信度量，待度量对象的可信模型用于反映待度量对象的可信程度，可信模型包括待度量对象的度量值和其他参数。
通过将可信软件基模块部署在可信功能组件中，能够进一步保证该第二操作系统的运行安全性，进一步保证根据该可信软件基模块维护的计算机的安全性。并且，通过该可信软件基模块获取待度量对象的可信模型，并根据该可信模型对待度量对象进行可信度量，由于该可信模型包括度量值和一个或多个其他参数，能够从多个维度反映待度量对象的可信程度，提高了对待度量对象的可信程度进行描述的准确性，当根据该可信模型对待度量对象进行可信度量时，提高了待度量对象的安全性。
在一种可实现方式中，第二操作系统内核层还包括以下一个或多个：可信度量策略管理模块、可信控制策略管理模块、可信基准库管理模块和可信度量结果与日志管理模块；可信度量策略管理模块用于管理可信度量过程中使用的度量策略，并向度量主体提供度量策略，度量主体用于对待度量对象进行可信度量；可信控制策略管理模块用于管理根据度量结果对待度量对象进行控制的控制策略，并向度量主体提供控制策略；可信基准库管理模块用于管理可信度量过程中用于与待度量对象的度量值进行比较的度量基准，并向度量主体提供度量基准；可信度量结果与日志管理模块用于记录可信度量结果和用于反映可信度量过程的信息。
并且，第二操作系统内核层还包括：可信中间件，可信中间件包括：可信度量服务模块；第二操作系统内核层基于可信根对可信应用程序层进行可信度量的功能，通过可信度量服务模块基于可信根对可信应用程序层进行可信度量实现；第二操作系统内核层还用于基于可信根对可信中间件进行可信度量，基于对可信中间件的度量结果，对可信中间件进行控制。
进一步地，可信中间件还包括以下一个或多个：远程安全管理代理模块、远程可信证明代理模块和可信密码服务中间件；远程安全管理代理模块用于基于与远程安全运维管理中心的连接，为可信功能组件提供远程安全管理服务；远程可信证明代理模块用于基于与远程安全运维管理中心的连接，为可信功能组件提供远程可信证明服务；可信密码服务中间件用于向计算组件和可信功能组件，提供用于使用密码模块的应用程序接口。
其中，可信度量包括：在待度量对象运行期间执行的可信度量和在待度量对象启动阶段执行的可信度量；当在待度量对象的运行期间执行可信度量时，该控制用于指示待度量对象是否继续运行；当在待度量对象的启动阶段执行可信度量时，该控制用于指示待度量对象是否启动。
通过在运行期间和启动阶段对待度量对象进行可信度量和的控制，使得本申请实施例提供的可信防护能力能够覆盖计算组件和可信功能组件的运行期间和启动阶段。
第二方面，本申请提供了一种计算机系统的可信功能组件，可信功能组件包括：基板管理控制器BMC芯片，BMC芯片的安全核中运行有安全固件功能层；BMC芯片用于通过运行安全固件功能层，在BMC芯片中构建可信根，对计算机系统的计算组件中的至少一个待度量对象进行可信度量，基于对至少一个待度量对象中的任一个待度量对象的可信度量结果，对任一个待度量对象进行控制；至少一个待度量对象包括以下一个或多个：复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
第三方面，本申请提供了一种计算机系统的可信功能组件，该可信功能组件包括基板管理控制器BMC芯片，该BMC芯片包括安全核和性能核，安全核用于通过运行安全固件启动层， 在BMC芯片中构建可信根，对计算机系统的可信功能组件和计算组件进行可信度量，基于对待度量对象的可信度量结果，对待度量对象进行控制。
其中，待度量对象包括以下一个或多个：安全固件引导层的镜像文件、安全固件功能层的镜像文件、第二操作系统引导层的镜像文件、第二操作系统内核层的镜像文件和可信应用程序层的镜像文件，以及计算组件中的复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件，安全固件引导层和安全固件功能层被配置为由安全核运行，第二操作系统引导层、第二操作系统内核层和可信应用程序层被配置为由性能核运行。
在一种可实现方式中，安全固件启动层用于基于在BMC芯片中构建的可信根，对安全固件引导层进行可信度量，基于对安全固件引导层的度量结果，对安全固件引导层进行控制；安全固件引导层用于基于可信根对安全固件功能层进行可信度量，基于对安全固件功能层的度量结果，对安全固件功能层进行控制；安全固件功能层用于对第二操作系统引导层进行可信度量，基于对第二操作系统引导层的可信度量结果，对第二操作系统引导层进行控制；第二操作系统引导层用于基于可信根对第二操作系统内核层进行可信度量，基于对第二操作系统内核层的度量结果，对第二操作系统内核层进行控制；第二操作系统内核层用于基于可信根对可信应用程序层进行可信度量，基于对可信应用程序层的度量结果，对可信应用程序层进行控制；可信应用程序层用于接收来自计算机系统外部的带外管理信号，基于带外管理信号提供运维服务和/或安全服务。
第四方面，本申请提供了一种计算机系统，该计算机系统包括：远程安全运维管理中心，远程安全运维管理中心用于对第一方面、第二方面或第三方面提供的可信功能组件，提供远程集中管理服务与运维服务。
其中，远程安全运维管理中心包括以下一个或多个：远程可信证明中心、可信策略与基准管理中心和平台安全管理与审计中心；远程可信证明中心用于为计算机提供可信挑战和远程可信证明服务；可信策略与基准管理中心用于对计算机中的可信度量策略、控制策略和可信基准库进行管理；平台安全管理与审计中心用于为计算机中的引导层可信组件提供远程连接接口、提供可信度量结果可视化界面功能和可信日志审计功能。
通过为计算机配置远程安全运维管理中心，本申请提供的计算机能够配合远程安全运维管理中心提供丰富的安全运维管理能力和远程可信证明服务能力，从而在计算机系统的可信功能组件中建立可信完善的度量主体和可信软件执行环境。
第五方面，本申请提供了一种计算机系统的运行方法，该方法包括：计算机系统的带外管理芯片通过运行安全固件，在带外管理芯片中构建可信根，基于可信根对计算机系统的计算组件进行可信度量，基于可信度量结果对计算组件进行控制；计算组件基于带外管理芯片的控制，执行控制指示的操作。
在该计算机系统的运行方法中，通过在带外管理芯片中构建可信根，由于带外管理芯片具有硬件更安全的特点，能够保证构建的可信根的安全性。并且，基于可信根对计算组件和可信功能组件进行可信度量和控制，能够保证可信度量和控制的安全性。
其中，安全核具体用于通过运行安全固件，在安全核中构建可信根。
在一种可实现方式中，用于构建可信根的可信度量根核心存储在带外管理芯片的只读存储器中。
在一种可实现方式中，安全固件具体用于对计算组件进行可信度量，基于对计算组件的 可信度量结果，对计算组件进行控制。
并且，安全固件对计算组件中的至少两个待度量对象进行可信度量，基于对至少两个待度量对象中的任一个待度量对象的可信度量结果，对任一个待度量对象进行控制。
其中，计算组件中的待度量对象包括：基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
可选地，计算组件的待度量对象还包括：复杂可编程逻辑器件的配置文件。
其中，安全固件包括：安全固件启动层、安全固件引导层和安全固件功能层，为进一步提高计算机的安全性，也可以对可信功能组件进行可信度量和控制，相应的，该方法还包括：带外管理芯片运行安全固件启动层，在带外管理芯片中构建可信根，安全固件启动层基于可信根对安全固件引导层进行可信度量，基于对安全固件引导层的度量结果，对安全固件引导层进行控制；安全固件引导层基于可信根对安全固件功能层进行可信度量，基于对安全固件功能层的度量结果，对安全固件功能层进行控制；安全固件功能层对其他待度量对象进行可信度量，基于对其他待度量对象的可信度量结果，对其他待度量对象进行控制，其他待度量对象包括计算机系统中除安全固件外的待度量对象。
在一种可实现方式中，带外管理芯片具有安全核；安全核具体用于运行安全固件启动层、安全固件引导层和安全固件功能层。
并且，带外管理芯片具有性能核，该性能核用于运行第二操作系统。
此时，该方法还包括：带外管理芯片运行计算机系统的第二操作系统引导层、第二操作系统内核层和可信应用程序层；安全固件基于可信根对第二操作系统引导层进行可信度量，基于对第二操作系统引导层的度量结果，对第二操作系统引导层进行控制；第二操作系统引导层基于可信根对第二操作系统内核层进行可信度量，基于对第二操作系统内核层的度量结果，对第二操作系统内核层进行控制；第二操作系统内核层基于可信根对可信应用程序层进行可信度量，基于对可信应用程序层的度量结果，对可信应用程序层进行控制；其中，可信应用程序层用于接收来自计算机系统外部的带外管理信号，基于带外管理信号提供运维服务和/或安全服务。
可选地，第二操作系统内核层包括：可信软件基模块。该方法还包括：可信软件基模块获取计算组件的第一操作系统内核、应用程序、可信功能组件中的第二操作系统内核和可信应用软件中至少一个待度量对象的可信模型，并基于任一待度量对象的可信模型对任一待度量对象进行可信度量，待度量对象的可信模型用于反映待度量对象的可信程度，可信模型包括待度量对象的度量值和其他参数。
并且，第二操作系统内核层还包括以下一个或多个：可信度量策略管理模块、可信控制策略管理模块、可信基准库管理模块和可信度量结果与日志管理模块。此时，该方法还包括以下一个或多个操作：可信度量策略管理模块管理可信度量过程中使用的度量策略，并向度量主体提供度量策略，度量主体用于对待度量对象进行可信度量；可信控制策略管理模块管理根据度量结果对待度量对象进行控制的控制策略，并向度量主体提供控制策略；可信基准库管理模块管理可信度量过程中用于与待度量对象的度量值进行比较的度量基准，并向度量主体提供度量基准；可信度量结果与日志管理模块记录可信度量结果和用于反映可信度量过程的信息。
进一步地，第二操作系统内核层还包括：可信中间件，可信中间件包括：可信度量服务模块；相应的，第二操作系统内核层基于可信根对可信应用程序层进行可信度量的功能，通 过可信度量服务模块基于可信根对可信应用程序层进行可信度量实现。且该方法还包括：第二操作系统内核层基于可信根对可信中间件进行可信度量，基于对可信中间件的度量结果，对可信中间件进行控制。
可选地，可信中间件还包括以下一个或多个：远程安全管理代理模块、远程可信证明代理模块和可信密码服务中间件；相应的，该方法还包括以下一个或多个：远程安全管理代理模块基于与远程安全运维管理中心的连接，为可信功能组件提供远程安全管理服务；远程可信证明代理模块基于与远程安全运维管理中心的连接，为可信功能组件提供远程可信证明服务；可信密码服务中间件向计算组件和可信功能组件，提供用于使用密码模块的应用程序接口。
其中，可信度量包括：在待度量对象运行期间执行的可信度量和在待度量对象启动阶段执行的可信度量；当在待度量对象的运行期间执行可信度量时，控制用于指示待度量对象是否继续运行；当在待度量对象的启动阶段执行可信度量时，控制用于指示待度量对象是否启动。
第六方面，本申请提供了一种计算机系统的可信功能组件的运行方法。该可信功能组件包括基板管理控制器BMC芯片。该方法包括：BMC芯片通过运行计算机的安全固件功能层，在BMC芯片中构建可信根，对计算机系统的计算组件中的至少一个待度量对象进行可信度量，基于对至少一个待度量对象中的任一个待度量对象的可信度量结果，对任一个待度量对象进行控制。
其中，至少一个待度量对象包括以下一个或多个：复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
第七方面，本申请提供了一种计算机系统的可信功能组件的运行方法。该可信功能组件包括基板管理控制器BMC芯片，BMC芯片包括安全核和性能核。该方法包括：安全核通过运行安全固件启动层，在BMC芯片中构建可信根，对计算机系统的可信功能组件和计算组件进行可信度量，基于对待度量对象的可信度量结果，对待度量对象进行控制。
其中，待度量对象包括以下一个或多个：安全固件引导层的镜像文件、安全固件功能层的镜像文件、第二操作系统引导层的镜像文件、第二操作系统内核层的镜像文件和可信应用程序层的镜像文件，以及计算组件中的复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件，安全固件引导层和安全固件功能层被配置为由安全核运行，第二操作系统引导层、第二操作系统内核层和可信应用程序层被配置为由性能核运行。
在一种可实现方式中，BMC芯片进行可信度量的过程包括：安全固件启动层基于在BMC芯片中构建的可信根，对安全固件引导层进行可信度量，基于对安全固件引导层的度量结果，对安全固件引导层进行控制；安全固件引导层基于可信根对安全固件功能层进行可信度量，基于对安全固件功能层的度量结果，对安全固件功能层进行控制；安全固件功能层对第二操作系统引导层进行可信度量，基于对第二操作系统引导层的可信度量结果，对第二操作系统引导层进行控制；第二操作系统引导层基于可信根对第二操作系统内核层进行可信度量，基于对第二操作系统内核层的度量结果，对第二操作系统内核层进行控制；第二操作系统内核层基于可信根对可信应用程序层进行可信度量，基于对可信应用程序层的度量结果，对可信应用程序层进行控制。其中，可信应用程序层接收来自计算机系统外部的带外管理信号，基 于带外管理信号提供运维服务和/或安全服务。
第八方面，本申请提供了一种计算机系统的运行方法。该方法包括：计算机系统的远程安全运维管理中心对第一方面、第二方面或第三方面提供的可信功能组件，提供远程集中管理服务与运维服务。
在一种可实现方式中，远程安全运维管理中心提供远程集中管理服务与运维服务，包括以下一个或多个：远程可信证明中心为计算机提供可信挑战和远程可信证明服务；可信策略与基准管理中心对计算机中的可信度量策略、可信控制策略和可信基准库进行管理；平台安全管理与审计中心为计算机中的引导层可信组件提供远程连接接口、提供可信度量结果可视化界面功能和可信日志审计功能。
附图说明
图1是本申请实施例提供的一种计算机的结构示意图；
图2是本申请实施例提供的一种硬件平台的结构示意图；
图3是本申请实施例提供的另一种计算机的结构示意图；
图4是本申请实施例提供的一种计算机系统的结构示意图；
图5是本申请实施例提供的一种集中式可信拓扑结构的示意图；
图6是本申请实施例提供的另一种计算机系统的结构示意图；
图7是本申请实施例提供的又一种计算机系统的结构示意图；
图8是本申请实施例提供的一种计算机系统的运行方法的流程图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
为便于理解，下面先对本申请实施例中出现的部分名词或术语进行解释：
可信计算(trusted computing，TC)是在计算机中广泛使用的，基于密码模块支持的可信计算平台，以提高计算机整体的安全性。
密码模块是为计算机提供完整性和真实性保障的安全芯片，一般通过物理方式被强绑定到计算机的硬件平台中。密码模块的核心功能是基于自主密码算法构建可信计算3个维度的功能，包括：平台完整性度量与验证、平台可信身份标识与鉴别、平台数据保护。可选地，密码模块可以为可信密码模块(trusted crypto module，TCM)或可信平台模块(trusted platform module，TPM)。
可信控制是指根据可信度量结果对待度量对象执行的控制操作，因此，该可信控制也可称为控制。其中，当对待度量对象的度量通过时，可以维持待度量对象原本的状态，或执行待度量对象在被可信度量之前预期需要执行的操作，当对待度量对象的度量不通过时，可以对待度量对象采取安全措施，例如，可以控制计算机复位，或者，可以控制待度量对象重新启动，以避免导致度量不通过的原因对计算机造成安全威胁。
可信根(root of trust，RoT)：是可信度量中的信任源点，是一个必然被信任的组件。一个可信计算平台中包括三种可信根：可信度量根(root of trust for measurement，RTM)、可信存储根(root of trust for storage，RTS)和可信报告根(root of trust for reporting，RTR)。其中，可信度量根是在涉及到度量操作时需要使用到的可信根，可信存储根是涉及在 存储操作时需要使用到的可信根，可信报告根是在涉及在报告读写等操作时使用到的可信根。
可信度量根核心(core root of trust for measurement，CRTM)：是用于建立可信度量根的可执行代码，通过运行该可信度量根核心能够的建立可信度量根。可信度量根核心是可信计算平台上电启动后执行的第一段代码。
可信软件基(trusted software base)：可信软件基是可信计算体系的重要组成部分，基于运算和防护并存的双系统体系结构思想设计。软件层面的双系统即宿主基础软件和可信软件基。可信软件基在宿主基础软件运行时进行主动拦截和度量，不需要修改原应用，通过制定策略进行主动实时防护，从而破坏和阻止进入系统的病毒或木马等恶意软件，达到主动免疫防御的安全效果。
基板管理控制器(baseboard management controller，BMC)：广泛应用于服务器类计算机平台处理器带外管理子系统，其功能包括虚拟键盘、鼠标、显示器、电源管理控制和远程运维等，也包括对服务器平台的电源电压、温度、风扇状态、机箱状态等物流信息的监视。基板管理控制器是主板第一个上电启动的部件。
基本输入输出系统(base input/output system，BIOS)，基本输入输出系统通过I/O接口实现基本的输入输出操作。
图1是本申请实施例提供的一种计算机的结构示意图。该计算机可以为：任何类型的服务器、桌上型计算机和膝上型计算机。如图1所示，计算机包括：硬件平台11、基于硬件平台11运行的计算组件12和可信功能组件13，硬件平台11、计算组件12和可信功能组件13之间建立有通信连接。
硬件平台11包括计算机运行所需的各种硬件。例如，如图2所示，硬件平台11包括：处理器111、存储器112、通信接口113、总线114和密码模块115等。
其中，处理器可以是通用处理器，例如，中央处理器(central processing unit，CPU)。
存储器可以包括多种类型的存储器。例如，存储器可以包括只读存储器(read only memory，ROM)，存储器也可以包括易失性存储器(volatile memory)，如随机存取存储器(random-access memory，RAM)。存储器也可以包括非易失性存储器(non-volatile memory)，如NAND闪存(flash)，快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)。且存储器还可以包括上述种类的存储器的组合。
通信接口可以是以下器件的任一种或任一种组合：网络接口(如以太网接口)、无线网卡等具有网络接入功能的器件。总线可以分为地址总线、数据总线、控制总线等。
密码模块115可以为TCM或TPM等。在本申请实施例中，密码模块115可以是符合《GM/T 0013-2012可信计算可信密码模块符合性检测规范》标准要求的密码芯片或模块，提供SM3，国密算法服务，用以存储度量值非易失寄存器，以及通过串行外设(serial peripheral interface，SPI)接口的应用命令接口。
计算组件12用于为用户提供计算服务。计算组件12包括：基本输入输出系统(basic input output system，BIOS)、第一操作系统引导层、第一操作系统内核和业务应用程序。该业务应用程序用于接收用户提交的任务请求，并根据该任务请求执行该任务请求请求执行的计算任务，并向用户提供计算结果。
可信功能组件13是计算机第一个上电运行的组件，用于为计算组件12提供带外管理服 务。该带外管理服务可以包括：对计算组件12的状态和行为进行控制，为计算组件12提供运维管理能力，对计算组件12进行可信度量、可信控制和安全运维。在一种可实现方式中，该可信功能组件13可以在计算组件12的启动阶段和运行阶段，对计算组件12进行可信度量和可信控制，以保证计算机的安全可信启动和运行。
如图3所示，该可信功能组件13包括：带外管理芯片131。该带外管理芯片131中运行有带外管理组件132。可选地，该带外管理芯片131可以为基板管理控制器，此时，该可信功能组件13又称为BMC可信功能组件或BMC带外管理系统。
图3是本申请实施例提供的一种计算机系统的示意图。如图3所示，计算机系统包括：计算组件12和可信功能组件13，可信功能组件13包括：带外管理芯片131。该带外管理芯片131上运行有带外管理组件132，带外管理组件132包括：安全固件1321。
带外管理芯片131用于通过运行安全固件1321，在带外管理芯片131中构建可信根，基于可信根对计算组件12进行可信度量，基于可信度量结果对计算组件12进行可信控制(也称控制)。其中，通过运行安全固件1321构建可信根的过程可以包括：通过运行安全固件1321驱动密码模块115，通过密码模块115在带外管理芯片131中构建可信根。其中，可信度量与可信控制之间还存在证书校验、签名认证、完整性度量和启动控制的关系。
计算组件12用于基于带外管理芯片131的可信控制，执行可信控制指示的操作。
由上可知，通过在带外管理芯片131中构建可信根，由于带外管理芯片131具有硬件更安全的特点，能够保证构建的可信根的安全性，进而保证使用该可信根对计算组件12进行可信度量和可信控制的安全性。
在本申请实施例中，可信度量包括：在待度量对象运行期间执行的可信度量和在待度量对象启动阶段执行的可信度量。当在待度量对象的运行期间执行可信度量时，可信控制用于指示待度量对象是否继续运行。在待度量对象的运行期间对待度量对象进行可信度量和可信控制，能够有效保证待度量对象在运行期间的安全性。当在待度量对象的启动阶段执行可信度量时，可信控制用于指示待度量对象是否启动，在待度量对象的启动阶段对待度量对象进行可信度量和可信控制，能够有效保证待度量对象在启动阶段的安全性。
由上可知，运行安全固件1321构建可信根，是通过运行安全固件1321中的CRTM实现构建可信根的功能。由于可信根是整个可信计算平台的信任源点，在带外管理子系统上电后，该CRTM能够自动加载至可执行内存区域中执行，且该CRTM为带外管理子系统上电启动后被执行的第一段代码。
可选地，该带外管理芯片131具有安全核。此时，构建可信根的操作可以通过该安全核实现。也即是，安全核具体用于通过运行安全固件1321，在安全核中构建可信根。相应的，CRTM可以在带外管理芯片131的安全域内存中运行。此时，该安全固件1321又称为安全核固件。
由于安全核实现了物理隔离，该物理隔离能够保证安全核内的安全性。因此，通过该安全核实现构建可信根的构建过程，能够进一步保证构建的可信根的安全性。
在一种可实现方式中，CRTM存储在带外管理芯片131的只读存储器(read only memory，ROM)中。例如，CRTM在出厂前预置在只读存储器中。
由于CRTM存储在只读存储器中，只读存储器只能被带外管理芯片131的安全核访问，且只能对只读存储器执行读操作不能执行写操作，当想要对该只读存储器中存储的可执行代 码进行恶意篡改时，由于该只读存储器不支持再次写入，能够防止对该只读存储器中存储的可执行代码的恶意篡改，能够保证该只读存储器中存储的CRTM的安全性，能够进一步保证根据CRTM构建的可信根的安全性。
可选地，在本申请实施例提供的可信功能组件13中，对计算组件12进行可信度量和可信控制的过程，可以由安全固件1321执行。
并且，如图4所示，安全固件1321包括：安全固件启动层1321a、安全固件引导层1321b和安全固件功能层1321c。其中，安全固件启动层1321a为包括可执行代码的集合，该集合包括CRTM。当由安全核运行安全固件启动层1321a时，安全固件启动层1321a又称为安全核固件启动层。且当安全固件启动层1321a保存在只读存储器中时，该安全固件启动层1321a又称为安全核ROM代码段。当由安全核运行安全固件引导层1321b时，安全固件引导层1321b又称为安全核固件引导层。当由安全核运行安全固件功能层1321c时，安全固件功能层1321c又称为安全核固件功能层。
安全固件引导层1321b是引导加载程序，用于引导安全固件功能层1321c启动。该安全固件引导层1321b的镜像文件存储在带外管理芯片131外的非易失闪存器件中。可选地，该非易失闪存器件同时还具备对该非易失闪存器件的数据访问权限进行识别和控制的功能、对该非易失闪存器件中存储的内容进行内容加密和提供写保护的功能，以提高对该非易失闪存器件中存储内容的硬件安全防护能力，此时，该非易失闪存器件也称为具备硬件防护功能的存储器件。
安全固件功能层1321c用于实现安全固件1321对其他组件执行的操作。安全固件功能层1321c的镜像文件存储于带外管理芯片131外的非易失闪存器件中，如存储在具备硬件防护功能的存储器件中。该其他组件包括除安全固件1321外的软件、固件和硬件。
例如，该其他组件可以为计算组件12。因此，对计算组件12进行可信度量和可信控制的过程，可以由安全固件功能层1321c执行。并且，其他组件可以包括带外管理子系统需要连接的设备，此时，该安全固件功能层1321c的功能可以包括：实现嵌入式多媒体卡(embedded multi media card，eMMC)接口驱动、SPI接口驱动、SPI型闪存控制器(serial peripheral interface flash controller，SFC)接口驱动、CPU总线(又称local bus)接口驱动、千兆网媒体访问控制(gigabit media access control，GMAC)接口驱动、双倍速率(double data rate，DDR)内存接口驱动、及外围组件互连快速(peripheral component interconnect express，PCIe)总线接口驱动等。其中，以上接口驱动对应的接口均是可信功能组件13需要使用的接口。
eMMC接口是多媒体卡(MMC)协会订立的标准闪存管理接口。在本申请实施例中，eMMC接口用于对接封装在非易失闪存器件中的eMMC控制器接口，eMMC接口驱动用以驱动和挂载具备硬件防护功能的存储器件。SPI接口是一种串行全双工同步通信总线接口，本申请实施例中主要用于对BIOS 121的存储器件中内容进行读取。SPI型闪存控制器是基于SPI接口按照SPI型闪存接口逻辑协议进行高度客制化的串行接口，主要用以对接SPI型闪存控制器外设。在本申请实施例中，SPI型闪存控制器用作集成密码模块115的基础接口。local bus是一种传统的数据地址复用总线形式，在本申请实施例中，local bus使用60X总线16位宽模式，其主要作为带外管理芯片131与计算机的复杂可编程逻辑器件(complex programmable logic device，CPLD)之间的控制接口，CPLD用作计算机主板电源和电路的逻辑控制器。PCIe接口是由外围部件互连专业组(peripheral component interconnect special interest  group，PCI-SIG)认证的高速串行计算机扩展总线标准接口，用于高速串行点对点双通道高带宽传输，由该PCIe接口连接的设备独享通道带宽，不共享总线带宽。在本申请实施例中，使用的是PCIe x1物理接口(一种PCIe接口)，用于建立可信功能组件13与计算组件12之间的安全可信交互通道。GMAC接口主要用于将带外管理芯片131与网络接口控制器设备连接。DDR接口是双倍速率同步动态随机存储器，DDR内存接口驱动用以对共享内存进行应用隔离和安全防护。
如图6所示，硬件平台11可以包括NAND闪存、BIOS、动态随机存取存储器(dynamic random access memory，DRAM)、CPLD和密码模块115。NAND闪存可以通过eMMC接口与带外管理芯片连接，BIOS可以通过SPI接口与带外管理芯片连接，DRAM可以通过DDR内存接口与带外管理芯片连接，CPLD可以通过local bus与带外管理芯片连接，密码模块115可以通过SFC接口与带外管理芯片131连接。
此时，安全固件1321对计算组件12进行可信度量和可信控制的过程，可以由安全固件功能层1321c执行。也即是，安全固件功能层1321c具体用于对计算组件12进行可信度量，基于对计算组件12的可信度量结果，对计算组件12进行可信控制。
其中，计算组件12中包括多个待度量对象。例如，如图5所示，计算组件12中的待度量对象包括：BIOS 121的镜像文件、第一操作系统内核122的镜像文件、第一操作系统引导层123的镜像文件和业务应用程序124的镜像文件。可选地，该计算组件12的待度量对象还包括：复杂可编程逻辑器件(complex programmable logic device，CPLD)125的配置文件。其中，复杂可编程逻辑器件125的配置文件用于配置复杂可编程逻辑器件125的逻辑功能。通过对复杂可编程逻辑器件125进行可信度量，能够保证该复杂可编程逻辑器件125的启动和运行的安全性。
在一种可实现方式中，如图5所示，当该计算组件12中包括多个待度量对象时，安全固件功能层1321c用于对该多个待度量对象中的至少一个待度量对象进行可信度量和可信控制。其中，图5为安全固件功能层1321c对CPLD125、BIOS 121、第一操作系统内核122、第一操作系统引导层123和业务应用程序124进行可信度量和可信控制的示意图。
此时，通过使用安全固件功能层1321c对计算组件12中的至少一个待度量对象进行可信度量和可信控制，相较于相关技术中对计算组件中待度量对象的可信度量和可信控制过程，能够将度量主体尽量集中在安全固件功能层1321c上，使得待度量对象能够尽量靠近可信根，能够解决因计算组件12中的度量主体也是待度量对象，导致度量主体和待度量对象身份混淆及可信域与非可信域边界模糊的问题，能够进一步保证计算组件12的安全性。
并且，通过安全固件功能层1321c对计算组件12中的至少两个待度量对象进行可信度量，能够使对该至少两个待度量对象的可信度量和可信控制过程不会互相依赖，将相关技术中链式传递的信任链改成了以安全固件功能层1321c为中心的集中式可信拓扑结构，能够避免出现计算组件12中某一个待度量对象被攻击或篡改，导致整个信任链断裂的情况。
在相关技术中，对计算组件中待度量对象进行可信度量的过程为：以可信根度量BIOS的镜像文件，然后由BIOS对第一操作系统引导层的镜像文件进行度量，再由第一操作系统引导层对第一操作系统内核的镜像文件进行可信度量。因此，相关技术中的信任链是从可信根依次传递到BIOS、第一操作系统引导层和第一操作系统内核的链式的信任链。
由于可信功能组件13用于对计算组件12的状态和行为进行控制，对计算组件12进行可信度量、可信控制和安全运维，则可信功能组件13的安全可信属性成为了一个可信计算 平台的安全基础，保障在可信功能组件13中部署和执行的软件和固件的安全，是构建一个可信计算平台安全可信属性需首要解决的问题。因此，为进一步提高计算机的安全性，也可以对可信功能组件13本身进行可信度量和可信控制，其实现方式包括：
安全固件启动层1321a还用于基于可信根对安全固件引导层1321b进行可信度量，基于对安全固件引导层1321b的度量结果，对安全固件引导层1321b进行可信控制。其中，当对安全固件引导层1321b的可信度量通过时，对安全固件引导层1321b的可信控制包括：允许带外管理芯片131加载和执行安全固件引导层1321b，当对安全固件引导层1321b的可信度量不通过时，对安全固件引导层1321b的可信控制包括：不允许带外管理芯片131加载和执行安全固件引导层1321b。
安全固件引导层1321b用于基于可信根对安全固件功能层1321c进行可信度量，基于对安全固件功能层1321c的度量结果，对安全固件功能层1321c进行可信控制。其中，当对安全固件功能层1321c的可信度量通过时，对安全固件功能层1321c的可信控制包括：允许带外管理芯片131加载和执行安全固件功能层1321c，当对安全固件功能层1321c的可信度量不通过时，对安全固件功能层1321c的可信控制包括：不允许带外管理芯片131加载和执行安全固件功能层1321c。
安全固件功能层1321c用于对其他待度量对象进行可信度量，基于对其他待度量对象的可信度量结果，对其他待度量对象进行可信控制。其他待度量对象包括计算机系统中除安全固件1321外的待度量对象。例如，其他待度量对象可以为计算组件12中的待度量对象，或者，其他待度量对象可以为运行在带外管理芯片131上的第二操作系统引导层1322等。其中，当对其他待度量对象的可信度量通过时，对其他待度量对象的可信控制包括：允许启动或运行该其他待度量对象，当对其他待度量对象的可信度量不通过时，对其他待度量对象的可信控制包括：不允许启动或运行该其他待度量对象。
在一种可实现方式中，安全固件启动层1321a、安全固件引导层1321b和安全固件功能层1321c中可以部署有多个功能模块，安全固件启动层1321a、安全固件引导层1321b和安全固件功能层1321c的上述功能可以通过对应的功能模块实现。下面对其一种可能的实现方式进行说明：
如图6所示，安全固件启动层1321a包括：可信根构建模块1a1和第一度量模块1a2。可信根构建模块1a1用于构建可信根。该第一度量模块1a2用于对安全固件引导层1321b进行可信度量和可信控制。
如图6所示，安全固件引导层1321b包括：第一引导模块1b1和第二度量模块1b2。第一引导模块1b1用于引导安全固件功能层1321c启动。第二度量模块1b2用于对安全固件功能层1321c进行可信度量和可信控制。
如图6所示，安全固件功能层1321c包括：可信模块服务中间件1c1和第三度量模块1c2。密码模块服务中间件1c1用于提供使用密码模块115的应用程序接口，即该可信模块服务中间件1c1用于将密码模块115的功能转化为驱动，并将转化后的驱动以应用程序接口的形式向安全固件功能层1321c的各个模块提供。第三度量模块1c2用于对其他待度量对象进行可信度量和可信控制。
在一种可实现方式中，安全固件功能层1321c能够对多个待度量对象进行可信度量和可信控制，为保证安全固件功能层1321c对不同待度量对象的可信度量和可信控制的实现效果，第三度量模块1c2的功能可以通过多个子功能模块实现。
示例的，对应于安全固件功能层1321c用于对计算组件12进行可信度量和可信控制的功能，且计算组件12中的待度量对象包括CPLD的配置文件、BIOS 121的镜像文件、第一操作系统内核122的镜像文件、第一操作系统引导层123的镜像文件和业务应用程序124的镜像文件时，如图6所示，第三度量模块1c2可以包括：CPLD度量模块1c21、CPLD控制功能模块1c22、BIOS度量模块1c23、核心可信度量与裁决模块1c24和平台可信控制模块1c25。其中，CPLD度量模块1c21用于对CPLD进行可信度量。CPLD控制功能模块1c22用于对CPLD进行可信控制。BIOS度量模块1c23用于对BIOS 121进行可信度量。核心可信度量与裁决模块1c24用于对第一操作系统内核122、第一操作系统引导层123和业务应用程序124进行可信度量。并且，该核心可信度量与裁决模块1c24还用于负责该安全固件功能层1321c中的公共事务。例如，该核心可信度量与裁决模块1c24还用于接收CPLD度量模块1c21、CPLD控制功能模块1c22和BIOS度量模块1c23等发送的各自的待度量对象，并将该待度量对象发送至密码模块115，以及，接收密码模块115基于接收到的待度量对象返回的度量值，根据度量值进行校验，根据校验结果生成控制命令，并向平台可信控制模块1c25发送该控制命令。平台可信控制模块1c25用于根据控制命令，对对应的经过度量的待度量对象进行可信控制。其中，度量值用于反映待度量对象的可信程度。待度量对象可以包括镜像文件(如二进制文件)和/或配置文件。例如，CPLD的待度量对象为CPLD的配置文件。第一操作系统内核122的待度量对象为第一操作系统内核122的二进制文件。
并且，如图4所示，带外管理组件132还包括：第二操作系统引导层1322、第二操作系统内核层1323和可信应用程序层1324。下面对第二操作系统引导层1322、第二操作系统内核层1323和可信应用程序层1324分别进行介绍：
第二操作系统引导层1322除了具有引导第二操作系统内核层1323启动的功能，第二操作系统引导层1322的功能还包括：在引导第二操作系统内核层1323启动之前，基于可信根对第二操作系统内核层1323进行可信度量，基于对第二操作系统内核层1323的度量结果，对第二操作系统内核层1323进行可信控制，以控制是否启动第二操作系统内核层1323。其中，当对第二操作系统内核层1323的可信度量通过时，对第二操作系统内核层1323的可信控制包括：允许带外管理芯片131加载和执行第二操作系统内核层1323，当对第二操作系统内核层1323的可信度量不通过时，对第二操作系统内核层1323的可信控制包括：不允许带外管理芯片131加载和执行第二操作系统内核层1323。第二操作系统内核层1323的镜像文件存储于带外管理芯片131外的非易失闪存器件中，如存储在具备硬件防护功能的存储器件中。
第二操作系统内核层1323除了用于实现操作系统内核的功能外，该第二操作系统内核1323a还用于基于可信根对可信应用程序层1324进行可信度量，基于对可信应用程序层1324的度量结果，对可信应用程序层1324进行可信控制。其中，可信应用程序层1324包括一个或多个可信应用程序。可信应用程序是在发行时经过发行方发行数字证书并备案管理的应用程序，该可信应用程序下载至带外管理芯片131后，由第二操作系统内核层1323对该可信应用程序进行可信度量。当对可信应用程序的可信度量通过时，对可信应用程序的可信控制包括：允许可信应用程序进入安装、升级或运行进程，当对可信应用程序的可信度量不通过时，对可信应用程序的可信控制包括：不允许可信应用程序进入安装、升级和运行进程。
可信应用程序层1324用于接收来自计算机系统外部的带外管理信号，基于带外管理信号提供运维服务和/或安全服务。如图7所示，可信应用程序层1324包括以下一个或多个可 信应用程序：计算机平台智能管理系统软件集1324a、计算机平台状态和故障管理软件1324b、安全模块版本升级管理模块1324c和日志审计安全运维软件1324d。计算机平台智能管理系统软件集1324a是带外管理运维功能软件的统称。计算机平台状态和故障管理软件1324b是通过对计算机平台电源、温度等物理状态的感知信息，对计算机平台进行状态指示和故障处理的软件。安全模块版本升级管理模块1324c是对安全固件1321以及计算组件12中CPLD的配置文件，BIOS 121的二进制文件，第一操作系统引导层123的二进制文件等进行版本升级管理的应用软件。日志审计安全运维软件1324d的功能是对可信功能组件13运行过程中产生的日志文件进行审计，并根据日志信息指示执行对应的处理措施的软件。
需要说明的是，对应于带外管理组件132还包括第二操作系统引导层1322，安全固件1321还用于基于可信根对第二操作系统引导层1322进行可信度量，基于对第二操作系统引导层1322的度量结果，对第二操作系统引导层1322进行可信控制。其中，当对第二操作系统引导层1322的可信度量通过时，对第二操作系统引导层1322的可信控制包括：允许带外管理芯片131加载和执行第二操作系统引导层1322，当对第二操作系统引导层1322的可信度量不通过时，对第二操作系统引导层1322的可信控制包括：不允许带外管理芯片131加载和执行第二操作系统引导层1322。第二操作系统引导层1322的镜像文件存储于带外管理芯片131外的非易失闪存器件中，如存储在具备硬件防护功能的存储器件中。
并且，对应于安全固件功能层1321c中的第三度量模块1c2通过子功能模块实现的实现方式，如图6所示，该第三度量模块1c2还包括：第二操作系统引导层度量模块1c26和第二操作系统内核度量模块1c27。第二操作系统引导层度量模块1c26用于对第二操作系统引导层1322进行可信度量。第二操作系统内核度量模块1c27用于对第二操作系统内核进行可信度量。相应的，该核心可信度量与裁决模块1c24还用于接收第二操作系统引导层度量模块1c26和第二操作系统内核度量模块1c27发送的待度量对象，并将待度量对象发送至密码模块115，以及，接收密码模块115基于接收到的待度量对象返回的度量值，根据度量值进行校验，根据校验结果生成控制命令，并向平台可信控制模块1c25发送该控制命令。平台可信控制模块1c25还用于根据控制命令，对对应的待度量对象进行可信控制。
在一种可实现方式中，如图4所示，第二操作系统引导层1322包括：第二引导模块1322a和引导层可信组件1322b。第二引导模块1322a用于引导第二操作系统内核层1323启动。该第二引导模块1322a的功能可以通过标准开源Linux通用引导加载程序(universal boot loader，U-Boot)代码实现。如图7所示，引导层可信组件1322b包括：第四度量模块2b1。该第四度量模块2b1用于基于可信根对第二操作系统内核层1323进行可信度量，基于对第二操作系统内核层1323的度量结果，对第二操作系统内核层1323进行可信控制。
如图4所示，第二操作系统内核层1323包括：第二操作系统内核1323a和内核可信组件1323b。该第二操作系统内核1323a用于实现可信功能组件13中操作系统内核的功能。该第二操作系统内核1323a的功能可以通过标准开源Linux操作系统内核代码实现。如图7所示，该内核可信组件1323b包括：第五度量模块3b1，该第五度量模块3b1用于基于可信根对可信应用程序层1324进行可信度量，基于对可信应用程序层1324的度量结果，对可信应用程序层1324进行可信控制。
可选地，如图7所示，内核可信组件1323b还包括：可信软件基模块3b2。可信软件基模块3b2用于获取计算组件的第一操作系统内核、应用程序、可信功能组件13中的第二操作系统内核和可信应用程序中的至少一个度量对象的可信模型，并配合第五度量模块3b1基 于该至少一个度量对象中任一待度量对象的可信模型对任一待度量对象进行可信度量。待度量对象的可信模型用于反映待度量对象的可信程度，可信模型包括的待度量对象的度量值和一个或多个其他参数。通过将可信软件基模块3b2部署在可信功能组件13中，能够进一步保证该第二操作系统的运行安全性，进一步保证根据该可信软件基模块3b2维护的计算机的安全性。
其他参数和度量值用于共同反映待度量对象的可信程度。其中，可信软件基模块3b2可以获取待度量对象，并根据该待度量对象进行建模，以得到该待度量对象的可信模型。在一种可实现方式中，度量值可以由密码模块115根据待度量对象，通过调用SM3国密算法服务得到。
通过该可信软件基模块3b2获取待度量对象的可信模型，并根据该可信模型对待度量对象进行可信度量，由于该可信模型包括度量值和一个或多个其他参数，能够从多个维度反映待度量对象的可信程度，提高了对待度量对象的可信程度进行描述的准确性，当根据该可信模型对待度量对象进行可信度量时，提高了待度量对象的安全性。
通过对可信功能组件13内部进行可信度量和可信控制，能够在该可信功能组件13内部中运行的可执行代码的加载阶段、启动阶段和运行阶段进行可信度量和可信控制，能够确保固件和软件代码在加载、启动和运行时的合法性和完整性，确保在带外管理芯片131上运行的固件和软件组件未被篡改或植入恶意代码，进一步保证了计算机的安全性。
如图7所示，内核可信组件1323b还包括以下一个或多个：可信度量策略管理模块3b3、可信控制策略管理模块3b4、可信基准库管理模块3b5和可信度量结果与日志管理模块3b6。下面分别对各个模块进行说明：
可信度量策略管理模块3b3用于管理可信度量过程中使用的度量策略，并向度量主体提供度量策略，度量主体用于对待度量对象进行可信度量。并且，对应于内核可信组件1323b包括可信软件基模块3b2，该可信度量策略管理模块3b3还用于提供与可信软件基模块3b2进行交互的交互接口。
其中，可信度量策略管理模块3b3对度量策略的管理包括：对度量策略进行加载使能、版本升级和故障回退。度量策略用于指示进行可信度量的待度量对象和使用的度量方法等信息。度量方法用于指示待度量对象的设置方式、可信度量的时机和可信度量所使用的密码算法等。待度量对象可以包括程序代码、数据和行为等。
可信控制策略管理模块3b4用于管理根据度量结果对待度量对象进行可信控制的控制策略，并向度量主体提供控制策略。并且，对应于内核可信组件1323b包括可信软件基模块3b2，该可信控制策略管理模块3b4还用于提供与可信软件基模块3b2进行交互的交互接口。
其中，可信控制策略管理模块3b4对控制策略的管理包括：对控制策略进行加载使能、版本升级和故障回退。控制策略用于指示可信控制的控制对象(即度量结果所属的待度量对象)和控制范围，通过可信控制使得控制对象达到的状态，控制对象根据可信控制进行响应的方式，以及根据控制对象的响应判断可信控制的执行效果。
可信基准库管理模3b5用于管理可信度量过程中用于与待度量对象的度量值进行比较的度量基准，并向度量主体提供度量基准。其中，可信基准库管理模块3b5对度量基准的管理包括：对度量基准进行登记、加载使能、版本升级和故障回退。并且，对应于内核可信组件1323b包括可信软件基模块3b2，该可信基准库管理模块3b5还用于提供与可信软件基模块3b2进行交互的交互接口。
可信度量结果与日志管理模块3b6用于记录可信度量结果和用于反映可信度量过程的信息。其中，用于反映可信度量过程的信息包括待度量对象。可信度量结果包括密码模块115根据待度量对象生成的度量值等信息和对度量值等信息进行校验的校验结果等日志内容。并且，该可信度量结果与日志管理模块3b6还用于向其他模块提供对度量结果进行管理和对日志进行审计的功能接口。
如图4所示，第二操作系统内核层1323还包括：可信中间件1323c。该可信中间件1323c用于为可信应用程序层1324提供服务。其中，可信中间件1323c的镜像文件存储于带外管理芯片131外的非易失闪存器件中，如存储在具备硬件防护功能的存储器件中。
对应于第二操作系统内核层1323还包括可信中间件1323c，在可信功能组件13中，可信中间件1323c部署在第二操作系统内核1323a和可信应用程序层1324之间，第二操作系统内核层1323包括的基于可信根对可信应用程序层1324进行可信度量的功能，通过可信中间件1323c基于可信根对可信应用程序层1324进行可信度量实现。并且，第二操作系统内核层1323还用于基于可信根对可信中间件1323c进行可信度量，基于对可信中间件1323c的度量结果，对可信中间件1323c进行可信控制。其中，当对可信中间件1323c的可信度量通过时，对可信中间件1323c的可信控制包括：允许带外管理芯片131加载和执行可信中间件1323c，当对可信中间件1323c的可信度量不通过时，对可信中间件1323c的可信控制包括：不允许带外管理芯片131加载和执行可信中间件1323c。
在一种可实现方式中，如图7所示，可信中间件1323c包括：可信度量服务模块3c1。此时，第二操作系统内核层1323基于可信根对可信应用程序层1324进行可信度量的过程，通过该可信度量服务模块3c1基于可信根对可信应用程序层1324进行可信度量实现。
进一步地，如图7所示，可信中间件1323c还包括以下一个或多个：远程安全管理代理模块3c2、远程可信证明代理模块3c3和可信密码服务中间件3c4。远程安全管理代理模块3c2用于基于与远程安全运维管理中心20的连接，为可信功能组件13提供远程安全管理服务。远程可信证明代理模块3c3用于基于与远程安全运维管理中心20的连接，为可信功能组件13提供远程可信证明服务。可信密码服务中间件3c4用于向计算组件12和可信功能组件13，提供用于使用密码模块的应用程序接口。
需要说的是，第二操作系统内核层1323还包括：实现eMMC接口驱动模块、PCIe总线接口驱动模块和DDR内存接口驱动模块。eMMC接口驱动模块、PCIe总线接口驱动模块和DDR内存接口驱动模块的实现方式和作用请相应参考前述内容，此处不再赘述。
对应于第二操作系统引导层1322还包括引导层可信组件1322b，第二操作系统内核层1323还包括内核可信组件1323b和可信中间件1323c，可信应用程序层1324中的安全模块版本升级管理模块1324c还用于对引导层可信组件1322b、内核可信组件1323b和可信中间件1323c进行版本升级管理。
在本申请实施例中，带外管理芯片131包括安全核，安全核能够访问带外管理芯片131上所有的安全域。在一种可实现方式中，安全固件1321由安全核运行。例如，安全固件启动层1321a、安全固件引导层1321b和安全固件功能层1321c均由安全核运行，以进一步保证安全固件启动层1321a、安全固件引导层1321b和安全固件功能层1321c的安全性。
通过安全核运行安全固件1321，能够利用安全核的物理隔离优势，使得性能域环境中运行的组件不具备向安全域越权的基础，实现对安全固件1321的隔离保护，保证了计算机具备更好的安全性。
进一步地，带外管理芯片131还包括性能核，安全核部署于安全域，性能核部署于性能域。该性能域与安全域之间设置有隔离措施，使得性能域无法直接访问安全域。性能核与安全核之间进行通信需要通过核间通信机制实现。其中，性能域包括性能核心和所有安全属性为性能域的硬件资源，性能域性能核心由安全域安全核启动和控制运行，可运行操作系统软件。
在一种可实现方式中，带外管理芯片131具有性能核，该性能核用于运行第二操作系统。例如，第二操作系统引导层1322、第二操作系统内核层1323和可信应用程序层1324可以由性能核运行。
由于密码模块115属于安全器件，性能核运行的组件无法直接使用密码模块115，性能核与密码模块115之间的交互需要通过安全核实现。在一种可实现方式中，安全核与性能核之间的核间通信机制可以通过交互接口实现。以上性能核运行的组件与安全核中运行的组件之间的交互可以通过该交互接口实现。此时，该安全固件功能层1321c的功能、第二操作系统引导层1322的功能、第二操作系统内核层1323的功能和可信中间件1323c的功能还包括：用于实现安全核与性能核之间通信的交互接口驱动。
可选地，如图4所示，本申请实施例提供的计算机系统还包括：远程安全运维管理中心20，计算机与远程安全运维管理中心20可以通过可信网络连接。远程安全运维管理中心20是对计算机的安全可信特性进行远程集中管理与智能运维的功能集。并且，当计算机还具有远程运维管理中心时，该远程安全运维管理中心20可以与计算机的远程运维管理中心采用隔离的方式部署，以满足隔离部署的要求。例如，远程安全运维管理中心20与计算机的远程运维管理中心可以部署运行于同一服务器系统的不同隔离域中，或者，可以分别部署在不同安全属性隔离域的独立服务器系统中，远程安全运维管理中心20与计算机的远程运维管理中心之间通过可信网络连接架构连接。
如图7所示，远程安全运维管理中心20可以包括以下一个或多个：远程可信证明中心201、可信策略与基准管理中心202和平台安全管理与审计中心203。远程可信证明中心201用于为计算机提供可信挑战和远程可信证明服务。可信策略与基准管理中心202是计算机中可信度量策略、可信控制策略和可信基准库的集中管理端，能够实现对可信策略和可信基准库的远程下发、更新管理、版本审计和故障恢复等服务。平台安全管理与审计中心203用于为引导层可信组件提供远程连接接口、固件和软件升级管理和版本管理功能、平台秘钥管理功能、可信度量结果可视化界面功能和可信日志审计功能。
其中，可信中间件1323c中的远程安全管理代理模块3c2和远程可信证明代理模块3c3，用于与远程安全运维管理中心20配合。例如，可信应用程序可以是在发行时经过远程安全运维管理中心20发行数字证书并备案管理的软件，且可信应用程序可以经由远程安全运维管理中心20通过可信网络下发至远程安全管理代理模块3c2，由远程安全管理代理模块3c2对可信应用程序进行可信度量，并在可信度量通过时，允许进入安装和运行进程。当可信度量不通过时，不允许可信应用程序进入安装和运行进程，且可以将可信度量不通过的情况反馈至远程安全运维管理中心20，以提示管理员对可信固件和升级部署行为进行决策。并且，当还部署有远程安全运维管理中心20时，第二操作系统引导层1322还用于建立网络接口控制器驱动及中间件，以便于建立可信功能组件13与远程安全运维管理中心20之间的安全连接。
通过为计算机配置远程安全运维管理中心20，本申请实施例提供的计算机能够配合远程 安全运维管理中心20提供丰富的安全运维管理能力和远程可信证明服务能力，从而在计算机系统的可信功能组件13中建立可信完善的度量主体和可信软件执行环境。
综上所述，在本申请实施例提供的计算机系统中，通过在带外管理芯片中构建可信根，由于带外管理芯片具有硬件更安全的特点，能够保证构建的可信根的安全性。并且，基于可信根对计算组件和可信功能组件进行可信度量和可信控制，能够保证可信度量和可信控制的安全性。同时，通过在运行期间和启动阶段对待度量对象进行可信度量和的可信控制，使得本申请实施例提供的可信防护能力能够覆盖计算组件和可信功能组件的运行期间和启动阶段。
另外，当本申请实施例中的带外管理芯片为BMC时，可以利用BMC具有的安全核的物理隔离优势，能够对计算机进行了完善稳妥的隔离保护，相对于相关技术具备更高的安全防护能力。
本申请实施例还提供了一种计算机系统的运行方法。该方法能够应用于本申请实施例提供的计算机系统。该计算机系统的实现方式请相应参考前述描述中的相关内容，此处不再赘述。该计算机系统的运行方法包括：计算机系统的带外管理芯片通过运行安全固件，在带外管理芯片中构建可信根，基于可信根对计算机系统的计算组件进行可信度量，基于可信度量结果对计算组件进行控制；计算组件基于带外管理芯片的控制，执行控制指示的操作。
在该计算机系统的运行方法中，通过在带外管理芯片中构建可信根，由于带外管理芯片具有硬件更安全的特点，能够保证构建的可信根的安全性。并且，基于可信根对计算组件和可信功能组件进行可信度量和控制，能够保证可信度量和控制的安全性。
图8是本申请实施例提供的一种计算机系统的运行方法的流程图。如图8所示，该方法包括：
步骤801、计算机系统的带外管理芯片通过运行安全固件，在带外管理芯片中构建可信根。
其中，安全核具体用于通过运行安全固件，在安全核中构建可信根。进一步地，安全固件包括：安全固件启动层，带外管理芯片可以通过运行安全固件启动层，在带外管理芯片中构建可信根。
在一种可实现方式中，用于构建可信根的可信度量根核心存储在带外管理芯片的只读存储器中。
步骤802、带外管理芯片根据可信根，对计算机系统的可信功能组件进行度量。
其中，安全固件包括：安全固件启动层、安全固件引导层和安全固件功能层，为进一步提高计算机的安全性，也可以对可信功能组件进行可信度量和控制，相应的，该步骤802的实现过程包括：安全固件启动层基于可信根对安全固件引导层进行可信度量，基于对安全固件引导层的度量结果，对安全固件引导层进行控制；安全固件引导层基于可信根对安全固件功能层进行可信度量，基于对安全固件功能层的度量结果，对安全固件功能层进行控制；安全固件功能层对其他待度量对象进行可信度量，基于对其他待度量对象的可信度量结果，对其他待度量对象进行控制，其他待度量对象包括计算机系统中除安全固件外的待度量对象。
在一种可实现方式中，带外管理芯片具有安全核；安全核具体用于运行安全固件启动层、安全固件引导层和安全固件功能层。
并且，带外管理芯片还具有性能核，该性能核用于运行第二操作系统。例如，带外管理 芯片运行计算机系统的第二操作系统引导层、第二操作系统内核层和可信应用程序层。此时，该步骤802还包括：安全固件基于可信根对第二操作系统引导层进行可信度量，基于对第二操作系统引导层的度量结果，对第二操作系统引导层进行控制；第二操作系统引导层基于可信根对第二操作系统内核层进行可信度量，基于对第二操作系统内核层的度量结果，对第二操作系统内核层进行控制；第二操作系统内核层基于可信根对可信应用程序层进行可信度量，基于对可信应用程序层的度量结果，对可信应用程序层进行控制。其中，可信应用程序层用于接收来自计算机系统外部的带外管理信号，基于带外管理信号提供运维服务和/或安全服务。
可选地，第二操作系统内核层包括：可信软件基模块。此时，该步骤802的实现过程还包括：可信软件基模块获取计算组件的第一操作系统内核、应用程序、可信功能组件中的第二操作系统内核和可信应用软件中至少一个待度量对象的可信模型，并基于任一待度量对象的可信模型对任一待度量对象进行可信度量。其中，待度量对象的可信模型用于反映待度量对象的可信程度，可信模型包括待度量对象的度量值和其他参数。
并且，第二操作系统内核层还包括以下一个或多个：可信度量策略管理模块、可信控制策略管理模块、可信基准库管理模块和可信度量结果与日志管理模块。此时，该方法还包括以下一个或多个操作：可信度量策略管理模块管理可信度量过程中使用的度量策略，并向度量主体提供度量策略，度量主体用于对待度量对象进行可信度量；可信控制策略管理模块管理根据度量结果对待度量对象进行控制的控制策略，并向度量主体提供控制策略；可信基准库管理模块管理可信度量过程中用于与待度量对象的度量值进行比较的度量基准，并向度量主体提供度量基准；可信度量结果与日志管理模块记录可信度量结果和用于反映可信度量过程的信息。
进一步地，第二操作系统内核层还包括：可信中间件。可信中间件包括：可信度量服务模块；相应的，第二操作系统内核层基于可信根对可信应用程序层进行可信度量的功能，通过可信度量服务模块基于可信根对可信应用程序层进行可信度量实现，并且，该步骤802的实现过程还包括：第二操作系统内核层基于可信根对可信中间件进行可信度量，基于对可信中间件的度量结果，对可信中间件进行控制。
可选地，可信中间件还包括以下一个或多个：远程安全管理代理模块、远程可信证明代理模块和可信密码服务中间件；相应的，该步骤802的实现过程还还包括以下一个或多个操作：远程安全管理代理模块基于与远程安全运维管理中心的连接，为可信功能组件提供远程安全管理服务；远程可信证明代理模块基于与远程安全运维管理中心的连接，为可信功能组件提供远程可信证明服务；可信密码服务中间件向计算组件和可信功能组件，提供用于使用密码模块的应用程序接口。
步骤803、带外管理芯片基于可信根对计算机系统的计算组件进行可信度量，基于可信度量结果对计算组件进行控制。
在一种可实现方式中，安全固件具体用于对计算组件进行可信度量，基于对计算组件的可信度量结果，对计算组件进行控制。并且，安全固件可以对计算组件中的至少两个待度量对象进行可信度量，基于对至少两个待度量对象中的任一个待度量对象的可信度量结果，对任一个待度量对象进行控制。其中，计算组件中的待度量对象包括：基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。可选地，计算组件的待度量对象还包括：复杂可编程逻辑器件的配置文件。
步骤804、计算组件基于带外管理芯片的控制，执行控制指示的操作。
其中，可信度量包括：在待度量对象运行期间执行的可信度量和在待度量对象启动阶段执行的可信度量；当在待度量对象的运行期间执行可信度量时，控制用于指示待度量对象是否继续运行；当在待度量对象的启动阶段执行可信度量时，控制用于指示待度量对象是否启动。
综上所述，在本申请实施例提供的计算机系统的运行方法中，通过在带外管理芯片中构建可信根，由于带外管理芯片具有硬件更安全的特点，能够保证构建的可信根的安全性。并且，基于可信根对计算组件和可信功能组件进行可信度量和可信控制，能够保证可信度量和可信控制的安全性。同时，通过在运行期间和启动阶段对待度量对象进行可信度量和的可信控制，使得本申请实施例提供的可信防护能力能够覆盖计算组件和可信功能组件的运行期间和启动阶段。
另外，当本申请实施例中的带外管理芯片为BMC时，可以利用BMC具有的安全核的物理隔离优势，能够对计算机进行了完善稳妥的隔离保护，相对于相关技术具备更高的安全防护能力。
本申请实施例还提供了一种计算机系统的可信功能组件的运行方法。该可信功能组件包括BMC芯片。该方法包括：BMC芯片通过运行计算机的安全固件功能层，在BMC芯片中构建可信根，对计算机系统的计算组件中的至少一个待度量对象进行可信度量，基于对至少一个待度量对象中的任一个待度量对象的可信度量结果，对任一个待度量对象进行控制。
其中，至少一个待度量对象包括以下一个或多个：复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
在该计算机系统的可信功能组件的运行方法中，通过在BMC芯片中构建可信根，由于BMC芯片具有硬件更安全的特点，能够保证构建的可信根的安全性。并且，基于可信根对计算组件和可信功能组件进行可信度量和控制，能够保证可信度量和控制的安全性。
同时，通过使用安全固件功能层对计算组件中的至少一个待度量对象进行可信度量和可信控制，相较于相关技术中对计算组件中待度量对象的可信度量和可信控制过程，能够将度量主体尽量集中在安全固件功能层上，使得待度量对象能够尽量靠近可信根，能够解决因计算组件中的度量主体也是待度量对象，导致度量主体和待度量对象身份混淆及可信域与非可信域边界模糊的问题，能够进一步保证计算组件的安全性。
本申请实施例还提供了一种计算机系统的可信功能组件的运行方法。该可信功能组件包括BMC芯片，BMC芯片包括安全核和性能核。该方法包括：安全核通过运行安全固件启动层，在BMC芯片中构建可信根，对计算机系统的可信功能组件和计算组件进行可信度量，基于对待度量对象的可信度量结果，对待度量对象进行控制。
其中，待度量对象包括以下一个或多个：安全固件引导层的镜像文件、安全固件功能层的镜像文件、第二操作系统引导层的镜像文件、第二操作系统内核层的镜像文件和可信应用程序层的镜像文件，以及计算组件中的复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件，安全固件引导层和安全固件功能层被配置为由安全核运行，第二操作系统 引导层、第二操作系统内核层和可信应用程序层被配置为由性能核运行。
在一种可实现方式中，BMC芯片进行可信度量的过程包括以下过程：
安全固件启动层基于在BMC芯片中构建的可信根，对安全固件引导层进行可信度量，基于对安全固件引导层的度量结果，对安全固件引导层进行控制；
安全固件引导层基于可信根对安全固件功能层进行可信度量，基于对安全固件功能层的度量结果，对安全固件功能层进行控制；
安全固件功能层对第二操作系统引导层进行可信度量，基于对第二操作系统引导层的可信度量结果，对第二操作系统引导层进行控制；
第二操作系统引导层基于可信根对第二操作系统内核层进行可信度量，基于对第二操作系统内核层的度量结果，对第二操作系统内核层进行控制；
第二操作系统内核层基于可信根对可信应用程序层进行可信度量，基于对可信应用程序层的度量结果，对可信应用程序层进行控制；
其中，可信应用程序层接收来自计算机系统外部的带外管理信号，基于带外管理信号提供运维服务和/或安全服务。
在该计算机系统的运行方法中，通过在BMC芯片中构建可信根，由于BMC芯片具有硬件更安全的特点，能够保证构建的可信根的安全性。并且，基于可信根对计算组件和可信功能组件进行可信度量和控制，能够保证可信度量和控制的安全性。
同时，通过利用BMC具有的安全核的物理隔离优势，能够对计算机进行了完善稳妥的隔离保护，相对于相关技术具备更高的安全防护能力。
另外，通过使用安全固件功能层对计算组件中的至少一个待度量对象进行可信度量和可信控制，相较于相关技术中对计算组件中待度量对象的可信度量和可信控制过程，能够将度量主体尽量集中在安全固件功能层上，使得待度量对象能够尽量靠近可信根，能够解决因计算组件中的度量主体也是待度量对象，导致度量主体和待度量对象身份混淆及可信域与非可信域边界模糊的问题，能够进一步保证计算组件的安全性。
本申请还提供了一种计算机系统的运行方法。该方法包括：计算机系统的远程安全运维管理中心对本申请实施例提供的可信功能组件，提供远程集中管理服务与运维服务。
在一种可实现方式中，远程安全运维管理中心提供远程集中管理服务与运维服务，包括以下一个或多个：
远程可信证明中心为计算机提供可信挑战和远程可信证明服务；
可信策略与基准管理中心对计算机中的可信度量策略、可信控制策略和可信基准库进行管理；
以及，平台安全管理与审计中心为计算机中的引导层可信组件提供远程连接接口、提供可信度量结果可视化界面功能和可信日志审计功能。
通过远程安全运维管理中心提供远程集中管理服务与运维服务，使得本申请实施例提供的计算机能够配合远程安全运维管理中心提供丰富的安全运维管理能力和远程可信证明服务能力，从而在计算机系统的可信功能组件中建立可信完善的度量主体和可信软件执行环境。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的方法的实现过程，可以相应参考前述内容中的对应内容，在此不再赘述。
本申请实施例提供了一种计算机。该计算机包括硬件平台，该硬件平台包括：处理器、存储器、通信接口、总线和密码模块等。该处理器，通信接口、存储器和密码模块之间通过总线相互连接。存储器中存储有计算机程序。处理器执行计算机程序时，计算机设备实现本申请实施例提供的方法。该计算机的实现方式和结构请参考本申请实施例前述内容中的相应内容。
本申请还提供了一种计算机可读存储介质，该计算机可读存储介质可以为非瞬态的可读存储介质，当计算机可读存储介质中的指令被计算机执行时，该计算机用于执行本申请提供的方法。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如SSD)。
本申请还提供了一种计算机程序产品，该计算机程序产品包括计算机指令，在被计算机设备执行时，该计算机设备执行本申请实施例提供的方法。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
在本申请实施例中，术语“第一”、“第二”和“第三”仅用于描述目的，而不能理解为指示或暗示相对重要性。术语“至少一个”是指一个或多个，术语“多个”指两个或两个以上，除非另有明确的限定。
本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
以上仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的构思和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (28)

  1. 一种计算机系统，其特征在于，所述计算机系统包括：计算组件和可信功能组件，所述可信功能组件包括带外管理芯片；
    所述带外管理芯片用于通过运行安全固件，在所述带外管理芯片中构建可信根，基于所述可信根对所述计算组件进行可信度量，基于可信度量结果对所述计算组件进行控制；
    所述计算组件用于基于所述带外管理芯片的控制，执行所述控制指示的操作。
  2. 根据权利要求1所述的计算机系统，其特征在于，所述带外管理芯片具有安全核；
    所述安全核具体用于通过运行所述安全固件，在所述安全核中构建所述可信根。
  3. 根据权利要求1或2所述的计算机系统，其特征在于，用于构建所述可信根的可信度量根核心存储在所述带外管理芯片的只读存储器中。
  4. 根据权利要求1至3任一所述的计算机系统，其特征在于，所述安全固件具体用于对所述计算组件进行可信度量，基于对所述计算组件的可信度量结果，对所述计算组件进行控制。
  5. 根据权利要求4所述的计算机系统，其特征在于，所述安全固件具体用于对所述计算组件中的至少两个待度量对象进行可信度量，基于对所述至少两个待度量对象中的任一个待度量对象的可信度量结果，对所述任一个待度量对象进行控制；
    其中，所述计算组件中的待度量对象包括：基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
  6. 根据权利要求5所述的计算机系统，其特征在于，所述计算组件的待度量对象还包括：复杂可编程逻辑器件的配置文件。
  7. 根据权利要求1至6任一所述的计算机系统，其特征在于，所述安全固件包括：安全固件启动层、安全固件引导层和安全固件功能层；
    所述带外管理芯片具体用于运行所述安全固件启动层，在所述带外管理芯片中构建所述可信根，所述安全固件启动层还用于基于所述可信根对所述安全固件引导层进行可信度量，基于对所述安全固件引导层的度量结果，对所述安全固件引导层进行控制；
    所述安全固件引导层用于基于所述可信根对所述安全固件功能层进行可信度量，基于对所述安全固件功能层的度量结果，对所述安全固件功能层进行控制；
    所述安全固件功能层用于对其他待度量对象进行可信度量，基于对所述其他待度量对象的可信度量结果，对所述其他待度量对象进行控制，所述其他待度量对象包括所述计算机系统中除所述安全固件外的待度量对象。
  8. 根据权利要求7所述的计算机系统，其特征在于，所述带外管理芯片具有安全核， 所述安全核具体用于运行所述安全固件启动层、所述安全固件引导层和安全固件功能层。
  9. 根据权利要求1至8任一所述的计算机系统，其特征在于，所述带外管理芯片具有性能核，所述性能核用于运行第二操作系统。
  10. 如权利要求9所述的计算机系统，其特征在于，所述性能核具体用于运行第二操作系统引导层、第二操作系统内核层和可信应用程序层；
    所述安全固件还用于基于所述可信根对所述第二操作系统引导层进行可信度量，基于对所述第二操作系统引导层的度量结果，对所述第二操作系统引导层进行控制；
    所述第二操作系统引导层用于基于所述可信根对所述第二操作系统内核层进行可信度量，基于对所述第二操作系统内核层的度量结果，对所述第二操作系统内核层进行控制；
    所述第二操作系统内核层用于基于所述可信根对所述可信应用程序层进行可信度量，基于对所述可信应用程序层的度量结果，对所述可信应用程序层进行控制；
    所述可信应用程序层用于接收来自所述计算机系统外部的带外管理信号，基于所述带外管理信号提供运维服务和/或安全服务。
  11. 根据权利要求10所述的计算机系统，其特征在于，所述第二操作系统内核层包括：可信软件基模块；
    所述可信软件基模块用于获取所述计算组件的第一操作系统内核、应用程序、所述可信功能组件中的第二操作系统内核和可信应用软件中至少一个待度量对象的可信模型，并基于任一待度量对象的可信模型对所述任一待度量对象进行可信度量，所述待度量对象的可信模型用于反映所述待度量对象的可信程度，所述可信模型包括所述待度量对象的度量值和其他参数。
  12. 根据权利要求10或11所述的计算机系统，其特征在于，所述第二操作系统内核层还包括以下一个或多个：可信度量策略管理模块、可信控制策略管理模块、可信基准库管理模块和可信度量结果与日志管理模块；
    所述可信度量策略管理模块用于管理可信度量过程中使用的度量策略，并向度量主体提供所述度量策略，所述度量主体用于对待度量对象进行可信度量；
    所述可信控制策略管理模块用于管理根据度量结果对待度量对象进行控制的控制策略，并向度量主体提供所述控制策略；
    所述可信基准库管理模块用于管理可信度量过程中用于与待度量对象的度量值进行比较的度量基准，并向度量主体提供所述度量基准；
    所述可信度量结果与日志管理模块用于记录可信度量结果和用于反映可信度量过程的信息。
  13. 根据权利要求10至12任一所述的计算机系统，其特征在于，所述第二操作系统内核层还包括：可信中间件，所述可信中间件包括：可信度量服务模块；
    所述第二操作系统内核层基于所述可信根对所述可信应用程序层进行可信度量的功能，通过所述可信度量服务模块基于所述可信根对所述可信应用程序层进行可信度量实现；
    所述第二操作系统内核层还用于基于所述可信根对所述可信中间件进行可信度量，基于对所述可信中间件的度量结果，对所述可信中间件进行控制。
  14. 根据权利要求13所述的计算机系统，其特征在于，所述可信中间件还包括以下一个或多个：远程安全管理代理模块、远程可信证明代理模块和可信密码服务中间件；
    所述远程安全管理代理模块用于基于与远程安全运维管理中心的连接，为所述可信功能组件提供远程安全管理服务；
    所述远程可信证明代理模块用于基于与远程安全运维管理中心的连接，为所述可信功能组件提供远程可信证明服务；
    所述可信密码服务中间件用于向所述计算组件和所述可信功能组件，提供用于使用密码模块的应用程序接口。
  15. 根据权利要求1至14任一所述的计算机系统，其特征在于，所述可信度量包括：在待度量对象运行期间执行的可信度量和在所述待度量对象启动阶段执行的可信度量；
    当在所述待度量对象的运行期间执行可信度量时，所述控制用于指示所述待度量对象是否继续运行；
    当在所述待度量对象的启动阶段执行可信度量时，所述控制用于指示所述待度量对象是否启动。
  16. 一种计算机系统的可信功能组件，其特征在于，所述可信功能组件包括基板管理控制器BMC芯片，所述BMC芯片的安全核中运行有安全固件功能层；
    所述BMC芯片用于通过运行所述安全固件功能层，在所述BMC芯片中构建可信根，对所述计算机系统的计算组件中的至少一个待度量对象进行可信度量，基于对所述至少一个待度量对象中的任一个待度量对象的可信度量结果，对所述任一个待度量对象进行控制；
    所述至少一个待度量对象包括以下一个或多个：复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
  17. 一种计算机系统的可信功能组件，其特征在于，所述可信功能组件包括基板管理控制器BMC芯片，所述BMC芯片包括安全核和性能核，
    所述安全核用于通过运行安全固件启动层，在所述BMC芯片中构建可信根，对所述计算机系统的可信功能组件和所述计算机系统的计算组件进行可信度量，基于对待度量对象的可信度量结果，对所述待度量对象进行控制；
    所述待度量对象包括以下一个或多个：安全固件引导层的镜像文件、安全固件功能层的镜像文件、第二操作系统引导层的镜像文件、第二操作系统内核层的镜像文件和可信应用程序层的镜像文件，以及所述计算组件中的复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件，所述安全固件引导层和所述安全固件功能层被配置为由所述安全核运行，所述第二操作系统引导层、所述第二操作系统内核层和所述可信应用程序层被配置为由所述性能核运行。
  18. 如权利要求17所述的可信功能组件，其特征在于，
    所述安全固件启动层用于基于在所述BMC芯片中构建的可信根，对所述安全固件引导层进行可信度量，基于对所述安全固件引导层的度量结果，对所述安全固件引导层进行控制；
    所述安全固件引导层用于基于所述可信根对所述安全固件功能层进行可信度量，基于对所述安全固件功能层的度量结果，对所述安全固件功能层进行控制；
    所述安全固件功能层用于对所述第二操作系统引导层进行可信度量，基于对所述第二操作系统引导层的可信度量结果，对所述第二操作系统引导层进行控制；
    所述第二操作系统引导层用于基于所述可信根对所述第二操作系统内核层进行可信度量，基于对所述第二操作系统内核层的度量结果，对所述第二操作系统内核层进行控制；
    所述第二操作系统内核层用于基于所述可信根对所述可信应用程序层进行可信度量，基于对所述可信应用程序层的度量结果，对所述可信应用程序层进行控制；
    所述可信应用程序层用于接收来自所述计算机系统外部的带外管理信号，基于所述带外管理信号提供运维服务和/或安全服务。
  19. 一种计算机系统，其特征在于，所述计算机系统包括：远程安全运维管理中心；
    所述远程安全运维管理中心用于对权利要求1至18任一所述的可信功能组件，提供远程集中管理服务与运维服务。
  20. 根据权利要求19所述的计算机系统，其特征在于，所述远程安全运维管理中心包括以下一个或多个：远程可信证明中心、可信策略与基准管理中心和平台安全管理与审计中心；
    所述远程可信证明中心用于为所述计算机提供可信挑战和远程可信证明服务；
    所述可信策略与基准管理中心用于对所述计算机中的可信度量策略、可信控制策略和可信基准库进行管理；
    所述平台安全管理与审计中心用于为所述计算机中的引导层可信组件提供远程连接接口、提供可信度量结果可视化界面功能和可信日志审计功能。
  21. 一种计算机系统的运行方法，其特征在于，所述方法包括：
    所述计算机系统的带外管理芯片通过运行安全固件，在所述带外管理芯片中构建可信根，基于所述可信根对所述计算机系统的计算组件进行可信度量，基于可信度量结果对所述计算组件进行控制；
    所述计算组件基于所述带外管理芯片的控制，执行所述控制指示的操作。
  22. 根据权利要求21所述的方法，其特征在于，所述方法还包括：
    所述安全固件对所述计算组件中的至少两个待度量对象进行可信度量，基于对所述至少两个待度量对象中的任一个待度量对象的可信度量结果，对所述任一个待度量对象进行控制；
    其中，所述计算组件中的待度量对象包括：基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
  23. 根据权利要求22所述的方法，其特征在于，所述计算组件的待度量对象还包括：复杂可编程逻辑器件的配置文件。
  24. 根据权利要求21至23任一所述的方法，其特征在于，所述安全固件包括：安全固件启动层、安全固件引导层和安全固件功能层，所述方法还包括：
    所述带外管理芯片运行所述安全固件启动层，在所述带外管理芯片中构建所述可信根，所述安全固件启动层基于所述可信根对所述安全固件引导层进行可信度量，基于对所述安全固件引导层的度量结果，对所述安全固件引导层进行控制；
    所述安全固件引导层基于所述可信根对所述安全固件功能层进行可信度量，基于对所述安全固件功能层的度量结果，对所述安全固件功能层进行控制；
    所述安全固件功能层对其他待度量对象进行可信度量，基于对所述其他待度量对象的可信度量结果，对所述其他待度量对象进行控制，所述其他待度量对象包括所述计算机系统中除所述安全固件外的待度量对象。
  25. 根据权利要求21至24任一所述的方法，其特征在于，所述方法还包括：
    所述带外管理芯片运行所述计算机系统的第二操作系统引导层、第二操作系统内核层和可信应用程序层；
    所述安全固件基于所述可信根对所述第二操作系统引导层进行可信度量，基于对所述第二操作系统引导层的度量结果，对所述第二操作系统引导层进行控制；
    所述第二操作系统引导层基于所述可信根对所述第二操作系统内核层进行可信度量，基于对所述第二操作系统内核层的度量结果，对所述第二操作系统内核层进行控制；
    所述第二操作系统内核层基于所述可信根对所述可信应用程序层进行可信度量，基于对所述可信应用程序层的度量结果，对所述可信应用程序层进行控制；
    所述可信应用程序层接收来自所述计算机系统外部的带外管理信号，基于所述带外管理信号提供运维服务和/或安全服务。
  26. 一种计算机系统的可信功能组件的运行方法，其特征在于，所述可信功能组件包括基板管理控制器BMC芯片，所述方法包括：
    所述BMC芯片通过运行所述计算机的安全固件功能层，在所述BMC芯片中构建可信根，对所述计算机系统的计算组件中的至少一个待度量对象进行可信度量，基于对所述至少一个待度量对象中的任一个待度量对象的可信度量结果，对所述任一个待度量对象进行控制；
    所述至少一个待度量对象包括以下一个或多个：复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件。
  27. 一种计算机系统的可信功能组件的运行方法，其特征在于，所述可信功能组件包括基板管理控制器BMC芯片，所述BMC芯片包括安全核和性能核，所述方法包括：
    所述安全核通过运行安全固件启动层，在所述BMC芯片中构建可信根，对所述性能核和所述计算机系统的计算组件进行可信度量，基于对待度量对象的可信度量结果，对所述待度 量对象进行控制；
    所述待度量对象包括以下一个或多个：安全固件引导层的镜像文件、安全固件功能层的镜像文件、第二操作系统引导层的镜像文件、第二操作系统内核层的镜像文件和可信应用程序层的镜像文件，以及所述计算组件中的复杂可编程逻辑器件的配置文件、基本输入/输出装置的镜像文件、第一操作系统内核的镜像文件、第一操作系统引导层的镜像文件和业务应用程序的镜像文件，所述安全固件引导层和所述安全固件功能层被配置为由所述安全核运行，所述第二操作系统引导层、所述第二操作系统内核层和所述可信应用程序层被配置为由所述性能核运行。
  28. 一种计算机系统的运行方法，其特征在于，所述方法包括：
    所述计算机系统的远程安全运维管理中心对权利要求1至18任一所述的可信功能组件，提供远程集中管理服务与运维服务。
PCT/CN2021/140990 2020-12-29 2021-12-23 计算机系统、可信功能组件及运行方法 WO2022143429A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21914166.0A EP4258146A4 (en) 2020-12-29 2021-12-23 COMPUTER SYSTEM, RELIABLE FUNCTIONAL ARRANGEMENT AND OPERATING METHODS
US18/344,240 US20230342472A1 (en) 2020-12-29 2023-06-29 Computer System, Trusted Function Component, and Running Method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011586588.5 2020-12-29
CN202011586588.5A CN114692159A (zh) 2020-12-29 2020-12-29 计算机系统、可信功能组件及运行方法

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/344,240 Continuation US20230342472A1 (en) 2020-12-29 2023-06-29 Computer System, Trusted Function Component, and Running Method

Publications (1)

Publication Number Publication Date
WO2022143429A1 true WO2022143429A1 (zh) 2022-07-07

Family

ID=82129178

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/140990 WO2022143429A1 (zh) 2020-12-29 2021-12-23 计算机系统、可信功能组件及运行方法

Country Status (4)

Country Link
US (1) US20230342472A1 (zh)
EP (1) EP4258146A4 (zh)
CN (1) CN114692159A (zh)
WO (1) WO2022143429A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117763553A (zh) * 2022-09-19 2024-03-26 华为技术有限公司 计算机设备及其运行方法、安全芯片

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105160255A (zh) * 2015-08-06 2015-12-16 浪潮电子信息产业股份有限公司 一种可信度量装置及方法
CN106874771A (zh) * 2017-02-16 2017-06-20 浪潮(北京)电子信息产业有限公司 一种构建可信硬件信任链的方法以及装置
CN107506663A (zh) * 2017-08-02 2017-12-22 中电科技（北京）有限公司 基于可信bmc的服务器安全启动方法
US10534620B2 (en) * 2017-11-30 2020-01-14 Dell Products, L.P. Systems and methods for establishing core root of trust measurement (CRTM) for basic input/output (BIOS) image recovery
CN111158767A (zh) * 2019-12-25 2020-05-15 北京工业大学 基于bmc的服务器安全启动方法及装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111008379B (zh) * 2019-11-22 2023-02-28 腾讯科技（深圳）有限公司 电子设备的固件安全检测方法及相关设备
CN112114908A (zh) * 2020-11-20 2020-12-22 支付宝(杭州)信息技术有限公司 硬件平台及其启动方法、装置和电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105160255A (zh) * 2015-08-06 2015-12-16 浪潮电子信息产业股份有限公司 一种可信度量装置及方法
CN106874771A (zh) * 2017-02-16 2017-06-20 浪潮(北京)电子信息产业有限公司 一种构建可信硬件信任链的方法以及装置
CN107506663A (zh) * 2017-08-02 2017-12-22 中电科技（北京）有限公司 基于可信bmc的服务器安全启动方法
US10534620B2 (en) * 2017-11-30 2020-01-14 Dell Products, L.P. Systems and methods for establishing core root of trust measurement (CRTM) for basic input/output (BIOS) image recovery
CN111158767A (zh) * 2019-12-25 2020-05-15 北京工业大学 基于bmc的服务器安全启动方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4258146A4 *

Also Published As

Publication number Publication date
US20230342472A1 (en) 2023-10-26
EP4258146A1 (en) 2023-10-11
CN114692159A (zh) 2022-07-01
EP4258146A4 (en) 2024-05-01

Similar Documents

Publication Publication Date Title
US20220035923A1 (en) Technologies for secure hardware and software attestation for trusted i/o
KR101453266B1 (ko) 서비스 프로세서 컴플렉스 내의 데이터 저장을 위한 요구 기반 ｕｓｂ 프록시
US8201239B2 (en) Extensible pre-boot authentication
US8909940B2 (en) Extensible pre-boot authentication
US9047468B2 (en) Migration of full-disk encrypted virtualized storage between blade servers
WO2020063001A1 (zh) 基本输入输出系统固件的管理方法、装置和服务器
US8984265B2 (en) Server active management technology (AMT) assisted secure boot
US10430589B2 (en) Dynamic firmware module loader in a trusted execution environment container
EP3701411A1 (en) Software packages policies management in a securela booted enclave
US20210342169A1 (en) Emulating physical security devices
US20230237155A1 (en) Securing communications with security processors using platform keys
US20230342472A1 (en) Computer System, Trusted Function Component, and Running Method
CN116049825A (zh) 管理基板管理控制器的存储器中的秘密的存储
US20220398320A1 (en) Data sharing system and method for a multi-boot baseboard management controller (bmc)
US11354259B1 (en) Computer system configurations based on accessing data elements presented by baseboard management controllers
US11748520B2 (en) Protection of a secured application in a cluster
US20190273609A1 (en) Mutually authenticated adaptive management interfaces for interaction with sensitive infrastructure
US20230359741A1 (en) Trusted boot method and apparatus, electronic device, and readable storage medium
US11809876B2 (en) Trusted platform module protection for non-volatile memory express (NVMe) recovery
CN116069584A (zh) 将监控服务扩展到可信云运营商域中
WO2023179745A1 (zh) 可信验证方法及装置
US20240073007A1 (en) Enforcing access control for embedded controller resources and interfaces
US20230146526A1 (en) Firmware memory map namespace for concurrent containers
Achemlal et al. Building trust in virtualized networks
CN117009282A (zh) 强制基于云计算的计算装置遵从参考操作状态

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21914166

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021914166

Country of ref document: EP

Effective date: 20230707

NENP Non-entry into the national phase

Ref country code: DE