WO2024060756A1 - 计算机设备及其运行方法、安全芯片 - Google Patents

计算机设备及其运行方法、安全芯片 Download PDF

Info

Publication number
WO2024060756A1
WO2024060756A1 PCT/CN2023/103448 CN2023103448W WO2024060756A1 WO 2024060756 A1 WO2024060756 A1 WO 2024060756A1 CN 2023103448 W CN2023103448 W CN 2023103448W WO 2024060756 A1 WO2024060756 A1 WO 2024060756A1
Authority
WO
WIPO (PCT)
Prior art keywords
chip
access
security
access request
processing chip
Prior art date
Application number
PCT/CN2023/103448
Other languages
English (en)
French (fr)
Inventor
张瑞
胡科开
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024060756A1 publication Critical patent/WO2024060756A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Definitions

  • This application relates to the field of confidential computing technology, and in particular to a computer device and its operating method, and a security chip.
  • Confidential computing is a technology that protects data in use by performing computations in a hardware-based trusted execution environment. Since the calculation process is performed in a trusted execution environment (TEE), the data involved in the calculation process can be protected. Confidential computing can protect the security of data in use. The key point is to rely on the trust chain of the trusted execution environment, and this trust chain needs to rely on the trust root in the processing chip that performs the calculation.
  • This application provides a computer device, its operating method, and a security chip.
  • This application makes the credibility of the root of trust in the security chip no longer subject to the credibility of the processing chip manufacturer, and gets rid of the current situation that the construction of a trusted execution environment is limited to the processing chip manufacturer, thus improving the credibility of confidential calculations. degree.
  • the technical solutions provided by this application are as follows:
  • this application provides a computer device.
  • the computer equipment includes: a processing chip and a security chip; the security chip is used to run the trusted root, and starts the processing chip based on the trusted root and performs trusted control on the processing chip; the processing chip includes a trusted execution environment, and the trusted execution environment is based on the trustworthy root. Building a trust root, a trusted execution environment is used to perform confidential computations.
  • the security chip and the processing chip are set up separately, which realizes the decoupling of the security chip and the processing chip.
  • the security of the security chip can be guaranteed and endorsed by the manufacturer of the security chip. In this way, the trustworthiness of the root of trust in the security chip is no longer subject to the trustworthiness of the processing chip manufacturer, and it breaks away from the current situation in which the construction of a trusted execution environment is limited to the processing chip manufacturer, thereby improving the reliability of confidential computing. level of trust, and can eliminate users’ distrust of processing chip manufacturers.
  • the security chip Since the security chip is decoupled from the processing chip, the security chip can be connected to different types of processing chips, which improves the compatibility of the entire computer device with multiple chips, which is conducive to promoting the development of large-scale confidential computing application scenarios and promoting confidential computing security. Ecological standardization process.
  • the trusted root includes one or more of the following: startup root, metric root, and encryption root.
  • Boot root is used to secure boot the processing chip.
  • Metric roots are used to prove to remote users that the running status of computer equipment is safe and trustworthy, that is, to achieve remote certification.
  • the encryption root is used to encrypt the memory space of the trusted execution environment to ensure that clear text data will not be leaked in the memory.
  • the security chip is specifically used to use the trusted root to obtain a firmware image used by the startup processing chip, and after the processing chip is powered on, use the firmware image to guide the processing chip to start up.
  • an access control mechanism and/or a communication protection mechanism can be set up in the computer device to ensure the security and trustworthiness of the trusted root and the security and trustworthiness of the communication between the security chip and the processing chip. The following describes the access control mechanism and communication protection mechanism respectively.
  • the processing chip includes a first access control module.
  • the first access control module is used to receive an access request to the trusted root, forward the access request to the security chip when the access request has access rights, and forward the access request to the security chip when the access request does not have access rights.
  • the security chip is also used to respond to access requests.
  • the security chip includes a second access control module.
  • the second access control module is configured to receive an access request to a trusted root, respond to the access request when the access request has access permission, and deny the access request when the access request does not have access permission.
  • the processing chip includes a third access control module
  • the security chip includes a fourth access control module.
  • the third access control module is used to receive an access request to the trusted root, obtain the permission indication information of the access request, and forward the access request and its permission indication information to the security chip; the fourth access control module is used to indicate the access request in the permission indication information.
  • the access permission is granted, the access request is responded to; when the permission indication information indicates that the access request does not have the access permission, the access request is denied.
  • the trusted root is the trusted root of the trusted execution environment, for the trusted root, the trusted execution environment has a higher security level, and the trusted root can be accessed by the trusted execution environment. Therefore, the trusted root comes from the trusted execution environment. Access requests from the trusted execution environment have access rights, while access requests from outside the trusted execution environment do not have access rights.
  • Authentication of access requests through the access control mechanism can ensure that access from the trusted execution environment is valid and block access from outside the trusted execution environment, ensuring the security and trustworthiness of the trusted root.
  • the communication protection mechanism can be implemented through the cooperation of the processing chip and the security chip.
  • the processing chip includes a first communication protection module
  • the security chip includes a second communication protection module
  • the second communication protection module matches the first communication protection module.
  • the first communication protection module and the second communication protection module jointly protect the communication between the security chip and the processing chip.
  • the first communication protection module performs a first communication protection measure on the communication content between the security chip and the processing chip
  • the second communication protection module performs a second communication protection measure on the communication content between the security chip and the processing chip.
  • the communication protection measure matches the first communication protection measure.
  • the second communication protection module performs a first communication protection measure on the communication content between the security chip and the processing chip; the first communication protection module performs a second communication protection measure on the communication content between the security chip and the processing chip, and the second communication protection module performs a second communication protection measure on the communication content between the security chip and the processing chip.
  • the communication protection measure matches the first communication protection measure.
  • one or more strategies can be used between the first communication protection module and the second communication protection module to ensure the security of communication between the security chip and the processing chip.
  • the first communication protection module and the second communication protection module are specifically used to protect the communication between the security chip and the processing chip based on the key policy, so as to ensure the communication between the security chip and the processing chip. Confidentiality.
  • the first communication protection module and the second communication protection module are specifically configured to protect the communication between the security chip and the processing chip based on at least one of the signature policy and the timestamp policy to ensure the security chip and processing.
  • the integrity of communication between chips prevents the communication content between the security chip and the processing chip from being forged and tampered with.
  • the security chip is also used in the remote attestation process.
  • the security chip can implement a remote attestation process using metric roots.
  • the security chip is also used to receive a metric value generated by the processing chip during the startup process, receive a security verification request for the trusted execution environment, generate a metric report based on the metric value, and feed back the metric report based on the security verification request. .
  • the computer device also includes a memory chip
  • the processing chip includes a memory encryption module.
  • the security chip is also used to encrypt the memory.
  • the security chip can enable a remote attestation process using a cryptographic root.
  • the security chip is also used to generate a key using a trusted root and provide the key to the memory encryption module;
  • the memory encryption module is used to encrypt the memory data using the key and provide the encrypted key to the memory chip.
  • memory data, and/or, obtain encrypted memory data from the memory chip, and use the key to decrypt the encrypted memory data;
  • the memory chip is used to store the encrypted memory data, and/or, provide the memory encryption module with Provides encrypted memory data.
  • this application provides a method for operating a computer device.
  • Computer equipment includes: processing chips and security chips.
  • the operating method of the computer equipment includes: the security chip runs the trusted root, and starts the processing chip based on the trusted root and performs trusted control on the processing chip; the processing chip builds a trusted execution environment based on the trusted root, and the trusted execution environment is used for Perform confidential calculations.
  • the security chip starts the processing chip based on the trusted root, including: the security chip uses the trusted root to obtain a firmware image used to start the processing chip; after the processing chip is powered on, the security chip uses the firmware image to boot the processing chip.
  • the trusted root includes one or more of the following: startup root, metric root, and encryption root.
  • the processing chip includes a first access control module
  • the operating method of the computer device also includes: the first access control module receives an access request to the trusted root, forwards the access request to the security chip when the access request has access rights, and rejects the access request when the access request does not have access rights; the security chip responds to the access request.
  • the security chip includes a second access control module
  • the operating method of the computer device also includes: the second access control module receives an access request to the trusted root, and responds to the access request when the access request has access rights, When the access request does not have access rights, Access request denied.
  • the processing chip includes a third access control module
  • the security chip includes a fourth access control module
  • the running method of the computer device also includes: the third access control module receives an access request to the trusted root, and obtains the permission of the access request. Instruction information forwards the access request and its permission indication information to the security chip; the fourth access control module responds to the access request when the permission indication information indicates that the access request has access permission, and when the permission indication information indicates that the access request does not have access permission , access request denied.
  • access requests from the trusted execution environment have access rights, and access requests from outside the trusted execution environment do not have access rights.
  • the processing chip includes a first communication protection module
  • the security chip includes a second communication protection module
  • the second communication protection module matches the first communication protection module.
  • the operating method of the computer device also includes: the first communication protection module and The second communication protection module jointly protects the communication between the security chip and the processing chip.
  • both the first communication protection module and the second communication protection module protect the communication between the security chip and the processing chip based on the key policy.
  • both the first communication protection module and the second communication protection module protect the communication between the security chip and the processing chip based on at least one of the signature policy and the timestamp policy.
  • the running method of the computer device also includes: the security chip receives the metric value generated by the processing chip during the startup process; the security chip receives the security verification request for the trusted execution environment; the security chip generates a metric report based on the metric value, and Feedback metrics reporting based on security verification requests.
  • the computer device also includes: a memory chip, and the processing chip includes a memory encryption module.
  • the running method of the computer device also includes: the security chip uses a trusted root to generate a key and provides the key to the memory encryption module; the memory encryption module uses The key encrypts the memory data and provides the encrypted memory data to the memory chip; the memory chip stores the encrypted memory data.
  • the computer device also includes: a memory chip, and the processing chip includes a memory encryption module.
  • the operating method of the computer device also includes: the security chip uses a trusted root to generate a key, and provides the key to the memory encryption module; the memory chip provides the memory to the memory.
  • the encryption module provides encrypted memory data; the memory encryption module uses a key to decrypt the encrypted memory data.
  • this application provides a security chip, which is the security chip in the first aspect of this application and any possible implementation thereof.
  • this application provides a computer device, including a memory and a processor.
  • the memory stores program instructions
  • the processor runs the program instructions to execute the method provided in the second aspect of this application and any possible implementation thereof. .
  • the present application provides a computer-readable storage medium.
  • the computer-readable storage medium is a non-volatile computer-readable storage medium.
  • the computer-readable storage medium includes program instructions. When the program instructions are executed on the container management device When running on the container management device, the container management device is caused to execute the method provided in the second aspect of this application and any possible implementation manner thereof.
  • the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the second aspect of the present application and any possible implementation thereof.
  • Figure 1 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • Figure 2 is a schematic structural diagram of another computer device provided by an embodiment of the present application.
  • Figure 3 is a schematic structural diagram of yet another computer device provided by an embodiment of the present application.
  • Figure 4 is a schematic structural diagram of yet another computer device provided by an embodiment of the present application.
  • Figure 5 is a schematic structural diagram of yet another computer device provided by an embodiment of the present application.
  • Figure 6 is a schematic structural diagram of yet another computer device provided by an embodiment of the present application.
  • Figure 7 is a schematic structural diagram of yet another computer device provided by an embodiment of the present application.
  • Figure 8 is a schematic diagram of the process of secure startup of a computer device provided by an embodiment of the present application.
  • Figure 9 is a schematic diagram of the process of implementing remote certification by a computer device provided by an embodiment of the present application.
  • FIG10 is a schematic diagram of a process of implementing memory encryption in a computer device provided in an embodiment of the present application.
  • Figure 11 is a schematic structural diagram of yet another computer device provided by an embodiment of the present application.
  • Figure 12 is a flow chart of a method of operating a computer device provided by an embodiment of the present application.
  • Figure 13 is a flowchart of another method of operating a computer device provided by an embodiment of the present application.
  • Confidential computing is a technology based on the capabilities of hardware and software to build and run a trusted execution environment that is isolated from an untrusted environment, guarantee its confidentiality, and perform calculations in it to protect the data in use.
  • confidential computing is defined as: Confidential computing is a technology that protects data in use by performing computations in a hardware-based trusted execution environment.
  • Trusted control refers to the control operation performed on the object to be measured based on the trusted measurement results. Therefore, trusted control can also be called control.
  • trusted control can also be called control.
  • the measurement of the object to be measured passes, the original state of the object to be measured can be maintained, or operations expected to be performed before the object to be measured can be performed with confidence.
  • security measures can be taken for the object to be measured. For example, you can control the computer to reset, or you can control the object to be measured to restart to avoid security threats to the computer caused by the reasons that cause the measurement to fail.
  • Root of trust A module composed of highly reliable hardware, firmware and software whose behavior is always predictable. It is a component that contains one or more specific security functions, such as measurement, storage, reporting, Verify or update. The root of trust is the basis for a system to ensure security and trustworthiness. In existing confidential computing solutions, there are three main types of trusted roots involved: boot root for secure boot, reporting root for remote attestation, and encryption root for memory encryption.
  • Measurement is the process of verifying the security of the measurement object.
  • the process of trustworthiness generally includes two processes: calculation and verification.
  • Calculation refers to using a predetermined algorithm to calculate the software code or configuration file of the measurement object, such as calculating the hash value of the software code.
  • Verification refers to comparing the calculation result with the pre-stored metric benchmark of the metric object. If the calculation result conforms to the metric benchmark, it is determined that the metric object complies with security, and vice versa.
  • the measurement object is the subject whose trustworthy measurement is performed, and the subject who performs the trustworthy measurement operation on the measurement object is the measurement subject.
  • Core root of trust for measurement It is the executable code used to establish the root of trust. By running the core root of trust, the root of trust can be established.
  • the trustworthy credential root core is the first piece of code executed after the trusted computing platform is powered on.
  • the processing chip includes a trusted execution environment and a normal execution environment (also called a rich execution environment (REE)).
  • Trusted execution environment and ordinary execution environment are concepts proposed by the Global Platform (GP).
  • the trusted execution environment and the ordinary execution environment are obtained by dividing two independent execution environments on a mobile terminal device based on the original hardware and software of the mobile terminal device. Among them, the trusted execution environment has its own operating system, and security applications are deployed in the trusted execution environment.
  • the ordinary execution environment cannot access the resources of the trusted execution environment without authorization.
  • the ordinary execution environment and the trusted execution environment isolate device resources and run in isolation through the sharing of physical devices and software scheduling within the hardware.
  • the processing chip may be a processor, such as a central processing unit (CPU).
  • Confidential computing can protect the security of data in use, and its application scenarios are very wide, especially in the field of cloud computing.
  • Common applications include Enclave-based encrypted data analysis, copyright protection, genetic data processing, key protection, key management systems, privacy-preserving machine learning, and confidential databases.
  • Others such as blockchain privacy computing, blockchain, trusted artificial intelligence (AI), privacy edge computing, etc., can all be built on the basis of confidential computing technology to better serve application scenarios.
  • Confidential computing technology is an innovative data isolation and encryption processing technology that can protect sensitive data from the server chip hardware layer even if privileged software such as OS kernel, hypervisor, and even BIOS have been damaged or even malicious.
  • the trust chain of the trusted execution environment is based on the root of trust built into the processing chip.
  • the trustworthiness of the root of trust is subject to the trustworthiness of the processing chip manufacturer, causing the trustworthiness of confidential computing to be affected by the trustworthiness of the processing chip manufacturer.
  • this also results in existing confidential computing solutions that are usually strongly bound to the processing chip provider and difficult to be compatible with each other.
  • application development in a confidential computing trusted execution environment requires a processing chip. Manufacturer approval and certification are required. This limits the use of chips from different manufacturers in one system or cluster at the same time, restricting the development of large-scale confidential computing.
  • FIG. 1 is a schematic diagram of a computer device 10 provided by an embodiment of the present application.
  • the computer device 10 includes: a processing chip 101 and a security chip 102 .
  • the security chip 102 is used to run the trusted root 1021, start the processing chip 101 based on the trusted root 1021, and perform security control on the processing chip 101.
  • the processing chip 101 includes a trusted execution environment 1011, which is built based on the trusted root 1021.
  • the trusted execution environment 1011 is used to perform confidential calculations. Among them, since the trusted execution environment 1011 needs to use a trust chain, and the trust chain is built based on the trusted root 1021, it can be considered that the trusted execution environment 1011 is built based on the trusted root 1021.
  • the security chip 102 and the processing chip 101 are set up separately, realizing the decoupling of the security chip 102 and the processing chip 101.
  • the security of the security chip 102 can be guaranteed and endorsed by the manufacturer of the security chip 102.
  • the trustworthiness of the root of trust 1021 in the security chip 102 is no longer subject to the trustworthiness of the processing chip 101 manufacturer, and it gets rid of the current situation in which the construction of the trusted execution environment 1011 is limited to the processing chip 101 manufacturer, thus improving the This increases the credibility of confidential computing and eliminates users' distrust of processing chip 101 manufacturers.
  • the security chip 102 Since the security chip 102 is decoupled from the processing chip 101, the security chip 102 can be connected to different types of processing chips 101, which improves the compatibility of the entire computer device 10 with multiple chips and is conducive to promoting the development of large-scale confidential computing application scenarios. And promote the standardization process of confidential computing security ecosystem.
  • an access control mechanism and/or a communication protection mechanism can be set up in the computer device 10 to ensure the security and trustworthiness of the trusted root 1021 and the security and reliability of the communication between the security chip and the processing chip 101.
  • the implementation principle of the access control mechanism is: after receiving an access request to the trusted root 1021, authenticate the access request, allow access when the access request has access permission, and allow access when the access request does not Access is denied when access is available.
  • the access control mechanism when implementing the access control mechanism, it can be implemented in the processing chip 101, or in the security chip 102, or through cooperation between the processing chip 101 and the security chip 102. The implementation processes of these three implementation situations are described below:
  • the access control mechanism is implemented in the processing chip 101 .
  • the processing chip 101 includes a first access control module 1012 .
  • the first access control module 1012 is configured to receive an access request to the trusted root 1021, forward the access request to the security chip 102 when the access request has access permission, and reject the access request when the access request does not have access permission.
  • the security chip 102 is also used to receive the access request and respond to the access request.
  • the access control mechanism is implemented in the security chip 102.
  • the security chip 102 includes a second access control module 1022.
  • the second access control module 1022 is used to receive an access request to the trusted root 1021, respond to the access request when the access request has access rights, and reject the access request when the access request does not have access rights.
  • the access request received by the security chip 102 may be sent by the processing chip 101.
  • the access control mechanism is implemented through the cooperation of the processing chip 101 and the security chip 102 .
  • the processing chip 101 includes a third access control module 1013
  • the security chip 102 includes a fourth access control module 1023 .
  • the third access control module 1013 is configured to receive an access request to the trusted root 1021, obtain the access request permission indication information, and forward the access request and its permission indication information to the security chip 102.
  • the fourth access control module 1023 is configured to receive an access request and its access permission, respond to the access request when the permission indication information indicates that the access request has access permission, and reject the access request when the permission indication information indicates that the access request does not have access permission. .
  • the trusted root 1021 is the trusted root 1021 of the trusted execution environment 1011, for the trusted root 1021, the trusted execution environment 1011 has a higher security level, and the trusted root 1021 can be used by the trusted execution environment. 1011 access, therefore, access requests from the trusted execution environment 1011 have access rights, and access requests from outside the trusted execution environment 1011 do not have access rights.
  • Authentication of access requests through the access control mechanism can ensure that access from the trusted execution environment 1011 is valid and block access from outside the trusted execution environment 1011, ensuring the security and trustworthiness of the trusted root 1021. This is especially obvious when the computer device 10 is deployed in the cloud.
  • the computer device 10 is usually managed by a cloud administrator.
  • the cloud administrator has higher authority, but this is not excluded. Cloud administrators can make the root of trust 1021 insecure.
  • the access request from the cloud administrator can be regarded as an access request from the ordinary execution environment 1014. Through this access control mechanism, the cloud administrator can be denied access to the trusted root 1021. Therefore, it can effectively Ensure the security and trustworthiness of trusted root 1021.
  • the access permission may or may not be carried in the access request.
  • access rights can be determined by the sender of the access request. For example, access rights can be set in advance for each component (such as computing resources, memory areas, peripherals, etc.) in the computer device 10.
  • the access rights set for it can be read first, and Send the access permission in the access request.
  • the access permission can also be set in advance for each component in the computer device 10, and any component can send its access permission to the component that needs to authenticate its access request.
  • the access permissions of all components can be recorded in the designated location of the computer device 10.
  • the access permissions of the access request can be obtained from the designated location according to the sender of the access request. Obtain the access rights for the access request.
  • access permissions can also be represented by permission identifiers, and different assignments of permission identifiers represent different access permissions. For example, when the assigned value of the authority identifier is 0, it can be determined that the access authority to the trusted root 1021 is present; when the assigned value of the authority identifier is 1, it can be determined that the access authority to the trusted root 1021 is not present.
  • the communication protection mechanism can be implemented through the cooperation of the processing chip 101 and the security chip 102 .
  • the processing chip 101 includes a first communication protection module 1015
  • the security chip 102 includes a second communication protection module 1024 .
  • the second communication protection module 1024 matches the first communication protection module 1015.
  • the first communication protection module 1015 and the second communication protection module 1024 are used to protect the communication between the security chip 102 and the processing chip 101 .
  • the first communication protection module performs a first communication protection measure on the communication content between the security chip and the processing chip;
  • the second communication protection module performs a second communication protection measure on the communication content between the security chip and the processing chip.
  • the communication protection measure matches the first communication protection measure.
  • the second communication protection module performs a first communication protection measure on the communication content between the security chip and the processing chip; the first communication protection module performs a second communication protection measure on the communication content between the security chip and the processing chip, and the second communication protection module performs a second communication protection measure on the communication content between the security chip and the processing chip.
  • the communication protection measure matches the first communication protection measure.
  • the matching of the first communication protection module 1015 and the second communication protection module 1024 means that they can protect the communication between the processing chip 101 and the security chip 102 according to the pre-negotiated encrypted communication protocol.
  • one or more strategies can be used between the first communication protection module 1015 and the second communication protection module 1024 to ensure the security of the communication between the security chip 102 and the processing chip 101 .
  • the first communication protection module 1015 and the second communication protection module 1024 can protect the communication between the security chip 102 and the processing chip 101 based on the key policy to ensure that the security chip 102 and the processing chip 101 Confidentiality of communications between. That is, when communicating between the security chip 102 and the processing chip 101, one of the first communication protection module 1015 and the second communication protection module 1024 can use the encryption key to encrypt the communication content.
  • the first communication protection module 1015 and Another one of the second communication protection modules 1024 may use a decryption key that matches the encryption key to decrypt the communication content to ensure the security of the communication content during the communication process.
  • the first communication protection module 1015 and the second communication protection module 1024 can also protect the communication between the security chip 102 and the processing chip 101 based on at least one of the signature policy and the timestamp policy to ensure that the security chip The integrity of the communication between the security chip 102 and the processing chip 101 prevents the communication content between the security chip 102 and the processing chip 101 from being forged and tampered with.
  • one of the first communication protection module 1015 and the second communication protection module 1024 can use some methods to sign the communication content, and the other of the first communication protection module 1015 and the second communication protection module 1024 can verify The signature, when verified, confirms that the communication content has not been forged or tampered with.
  • the first communication protection module 1015 can use a hash algorithm to perform a hash operation on the data to be sent, and then use an asymmetric private key to encrypt the hash result to generate a signature.
  • the second communication protection module 1024 can verify the signature using the corresponding public key.
  • one of the first communication protection module 1015 and the second communication protection module 1024 can use some methods to add a timestamp to the communication content, and the other of the first communication protection module 1015 and the second communication protection module 1024 One can verify the validity of the timestamp. When verifying that the timestamp is valid, it is determined that the communication content has not been forged or tampered with.
  • the first communication protection module 1015 and the second communication protection module 1024 can implement communication protection through the transport layer security protocol (transport layer security, TLS) or the secure socket layer (secure sockets layer, SSL) security protocol. mechanism.
  • transport layer security protocol transport layer security, TLS
  • secure socket layer secure sockets layer, SSL
  • the trusted root 1021 includes one or more of the following: startup root 1021a, metric root 1021b (also called reporting root), and encryption root 1021c (also called storage root).
  • the boot root 1021a is used to securely boot the processing chip 101.
  • the metric root 1021b is used to prove to remote users that the running status of the computer device 10 is safe and trustworthy, that is, to implement remote certification.
  • the encryption root 1021c is used to encrypt the memory space of the trusted execution environment 1011 to ensure that data will not be leaked in plain text in the memory.
  • the startup root 1021a, the metric root 1021b, and the encryption root 1021c all run in the security chip 102, which is external to the processing chip 101.
  • the startup root 1021a, the metric root 1021b and the encryption root 1021c are all external to the processing chip 101, so that the security of the startup root 1021a, the metric root 1021b and the encryption root 1021c can be guaranteed and endorsed by the manufacturer of the security chip 102 , and is no longer limited by the manufacturer of the processing chip 101.
  • FIG. 7 the startup root 1021a, the metric root 1021b, and the encryption root 1021c all run in the security chip 102, which is external to the processing chip 101.
  • the startup root 1021a, the metric root 1021b and the encryption root 1021c are all external to the processing chip 101, so that the security of the startup root 1021a, the metric root 1021b and the encryption root 1021c can be guaranteed and endorsed by the manufacturer of the security chip 102 , and is no longer limited
  • FIG. 7 illustrates that the boot root 1021a, metric root 1021b, and encryption root 1021c are all running in the security chip 102, it is not excluded that parts of the boot root 1021a, metric root 1021b, and encryption root 1021c can also run. Outside the security chip 102 (eg in the processing chip 101). For example, the boot root 1021a and the metric root 1021b can run in the security chip 102, and the encryption root 1021c can run in the processing chip 101.
  • Persons of ordinary skill in the art know that as business requirements change, the deployment method of the startup root 1021a, the measurement root 1021b, and the encryption root 1021c can be adjusted according to the business requirements, which are not specifically limited in the embodiments of this application.
  • the security chip 102 is specifically used to use the boot root 1021a to obtain the firmware image used by the boot processing chip 101 after power-on, and use the firmware image to boot the processing chip 101 to start.
  • the security chip 102 is first reset and powered on, and then the security chip 102 builds the trusted root 1021 by running the trusted metric root core. Then, use the boot root 1021a to verify the latest version of the firmware image 1031. When the latest version of the firmware image 1031 passes the verification, it is determined that the latest version of the firmware image 1031 is used to boot the processing chip 101 for startup.
  • the latest version of the firmware image 1031 fails the verification, it is determined to use the older version of the backup firmware image 1031 to boot the processing chip 101 to ensure that the computer device 10 can start. Then, the system of the computer device 10 including the processing chip 101 is powered on, and the determined firmware image is used to boot the processing chip 101 to start.
  • the system firmware 1016 is securely booted, and then the software of the computer device 10 (such as the operating system of the trusted execution environment 1011 (TEE OS, also known as the secure operating system), the operating system LibOS of the ordinary execution environment 1014 (also known as the ordinary operating system) , such as the Linux kernel), virtual machine operating system, etc.), and after the verification ensures that the software has not been tampered with, the trusted system software is loaded, thereby enabling the startup of the entire computer device 10.
  • the trusted metric root core is the first line of code run after the security chip 102 is powered on, which can be stored in the read-only memory (ROM) of the security chip 102 .
  • the firmware image 1031 may be stored in the flash memory (Flash) 103 of the computer device 10 .
  • Verifying the firmware image is mainly to verify its integrity to ensure that the confidential computing firmware has not been tampered with, and after determining that the confidential computing firmware has not been tampered with, load trusted firmware.
  • the firmware can be confidential computing firmware, such as basic input/output system (BIOS), bootloader, ATF, etc.
  • BIOS basic input/output system
  • bootloader ATF
  • the secure startup should be extended to the integrity of each secure application.
  • the computer device 10 also needs to verify the security application and load a trusted security application after ensuring that the security application has not been tampered with.
  • the operation of booting the processing chip 101 using the determined firmware image may be performed by the boot boot module 1017 in the processing chip 101 .
  • the startup sequence of each component during the safe boot process is shown in the direction of the bold black arrow in Figure 8.
  • the implementation of remote attestation by the metric root 1021b includes: the security chip 102 receives the metric value generated by the processing chip 101 during the startup process, and when receiving the security verification request for the trusted execution environment 1011, generates a metric report based on the metric value, and Feedback metrics reporting based on security verification requests.
  • the security chip 102 receives the metric value generated by the processing chip 101 during the startup process, and when receiving the security verification request for the trusted execution environment 1011, generates a metric report based on the metric value, and Feedback metrics reporting based on security verification requests.
  • the security chip 102 receives the metric value generated by the processing chip 101 during the startup process, and when receiving the security verification request for the trusted execution environment 1011, generates a metric report based on the metric value, and Feedback metrics reporting based on security verification requests.
  • the security chip 102 receives the metric value generated by the processing chip 101 during the startup process, and when receiving the security verification request for the trusted execution environment 1011, generates a
  • the remote user can verify the metric value stored in the root of trust 1021 through a cryptographic challenge at any time to confirm that the operating status of the computer device 10 is safe and trustworthy.
  • the remote certification process will be triggered.
  • the metric root 1021b serves as the reporting root of the computer device 10, can generate a metric report for remote challenges based on the saved metric values, and provide remote certification services.
  • the metric report is provided by the server (the dotted line arrow in Figure 9 is the sending direction of the metric report).
  • the remote server can verify the metric report to ensure the security of the trusted execution environment 1011.
  • the computer device 10 When encrypting the memory space of the trusted execution environment 1011, as shown in FIG10, the computer device 10 also includes a memory chip 104, and the processing chip 101 includes a memory encryption module 1018.
  • the security chip 102 is also used to generate a key using the trusted root 1021, and provide the key to the memory encryption module 1018 through an encrypted channel.
  • the memory encryption module 1018 is used to encrypt the memory data using the key, and provide the encrypted memory data to the memory chip 104, and/or obtain the encrypted memory data from the memory chip 104, and use the key to decrypt the encrypted memory data.
  • the memory encryption module 1018 After the memory encryption module 1018 decrypts the memory data, it can provide the decrypted memory data to the trusted execution environment 1011, so that the trusted execution environment 1011 performs confidential computing based on the data.
  • the memory chip 104 is used to receive and store the encrypted memory data, and/or provide the encrypted memory data to the memory encryption module 1018. In this way, it can be ensured that the data always remains in a ciphertext state after leaving the processing chip 101.
  • the memory encryption module can be a memory encryption engine (memory encryption engine, MEE), which is used to perform hardware encryption and decryption operations on the memory space that needs to be encrypted.
  • MEE memory encryption engine
  • the memory chip 104 may include an encrypted memory area and a normal memory area.
  • the encrypted memory area is a memory space that needs to be encrypted.
  • one or more security applications can usually be deployed in the trusted execution environment 1011, and each security application can correspond to an encrypted area in the encrypted memory area.
  • the encryption root 1021c can generate different keys for different security applications, and the memory encryption module can use the security application's own key to perform encryption on the data used by the security application itself. Encryption or decryption operations to ensure the security of data used by each security application.
  • the dotted arrow represents the key transmission direction
  • the dotted arrow represents the data transmission direction.
  • the security chip 102 and the processing chip 101 are provided separately, which realizes the decoupling of the security chip 102 and the processing chip 101.
  • the security of the security chip 102 can be provided by the security chip 102. guaranteed and endorsed by the manufacturer. In this way, the trustworthiness of the root of trust 1021 in the security chip 102 is no longer subject to the trustworthiness of the processing chip 101 manufacturer, and it gets rid of the current situation in which the construction of the trusted execution environment 1011 is limited to the processing chip 101 manufacturer, thus improving the This increases the credibility of confidential computing and eliminates users' distrust of processing chip 101 manufacturers.
  • the security chip 102 Since the security chip 102 is decoupled from the processing chip 101, the security chip 102 can be connected to different types of processing chips 101, which improves the compatibility of the entire computer device 10 with multiple chips and is conducive to promoting the development of large-scale confidential computing application scenarios. And promote the standardization process of confidential computing security ecosystem.
  • FIG. 11 is a schematic diagram of another computer device 10 provided by an embodiment of the present application.
  • the computer device 10 may also include: a memory 105 , a communication interface 106 and a bus 107 .
  • the processing chip 101, the security chip 102, the memory 105, and the communication interface 106 realize communication connections between each other through the bus 107.
  • the processing chip 101 may include a general processing chip 101 and/or a dedicated hardware chip.
  • the general processing chip 101 may include: a central processing unit (CPU), a microprocessor or a graphics processing unit (GPU).
  • the CPU is, for example, a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a dedicated hardware chip is a high-performance processing hardware module. Specialized hardware chips include at least one of a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a network processor (NP) One item.
  • the processing chip 101 may also be an integrated circuit chip with signal processing capabilities. During the implementation process, some or all of the functions implemented by the processing chip 101 in this application can be completed by instructions in the form of hardware integrated logic circuits or software in the processing chip 101 .
  • the memory 105 is used to store computer programs, which include an operating system 105a and executable codes (ie, program instructions) 105b.
  • the memory 105 is, for example, a read-only memory or other type of static storage device that can store static information and instructions, or a random access memory or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable memory device.
  • the memory 105 is used to store outbound port queues, etc.
  • the memory 105 exists independently, for example, and is connected to the processing chip 101 through a bus 107 . Or the memory 105 and the processing chip 101 are integrated together.
  • Memory 105 may store executable code. When the executable code stored in the memory 105 is executed by the processing chip 101, the processing chip 101 is used for some or all of the functions implemented by the processing chip 101 in this application. For example, processing chip 101 performs confidential calculations.
  • the memory 105 may also include operating systems and other software modules and data required for running processes.
  • the communication interface 106 uses a transceiver module such as but not limited to a transceiver to implement communication with other devices or communication networks.
  • the communication interface 106 may be any one or any combination of the following devices: a network interface (such as an Ethernet interface), a wireless network card, and other devices with network access functions.
  • Bus 107 is any type of communication bus used to interconnect internal devices of computer device 10 (eg, memory 105, processing chip 101, communication interface 106).
  • system bus e.g., system bus.
  • the embodiment of the present application takes the above-mentioned devices inside the computer device 10 as being interconnected through the bus 107 as an example.
  • the above-mentioned devices inside the computer device 10 may also use other connection methods besides the bus 107 to communicate with each other.
  • the above-mentioned devices inside the computer device 10 are interconnected through internal logical interfaces.
  • the computer device 10 may also include a flash memory 103 and a memory chip 104, etc.
  • the above-mentioned plurality of devices can be respectively arranged on independent chips, or at least part or all of them can be arranged on the same chip. Whether each device is independently installed on different chips or integrated on one or more chips often depends on the needs of product design.
  • the embodiments of this application do not limit the specific implementation forms of the above devices.
  • the descriptions of the processes corresponding to each of the above drawings have different emphases. For parts that are not detailed in a certain process, you can refer to the relevant descriptions of other processes.
  • each component of the computer device may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product that provides a program development platform includes one or more computer instructions. When these computer program instructions are loaded and executed on the computer device 10, the functions in the components of the computer device provided by the embodiments of the present application are fully or partially implemented, such as Realize the function of the processing chip or realize the function of the security chip.
  • computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another.
  • computer instructions may be transmitted over a wired connection from a website, computer, server or data center. (such as coaxial cable, optical fiber, digital subscriber line or wireless (such as infrared, wireless, microwave, etc.) to transmit to another website, computer, server or data center.
  • the computer-readable storage medium stores information that provides a program development platform Computer program instructions.
  • the structure of the above computer device is an exemplary description of the structure of the computer device provided in the embodiment of the present application, and does not constitute a limitation on the structure of the computer device.
  • a person of ordinary skill in the art will know that as business needs change, the structure of the computer device can be adjusted according to application requirements, and the embodiment of the present application does not list them one by one.
  • the embodiment of the present application also provides a method for operating a computer device.
  • the computer device includes: a processing chip and a security chip.
  • the computer device may be the computer device provided in the above embodiment.
  • the computer device may be the computer device shown in any one of Figures 1 to 11.
  • the method for operating the computer device includes:
  • Step 1201 The security chip runs the trusted root, starts the processing chip based on the trusted root, and performs trustworthy control on the processing chip.
  • the trusted root includes one or more of the following: a startup root, a metric root, and a cryptographic root.
  • the implementation process of the security chip starting the processing chip based on the trusted root includes: the security chip uses the trusted root to obtain a firmware image used to start the processing chip; after the processing chip is powered on, the security chip uses the firmware image to boot the processing chip.
  • Step 1202 The processing chip builds a trusted execution environment based on the trusted root, and the trusted execution environment is used to perform confidential calculations.
  • an access control mechanism and/or a communication protection mechanism can be set up in the computer device to ensure the security and trustworthiness of the trusted root and the security and trustworthiness of the communication between the security chip and the processing chip. The following describes the access control mechanism and communication protection mechanism respectively.
  • the processing chip includes a first access control module.
  • the operating method of the computer device may also include:
  • Step 1203 The first access control module receives the access request to the trusted root, forwards the access request to the security chip when the access request has access permission, and rejects the access request when the access request does not have access permission.
  • Step 1204 The security chip responds to the access request.
  • the security chip includes a second access control module.
  • the method of operating the computer device may also include:
  • Step 1205 The second access control module receives the access request to the trusted root, responds to the access request when the access request has access permission, and rejects the access request when the access request does not have access permission.
  • the processing chip includes a third access control module
  • the security chip includes a fourth access control module.
  • the operating method of the computer device may also include:
  • Step 1206 The third access control module receives an access request to the trusted root, obtains permission indication information of the access request, and forwards the access request and its permission indication information to the security chip.
  • Step 1207 The fourth access control module responds to the access request when the permission indication information indicates that the access request has access permission, and rejects the access request when the permission indication information indicates that the access request does not have access permission.
  • access requests from the trusted execution environment have access rights, and access requests from outside the trusted execution environment do not have access rights.
  • the processing chip includes a first communication protection module
  • the security chip includes a second communication protection module
  • the second communication protection module matches the first communication protection module.
  • the operating method of the computer device also includes: the first communication protection module and the second communication protection module jointly protect the communication between the security chip and the processing chip.
  • the operating method of the computer device also includes: step 1208, the first communication protection module performs the first communication protection measure on the communication content between the security chip and the processing chip; step 1209, the second communication protection The module performs a second communication protection measure on the communication content between the security chip and the processing chip, and the second communication protection measure matches the first communication protection measure.
  • the operating method of the computer device further includes: the second communication protection module performs the first communication protection measure on the communication content between the security chip and the processing chip; the first communication protection module performs the first communication protection measure on the communication content between the security chip and the processing chip. A second communication protection measure is executed, and the second communication protection measure matches the first communication protection measure.
  • both the first communication protection module and the second communication protection module protect the communication between the security chip and the processing chip based on the key policy.
  • the first communication protection measure may be encryption
  • the second communication protection measure may be decryption.
  • both the first communication protection module and the second communication protection module protect the communication between the security chip and the processing chip based on at least one of the signature policy and the timestamp policy.
  • the first communication protection measure may be signing and adding a time stamp
  • the second communication protection measure may be verifying the signature and time stamp.
  • the communication protection mechanism can be used in combination with the access control mechanism, and the communication protection mechanism can be used in combination with any implementation method of the access control mechanism.
  • Figure 13 here is a schematic diagram of the first implementation of the communication protection mechanism and the access control mechanism.
  • the operating method of the computer device may also include a remote certification process.
  • the operating method of the computer device may also include:
  • Step 1210 The security chip receives and processes the metric value generated by the chip during the startup process.
  • Step 1211 The security chip receives a security verification request for the trusted execution environment.
  • Step 1212 The security chip generates a metric report based on the metric value, and feeds back the metric report based on the security verification request.
  • the computer equipment also includes: memory chips.
  • the processing chip includes a memory encryption module.
  • the method of operating the computer device may also include a memory encryption and decryption process. As shown in Figure 13, the operating method of the computer device may also include the following memory encryption process:
  • Step 1213 The security chip uses the trusted root to generate a key and provide the key to the memory encryption module.
  • Step 1214 The memory encryption module uses the key to encrypt the memory data and provides the encrypted memory data to the memory chip.
  • Step 1215 The memory chip stores the encrypted memory data.
  • the operating method of the computer device may also include the following memory decryption process:
  • Step 1213 The security chip uses the trusted root to generate a key and provide the key to the memory encryption module.
  • Step 1216 The memory chip provides the encrypted memory data to the memory encryption module.
  • Step 1217 The memory encryption module uses the key to decrypt the encrypted memory data.
  • the security chip and the processing chip are set up separately, which realizes the decoupling of the security chip and the processing chip.
  • the security of the security chip can be performed by the manufacturer of the security chip. Guarantees and endorsements. In this way, the trustworthiness of the root of trust in the security chip is no longer subject to the trustworthiness of the processing chip manufacturer, and it breaks away from the current situation in which the construction of a trusted execution environment is limited to the processing chip manufacturer, thereby improving the reliability of confidential computing. level of trust, and can eliminate users’ distrust of processing chip manufacturers.
  • the security chip Since the security chip is decoupled from the processing chip, the security chip can be connected to different types of processing chips, which improves the compatibility of the entire computer device with multiple chips, which is conducive to promoting the development of large-scale confidential computing application scenarios and promoting confidential computing security. Ecological standardization process.
  • An embodiment of the present application also provides a security chip.
  • the security chip is used to run a root of trust, start the processing chip based on the root of trust, and perform trustworthy control of the processing chip.
  • the security chip is specifically used to use a trusted root to obtain the firmware image used by the boot processing chip, and perform the boot operation on the processing chip. After power-on, use the firmware image boot processing chip to start.
  • the trusted root includes one or more of the following: startup root, metric root, and encryption root.
  • the security chip is also used to respond to access requests.
  • the computer device may include a security chip and a processing chip.
  • the processing chip is configured to receive an access request to a trusted root. When the access request has access permission, forward the access request to the security chip. When the access request does not have access permission, When access permission is granted, the access request is denied. At this time, if the access request received by the security chip is an access request with access permission, it can respond to the access request.
  • the security chip includes a second access control module.
  • the second access control module is used to receive an access request to the trusted root, respond to the access request if the access request has access rights, and reject the access request if the access request does not have access rights.
  • the processing chip includes a third access control module
  • the security chip includes a fourth access control module.
  • the third access control module is used to receive the access request to the trusted root, obtain the permission indication information of the access request, and forward the access request and its permission indication information to the security chip; the fourth access control module is used to indicate the access request in the permission indication information.
  • the access permission is granted, the access request is responded to; when the permission indication information indicates that the access request does not have the access permission, the access request is denied.
  • access requests from the trusted execution environment have access rights, and access requests from outside the trusted execution environment do not have access rights.
  • the security chip can also implement a communication protection mechanism to protect its communication content.
  • the processing chip includes a first communication protection module
  • the security chip includes a second communication protection module
  • the second communication protection module matches the first communication protection module
  • the first communication protection module and the second communication protection module are Yu Lianhe protects the communication between the security chip and the processing chip.
  • the first communication protection module and the second communication protection module are specifically used to protect the communication between the security chip and the processing chip based on the key policy.
  • first communication protection module and the second communication protection module are specifically configured to protect the communication between the security chip and the processing chip based on at least one of the signature policy and the timestamp policy.
  • the security chip is also used to receive the metric value generated by the processing chip during the startup process, receive the security verification request for the trusted execution environment, generate a metric report based on the metric value, and feed back the metric report based on the security verification request.
  • the computer device further includes a memory chip
  • the processing chip includes a memory encryption module.
  • the security chip is further used to generate a key using a trusted root and provide the key to the memory encryption module;
  • the memory encryption module is used to encrypt memory data using the key and provide the encrypted memory data to the memory chip, and/or obtain the encrypted memory data from the memory chip and decrypt the encrypted memory data using the key;
  • the memory chip is used to store the encrypted memory data and/or provide the encrypted memory data to the memory encryption module.
  • the security chip and the processing chip are set up separately, which realizes the decoupling of the security chip and the processing chip.
  • the security of the security chip can be guaranteed and endorsed by the manufacturer of the security chip. .
  • the trustworthiness of the root of trust in the security chip is no longer subject to the trustworthiness of the processing chip manufacturer, and it breaks away from the current situation in which the construction of a trusted execution environment is limited to the processing chip manufacturer, thus improving the reliability of confidential computing. level of trust, and can eliminate users’ distrust of processing chip manufacturers.
  • the security chip Since the security chip is decoupled from the processing chip, the security chip can be connected to different types of processing chips, which improves the compatibility of the entire computer device with multiple chips, which is conducive to promoting the development of large-scale confidential computing application scenarios and promoting confidential computing security. Ecological standardization process.
  • Embodiments of the present application also provide a computer-readable storage medium.
  • the computer-readable storage medium may be a non-volatile computer-readable storage medium.
  • the computer-readable storage medium includes program instructions. When the program instructions are stored on a computer device, When running, the computer device is caused to execute the running method of the computer device provided by the embodiment of the present application.
  • Embodiments of the present application also provide a computer program product containing instructions.
  • the computer program product When the computer program product is run on a computer, it causes the computer to execute the operating method of the computer device provided by the embodiment of the present application.
  • the information including but not limited to user equipment information, user personal information, etc.
  • data including but not limited to data used for analysis, stored data, displayed data, etc.
  • signals involved in this application All are authorized by the user or fully authorized by all parties. rights, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.
  • the terms “first”, “second” and “third” are only used for description purposes and cannot be understood as indicating or implying relative importance.
  • the term “at least one” refers to one or more, and the term “plurality” refers to two or more, unless expressly limited otherwise.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种计算机设备及其运行方法、安全芯片，属于机密计算技术领域。该计算机设备包括：处理芯片和安全芯片；安全芯片用于运行可信根，并基于可信根启动处理芯片和对处理芯片进行可信控制；处理芯片包括可信执行环境，可信执行环境基于可信根构建，可信执行环境用于执行机密计算。本申请使得安全芯片中的可信根的可信程度不再受制于处理芯片厂商的可信程度，摆脱了可信执行环境的构建限制于处理芯片厂商的现状，进而提高了机密计算的可信程度。

Description

计算机设备及其运行方法、安全芯片
本申请要求于2022年09月19日提交的申请号为202211139911.3、发明名称为“计算机设备及其运行方法、安全芯片”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及机密计算技术领域，特别涉及一种计算机设备及其运行方法、安全芯片。
背景技术
随着计算机技术的快速发展，数据的安全性受到了越来越多的重视。当前对数据的安全性的保护策略通常作用于静态存储的数据或处于网络传输状态的数据。但是，当数据正在被使用时，数据的安全性仍然存在风险。因此，对正在被使用的数据进行保护是亟待解决的问题。
目前，可以采用机密计算(confidential computing)技术对正在被使用的数据进行保护。在国际机密计算联盟(confidential computing consortium，CCC)中，机密计算的定义为：机密计算是通过在基于硬件的可信执行环境中执行计算来保护使用中的数据的一种技术。由于计算过程在可信执行环境(trusted execution environment，TEE)中进行，因此计算过程中涉及的数据能够被保护。机密计算能够保护使用中的数据的安全性，其关键点在于依赖可信执行环境的信任链，而该信任链需要依赖执行计算的处理芯片中的可信根构建。
但是，可信根的可信程度受制于处理芯片厂商的可信程度，导致机密计算的可信程度也会受到处理芯片厂商的可信程度的影响。
发明内容
本申请提供了一种计算机设备及其运行方法、安全芯片。本申请使得安全芯片中的可信根的可信程度不再受制于处理芯片厂商的可信程度，摆脱了可信执行环境的构建限制于处理芯片厂商的现状，进而提高了机密计算的可信程度。本申请提供的技术方案如下：
第一方面，本申请提供了一种计算机设备。计算机设备包括：处理芯片和安全芯片；安全芯片用于运行可信根，并基于可信根启动处理芯片和对处理芯片进行可信控制；处理芯片包括可信执行环境，可信执行环境基于可信根构建，可信执行环境用于执行机密计算。
在本申请提供的计算机设备中，安全芯片与处理芯片分开设置，实现了安全芯片与处理芯片的解耦，安全芯片的安全性可以由安全芯片的厂商进行保障和背书。这样一来，安全芯片中的可信根的可信程度不再受制于处理芯片厂商的可信程度，摆脱了可信执行环境的构建限制于处理芯片厂商的现状，进而提高了机密计算的可信程度，且能够消除用户对处理芯片厂商的不信任。由于安全芯片与处理芯片解耦，使得安全芯片能够与不同类型的处理芯片对接，提高了整个计算机设备对多种芯片的兼容性，有利于促进大规模机密计算应用场景的发展以及推动机密计算安全生态的标准化进程。
可选的，可信根包括以下一种或多种：启动根、度量根和加密根。启动根用于安全启动处理芯片。度量根用于向远程的用户证明计算机设备的运行状态的安全可信，即实现远程证明。加密根用于对可信执行环境的内存空间进行加密，以保证数据在内存中不会出现明文泄露。
在一种实现方式中，安全芯片具体用于使用可信根获取启动处理芯片使用的固件镜像，并在处理芯片上电后，使用固件镜像引导处理芯片启动。
将可信根外置在处理芯片外后，一个比较关键的问题是如何继续保证可信根本身以及可信根与处理芯片之间通信的安全可信。为此，本申请在实现可信根外置的同时，还提出了一些安全保障机制。在一种可实现方式中，可以在计算机设备中设置访问控制机制和/或通信保护机制，以保证可信根的安全可信，以及保证安全芯片与处理芯片之间通信的安全可信。下面分别对访问控制机制和通信保护机制进行说明。
在访问控制机制的一种实现方式中，处理芯片包括第一访问控制模块。第一访问控制模块用于接收对可信根的访问请求，在访问请求具有访问权限时，向安全芯片转发访问请求，在访问请求不具有访问权限 时，拒绝访问请求；安全芯片还用于对访问请求进行响应。
在访问控制机制的另一种实现方式中，安全芯片包括第二访问控制模块。第二访问控制模块用于接收对可信根的访问请求，在访问请求具有访问权限时，对访问请求进行响应，在访问请求不具有访问权限时，拒绝访问请求。
在访问控制机制的再一种实现方式中，处理芯片包括第三访问控制模块，安全芯片包括第四访问控制模块。第三访问控制模块用于接收对可信根的访问请求，获取访问请求的权限指示信息，向安全芯片转发访问请求及其权限指示信息；第四访问控制模块用于在权限指示信息指示访问请求具有访问权限时，对访问请求进行响应，在权限指示信息指示访问请求不具有访问权限时，拒绝访问请求。
其中，由于可信根是可信执行环境的可信根，对可信根而言，可信执行环境具有较高的安全等级，可信根能够能被可信执行环境访问，因此，来自可信执行环境的访问请求具有访问权限，来自可信执行环境外的访问请求不具有访问权限。
通过访问控制机制对访问请求进行鉴权，能够保证来自可信执行环境的访问有效，并屏蔽来自可信执行环境外的访问，能够保证可信根的安全可信。
下面对通信保护机制进行说明。在本申请中，通信保护机制可以通过处理芯片和安全芯片合作实现。在通信保护机制的一种可实现方式中，处理芯片包括第一通信保护模块，安全芯片包括第二通信保护模块，第二通信保护模块与第一通信保护模块匹配。此时，第一通信保护模块与第二通信保护模块联合对安全芯片和处理芯片之间的通信进行保护。例如，第一通信保护模块对安全芯片和处理芯片之间的通信内容执行第一通信保护措施；第二通信保护模块对安全芯片和处理芯片之间的通信内容执行第二通信保护措施，第二通信保护措施与第一通信保护措施匹配。或者，第二通信保护模块对安全芯片和处理芯片之间的通信内容执行第一通信保护措施；第一通信保护模块对安全芯片和处理芯片之间的通信内容执行第二通信保护措施，第二通信保护措施与第一通信保护措施匹配。
在实现通信保护机制时，第一通信保护模块和第二通信保护模块之间可以通过一种或多种策略，保障安全芯片和处理芯片之间通信的安全性。在一种实现方式中，第一通信保护模块和第二通信保护模块具体用于基于密钥策略，对安全芯片和处理芯片之间的通信进行保护，以保障安全芯片和处理芯片之间通信的机密性。
可选的，第一通信保护模块和第二通信保护模块具体还用于基于签名策略和时间戳策略中的至少一个，对安全芯片和处理芯片之间的通信进行保护，以保障安全芯片和处理芯片之间通信的完整性，防止安全芯片和处理芯片之间的通信内容被伪造和篡改。
可选的，安全芯片还用于远程证明过程。安全芯片可以使用度量根实现远程证明过程。在一种实现方式中，安全芯片还用于接收处理芯片在启动过程中生成的度量值，接收对可信执行环境的安全验证请求，基于度量值生成度量报告，并基于安全验证请求反馈度量报告。
可选的，计算机设备还包括内存芯片，处理芯片包括内存加密模块。则安全芯片还用于对内存进行加密。安全芯片可以使用加密根实现远程证明过程。在一种可实现方式中，安全芯片还用于使用可信根生成密钥，向内存加密模块提供密钥；内存加密模块用于使用密钥对内存数据进行加密，并向内存芯片提供经过加密的内存数据，和/或，从内存芯片获取经过加密的内存数据，并使用密钥对经过加密的内存数据进行解密；内存芯片用于存储经过加密的内存数据，和/或，向内存加密模块提供经过加密的内存数据。
第二方面，本申请提供了一种计算机设备的运行方法。计算机设备包括：处理芯片和安全芯片。该计算机设备的运行方法包括：安全芯片运行可信根，并基于可信根启动处理芯片和对处理芯片进行可信控制；处理芯片基于可信根构建可信执行环境，可信执行环境用于执行机密计算。
可选的，安全芯片基于可信根启动处理芯片，包括：安全芯片使用可信根获取启动处理芯片使用的固件镜像；安全芯片在处理芯片上电后，使用固件镜像引导处理芯片启动。
可选的，可信根包括以下一种或多种：启动根、度量根和加密根。
可选的，处理芯片包括第一访问控制模块，该计算机设备的运行方法还包括：第一访问控制模块接收对可信根的访问请求，在访问请求具有访问权限时，向安全芯片转发访问请求，在访问请求不具有访问权限时，拒绝访问请求；安全芯片对访问请求进行响应。
可选的，安全芯片包括第二访问控制模块，该计算机设备的运行方法还包括：第二访问控制模块接收对可信根的访问请求，在访问请求具有访问权限时，对访问请求进行响应，在访问请求不具有访问权限时， 拒绝访问请求。
可选的，处理芯片包括第三访问控制模块，安全芯片包括第四访问控制模块，该计算机设备的运行方法还包括：第三访问控制模块接收对可信根的访问请求，获取访问请求的权限指示信息，向安全芯片转发访问请求及其权限指示信息；第四访问控制模块在权限指示信息指示访问请求具有访问权限时，对访问请求进行响应，在权限指示信息指示访问请求不具有访问权限时，拒绝访问请求。
可选的，来自可信执行环境的访问请求具有访问权限，来自可信执行环境外的访问请求不具有访问权限。
可选的，处理芯片包括第一通信保护模块，安全芯片包括第二通信保护模块，第二通信保护模块与第一通信保护模块匹配，该计算机设备的运行方法还包括：第一通信保护模块与第二通信保护模块联合对安全芯片和处理芯片之间的通信进行保护。
可选的，第一通信保护模块和第二通信保护模块均基于密钥策略，对安全芯片和处理芯片之间的通信进行保护。
可选的，第一通信保护模块和第二通信保护模块均基于签名策略和时间戳策略中的至少一个，对安全芯片和处理芯片之间的通信进行保护。
可选的，该计算机设备的运行方法还包括：安全芯片接收处理芯片在启动过程中生成的度量值；安全芯片接收对可信执行环境的安全验证请求；安全芯片基于度量值生成度量报告，并基于安全验证请求反馈度量报告。
可选的，计算机设备还包括：内存芯片，处理芯片包括内存加密模块，该计算机设备的运行方法还包括：安全芯片使用可信根生成密钥，向内存加密模块提供密钥；内存加密模块使用密钥对内存数据进行加密，并向内存芯片提供经过加密的内存数据；内存芯片存储经过加密的内存数据。
可选的，计算机设备还包括：内存芯片，处理芯片包括内存加密模块，该计算机设备的运行方法还包括：安全芯片使用可信根生成密钥，向内存加密模块提供密钥；内存芯片向内存加密模块提供经过加密的内存数据；内存加密模块使用密钥对经过加密的内存数据进行解密。
第三方面，本申请提供了一种安全芯片，安全芯片为本申请第一方面以及其任一种可能的实现方式中的安全芯片。
第四方面，本申请提供了一种计算机设备，包括存储器和处理器，存储器存储有程序指令，处理器运行程序指令以执行本申请第二方面以及其任一种可能的实现方式中提供的方法。
第五方面，本申请提供了一种计算机可读存储介质，该计算机可读存储介质为非易失性计算机可读存储介质，该计算机可读存储介质包括程序指令，当程序指令在容器管理设备上运行时，使得容器管理设备执行本申请第二方面以及其任一种可能的实现方式中提供的方法。
第六方面，本申请提供了一种包含指令的计算机程序产品，当计算机程序产品在计算机上运行时，使得计算机执行本申请第二方面以及其任一种可能的实现方式中提供的方法。
附图说明
图1是本申请实施例提供的一种计算机设备的结构示意图；
图2是本申请实施例提供的另一种计算机设备的结构示意图；
图3是本申请实施例提供的又一种计算机设备的结构示意图；
图4是本申请实施例提供的再一种计算机设备的结构示意图；
图5是本申请实施例提供的又一种计算机设备的结构示意图；
图6是本申请实施例提供的再一种计算机设备的结构示意图；
图7是本申请实施例提供的又一种计算机设备的结构示意图；
图8是本申请实施例提供的一种计算机设备安全启动的过程示意图；
图9是本申请实施例提供的一种计算机设备实现远程证明的过程示意图；
图10是本申请实施例提供的一种计算机设备实现内存加密的过程示意图；
图11是本申请实施例提供的再一种计算机设备的结构示意图；
图12是本申请实施例提供的一种计算机设备的运行方法的流程图；
图13是本申请实施例提供的另一种计算机设备的运行方法的流程图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
为便于理解，下面先对本申请实施例涉及的一些术语和技术进行简单介绍。
机密计算是基于硬件和软件的能力，构建和运行一种与不可信环境隔离的可信执行环境，保障其机密性，并在其中执行计算以保护使用中的数据的一种技术。在国际机密计算联盟中，机密计算的定义为：机密计算是通过在基于硬件的可信执行环境中执行计算来保护使用中的数据的一种技术。
可信控制是指根据可信度量结果对待度量对象执行的控制操作，因此，可信控制也可称为控制。其中，当对待度量对象的度量通过时，可以维持待度量对象原本的状态，或执行待度量对象在被可信度量之前预期需要执行的操作。当对待度量对象的度量不通过时，可以对待度量对象采取安全措施。例如，可以控制计算机复位，或者，可以控制待度量对象重新启动，以避免导致度量不通过的原因对计算机造成安全威胁。
可信根(root of trust，RoT)：由高可靠的硬件、固件及软件所组成的行为运行始终可预期的模块，是包含一个或多个特定安全功能的组件，例如度量、存储、报告、验证或更新。可信根是一个系统能够保证安全可信的基础。在现有的机密计算解决方案中，涉及到的可信根主要有三种：用于安全启动的启动根、用于远程证明的报告根和用于内存加密的加密根。
度量(或称可信度量)是验证度量对象的安全性的过程。可信度量的过程的一般包括：计算和校验两个过程。计算是指采用预定算法对度量对象的软件代码或配置文件进行计算，例如计算软件代码的杂凑值。校验是指将计算结果与预先存储的该度量对象的度量基准进行比对，如果计算结果符合度量基准，则确定该度量对象符合安全性，反之亦然。其中，度量对象为被执行可信度量的主体，对度量对象执行可信度量操作的主体为度量主体。
可信度量根核心(core root of trust for measurement，CRTM)：是用于建立可信度量根的可执行代码，通过运行该可信度量根核心能够的建立可信度量根。可信度量根核心是可信计算平台上电启动后执行的第一段代码。
处理芯片包括可信执行环境和普通执行环境(也称富执行环境(rich execution environment，REE))。可信执行环境和普通执行环境是全球平台组织(global platform，GP)提出的概念。可信执行环境和普通执行环境是在移动终端设备原有的硬件和软件的基础上，通过在一个移动终端设备上划分出的两个独立的执行环境得到。其中，可信执行环境具有自身操作系统，可信执行环境中部署由安全应用。普通执行环境在非授权情况下不能访问可信执行环境的资源。普通执行环境和可信执行环境对设备资源进行了隔离，通过对物理器件共享及硬件内的软件调度隔离运行。在一种实现方式中，处理芯片可以为处理器，例如中央处理器(central processing unit，CPU)。
随着计算机技术的快速发展，数据的安全性受到了越来越多的重视。并且，近年来随着云计算的快速发展，越来越多的关键性服务和高价值数据被迁移到了云端。随着计算从内部部署转移到公共云和边缘，对数据的保护变得更加复杂。当前对数据的安全性的保护策略通常作用于静态存储的数据或处于网络传输状态的数据。但是，当数据正在被使用时，数据的安全性仍然存在风险。这也是数据保护中最具挑战性的一个步骤。因此，对正在被使用的数据进行保护是亟待解决的问题。
目前安全领域重要的一项技术进展名为机密计算。机密计算可以保护使用中数据的安全性，其应用场景非常广泛，特别是在云计算领域。常见的应用有基于Enclave的加密数据分析、版权保护、基因数据处理、密钥保护、密钥管理系统、隐私保护的机器学习、以及保密数据库等。其他如区块链隐私计算、区块链、可信人工智能(artificial intelligence，AI)、隐私边缘计算等，都可以构建在机密计算技术基础上，以更好的服务应用场景。机密计算技术是一种创新的数据隔离和加密处理技术，它可以从服务器芯片硬件层保障，即使OS kernel、Hypervisor、甚至BIOS等特权软件都已经遭到破坏甚至本来就是恶意的情况下，敏感数据和代码依然能安全无虞，确保重要应用数据和代码的机密性和完整性，为关键业务提供易用、安全、集群化的可信计算环境。由于计算过程在可信执行环境中进行，因此计算过程中涉及的数据能够被保护。机密计算能够保护使用中的数据的安全性，其关键点在于依赖可信执行环境的信任链，而该信任链需要依赖执行计算的处理芯片中的可信根构建。
但是，目前在实现机密计算的方案中，可信执行环境的信任链都是基于处理芯片内置的可信根构建。这样一来，可信根的可信程度受制于处理芯片厂商的可信程度，导致机密计算的可信程度也会受到处理芯片厂商的可信程度的影响。并且，这样还导致现有的机密计算解决方案通常与处理芯片的提供厂商强绑定，且难以互相兼容，导致在某些技术方案中，机密计算可信执行环境中的应用开发需要得到处理芯片厂商的审批与认证才能进行。这样就限制了在一个系统或者集群中同时采用不同厂商的芯片，制约了大规模机密计算的发展。
本申请实施例提供了一种计算机设备。图1是本申请实施例提供的一种计算机设备10的示意图。如图1所示，该计算机设备10包括：处理芯片101和安全芯片102。安全芯片102用于运行可信根1021，并基于可信根1021启动处理芯片101和对处理芯片101进行安全控制。处理芯片101包括可信执行环境1011，可信执行环境1011基于可信根1021构建，可信执行环境1011用于执行机密计算。其中，由于可信执行环境1011需要使用信任链，而信任链基于可信根1021构建，因此，可以认为可信执行环境1011基于可信根1021构建。
在该计算机设备10中，安全芯片102与处理芯片101分开设置，实现了安全芯片102与处理芯片101的解耦，安全芯片102的安全性可以由安全芯片102的厂商进行保障和背书。这样一来，安全芯片102中的可信根1021的可信程度不再受制于处理芯片101厂商的可信程度，摆脱了可信执行环境1011的构建限制于处理芯片101厂商的现状，进而提高了机密计算的可信程度，且能够消除用户对处理芯片101厂商的不信任。由于安全芯片102与处理芯片101解耦，使得安全芯片102能够与不同类型的处理芯片101对接，提高了整个计算机设备10对多种芯片的兼容性，有利于促进大规模机密计算应用场景的发展以及推动机密计算安全生态的标准化进程。
将可信根1021外置在处理芯片101外后，一个比较关键的问题是如何继续保证可信根1021本身以及可信根1021与处理芯片101之间通信的安全可信。为此，本申请实施例在实现可信根1021外置的同时，还提出了一些安全保障机制。在一种可实现方式中，可以在计算机设备10中设置访问控制机制和/或通信保护机制，以保证可信根1021的安全可信，以及保证安全芯片与处理芯片101之间通信的安全可信。下面分别对访问控制机制和通信保护机制进行说明。
在本申请实施例中，访问控制机制的实现原则是：在接收到对可信根1021的访问请求后，对该访问请求进行鉴权，在访问请求具有访问权限时允许访问，在访问请求不具有访问权限时拒绝访问。可选的，在实现该访问控制机制时，其可以在处理芯片101中实现，也可以在安全芯片102中实现，还可以通过处理芯片101和安全芯片102合作实现。下面分别对这三种实现情况的实现过程进行说明：
在第一种实现情况中，访问控制机制在处理芯片101中实现。如图2所示，在一种实现方式中，处理芯片101包括第一访问控制模块1012。第一访问控制模块1012用于接收对可信根1021的访问请求，在访问请求具有访问权限时，向安全芯片102转发访问请求，在访问请求不具有访问权限时，拒绝访问请求。此时，由于第一访问控制模块1012向安全芯片102转发的访问请求具有访问权限，安全芯片102还用于接收访问请求，对访问请求进行响应。
在第二种实现情况中，访问控制机制在安全芯片102中实现。如图3所示，在一种实现方式中，安全芯片102包括第二访问控制模块1022。第二访问控制模块1022用于接收对可信根1021的访问请求，在访问请求具有访问权限时，对访问请求进行响应，在访问请求不具有访问权限时，拒绝访问请求。其中，安全芯片102接收的访问请求可以为处理芯片101发送的。
在第三种实现情况中，访问控制机制通过处理芯片101和安全芯片102合作实现。如图4所示，在一种实现方式中，处理芯片101包括第三访问控制模块1013，安全芯片102包括第四访问控制模块1023。第三访问控制模块1013用于接收对可信根1021的访问请求，获取访问请求权限指示信息，向安全芯片102转发访问请求及其权限指示信息。第四访问控制模块1023用于接收访问请求及其访问权限，在权限指示信息指示访问请求具有访问权限时，对访问请求进行响应，在权限指示信息指示访问请求不具有访问权限时，拒绝访问请求。
其中，由于可信根1021是可信执行环境1011的可信根1021，对可信根1021而言，可信执行环境1011具有较高的安全等级，可信根1021能够能被可信执行环境1011访问，因此，来自可信执行环境1011的访问请求具有访问权限，来自可信执行环境1011外的访问请求不具有访问权限。例如，以访问控制机制通 过处理芯片101实现为例，如图5所示，当计算机设备10包括可信执行环境1011和普通执行环境1014时，由于可信根1021作为可信执行环境1011的可信根1021，仅能被具有较高安全等级的可信执行环境1011访问，而任何来自普通执行环境1014的访问请求，包括来自普通执行环境1014中管理员级别的访问都不应该拥有对可信根1021的访问权限，因此，所有来自可信执行环境1011的访问请求具有访问权限，所有来自普通执行环境1014的访问请求均不具有访问权限。
通过访问控制机制对访问请求进行鉴权，能够保证来自可信执行环境1011的访问有效，并屏蔽来自可信执行环境1011外的访问，能够保证可信根1021的安全可信。这一点在计算机设备10部署在云端时表现的尤其明显，当计算机设备10部署在云端时，计算机设备10通常由云端管理员进行管理，一般来说云端管理员具有较高的权限，但不排除云端管理员会造成可信根1021的不安全。在本申请实施例中，可将来自云端管理员的访问请求视为来自普通执行环境1014的访问请求，通过该访问控制机制能够拒绝云端管理员对可信根1021的访问，因此，能够有效地保证可信根1021的安全可信。
在一种可实现方式中，在实现访问控制机制时，访问权限可以携带在访问请求中，也可以不携带在访问请求中。当访问权限携带在访问请求中时，访问权限可以由访问请求的发送者确定。例如，可以预先为计算机设备10中每个组件(如计算资源、内存区域和外设等)设置访问权限，当任一组件需要发送访问请求时，可以先读取为其设置的访问权限，并将该访问权限携带在该访问请求中发送。当访问请求不携带在访问请求中时，也可以预先为计算机设备10中每个组件设置访问权限，任一组件可以向需要对其访问请求鉴权的组件发送其访问权限。或者，当访问请求不携带在访问请求中时，计算机设备10的指定位置中可以记载有所有组件的访问权限，在需要获取访问请求的访问权限时，可以根据访问请求的发送端从该指定位置中获取访问请求的访问权限。
并且，访问权限还可以使用权限标识表示，权限标识的不同赋值表示的访问权限不同。例如，当权限标识的赋值为0时，可以确定具有对可信根1021的访问权限，当权限标识的赋值为1时，可以确定不具有对可信根1021的访问权限。
下面对通信保护机制进行说明。在本申请实施例中，通信保护机制可以通过处理芯片101和安全芯片102合作实现。在一种实现方式中，如图6所示，处理芯片101包括第一通信保护模块1015，安全芯片102包括第二通信保护模块1024。第二通信保护模块1024与第一通信保护模块1015匹配。第一通信保护模块1015和第二通信保护模块1024用于对安全芯片102和处理芯片101之间的通信进行保护。例如，第一通信保护模块对安全芯片和处理芯片之间的通信内容执行第一通信保护措施；第二通信保护模块对安全芯片和处理芯片之间的通信内容执行第二通信保护措施，第二通信保护措施与第一通信保护措施匹配。或者，第二通信保护模块对安全芯片和处理芯片之间的通信内容执行第一通信保护措施；第一通信保护模块对安全芯片和处理芯片之间的通信内容执行第二通信保护措施，第二通信保护措施与第一通信保护措施匹配。其中，第一通信保护模块1015和第二通信保护模块1024匹配表示两者能够按照预先商议好的加密通信协议对处理芯片101和安全芯片102之间的通信进行保护。
在实现通信保护机制时，第一通信保护模块1015和第二通信保护模块1024之间可以通过一种或多种策略，保障安全芯片102和处理芯片101之间通信的安全性。在一种实现方式中，第一通信保护模块1015和第二通信保护模块1024可以基于密钥策略，对安全芯片102和处理芯片101之间的通信进行保护，以保障安全芯片102和处理芯片101之间通信的机密性。也即是，在安全芯片102和处理芯片101之间通信时，第一通信保护模块1015和第二通信保护模块1024中的一个可以使用加密密钥对通信内容加密，第一通信保护模块1015和第二通信保护模块1024中的另一个可以使用与加密密钥匹配的解密密钥，对通信内容进行解密，以保证通信内容在通信过程中的安全性。
可选的，第一通信保护模块1015和第二通信保护模块1024还可以基于签名策略和时间戳策略中的至少一个，对安全芯片102和处理芯片101之间的通信进行保护，以保障安全芯片102和处理芯片101之间通信的完整性，防止安全芯片102和处理芯片101之间的通信内容被伪造和篡改。
在使用签名策略时，第一通信保护模块1015和第二通信保护模块1024中的一个可以使用一些方式对通信内容签名，第一通信保护模块1015和第二通信保护模块1024中的另一个可以验证签名，在验证通过时，确定通信内容未被伪造和篡改。例如，当处理芯片101向安全芯片102发送数据时，第一通信保护模块1015可以采用哈希(Hash)算法对待发送的数据进行杂凑操作，然后使用非对称私钥对杂凑的结果进行加密产生签名。第二通信保护模块1024可以采用相应的公钥验证签名。
在使用时间戳策略时，第一通信保护模块1015和第二通信保护模块1024中的一个可以使用一些方式向通信内容添加时间戳，第一通信保护模块1015和第二通信保护模块1024中的另一个可以验证时间戳的有效性，在验证时间戳有效时，确定通信内容未被伪造和篡改。
在一种实现方式中，第一通信保护模块1015和第二通信保护模块1024可以通过传输层安全性协议(transport layer security，TLS)或安全套接层(secure sockets layer，SSL)安全协议实现通信保护机制。
在本申请实施例中，可信根1021包括以下一种或多种：启动根1021a、度量根1021b(也称报告根)和加密根1021c(也称存储根)。启动根1021a用于安全启动处理芯片101。度量根1021b用于向远程的用户证明计算机设备10的运行状态的安全可信，即实现远程证明。加密根1021c用于对可信执行环境1011的内存空间进行加密，以保证数据在内存中不会出现明文泄露。
示例的，如图7所示，启动根1021a、度量根1021b和加密根1021c均运行在安全芯片102中，该安全芯片102外置在处理芯片101外。这样一来，启动根1021a、度量根1021b和加密根1021c均外置于处理芯片101外，使得启动根1021a、度量根1021b和加密根1021c的安全性可以由安全芯片102的厂商进行保障和背书，而不再受限于处理芯片101的厂商。另外，虽然图7是以启动根1021a、度量根1021b和加密根1021c均运行在安全芯片102中为例进行说明，但不排除启动根1021a、度量根1021b和加密根1021c中的部分也可以运行在安全芯片102外(如处理芯片101中)。例如，启动根1021a和度量根1021b可以运行在安全芯片102中，加密根1021c可以运行在处理芯片101中。本领域普通技术人员可知，随着业务需求的改变，启动根1021a、度量根1021b和加密根1021c的部署方式可以根据业务需求进行调整，本申请实施例对其不做具体限定。
下面分别对启动根1021a、度量根1021b和加密根1021c的实现过程进行说明：
在启动根1021a安全启动处理芯片101的过程中，安全芯片102具体用于在上电后，使用启动根1021a获取启动处理芯片101使用的固件镜像，并使用固件镜像引导处理芯片101启动。在一种实现方式中，如图8所示，在计算机设备10的上电过程中，安全芯片102首先复位并上电，然后安全芯片102通过运行可信度量根核心构建可信根1021。然后，使用启动根1021a对最新版本的固件镜像1031进行校验。在最新版本的固件镜像1031通过校验时，确定使用该最新版本的固件镜像1031引导处理芯片101启动。在最新版本的固件镜像1031未通过校验时，确定使用较老版本的备份固件镜像1031引导处理芯片101启动，以确保计算机设备10能够启动。然后对包括处理芯片101在内的计算机设备10的系统上电，并使用确定的固件镜像引导处理芯片101启动。例如，安全启动系统固件1016，然后对计算机设备10的软件(如可信执行环境1011的操作系统(TEE OS，也称安全操作系统)、普通执行环境1014的操作系统LibOS(也称普通操作系统，例如Linux内核)、虚拟机操作系统等)的完整性进行校验，通过校验确保软件未被篡改后，加载可信的系统软件，从而实现整个计算机设备10的启动。其中，可信度量根核心是安全芯片102上电后运行的第一行代码，其可以存储在安全芯片102的只读存储器(read only memory，ROM)中。固件镜像1031可以存储在计算机设备10的闪存(Flash)103中。对固件镜像进行校验主要是对其完整性进行校验，确保机密计算固件未被篡改，并在确定机密计算固件未被篡改后，加载可信的固件。固件可以为机密计算固件，如基本输入输出系统(base input/output system，BIOS)、引导加载程序(Bootloader)、ATF等。并且，可信执行环境1011中部署有安全应用，在安全启动的过程中，安全启动应扩展到每个安全应用的完整性。每次加载一个安全应用(如用户工作负载)时，计算机设备10还需要对安全应用进行校验，并在确保安全应用未被篡改后，加载可信的安全应用。另外，使用确定的固件镜像引导处理芯片101启动的操作可以由处理芯片101中的启动引导模块1017执行。安全启动过程中各组件的启动顺序见图8中黑色加粗的箭头的指向。
度量根1021b实现远程证明的实现方式包括：安全芯片102接收处理芯片101在启动过程中生成的度量值，在接收到对可信执行环境1011的安全验证请求时，基于度量值生成度量报告，并基于安全验证请求反馈度量报告。在一种实现方式中，如图9所示，在可信根1021安全启动处理芯片101的过程中，当某个层级的固件或者软件被确认安全后，就会生成其度量值，并将度量值发送至安全芯片102(图9中虚线箭头为度量值的发送方向)，安全芯片102可以保存启动过程中各个阶段生成的度量值。在计算机设备10随后的运行过程中，远程的用户可以随时通过密码学挑战的方式来校验可信根1021中保存的度量值，以确认计算机设备10的运行状态的安全可信。此时，就会触发远程证明过程。在这个过程中，度量根1021b作为计算机设备10的报告根，可以根据保存的度量值生成用于远程挑战的度量报告，并向远程证明服务 器提供该度量报告(图9中点画线箭头为度量报告的发送方向)。远程服务器可以对度量报告进行校验，以确保可信执行环境1011的安全性。
在对可信执行环境1011的内存空间进行加密时，如图10所示，计算机设备10还包括内存芯片104，处理芯片101包括内存加密模块1018。此时，安全芯片102还用于使用可信根1021生成密钥，并通过加密通道向内存加密模块1018提供密钥。内存加密模块1018用于使用密钥对内存数据进行加密，并向内存芯片104提供经过加密的内存数据，和/或，从内存芯片104获取经过加密的内存数据，并使用密钥对经过加密的内存数据进行解密。内存加密模块1018对内存数据解密后，可向可信执行环境1011提供解密后的内存数据，以便于可信执行环境1011基于该数据进行机密计算。相应的，内存芯片104用于接收并存储经过加密的内存数据，和/或，向内存加密模块1018提供经过加密的内存数据。这样一来，就能够保证数据在离开处理芯片101后始终保持为密文状态。
其中，当可信根1021包括加密根1021c时，由加密根1021c生成密钥。在一种实现方式中，内存加密模块可以为内存加密引擎(memory encryption engine，MEE)，其用于对需要加密的内存空间进行硬件加解密操作。例如，如图10所示，内存芯片104可以包括加密内存区和普通内存区，加密内存区为需要加密的内存空间。另外，可信执行环境1011中通常可以部署有一个或多个安全应用，每个安全应用可以对应加密内存区中的一个加密区。当可信执行环境1011中部署有多个安全应用时，加密根1021c可以为不同的安全应用生成不同的密钥，内存加密模块可以使用安全应用自身的密钥对该安全应用自身使用的数据进行加密或解密操作，以保证每个安全应用使用的数据的安全性。图10中虚线箭头表示密钥的传递方向，点画线箭头表示数据的传递方向。
由上可知，在本申请实施例提供的计算机设备10中，安全芯片102与处理芯片101分开设置，实现了安全芯片102与处理芯片101的解耦，安全芯片102的安全性可以由安全芯片102的厂商进行保障和背书。这样一来，安全芯片102中的可信根1021的可信程度不再受制于处理芯片101厂商的可信程度，摆脱了可信执行环境1011的构建限制于处理芯片101厂商的现状，进而提高了机密计算的可信程度，且能够消除用户对处理芯片101厂商的不信任。由于安全芯片102与处理芯片101解耦，使得安全芯片102能够与不同类型的处理芯片101对接，提高了整个计算机设备10对多种芯片的兼容性，有利于促进大规模机密计算应用场景的发展以及推动机密计算安全生态的标准化进程。
图11是本申请实施例提供的另一种计算机设备10的示意图。如图11所示，该计算机设备10还可以包括：存储器105、通信接口106和总线107。其中，处理芯片101、安全芯片102、存储器105、通信接口106通过总线107实现彼此之间的通信连接。
处理芯片101可以包括通用处理芯片101和/或专用硬件芯片。通用处理芯片101可以包括：中央处理器(central processing unit，CPU)、微处理器或图形处理器(graphics processing unit，GPU)。CPU例如是一个单核处理器(single-CPU)，又如是一个多核处理器(multi-CPU)。专用硬件芯片是一个高性能处理的硬件模块。专用硬件芯片包括数字信号处理器、专用集成电路(application-specific integrated circuit，ASIC)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)或者网络处理器(network processer，NP)中的至少一项。处理芯片101还可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，本申请中处理芯片101实现的部分或全部功能，可以通过处理芯片101中的硬件的集成逻辑电路或者软件形式的指令完成。
存储器105用于存储计算机程序，计算机程序包括操作系统105a和可执行代码(即程序指令)105b。存储器105例如是只读存储器或可存储静态信息和指令的其它类型的静态存储设备，又如是随机存取存储器或者可存储信息和指令的其它类型的动态存储设备，又如是电可擦可编程只读存储器、只读光盘或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的可执行代码并能够由计算机存取的任何其它介质，但不限于此。例如存储器105用于存放出端口队列等。存储器105例如是独立存在，并通过总线107与处理芯片101相连接。或者存储器105和处理芯片101集成在一起。存储器105可以存储可执行代码。当存储器105中存储的可执行代码被处理芯片101执行时，处理芯片101用于本申请中处理芯片101实现的部分或全部功能。例如，处理芯片101执行机密计算。存储器105中还可以包括操作系统等其他运行进程所需的软件模块和数据等。
通信接口106使用例如但不限于收发器一类的收发模块，来实现与其他设备或通信网络之间的通信。 例如，通信接口106可以是以下器件的任一种或任一种组合：网络接口(如以太网接口)、无线网卡等具有网络接入功能的器件。
总线107是任何类型的，用于实现计算机设备10的内部器件(例如，存储器105、处理芯片101、通信接口106)互连的通信总线。例如系统总线。本申请实施例以计算机设备10内部的上述器件通过总线107互连为例说明，可选地，计算机设备10内部的上述器件还可以采用除了总线107之外的其他连接方式彼此通信连接。例如，计算机设备10内部的上述器件通过内部的逻辑接口互连。
可选的，根据应用需求，该计算机设备10还可以包括闪存103和内存芯片104等。
需要说明的是，上述多个器件可以分别设置在彼此独立的芯片上，也可以至少部分的或者全部的设置在同一块芯片上。将各个器件独立设置在不同的芯片上，还是整合设置在一个或者多个芯片上，往往取决于产品设计的需要。本申请实施例对上述器件的具体实现形式不做限定。且上述各个附图对应的流程的描述各有侧重，某个流程中没有详述的部分，可以参见其他流程的相关描述。
在上述实施例中，计算机设备总各组件实现的功能可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。提供程序开发平台的计算机程序产品包括一个或多个计算机指令，在计算机设备10上加载和执行这些计算机程序指令时，全部或部分地实现本申请实施例提供的计算机设备的组件中的功能，如实现处理芯片的功能或实现安全芯片的功能。
并且，计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质存储有提供程序开发平台的计算机程序指令。
应当理解的是，以上计算机设备的结构是对本申请实施例提供的计算机设备的结构的示例性说明，并不构成对于该计算机设备的结构的限定，本领域普通技术人员可知，随着业务需求的改变，计算机设备的结构可以根据应用需求进行调整，本申请实施例对其不做一一列举。
本申请实施例还提供了一种计算机设备的运行方法。该计算机设备包括：处理芯片和安全芯片。在一种可实现方式中，该计算机设备可以为前述实施例提供的计算机设备。例如，该计算机设备可以为图1至图11任一所示的计算机设备。如图12所示，该计算机设备的运行方法包括：
步骤1201、安全芯片运行可信根，并基于可信根启动处理芯片和对处理芯片进行可信控制。
在一种可实现方式中，可信根包括以下一种或多种：启动根、度量根和加密根。
可选的，安全芯片基于可信根启动处理芯片的实现过程，包括：安全芯片使用可信根获取启动处理芯片使用的固件镜像；安全芯片在处理芯片上电后，使用固件镜像引导处理芯片启动。
步骤1202、处理芯片基于可信根构建可信执行环境，可信执行环境用于执行机密计算。
将可信根外置在处理芯片外后，一个比较关键的问题是如何继续保证可信根本身以及可信根与处理芯片之间通信的安全可信。为此，本申请实施例在实现可信根外置的同时，还提出了一些安全保障机制。在一种可实现方式中，可以在计算机设备中设置访问控制机制和/或通信保护机制，以保证可信根的安全可信，以及保证安全芯片与处理芯片之间通信的安全可信。下面分别对访问控制机制和通信保护机制进行说明。
在访问控制机制的一种实现方式中，处理芯片包括第一访问控制模块。如图13所示，该计算机设备的运行方法还可以包括：
步骤1203、第一访问控制模块接收对可信根的访问请求，在访问请求具有访问权限时，向安全芯片转发访问请求，在访问请求不具有访问权限时，拒绝访问请求。
步骤1204、安全芯片对访问请求进行响应。
在访问控制机制的另一种实现方式中，安全芯片包括第二访问控制模块。该计算机设备的运行方法还可以包括：
步骤1205、第二访问控制模块接收对可信根的访问请求，在访问请求具有访问权限时，对访问请求进行响应，在访问请求不具有访问权限时，拒绝访问请求。
在访问控制机制的再一种实现方式中，处理芯片包括第三访问控制模块，安全芯片包括第四访问控制模块。该计算机设备的运行方法还可以包括：
步骤1206、第三访问控制模块接收对可信根的访问请求，获取访问请求的权限指示信息，向安全芯片转发访问请求及其权限指示信息。
步骤1207、第四访问控制模块在权限指示信息指示访问请求具有访问权限时，对访问请求进行响应，在权限指示信息指示访问请求不具有访问权限时，拒绝访问请求。
其中，来自可信执行环境的访问请求具有访问权限，来自可信执行环境外的访问请求不具有访问权限。
在通信保护机制的一种可实现方式中，处理芯片包括第一通信保护模块，安全芯片包括第二通信保护模块，第二通信保护模块与第一通信保护模块匹配。此时，该计算机设备的运行方法还包括：第一通信保护模块与第二通信保护模块联合对安全芯片和处理芯片之间的通信进行保护。例如，如图13所示，该计算机设备的运行方法还包括：步骤1208、第一通信保护模块对安全芯片和处理芯片之间的通信内容执行第一通信保护措施；步骤1209、第二通信保护模块对安全芯片和处理芯片之间的通信内容执行第二通信保护措施，第二通信保护措施与第一通信保护措施匹配。或者，该计算机设备的运行方法还包括：第二通信保护模块对安全芯片和处理芯片之间的通信内容执行第一通信保护措施；第一通信保护模块对安全芯片和处理芯片之间的通信内容执行第二通信保护措施，第二通信保护措施与第一通信保护措施匹配。
可选的，第一通信保护模块和第二通信保护模块均基于密钥策略，对安全芯片和处理芯片之间的通信进行保护。此时，作为一种示例，第一通信保护措施可以为加密，第二通信保护措施可以为解密。
并且，第一通信保护模块和第二通信保护模块均基于签名策略和时间戳策略中的至少一个，对安全芯片和处理芯片之间的通信进行保护。此时，作为一种示例，第一通信保护措施可以为签名和添加时间戳，第二通信保护措施可以为验证签名和时间戳。
需要说明的是，该通信保护机制可以与访问控制机制结合使用，且该通信保护机制可以与访问控制机制的任一种实现方式结合使用。此处图13为通信保护机制与访问控制机制的第一种实现方式结合使用的示意图。
可选的，该计算机设备的运行方法还可以包括远程证明过程。如图13所示，该计算机设备的运行方法还可以包括：
步骤1210、安全芯片接收处理芯片在启动过程中生成的度量值。
步骤1211、安全芯片接收对可信执行环境的安全验证请求。
步骤1212、安全芯片基于度量值生成度量报告，并基于安全验证请求反馈度量报告。
可选的，计算机设备还包括：内存芯片。处理芯片包括内存加密模块。该计算机设备的运行方法还可以包括内存加解密过程。如图13所示，该计算机设备的运行方法还可以包括以下内存加密过程：
步骤1213、安全芯片使用可信根生成密钥，向内存加密模块提供密钥。
步骤1214、内存加密模块使用密钥对内存数据进行加密，并向内存芯片提供经过加密的内存数据。
步骤1215、内存芯片存储经过加密的内存数据。
如图13所示，该计算机设备的运行方法还可以包括以下内存解密过程：
步骤1213、安全芯片使用可信根生成密钥，向内存加密模块提供密钥。
步骤1216、内存芯片向内存加密模块提供经过加密的内存数据。
步骤1217、内存加密模块使用密钥对经过加密的内存数据进行解密。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的计算机设备的运行方法的具体工作过程，可以参考前述实施例中的对应内容，在此不再赘述。
综上所述，在本申请实施例提供的计算机设备的运行方法中，安全芯片与处理芯片分开设置，实现了安全芯片与处理芯片的解耦，安全芯片的安全性可以由安全芯片的厂商进行保障和背书。这样一来，安全芯片中的可信根的可信程度不再受制于处理芯片厂商的可信程度，摆脱了可信执行环境的构建限制于处理芯片厂商的现状，进而提高了机密计算的可信程度，且能够消除用户对处理芯片厂商的不信任。由于安全芯片与处理芯片解耦，使得安全芯片能够与不同类型的处理芯片对接，提高了整个计算机设备对多种芯片的兼容性，有利于促进大规模机密计算应用场景的发展以及推动机密计算安全生态的标准化进程。
本申请实施例还提供了一种安全芯片。该安全芯片用于运行可信根，并基于可信根启动处理芯片和对处理芯片进行可信控制。
在一种实现方式中，安全芯片具体用于使用可信根获取启动处理芯片使用的固件镜像，并在处理芯片 上电后，使用固件镜像引导处理芯片启动。
可选的，可信根包括以下一种或多种：启动根、度量根和加密根。
可选的，安全芯片还用于对访问请求进行响应。
在一种实现方式中，计算机设备可以包括安全芯片和处理芯片，处理芯片用于接收对可信根的访问请求，在访问请求具有访问权限时，向安全芯片转发访问请求，在访问请求不具有访问权限时，拒绝访问请求。此时，安全芯片接收到的访问请求为具有访问权限的访问请求，则可以对访问请求进行响应。
在另一种实现方式中，安全芯片包括第二访问控制模块。第二访问控制模块用于接收对可信根的访问请求，在访问请求具有访问权限时，对访问请求进行响应，在访问请求不具有访问权限时，拒绝访问请求。
在再一种实现方式中，处理芯片包括第三访问控制模块，安全芯片包括第四访问控制模块。第三访问控制模块用于接收对可信根的访问请求，获取访问请求的权限指示信息，向安全芯片转发访问请求及其权限指示信息；第四访问控制模块用于在权限指示信息指示访问请求具有访问权限时，对访问请求进行响应，在权限指示信息指示访问请求不具有访问权限时，拒绝访问请求。
其中，来自可信执行环境的访问请求具有访问权限，来自可信执行环境外的访问请求不具有访问权限。
可选的，安全芯片还可以执行通信保护机制，以对其通信内容进行保护。在一种实现方式中，处理芯片包括第一通信保护模块，安全芯片包括第二通信保护模块，第二通信保护模块与第一通信保护模块匹配，第一通信保护模块和第二通信保护模块用于联合对安全芯片和处理芯片之间的通信进行保护。
在一种实现方式，第一通信保护模块和第二通信保护模块具体用于基于密钥策略，对安全芯片和处理芯片之间的通信进行保护。
进一步地，第一通信保护模块和第二通信保护模块具体还用于基于签名策略和时间戳策略中的至少一个，对安全芯片和处理芯片之间的通信进行保护。
可选的，安全芯片还用于接收处理芯片在启动过程中生成的度量值，接收对可信执行环境的安全验证请求，基于度量值生成度量报告，并基于安全验证请求反馈度量报告。
可选的，计算机设备还包括内存芯片，处理芯片包括内存加密模块。则安全芯片还用于使用可信根生成密钥，向内存加密模块提供密钥；内存加密模块用于使用密钥对内存数据进行加密，并向内存芯片提供经过加密的内存数据，和/或，从内存芯片获取经过加密的内存数据，并使用密钥对经过加密的内存数据进行解密；内存芯片用于存储经过加密的内存数据，和/或，向内存加密模块提供经过加密的内存数据。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的安全芯片的实现过程，可以参考前述实施例中的对应内容，在此不再赘述。
综上所述，在本申请实施例提供的安全芯片中，安全芯片与处理芯片分开设置，实现了安全芯片与处理芯片的解耦，安全芯片的安全性可以由安全芯片的厂商进行保障和背书。这样一来，安全芯片中的可信根的可信程度不再受制于处理芯片厂商的可信程度，摆脱了可信执行环境的构建限制于处理芯片厂商的现状，进而提高了机密计算的可信程度，且能够消除用户对处理芯片厂商的不信任。由于安全芯片与处理芯片解耦，使得安全芯片能够与不同类型的处理芯片对接，提高了整个计算机设备对多种芯片的兼容性，有利于促进大规模机密计算应用场景的发展以及推动机密计算安全生态的标准化进程。
本申请实施例还提供了一种计算机可读存储介质，该计算机可读存储介质可以为非易失性计算机可读存储介质，该计算机可读存储介质包括程序指令，当程序指令在计算机设备上运行时，使得计算机设备执行如本申请实施例提供的计算机设备的运行方法。
本申请实施例还提供了一种包含指令的计算机程序产品，当计算机程序产品在计算机上运行时，使得计算机执行本申请实施例提供的计算机设备的运行方法。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
需要说明的是，本申请所涉及的信息(包括但不限于用户设备信息、用户个人信息等)、数据(包括但不限于用于分析的数据、存储的数据、展示的数据等)以及信号，均为经用户授权或者经过各方充分授 权的，且相关数据的收集、使用和处理需要遵守相关国家和地区的相关法律法规和标准。
在本申请实施例中，术语“第一”、“第二”和“第三”仅用于描述目的，而不能理解为指示或暗示相对重要性。术语“至少一个”是指一个或多个，术语“多个”指两个或两个以上，除非另有明确的限定。
本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的构思和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (28)

  1. 一种计算机设备，其特征在于，所述计算机设备包括：处理芯片和安全芯片；
    所述安全芯片用于运行可信根，并基于所述可信根启动所述处理芯片和对所述处理芯片进行可信控制；
    所述处理芯片包括可信执行环境，所述可信执行环境基于所述可信根构建，所述可信执行环境用于执行机密计算。
  2. 根据权利要求1所述的计算机设备，其特征在于，
    所述安全芯片具体用于使用所述可信根获取启动所述处理芯片使用的固件镜像，并在所述处理芯片上电后，使用所述固件镜像引导所述处理芯片启动。
  3. 根据权利要求1或2所述的计算机设备，其特征在于，所述可信根包括以下一种或多种：启动根、度量根和加密根。
  4. 根据权利要求1至3任一所述的计算机设备，其特征在于，所述处理芯片包括第一访问控制模块；
    所述第一访问控制模块用于接收对所述可信根的访问请求，在所述访问请求具有访问权限时，向所述安全芯片转发所述访问请求，在所述访问请求不具有访问权限时，拒绝所述访问请求；
    所述安全芯片还用于对所述访问请求进行响应。
  5. 根据权利要求1至3任一所述的计算机设备，其特征在于，所述安全芯片包括第二访问控制模块；
    所述第二访问控制模块用于接收对所述可信根的访问请求，在所述访问请求具有访问权限时，对所述访问请求进行响应，在所述访问请求不具有访问权限时，拒绝所述访问请求。
  6. 根据权利要求1至3任一所述的计算机设备，其特征在于，所述处理芯片包括第三访问控制模块，所述安全芯片包括第四访问控制模块；
    所述第三访问控制模块用于接收对所述可信根的访问请求，获取所述访问请求的权限指示信息，向所述安全芯片转发所述访问请求及其权限指示信息；
    所述第四访问控制模块用于在所述权限指示信息指示访问请求具有访问权限时，对所述访问请求进行响应，在所述权限指示信息指示访问请求不具有访问权限时，拒绝所述访问请求。
  7. 根据权利要求4至6任一所述的计算机设备，其特征在于，来自所述可信执行环境的访问请求具有访问权限，来自所述可信执行环境外的访问请求不具有访问权限。
  8. 根据权利要求1至7任一所述的计算机设备，其特征在于，所述处理芯片包括第一通信保护模块，所述安全芯片包括第二通信保护模块，所述第二通信保护模块与所述第一通信保护模块匹配，所述第一通信保护模块和所述第二通信保护模块用于联合对所述安全芯片和所述处理芯片之间的通信进行保护。
  9. 根据权利要求8所述的计算机设备，其特征在于，所述第一通信保护模块和所述第二通信保护模块具体用于基于密钥策略，对所述安全芯片和所述处理芯片之间的通信进行保护。
  10. 根据权利要求9所述的计算机设备，其特征在于，所述第一通信保护模块和所述第二通信保护模块具体还用于基于签名策略和时间戳策略中的至少一个，对所述安全芯片和所述处理芯片之间的通信进行保护。
  11. 根据权利要求1至10任一所述的计算机设备，其特征在于，
    所述安全芯片还用于接收所述处理芯片在启动过程中生成的度量值，接收对所述可信执行环境的安全 验证请求，基于所述度量值生成度量报告，并基于所述安全验证请求反馈所述度量报告。
  12. 根据权利要求1至11任一所述的计算机设备，其特征在于，所述计算机设备还包括内存芯片，所述处理芯片包括内存加密模块；
    所述安全芯片还用于使用所述可信根生成密钥，向所述内存加密模块提供所述密钥；
    所述内存加密模块用于使用所述密钥对内存数据进行加密，并向所述内存芯片提供经过加密的内存数据，和/或，从所述内存芯片获取经过加密的内存数据，并使用所述密钥对经过加密的内存数据进行解密；
    所述内存芯片用于存储经过加密的内存数据，和/或，向所述内存加密模块提供经过加密的内存数据。
  13. 一种计算机设备的运行方法，其特征在于，所述计算机设备包括：处理芯片和安全芯片，所述方法包括：
    所述安全芯片运行可信根，并基于所述可信根启动所述处理芯片和对所述处理芯片进行可信控制；
    所述处理芯片基于所述可信根构建可信执行环境，所述可信执行环境用于执行机密计算。
  14. 根据权利要求13所述的方法，其特征在于，所述安全芯片基于所述可信根启动所述处理芯片，包括：
    所述安全芯片使用所述可信根获取启动所述处理芯片使用的固件镜像；
    所述安全芯片在所述处理芯片上电后，使用所述固件镜像引导所述处理芯片启动。
  15. 根据权利要求13或14所述的方法，其特征在于，所述可信根包括以下一种或多种：启动根、度量根和加密根。
  16. 根据权利要求13至15任一所述的方法，其特征在于，所述处理芯片包括第一访问控制模块，所述方法还包括：
    所述第一访问控制模块接收对所述可信根的访问请求，在所述访问请求具有访问权限时，向所述安全芯片转发所述访问请求，在所述访问请求不具有访问权限时，拒绝所述访问请求；
    所述安全芯片对所述访问请求进行响应。
  17. 根据权利要求13至15任一所述的方法，其特征在于，所述安全芯片包括第二访问控制模块，所述方法还包括：
    所述第二访问控制模块接收对所述可信根的访问请求，在所述访问请求具有访问权限时，对所述访问请求进行响应，在所述访问请求不具有访问权限时，拒绝所述访问请求。
  18. 根据权利要求13至15任一所述的方法，其特征在于，所述处理芯片包括第三访问控制模块，所述安全芯片包括第四访问控制模块，所述方法还包括：
    所述第三访问控制模块接收对所述可信根的访问请求，获取所述访问请求的权限指示信息，向所述安全芯片转发所述访问请求及其权限指示信息；
    所述第四访问控制模块在所述权限指示信息指示访问请求具有访问权限时，对所述访问请求进行响应，在所述权限指示信息指示访问请求不具有访问权限时，拒绝所述访问请求。
  19. 根据权利要求16至18任一所述的方法，其特征在于，来自所述可信执行环境的访问请求具有访问权限，来自所述可信执行环境外的访问请求不具有访问权限。
  20. 根据权利要求13至19任一所述的方法，其特征在于，所述处理芯片包括第一通信保护模块，所述安全芯片包括第二通信保护模块，所述第二通信保护模块与所述第一通信保护模块匹配，所述方法还包括：
    所述第一通信保护模块与所述第二通信保护模块联合对所述安全芯片和所述处理芯片之间的通信进行保护。
  21. 根据权利要求20所述的方法，其特征在于，所述第一通信保护模块和所述第二通信保护模块均基于密钥策略，对所述安全芯片和所述处理芯片之间的通信进行保护。
  22. 根据权利要求21所述的方法，其特征在于，所述第一通信保护模块和所述第二通信保护模块均基于签名策略和时间戳策略中的至少一个，对所述安全芯片和所述处理芯片之间的通信进行保护。
  23. 根据权利要求13至22任一所述的方法，其特征在于，所述方法还包括：
    所述安全芯片接收所述处理芯片在启动过程中生成的度量值；
    所述安全芯片接收对所述可信执行环境的安全验证请求；
    所述安全芯片基于所述度量值生成度量报告，并基于所述安全验证请求反馈所述度量报告。
  24. 根据权利要求13至23任一所述的方法，其特征在于，所述计算机设备还包括：内存芯片，所述处理芯片包括内存加密模块，所述方法还包括：
    所述安全芯片使用所述可信根生成密钥，向所述内存加密模块提供所述密钥；
    所述内存加密模块使用所述密钥对内存数据进行加密，并向所述内存芯片提供经过加密的内存数据；
    所述内存芯片存储经过加密的内存数据。
  25. 根据权利要求13至24任一所述的方法，其特征在于，所述计算机设备还包括：内存芯片，所述处理芯片包括内存加密模块，所述方法还包括：
    所述安全芯片使用所述可信根生成密钥，向所述内存加密模块提供所述密钥；
    所述内存芯片向所述内存加密模块提供经过加密的内存数据；
    所述内存加密模块使用所述密钥对经过加密的内存数据进行解密。
  26. 一种安全芯片，其特征在于，所述安全芯片为权利要求1至12任一所述的安全芯片。
  27. 一种计算机可读存储介质，其特征在于，包括程序指令，当所述程序指令在计算机设备上运行时，使得所述计算机设备执行如权利要求13至25任一所述的方法。
  28. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得所述计算机执行如权利要求13至25任一所述的方法。
PCT/CN2023/103448 2022-09-19 2023-06-28 计算机设备及其运行方法、安全芯片 WO2024060756A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211139911.3 2022-09-19
CN202211139911.3A CN117763553A (zh) 2022-09-19 2022-09-19 计算机设备及其运行方法、安全芯片

Publications (1)

Publication Number Publication Date
WO2024060756A1 true WO2024060756A1 (zh) 2024-03-28

Family

ID=90316734

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/103448 WO2024060756A1 (zh) 2022-09-19 2023-06-28 计算机设备及其运行方法、安全芯片

Country Status (2)

Country Link
CN (1) CN117763553A (zh)
WO (1) WO2024060756A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210141940A1 (en) * 2019-11-13 2021-05-13 Sensoriant, Inc. Method and system for enhancing the integrity of computing with shared data and algorithms
CN114600102A (zh) * 2020-01-29 2022-06-07 华为技术有限公司 用于保护共享对象的装置和方法
CN114692159A (zh) * 2020-12-29 2022-07-01 华为技术有限公司 计算机系统、可信功能组件及运行方法
CN114692160A (zh) * 2020-12-29 2022-07-01 华为技术有限公司 计算机安全可信启动的处理方法及装置
CN114936365A (zh) * 2022-01-27 2022-08-23 华为技术有限公司 一种机密数据的保护系统、方法以及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210141940A1 (en) * 2019-11-13 2021-05-13 Sensoriant, Inc. Method and system for enhancing the integrity of computing with shared data and algorithms
CN114600102A (zh) * 2020-01-29 2022-06-07 华为技术有限公司 用于保护共享对象的装置和方法
CN114692159A (zh) * 2020-12-29 2022-07-01 华为技术有限公司 计算机系统、可信功能组件及运行方法
CN114692160A (zh) * 2020-12-29 2022-07-01 华为技术有限公司 计算机安全可信启动的处理方法及装置
CN114936365A (zh) * 2022-01-27 2022-08-23 华为技术有限公司 一种机密数据的保护系统、方法以及装置

Also Published As

Publication number Publication date
CN117763553A (zh) 2024-03-26

Similar Documents

Publication Publication Date Title
US10721080B2 (en) Key-attestation-contingent certificate issuance
KR102504519B1 (ko) 네트워킹된 장치들을 갖는 컴퓨터 구동 시스템의 반가상 보안 위협 보호
EP2866166B1 (en) Systems and methods for enforcing third party oversight data anonymization
RU2762141C2 (ru) Абстрактная идентификация анклава
US8171295B2 (en) Information processing apparatus, a server apparatus, a method of an information processing apparatus, a method of a server apparatus, and an apparatus executable process
CN107077574B (zh) 用于客户端设备的信任服务
EP3061027B1 (en) Verifying the security of a remote server
US20140066015A1 (en) Secure device service enrollment
US8090946B2 (en) Inter-system binding method and application based on hardware security unit
US20200026882A1 (en) Methods and systems for activating measurement based on a trusted card
US8745224B2 (en) Method and apparatus for dynamic provisioning of an access control policy in a controller hub
CN113785548A (zh) 用于实施数据中心中的有效载荷安全性策略的证明服务
US12056248B1 (en) Enclave-based cryptography services in edge computing environments
EP3832511A1 (en) Security processor configured to authenticate user and authorize user for user data and computing system including the same
US9660863B2 (en) Network connecting method and electronic device
US9692641B2 (en) Network connecting method and electronic device
EP3720042B1 (en) Method and device for determining trust state of tpm, and storage medium
WO2024060756A1 (zh) 计算机设备及其运行方法、安全芯片
KR20150089696A (ko) 접근제어와 우선순위기반 무결성 검증 시스템 및 그 방법
Pedone et al. Trusted computing technology and proposals for resolving cloud computing security problems
US20240296226A1 (en) Systems and methods for identifying firmware versions using spdm alias certificates
US20240297871A1 (en) Systems and methods for cloning bmc profiles in a cluster environment
US20240296234A1 (en) Systems and methods for key distribution of low end spdm devices
US20240296227A1 (en) Systems and methods to prevent cloning on spdm-enabled devices
Κασαγιάννης Security evaluation of Android Keystore

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23867051

Country of ref document: EP

Kind code of ref document: A1