Trust chain transfer method for trusted computing platform

Abstract

The invention discloses a trust chain transfer method for a trusted computing platform. A trusted computing module (TCM) serving as a starting point of starting a trust chain is started and actively initiated at first to verify the trustiness of a BIOS (basic input output system) chip; after the trusted BIOS chip is started, a MAIN BLOCK of the BIOS chip performs concentrated integrity verification on key files of an MBR (master boot record), an operating system loader and an operating system kernel; in the starting process of an operating system, the starting and running of an unauthorized program are prevented in a way of combining the integrity verification based on a white list and running program control; and hashing operations for the integrity verification are finished by a hardware computing engine. When a user starts any executable program, a security module in the operating system kernel checks the integrity of the program and checks whether the program is in the trusted program white list or not, and only application programs which are in the trusted program white list of the system and have integrity measures consistent with an expected value are permitted to be run. High-efficiency and fine-grained trust chain transfer is realized, the damages of viruses to system files and program files can be prevented, and the execution of the unauthorized program can be prevented.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method for establishing and transferring trust relationships among trusted computing platform components. Background technique [0002] Trusted Computing Group (TCG) is referred to as TCG for short. The basic idea of ​​trusted computing proposed by TCG is to build a root of trust (Root of trust), and start from the root of trust, use the method of hash measurement to establish a verifiable chain of trust, from the hardware platform to the BIOS, operation The system, and then the application, is verified at the first level, so as to extend this trust to the entire computer system and ensure that the computer system is credible. The chain of trust describes the logical concept of the trust relationship formed by one-way and sequential integrity verification of the starting sequence and time of each component module formed when a trusted computing platform is started. [0003...

AI Technical Summary

Problems solved by technology

At the starting point of the establishment of the trust chain, since the BIOS is regarded as a part of the trusted measurement root, there is a possibility that the trusted measurement root is uncontrollable and untrustworthy; There are many links, the verification subject is easily bypassed, and there is a threat that the trust chain is "hijacked" by malicious code;

Images