Trusted computing system and measurement method based on trusted computing system

Abstract

The application relates to the technical field of information security, in particular to a trusted computing system and a measurement method based on the trusted computing system. The trusted computing system comprises a TPCM interface module in an operating system loader, which is used for encapsulating corresponding to-be-measured content in a hardware device based on a proactive measurement control instruction sent by a proactive measurement engine and a pre-defined algorithm in a trusted platform control module (TPCM); an assisted measurement engine module in the operating system loader, which is used for performing scheduling processing and assisted measurement processing on the encapsulated to-be-measured content, obtaining measurement content, and sending the measurement content to the proactive measurement engine; and the proactive measurement engine, which is used for sending the proactive measurement control instruction to the TPCM interface module, receiving the measurement content sent by the assisted measurement engine module, and performing measurement verification on the measurement content to verify whether the system state is trusted. In this way, the system can perform proactive measurement, and the authenticity, reliability and flexibility of the measurement are improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a trusted computing system and a measurement method based on the trusted computing system. Background Technology

[0002] With the development of information security technology, trusted computing has become a new development direction, attracting increasing attention from relevant research institutions. Trusted computing systems are primarily based on trusted security chips, establishing a secure computing environment that users can anticipate. The Trusted Computing Group (TCG) was the first to propose and specify industry standards for trusted computing. By introducing security chips on the motherboard to establish a chain of trust step by step and ensuring the security of this chain, a secure and trusted working environment is ultimately built on the computer hardware system.

[0003] To address current cybersecurity challenges, the TCG proposed a trusted computing approach. This approach uses the Trusted Platform Module (TPM) and the Basic Input Output System (BIOS) start code as trust roots, measuring each level sequentially to build a trust chain within the computer. This protects critical computer resources from unauthorized tampering and damage. The TPM operates in a "passive" mode, functioning as a regular peripheral device that is invoked by other applications. These applications can decide whether to use or disable the TPM. Specifically, the operating system or applications running on it, in conjunction with a remote server, verify whether the platform's startup state matches expected measurement results, thereby determining the system's security status and verifying its trustworthiness.

[0004] However, the aforementioned TPM can only perform static measurements on computer resources such as firmware and executable programs, and cannot perform active measurements. When its operating environment is illegally intruded or tampered with, it will affect the authenticity and reliability of the measurements. Summary of the Invention

[0005] This application provides a trusted computing system and a measurement method based on the trusted computing system, which can actively measure computer systems and improve the authenticity, reliability and flexibility of the measurement.

[0006] In a first aspect, this application provides a trusted computing system, which includes: a trusted platform control module (TPCM), an active measurement engine, hardware devices, and an operating system loader;

[0007] The operating system loader includes a TPCM interface module and an assisted measurement engine module. The TPCM interface module is used to encapsulate the corresponding content to be measured in the hardware device based on the active measurement control command sent by the active measurement engine and the predefined algorithm in the TPCM. The assisted measurement engine module is used to perform scheduling and assisted measurement processing on the encapsulated content to be measured to obtain measurement content, and send the measurement content to the active measurement engine.

[0008] The active measurement engine is used to send active measurement control commands to the TPCM interface module, receive the measurement content sent by the assisting measurement engine module, and perform measurement verification on the measurement content to verify whether the system status is reliable.

[0009] Optionally, the TPCM interface module includes: a low-level device driver, a TPCM function operation module, and a security protocol stack. The low-level device driver is used to establish a channel between the hardware device and the TPCM so that the operating system loader and the TPCM can communicate.

[0010] The TPCM function operation module is used to encapsulate the content to be measured based on the function corresponding to the content to be measured after receiving the active measurement control command sent by the active measurement engine within a predefined period; the function is determined based on the predefined algorithm in the TPCM.

[0011] The security protocol stack is used to encrypt the encapsulated content to be measured and send the encrypted content to be measured to the assisted measurement engine module.

[0012] Optionally, the assisted measurement engine module includes: a protocol parsing and scheduling module and an assisted measurement processing module; the protocol parsing and scheduling module is used to decrypt the encrypted content to be measured based on a predefined protocol, schedule the corresponding type of operating system file, and send the operating system file to the assisted measurement processing module for processing; the operating system file includes an operating system kernel file and an operating system configuration file;

[0013] The assisted measurement processing module is used to read the measurement content in the operating system file and call the TPCM interface module to send the measurement content to the active measurement engine.

[0014] Optionally, the active measurement engine is located within the TPCM service module, which is used to obtain measurement baseline values; the active measurement engine is specifically used for:

[0015] The measurement content sent by the assisted measurement processing module is obtained based on the active measurement control command. The measurement content is measured and calculated using the predefined algorithm provided by the TPCM to obtain the measurement result. The measurement verification is performed based on the measurement benchmark value and the measurement result to determine whether the system status is reliable.

[0016] If the system status is reliable, then send a command to start the operating system to the operating system loader;

[0017] If the system status is untrusted, a command to prevent the operating system from starting is sent to the operating system loader.

[0018] Optionally, the operating system loader further includes a behavior execution module, which is used to perform corresponding operations based on the control commands sent by the TPCM and transfer control to the corresponding operating system.

[0019] Optionally, the behavior execution module performs corresponding operations based on the control commands sent by the TPCM, including:

[0020] If the control command sent by the TPCM is a command to start the operating system, then the corresponding startup parameters are obtained, the corresponding operating system is started based on the startup parameters, and the startup parameters are stored for the next measurement calculation.

[0021] If the control command sent by the TPCM is a command to prevent the operating system from starting, then the corresponding operating system kernel will be prevented from starting, and an alarm message will be sent.

[0022] Optionally, the trusted computing system further includes a TPCM management interface, which is used to: obtain real-time changing metric benchmark values ​​from a remote location, or obtain manually input metric benchmark values, and send the obtained metric benchmark values ​​to the TPCM service module.

[0023] Secondly, this application also provides a measurement method based on a trusted computing system, applied to an operating system loader, wherein the operating system loader includes a TPCM interface module and an assisted measurement engine module; the method includes:

[0024] Through the TPCM interface module, based on the active measurement control commands sent by the active measurement engine and the predefined algorithms within the Trusted Platform Control Module (TPCM), the corresponding content to be measured within the hardware device is encapsulated.

[0025] The assisted measurement engine module performs scheduling and assisted measurement processing on the encapsulated content to be measured to obtain measurement content, and sends the measurement content to the active measurement engine so that the active measurement engine can perform measurement verification based on the measurement content sent by the assisted measurement engine module to verify whether the system status is reliable.

[0026] Thirdly, this application also provides a measurement method based on a trusted computing system, applied to an active measurement engine, the method comprising:

[0027] Send active measurement control commands to the TPCM interface module in the operating system loader;

[0028] The system receives measurement content sent by the assisted measurement engine module in the operating system loader and performs measurement verification on the measurement content to verify whether the system state is trustworthy. The TPCM interface module is used to encapsulate the corresponding content to be measured in the hardware device based on the active measurement control instructions sent by the active measurement engine and the predefined algorithm in the Trusted Platform Control Module (TPCM). The assisted measurement engine module is used to perform scheduling and assisted measurement processing on the encapsulated content to be measured to obtain the measurement content and send the measurement content to the active measurement engine.

[0029] Fourthly, this application also provides an electronic device, including: a processor, a memory, and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor, and the computer program includes instructions for performing a measurement method based on a trusted computing system as described in the second or third aspect.

[0030] In summary, this application provides a trusted computing system and a measurement method based on the trusted computing system. The system can cooperate with an active measurement engine through a TPCM interface module and an assisted measurement engine module in the operating system loader. After the TPCM interface module receives the active measurement control command sent by the active measurement engine, it encapsulates the corresponding content to be measured within the hardware device. The encapsulated content is then sent to the assisted measurement engine module for scheduling and assisted measurement processing to obtain the measurement content. Furthermore, the measurement content is sent to the active measurement engine for measurement verification to verify the trustworthiness of the system state. Therefore, this application can perform active measurement, thereby improving the authenticity, reliability, and flexibility of the measurement. Attached Figure Description

[0031] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0032] Figure 1This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0033] Figure 2 This provides a system architecture diagram for verifying the reliability of a system state;

[0034] Figure 3 Here is another system architecture diagram for verifying the reliability of the system state;

[0035] Figure 4 A schematic diagram of the dual-system architecture of the trusted computing platform supported by TPCM;

[0036] Figure 5 This is a schematic diagram of the architecture of a trusted computing system provided in an embodiment of this application;

[0037] Figure 6 A Grub display interface diagram provided in an embodiment of this application;

[0038] Figure 7 A schematic diagram of the architecture of a TPCM interface module provided in an embodiment of this application;

[0039] Figure 8 A schematic diagram of the architecture of an assisted measurement engine module provided in an embodiment of this application;

[0040] Figure 9 This application provides a schematic diagram of the architecture of a complete trusted computing system.

[0041] Figure 10 A flowchart illustrating a measurement method based on a trusted computing system provided in an embodiment of this application;

[0042] Figure 11 A flowchart illustrating another measurement method based on a trusted computing system provided in this application embodiment;

[0043] Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0044] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0045] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0046] To facilitate a clear description of the technical solutions in the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with essentially the same function and purpose. For example, "first device" and "second device" are merely used to distinguish different devices and do not limit their order of execution. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply that they are different.

[0047] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0048] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0049] The embodiments of this application will now be described in conjunction with the accompanying drawings. Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. The trusted computing system provided in this application can be applied to, for example... Figure 1The application scenario shown includes a computer terminal device and a user. The computer terminal device is equipped with a trusted computing system, which comprises a computing component and a protection component. The computing component includes a hardware system and a software system. The hardware system is typically a chip. The software system can acquire data from the hardware system, which can be used for measurement calculations to obtain measurement results. The protection component includes a Trusted Platform Control Module (TPCM) hardware, TPCM firmware, and an active measurement engine. The TPCM hardware stores the algorithms used for measurement. The TPCM firmware is loaded onto the TPCM hardware and runs on it. The active measurement engine is used to send active measurement requests and perform active measurements to obtain measurement results. Based on the measurement results, it determines whether the system is trustworthy.

[0050] Specifically, if a computer terminal device has both Ubuntu and Red Hat operating systems installed, the active measurement engine will send an active measurement request to the computing component. The software system in the computing component can determine which operating system to boot based on the received active measurement request, and then obtain the measurement data (i.e., measurement content) from the hardware system. This measurement content is then sent to the active measurement engine, which performs measurement calculations and verifies the trustworthiness of the corresponding operating system. If the operating system is not trustworthy, the engine sends a command to the computing component to prevent the corresponding operating system kernel from booting. Correspondingly, the computing component can also send alarm information and display it visually on the computer terminal device for the user to view.

[0051] It should be noted that a trusted computing system is a computer system capable of providing system reliability, availability, and information and behavioral security. System reliability and security are the two most important attributes of trusted computing at present. Therefore, trustworthiness means that the services provided by a computer system are reliable, and this reliability is verifiable. One of the core goals of trustworthiness is to ensure the integrity of the system and guarantee that the system operates in the intended state.

[0052] Trusted Computing (TC) is a technology promoted and developed by the TCG (Trusted Computing Group). It's a widely used trusted computing platform in computing and communication systems, supported by a hardware security module (TPM), which can improve the overall security of the system. Its core idea is that computer behavior conforms to expectations. This typically involves recording startup state information during the boot process and verifying whether the startup state conforms to expectations after the system has run for a certain period. In other words, the TCG defines what information is recorded, when, where, and according to what data structure.

[0053] Among them, TPM can provide cryptographic operation functions for trusted computing platforms and has storage protection functions, including hardware configurations such as platform status registers.

[0054] In one possible implementation, Figure 2 This provides a system architecture diagram for verifying the reliability of a system state, such as... Figure 2 As shown, the Trusted Platform Module (TPM), as the core hardware of trusted computing, provides underlying hardware support for trusted computing. It is connected via soldering or plug-in cards on the computer platform hardware. The TPM, as a peripheral of the Central Processing Unit (CPU), is booted by the BIOS. It's important to note that the BIOS is a set of programs embedded in a ROM / Flash chip on the computer's motherboard. It stores the computer's most important basic input / output programs, power-on self-test (POST) programs, and system startup programs. Its main function is to provide the lowest-level and most direct hardware settings and control for the computer. In addition, the BIOS also provides some system parameters to the operating system. With technological advancements, the limitations of traditional BIOS have become increasingly apparent, leading to its gradual replacement by the Unified Extensible Firmware Interface (UEFI). UEFI, as a replacement for BIOS, defines the software interface between the operating system and the system firmware, responsible for power-on self-test, communication with the operating system, and providing an interface connecting the operating system and hardware. A BIOS implemented according to the UEFI specification is simply called UEFI, or UEFI BIOS.

[0055] Furthermore, after power-on and completing basic hardware initialization, the UEFI BIOS runs the TPM device driver, enabling the TPM hardware to operate. Then, a root of trust is created in the UEFI BIOS, and measurements and logs are performed level by level. These logs are then stored in the Platform Configuration Register (PCR). The boot state is recorded using a method where the previous level measures the next. The operating system or applications running on the system, in conjunction with a remote server, then verify whether the platform boot state meets expectations, i.e., verify the system's trustworthiness. The root of trust is a source that can always be trusted within the cryptographic system.

[0056] During the late-stage boot process of UEFI BIOS, the bootloader package from the GNU project (GNUGrand Unified Bootloader, Grub) is measured and launched. After Grub starts, it internally calls the TPM low-level driver provided by UEFI BIOS to encapsulate the TPM device functions. After reading the kernel files of the operating system, such as OS1 to OSn, Grub prioritizes measuring the operating system kernel files and records the measurement results in the log and stores them in the PCR. Grub will then select which operating system to boot from. After the corresponding operating system kernel is launched, the corresponding operating system takes over control and runs the corresponding operating system.

[0057] It should be noted that Grub can select different operating systems to boot from, and the system will be measured based on the operating system the user intends to boot. The common approach is to, after entering the operating system, check the PCR status and recorded logs, and verify the system boot process as expected through methods such as remote verification. Grub is one of the most widely used operating system loaders (OS loader) currently.

[0058] However, the above implementation scheme uses TPM in Grub to measure the behavior of the operating system kernel, which only records information in the operating system to be run. That is, it can only perform static measurement on resources such as computer firmware and executable programs, and cannot perform active measurement. It needs to be combined with a remote server to verify whether the platform boot status meets the expected measurement results. When its running environment is illegally invaded or tampered with, the operating system can also be booted, causing many harms and affecting the authenticity and reliability of the measurement.

[0059] In another possible implementation, Figure 3 Another system architecture diagram is provided for verifying the reliability of the system state, such as Figure 3 As shown, TPCM operates in "active" mode. As a protective component, it is the first component to power on and run on the platform. It executes independently and in parallel with the computing component, providing active measurement and active control for UEFI in the trusted computing platform, and performing security protection while performing computation.

[0060] Specifically, TPCM uses an independent hardware form and connects to the computer platform hardware. It is provided as a high-speed serial computer expansion bus standard (Peripheral Component Interconnect express, PCIe) card. For example, the TPCM hardware runs the corresponding TPCM firmware. The TPCM firmware runs on the flash memory chip on the PCIe card. TPCM can ensure that the PCIe card starts and executes before the computer platform hardware by modifying the power-on configuration information. The TPCM measurement agent is program code deployed in the trusted computing system. It can perform static and dynamic measurements on trusted computing to obtain the system status information of trusted computing.

[0061] Furthermore, after the TPCM powers on and boots, it performs a TPCM self-test, then the computer platform hardware boots, completes UEFI initialization, and loads PCIe devices. That is, it uses the hardware resources provided by the TPCM to create TPCM measurement agents in UEFI and Grub. The TPCM measurement agent in UEFI measures Grub, and the TPCM measurement agent in Grub measures the kernel files of the operating system OS1 to OSn. Then, the system's security status is known through the measurement results of the TPCM measurement agent, and the trustworthiness of the system status is verified. Finally, the corresponding operating system is booted.

[0062] However, the above implementation scheme, by adopting a measurement proxy, cannot reflect proactive measurement and proactive control except for measuring UEFI after priority startup. Its implementation essence is to treat TPCM as a special TPM after UEFI startup, providing measurement functions similar to TPM. The ability to proactively decide whether to measure and proactively verify measurement results is limited, resulting in poor flexibility.

[0063] Based on the international standard-based model of powering on the CPU first and then establishing a trust chain with the help of a cryptographic chip, a dual-system architecture for a trusted computing platform based on the TPCM chip is proposed. In addition to providing domestic SM2, SM3 and SM4 cryptographic functions, the TPCM chip can also power on the CPU first and perform integrity measurement on the BIOS before the CPU, thereby performing active control and active measurement based on predefined algorithms.

[0064] For example, Figure 4 A schematic diagram of the dual-system architecture of the trusted computing platform supported by TPCM is provided, as shown below. Figure 4As shown, the trusted computing platform's dual-architecture includes a computing component and a protection component. A communication connection is established between the computing component and the protection component. The computing component consists of various parts for executing computational tasks, including computing components, system firmware, system software, and application software. The system software can obtain relevant data from the computing components and system firmware, which can be used for measurement. The application software can also obtain the data required for measurement. The protection component consists of a trusted cryptographic module, a TPCM (Trusted Quantity Management System), and a trusted software base. The protection component executes independently of the computing component. The trusted cryptographic module stores predefined algorithms and provides them to the TPCM. The trusted software base provides the trusted computing platform with proactive measurement and proactive control features for trusted computing protection functions. Specifically, it performs measurement calculations based on data, obtains measurement results, and uses these results to determine the system's trustworthiness. This dual-architecture trusted computing platform can achieve security protection while performing computation, making the entire computation process controllable and measurable, and free from interference from external factors.

[0065] Based on the above considerations, this application proposes a trusted computing system with reference to the dual-architecture of a trusted computing platform. This system can send proactive measurement control commands to the operating system loader via the proactive measurement engine in the TPCM. The operating system loader can then read the data required to execute the proactive measurement control commands and send it to the proactive measurement engine. Furthermore, the proactive measurement engine uses the data for measurement calculations and verification to verify the trustworthiness of the system state. This allows for proactive measurement of resources such as computer firmware and executable programs, improving the authenticity, reliability, and flexibility of the measurements. The proactive measurement engine can be located within the TPCM or parallel to it; this application does not specifically limit this.

[0066] For example, Figure 5 This is a schematic diagram of the architecture of a trusted computing system provided in an embodiment of this application, such as... Figure 5 As shown, the trusted computing system includes: a Trusted Platform Control Module (TPCM), an Active Metrics Engine, hardware devices, and an operating system loader;

[0067] The operating system loader includes a TPCM interface module and an assisted measurement engine module. The TPCM interface module is used to encapsulate the corresponding content to be measured in the hardware device based on the active measurement control command sent by the active measurement engine and the predefined algorithm in the TPCM. The assisted measurement engine module is used to perform scheduling and assisted measurement processing on the encapsulated content to be measured to obtain measurement content, and send the measurement content to the active measurement engine.

[0068] The active measurement engine is used to send active measurement control commands to the TPCM interface module, receive the measurement content sent by the assisting measurement engine module, and perform measurement verification on the measurement content to verify whether the system status is reliable.

[0069] In this embodiment, the Trusted Platform Control Module (TPCM) can be integrated into the Trusted Computing System. The TPCM is a fundamental hardware module for establishing and securing the origin of trust, providing functions such as proactive measurement and proactive control for the Trusted Computing System. The TPCM is an active device, and it can include TPCM hardware, TPCM firmware, and an active measurement engine. The TPCM hardware is used to store predefined algorithms, and the TPCM firmware is used to load the predefined algorithms. The predefined algorithms are used to measure the files to be executed. The active measurement engine can be used to send proactive measurement control commands within a predefined period or during startup. This embodiment does not specifically limit the timing of the proactive measurement engine sending proactive measurement control commands. The proactive measurement engine is also used to perform measurement calculations and verifications on the received measurement content, i.e., to compare whether the measurement results obtained from the measurement have any anomalies. The predefined period can be a continuously preset period set by the system, such as 5 minutes, or a manually input period. This embodiment does not specifically limit this.

[0070] Metrics can refer to the process of first calculating the hash value of the file to be executed, then performing a hash calculation, writing the resulting hash into the PCR in an expanded manner, and forming a log with the relevant information.

[0071] An operating system loader can refer to a loader used to boot an operating system, such as winloader.efi for Windows OS, BOOTX64.efi for x86-64 PCs, and BOOTIA32.efi for x86-32 PCs. Operating system loaders include lilo (Linux Loader), elilo (EFI Linux Loader), and Grub, among which Grub is one of the most widely used operating system loaders. Grub is a multi-boot manager that can select which system to boot when multiple operating systems coexist. It can boot operating systems such as Unix, Linux, and Windows. Therefore, this application uses Grub as an example for description.

[0072] Hardware devices include not only untrusted hardware devices such as platform hardware, but may also include other trusted hardware devices. This application does not specifically limit this in its embodiments.

[0073] The operating system loader runs on the platform hardware, and there are related connection methods between the platform hardware and the TPCM hardware. A common method is to connect using a PCIe card. Specifically, by connecting to the computer hardware platform using a PCIe card, it takes priority over the computer hardware platform by pulling power signals and controls the power-on sequence of the computer platform.

[0074] It should be noted that the connection between the platform hardware and the TPCM hardware can be achieved not only through PCIe cards, but also through other hardware interfaces, such as Serial Peripheral Interface (SPI) and Inter-Integrated Circuit (I2C). In addition to PCIe cards, TPCMs can also take various forms, such as Baseboard Management Controller (BMC), CPU integration, and coprocessor hardware and software. This application does not specifically limit the connection method between the platform hardware and the TPCM or the form of the TPCM.

[0075] After the TPCM controls the UEFI to start, the UEFI will initialize the platform hardware, complete the self-test, and boot the operating system loader. The active measurement scheme in the UEFI is existing technology and will not be described in detail here. This application mainly describes the active measurement of the TPCM in the operating system loader.

[0076] Specifically, the operating system loader includes a TPCM interface module and an assistive measurement engine module, which are two newly added functional modules. After receiving the active measurement control command sent by the active measurement engine, the TPCM interface module can shield the differences in the interface forms of various device drivers, encapsulate the relevant data and commands based on the predefined algorithms in TPCM, and then send the encapsulated relevant data and commands to the assistive measurement engine module for processing.

[0077] Once the assisted measurement engine module detects the encapsulated data and commands sent by the TPCM interface module, it can obtain information such as the type, location, and attributes of the corresponding operating system kernel file. Based on this information, it can schedule the measurement content of the corresponding type of operating system, load the corresponding driver to read the measurement content of the operating system, and then call the TPCM interface module to send the measurement content to the active measurement engine for measurement calculation and verification to verify whether the system status is reliable.

[0078] The TPCM interface module can establish a communication channel between the operating system loader and the TPCM, enabling relevant data and commands to communicate between the operating system loader and the TPCM, and supporting corresponding device drivers depending on the connection method between the TPCM and the platform hardware.

[0079] Therefore, this application provides a trusted computing system that can cooperate with an active measurement engine through the TPCM interface module and the assisted measurement engine module in the operating system loader. After the TPCM interface module receives the active measurement control command sent by the active measurement engine, it encapsulates the corresponding content to be measured in the hardware device, and then sends the encapsulated content to the assisted measurement engine module for scheduling and assisted measurement processing to obtain the measurement content. Furthermore, the measurement content is sent to the active measurement engine for measurement verification to verify whether the system state is trustworthy. This application removes the function of the original measurement agent, which facilitates maintenance such as operating system kernel upgrades. Therefore, active measurement can be performed, thereby improving the authenticity, reliability and flexibility of the measurement.

[0080] The following description uses Grub as an example of an operating system loader. The main function of an operating system loader is to load and boot the operating system. Specifically, its core function is to load the operating system kernel file and guide its execution. Usually, the operating system loader is provided by the operating system vendor. For example, the operating system loader for Linux is lilo, and the updated Linux operating system loader is elilo. The operating system loader for Windows NT is NTLoader. Due to the wide variety of operating systems, it is troublesome for the BIOS to adapt to various types of operating system loaders. Grub is a multi-boot manager that can boot Unix, Linux, Windows, and other operating systems. Therefore, Grub can be used to complete the boot of various operating systems.

[0081] It should be noted that initializing the hardware boot operating system is a task that UEFI or BIOS needs to complete. Therefore, after the BIOS has reached a certain stage of the boot process, it will boot the operating system loader. Specifically, the BIOS is the first component of the computer system to run after power-on. After completing the early basic initialization, the BIOS will further initialize the TPM and create the core of the trusted root measurement module (CRTM). This allows it to measure the content executed by the BIOS and store the measurement results in the PCR, record log information, and then boot the operating system loader to obtain the data required for the measurement.

[0082] For example, Figure 6 A Grub display interface diagram provided for an embodiment of this application; as shown Figure 6 As shown, Grub is a multi-boot manager that can load the kernel of an operating system and initialize the operating system, or hand over the boot control to the operating system to complete the boot process. For example, Grub can replace lilo to boot Linux. It supports boot screen display and allows menu-driven selection of execution modes. As can be seen from the figure, multiple operating systems can be booted by it.

[0083] Specifically, in the GNU GRUB version 0.95 display interface, users can use the up and down arrow keys to select highlighted items. They can choose Ubuntu, kernel 2.6.12-9386, Ubuntu, kernel 2.6.12-9386 (recovery mode), Ubuntu, memory test 86*, or other operating systems such as Windows NT / 2000 / XP. Furthermore, after selecting an item in the display interface, pressing the Enter key will start the selected operating system. Users can also press the 'e' key to edit commands before starting the operating system, or press the 'c' key to start the command line.

[0084] Optionally, the TPCM interface module includes: a low-level device driver, a TPCM function operation module, and a security protocol stack. The low-level device driver is used to establish a channel between the hardware device and the TPCM so that the operating system loader and the TPCM can communicate.

[0085] The TPCM function operation module is used to encapsulate the content to be measured based on the function corresponding to the content to be measured after receiving the active measurement control command sent by the active measurement engine within a predefined period; the function is determined based on the predefined algorithm in the TPCM.

[0086] The security protocol stack is used to encrypt the encapsulated content to be measured and send the encrypted content to be measured to the assisted measurement engine module.

[0087] In this embodiment, the underlying device driver can support the corresponding device driver according to the connection method between the TPCM side and the platform hardware, such as implementing a PCIe device driver or an SPI driver in Grub. Specifically, the underlying device driver enables relevant data and commands to communicate between Grub and TPCM by establishing a communication channel between Grub and TPCM. For example, Grub can obtain the measurement algorithm pre-stored in TPCM, or the TPCM side can send active measurement control commands through protocol communication.

[0088] The TPCM side is an independent and complete TPCM functional module. The TPCM side includes TPCM hardware, TPCM firmware, active measurement engine, etc., and belongs to the protection component. This application embodiment does not specifically limit the number and type of modules included in the TPCM side. The TPCM side does not depend on the host side resources of the measured object, follows the TPCM specification requirements, can be started first, and can send active measurement control commands for active measurement after starting.

[0089] The TPCM function operation module is used to shield the differences in the underlying device driver interface form and encapsulate the specific function commands of TPCM, such as the TPCM status and attribute information obtained from the active measurement control instructions within a predefined period received from Grub. The TPCM status and attribute information is determined by a predefined algorithm.

[0090] Since the TPCM and Grub need to transmit the content to be measured, a relevant security protocol stack is required to ensure that the control commands sent by the TPCM are not tampered with, thereby ensuring that the online transmission is encrypted. Therefore, the TPCM interface module also includes a security protocol stack for encrypting the content to be measured. The content to be measured includes active measurement control commands and measurement data. This application embodiment does not specifically limit this.

[0091] It should be noted that if UEFI can provide a device driver interface to Grub, then Grub can directly encapsulate the relevant UEFI metrics.

[0092] For example, Figure 7 This application provides an embodiment of a TPCM interface module architecture diagram, as shown below. Figure 7 As shown, the TPCM interface module includes a low-level device driver, a TPCM function execution module, and a security protocol stack. The low-level device driver is used to establish a communication connection between the operating system loader and the TPCM, enabling the content to be measured to communicate between the operating system loader and the TPCM. The TPCM function execution module is used to encapsulate the content to be measured based on the function corresponding to the content to be measured, and then transmit the encapsulated content to the security protocol stack for encryption.

[0093] Therefore, the TPCM interface module includes the underlying device driver, the TPCM function operation module, and the security protocol stack. Through the cooperation of these three functional modules, the TPCM can communicate with the operating system loader. Since the active measurement engine sends active measurement control commands based on a preset period, it can also perform active measurement at regular intervals. After receiving the active measurement control command, the content to be measured is encapsulated for easier management, and the encapsulated content to be measured is encrypted to reduce the risk of leakage. It realizes the functions of trusted authentication and encryption protection, thereby supporting the operating system loader to perform active measurement.

[0094] Optionally, the assisted measurement engine module includes: a protocol parsing and scheduling module and an assisted measurement processing module; the protocol parsing and scheduling module is used to decrypt the encrypted content to be measured based on a predefined protocol, schedule the corresponding type of operating system file, and send the operating system file to the assisted measurement processing module for processing; the operating system file includes an operating system kernel file and an operating system configuration file;

[0095] The assisted measurement processing module is used to read the measurement content in the operating system file and call the TPCM interface module to send the measurement content to the active measurement engine.

[0096] The measurement content includes operating system kernel files, configuration information, and system startup parameters.

[0097] In this embodiment, the protocol parsing and scheduling module can parse the encrypted content to be measured sent by the TPCM interface module, i.e., decrypt the content to be measured, and obtain information such as the type, location, and attributes of the operating system file in the decrypted content, including the type of operating system file (Windows 10 or Ubuntu 18.4), the location of the operating system file to be started (on flash memory, hard disk, or network server), and further, call the corresponding type and location of the operating system file. The operating system file includes the operating system kernel file and the operating system configuration file. The operating system kernel file is a file in the system software with functions such as hardware abstraction layer, disk and file system control, and multitasking. The operating system configuration file is a computer file used to configure parameters and initial settings for computer programs.

[0098] It should be noted that when the assisted measurement engine module is started, that is, when it receives the encrypted content to be measured sent by the TPCM interface module, the assisted measurement engine module can detect the content to be measured and parse and schedule it. Therefore, the TPCM and the operating system loader have predefined relevant protocols to describe the type, location, attributes and other information of the operating system files that the TPCM wants the operating system loader to capture.

[0099] The assisted measurement processing module is used to load the corresponding driver to process the operating system files. If the operating system to be booted is on the hard drive, the HDD driver needs to be loaded; if it is on the network server, the network protocol stack needs to be loaded. Then, the kernel file of the operating system is read to obtain the operating system configuration information and boot parameters and other measurement information required by the measurement. The TPCM interface module is then called to send the measurement information required by the measurement to the active measurement engine.

[0100] For example, Figure 8 This application provides an architectural diagram of an assisted measurement engine module; as shown in the embodiments. Figure 8 As shown, the assisted measurement engine module includes a protocol parsing and scheduling module and an assisted measurement processing module. The protocol parsing and scheduling module is used to parse the protocol content in the content to be measured and schedule the corresponding type of operating system file. Then, the assisted measurement processing module can read the measurement content in the operating system file, that is, the data to be captured for measurement.

[0101] Therefore, in this embodiment of the application, the protocol parsing and scheduling module and the measurement processing module in the assisted measurement engine module cooperate with each other to obtain the data required for measurement and send it to the active measurement engine, thereby reducing the workload of the operating system loader and facilitating computer system upgrades.

[0102] Based on the above embodiments, it can be understood that the operating system loader process is to receive the measurement assistance request (active measurement control instruction) sent by the TPCM side, then parse the protocol content, read the data to be captured by the measurement request and send it to the TPCM. Therefore, the operating system loader has stripped the original measurement agent function, reduced the memory usage of the operating system loader, and facilitated the upgrading and maintenance of the operating system kernel.

[0103] Optionally, the active measurement engine is located within the TPCM service module, which is used to obtain measurement baseline values; the active measurement engine is specifically used for:

[0104] The measurement content sent by the assisted measurement processing module is obtained based on the active measurement control command. The measurement content is measured and calculated using the predefined algorithm provided by the TPCM to obtain the measurement result. The measurement verification is performed based on the measurement benchmark value and the measurement result to determine whether the system status is reliable.

[0105] If the system status is reliable, then send a command to start the operating system to the operating system loader;

[0106] If the system status is untrusted, a command to prevent the operating system from starting is sent to the operating system loader.

[0107] In this application embodiment, the predefined algorithm can be used for measurement calculation or to distinguish the function corresponding to the content to be measured. This application embodiment does not limit the specific algorithm referred to by the predefined algorithm.

[0108] Specifically, the active measurement engine can send active measurement control commands to obtain the measurement content corresponding to the operating system loader, i.e., the data required for measurement. Then, it performs measurement calculations on the measurement content to obtain measurement results. The measurement results are used to describe the operating system's running status. By comparing the measurement results with the measurement benchmark value, it can be determined whether the operating system has experienced any abnormalities, i.e., whether the system status is reliable. If the system status is determined to be reliable, a start operating system command is sent to the operating system loader to start the corresponding operating system kernel. If the system status is determined to be unreliable, a prohibition operating system start command is sent to the operating system loader to prevent the operating system kernel from starting, thus ensuring the security of the computing system.

[0109] It should be noted that the active measurement engine is on the TPCM side. It can be set in the TPCM service module inside TPCM, or it can be set up alongside TPCM. However, since the active measurement engine is on the TPCM side, it can be started first. After starting, it implements active measurement and active control behaviors, that is, it can send active measurement and control commands to the operating system loader, etc. through protocol communication.

[0110] Therefore, the embodiments of this application can reduce system coupling and remove the measurement agent function in the operating system loader. That is, the operating system loader does not need to perform benchmark comparison, remote proof support and other operations, so that the active measurement engine can perform measurement calculations and verify whether the system is trustworthy. This conforms to the latest national standard ideas and requirements for trusted computing and provides convenience for system operation.

[0111] Optionally, the operating system loader further includes a behavior execution module, which is used to perform corresponding operations based on the control commands sent by the TPCM and transfer control to the corresponding operating system.

[0112] Specifically, the behavior execution module is used to execute control commands sent from the TPCM side. For example, if the active measurement engine finds an anomaly after completing the measurement calculation, it will send a prohibition control command to prevent the operating system kernel from starting. At this time, the behavior execution module will stop booting the operating system. Conversely, if the active measurement engine sends a control command to allow startup, the behavior execution module will correctly configure the startup parameters, store the operating system kernel file in memory, and perform a series of actions such as handing over control to the operating system kernel file.

[0113] Therefore, the embodiments of this application can control the startup or pausing of the operating system through the behavior execution module added to the operating system loader, thereby realizing the active control function of the trusted computing system.

[0114] Optionally, the behavior execution module performs corresponding operations based on the control commands sent by the TPCM, including:

[0115] If the control command sent by the TPCM is a command to start the operating system, then the corresponding startup parameters are obtained, the corresponding operating system is started based on the startup parameters, and the startup parameters are stored for the next measurement calculation.

[0116] If the control command sent by the TPCM is a command to prevent the operating system from starting, then the corresponding operating system kernel will be prevented from starting, and an alarm message will be sent.

[0117] In this embodiment, the startup parameters are used to indicate the parameters required for the startup of the corresponding operating system, and the alarm information is used to indicate that the corresponding operating system has encountered an abnormality. For example, if the operating system is occupied by malicious software, the corresponding alarm information is sent. This embodiment does not specifically limit the content and form of the alarm information sent. It can be displayed in the form of a display box with the content "Operating System 1 is running abnormally".

[0118] For example, in Figure 1 In the application scenario, if the protection component in the computer terminal device sends a command to the computing component to start the operating system, the software system can obtain the corresponding startup parameters, start the corresponding operating system based on the startup parameters, load the hardware system, and store the measurement content corresponding to the operating system for the next measurement calculation; if the protection component in the computer terminal device sends a command to the computing component to prohibit the startup of the operating system, the software system can prohibit the startup of the corresponding operating system kernel and send alarm information in the form of a display box for visualization on the computer terminal device for user viewing.

[0119] It should be noted that in this embodiment of the application, when the corresponding operating system is started based on the startup parameters and the startup parameters are stored for the next measurement calculation, the kernel file, configuration information and other contents of the corresponding operating system are also stored, that is, the changed measurement contents can be stored in real time.

[0120] Therefore, the embodiments of this application can perform corresponding operations based on the control commands sent by TPCM, thereby improving the flexibility of system operation and realizing the trusted storage and trusted reporting functions of the trusted computing system.

[0121] Optionally, the trusted computing system further includes a TPCM management interface, which is used to: obtain real-time changing metric benchmark values ​​from a remote location, or obtain manually input metric benchmark values, and send the obtained metric benchmark values ​​to the TPCM service module.

[0122] In this embodiment of the application, the measurement benchmark value can refer to the benchmark value used to determine whether the operating system has an abnormal setting. Due to the upgrade of the computer system or the continuous operation of the system, the measurement benchmark value will change. Therefore, the measurement benchmark value corresponding to the computer system at this time can be accurately obtained by obtaining the changing measurement benchmark value in real time from a remote end such as the cloud, or by obtaining the measurement benchmark value entered manually. Alternatively, the corresponding measurement benchmark value can be obtained through a local server. This embodiment of the application does not limit the specific value of the measurement benchmark value or the source of acquisition.

[0123] Therefore, by setting up a TPCM management interface, the embodiments of this application can obtain updated measurement benchmark values ​​in real time, ensuring the accuracy of measurement verification.

[0124] In conjunction with the above embodiments, Figure 9 This application provides a schematic diagram of the architecture of a complete trusted computing system, as shown in the embodiments. Figure 9 As shown, the TPCM establishes a connection with the computer platform hardware, compared to Figure 3 The existing technology shown mainly adds three major functional modules to Grub: the TPCM interface module, the assisted measurement engine module, and the behavior execution module. These three functional modules work together to support proactive measurement and response control behaviors in Grub. The TPCM side mainly consists of TPCM hardware, TPCM firmware, TPCM service modules including the proactive measurement engine, and TPCM management interface, which can complete the initiation, verification, and control command initiation of proactive measurement behaviors.

[0125] Existing technologies integrate measurement agent functionality into Grub, utilizing the measurement agent for measurement operations, as well as proactive control judgments and benchmark comparisons. This involves benchmark reading, event log storage, and remote proof support. Consequently, Grub consumes a large amount of memory and its operations are cumbersome. In contrast, the aforementioned Trusted Computing System (TPCM) removes the original measurement agent functionality and adds auxiliary measurement functions, behavior execution functions, and an independent driver module to support TPCM proactive measurement. It also eliminates the need for benchmark comparisons, event log storage, and remote proof support, enabling proactive measurement and proactive control. This separates the measurement subject from the measured object, facilitating maintenance such as operating system kernel upgrades.

[0126] Therefore, the trusted computing system provided in this application embodiment, through an independent TPCM module (TPCM side) and by adopting a high-speed channel connection, has complete TPCM basic functions and related software stack. It can actively send measurement assistance requests and control behavior information to the operating system loader through a protocol, realize the dual system of TPCM running in parallel with the computing system, solve the problem of actively measuring and verifying the operating system kernel file, and control the execution of the operating system kernel according to the verification results, thus ensuring the security of the computer system.

[0127] Optionally, this application also provides a measurement method based on a trusted computing system, applied to an operating system loader. Figure 10 A flowchart illustrating a measurement method based on a trusted computing system provided in this application embodiment; as shown Figure 10 As shown, the operating system loader includes a TPCM interface module and an assisted measurement engine module; the process of the measurement method based on the trusted computing system includes the following steps:

[0128] S1001. Through the TPCM interface module, based on the active measurement control command sent by the active measurement engine and the predefined algorithm in the Trusted Platform Control Module (TPCM), the corresponding content to be measured in the hardware device is encapsulated.

[0129] S1002. The encapsulated content to be measured is scheduled and assisted in measurement by the assisted measurement engine module to obtain the measurement content, and the measurement content is sent to the active measurement engine so that the active measurement engine can perform measurement verification based on the measurement content sent by the assisted measurement engine module to verify whether the system status is reliable.

[0130] The specific implementation principle and effect of the measurement method based on trusted computing system provided in the above embodiments can be found in the relevant descriptions and effects of the above embodiments, which will not be elaborated here.

[0131] Optionally, this application also provides a measurement method based on a trusted computing system, applied to an active measurement engine. Figure 11 A flowchart illustrating another measurement method based on a trusted computing system provided in this application embodiment is shown below. Figure 11 As shown, the flow of the measurement method based on the trusted computing system includes the following steps:

[0132] S1101. Send an active measurement control command to the TPCM interface module in the operating system loader.

[0133] S1102. Receive measurement content sent by the assisted measurement engine module in the operating system loader, and perform measurement verification on the measurement content to verify whether the system state is trustworthy. The TPCM interface module is used to measure the corresponding content to be measured in the hardware device based on the active measurement control command sent by the active measurement engine and the predefined algorithm within the Trusted Platform Control Module (TPCM). The assisted measurement engine module is used to perform scheduling and assisted measurement processing on the encapsulated content to be measured to obtain the measurement content, and then send the measurement content to the active measurement engine.

[0134] The specific implementation principle and effect of the measurement method based on trusted computing system provided in the above embodiments can be found in the relevant descriptions and effects of the above embodiments, which will not be elaborated here.

[0135] This application also provides a schematic diagram of the structure of an electronic device. Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 12 As shown, the electronic device may include: a processor 1201 and a memory 1202 communicatively connected to the processor; the memory 1202 stores a computer program; the processor 1201 executes the computer program stored in the memory 1202, causing the processor 1201 to perform the method described in any of the above embodiments.

[0136] The memory 1202 and the processor 1201 can be connected via bus 1203.

[0137] This application also provides a computer-readable storage medium storing computer program execution instructions, which, when executed by a processor, are used to implement the methods described in any of the foregoing embodiments of this application.

[0138] This application also provides a chip for executing instructions, which is used to perform the methods described in any of the foregoing embodiments executed by an electronic device as described in any of the foregoing embodiments of this application.

[0139] This application also provides a computer program product, which includes a computer program that, when executed by a processor, can implement the methods described in any of the foregoing embodiments executed by an electronic device as described in any of the foregoing embodiments of this application.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0141] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0142] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0143] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this application.

[0144] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0145] The memory may include high-speed random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0146] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0147] The aforementioned storage media can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage media can be any available medium accessible to general-purpose or special-purpose computers.

[0148] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0149] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A trusted computing system, characterized in that, The trusted computing system includes: a Trusted Platform Control Module (TPCM), an Active Metrics Engine, hardware devices, and an operating system loader; The operating system loader includes a TPCM interface module and an auxiliary measurement engine module. The TPCM interface module includes a low-level device driver, a TPCM function execution module, and a security protocol stack. The low-level device driver is used to establish a channel between the hardware device and the TPCM to enable communication between the operating system loader and the TPCM. The TPCM function execution module is used to encapsulate the content to be measured based on the function corresponding to the content to be measured, determined by a predefined algorithm within the TPCM, after receiving an active measurement control command sent by the active measurement engine within a predefined period or during the startup of the trusted computing system. The content to be measured includes the active measurement control command and the corresponding measurement data within the hardware device. The security protocol stack is used to encrypt the encapsulated content to be measured and send the encrypted content to be measured to the auxiliary measurement engine module. The assisted measurement engine module includes: a protocol parsing and scheduling module and an assisted measurement processing module; the protocol parsing and scheduling module is used to decrypt the encrypted content to be measured based on a predefined protocol, schedule the corresponding type of operating system file, and send the operating system file to the assisted measurement processing module for processing; the operating system file includes an operating system kernel file and an operating system configuration file; the assisted measurement processing module is used to read the measurement content in the operating system file and call the TPCM interface module to send the measurement content to the active measurement engine; the measurement content includes the operating system kernel file; The active measurement engine is located within the TPCM service module of the TPCM, which is used to obtain measurement baseline values. The active measurement engine is used to send active measurement control commands to the TPCM interface module within the predefined period or during the startup process of the trusted computing system. The active measurement engine is also used to obtain measurement content sent by the assisted measurement processing module based on the active measurement control commands, perform measurement calculations on the measurement content using the predefined algorithms provided by the TPCM, obtain measurement results, and perform measurement verification based on the measurement baseline values ​​and the measurement results to determine whether the system state is trustworthy. If the system state is trustworthy, a command to start the operating system is sent to the operating system loader; if the system state is untrustworthy, a command to prohibit starting the operating system is sent to the operating system loader.

2. The trusted computing system according to claim 1, characterized in that, The operating system loader further includes a behavior execution module, which is used to perform corresponding operations based on the control commands sent by the TPCM and transfer control to the corresponding operating system.

3. The trusted computing system according to claim 2, characterized in that, The behavior execution module performs corresponding operations based on the control commands sent by the TPCM, including: If the control command sent by the TPCM is a command to start the operating system, then the corresponding startup parameters are obtained, the corresponding operating system is started based on the startup parameters, and the startup parameters are stored for the next measurement calculation. If the control command sent by the TPCM is a command to prevent the operating system from starting, then the corresponding operating system kernel will be prevented from starting, and an alarm message will be sent.

4. The trusted computing system according to any one of claims 1-3, characterized in that, The trusted computing system further includes a TPCM management interface, which is used to: obtain real-time changing metric benchmark values ​​from a remote location, or obtain manually input metric benchmark values, and send the obtained metric benchmark values ​​to the TPCM service module.

5. A measurement method based on a trusted computing system, characterized in that, This method is applied to an operating system loader, which includes a TPCM interface module and an assisted measurement engine module. The TPCM interface module includes a low-level device driver, a TPCM function execution module, and a security protocol stack. The assisted measurement engine module includes a protocol parsing and scheduling module and an assisted measurement processing module. The underlying device driver establishes a channel between the hardware device and the TPCM, enabling communication between the operating system loader and the TPCM. Upon receiving an active measurement control command sent by the active measurement engine within a predefined period or during the startup of the trusted computing system, the TPCM function operation module encapsulates the content to be measured based on the function corresponding to the content to be measured, determined by a predefined algorithm within the TPCM. The content to be measured includes the active measurement control command and the corresponding measurement data within the hardware device. The encapsulated content to be measured is encrypted using the security protocol stack, and the encrypted content to be measured is sent to the assisting measurement engine module. The protocol parsing and scheduling module decrypts the encrypted content to be measured based on a predefined protocol, schedules the corresponding type of operating system file, and sends the operating system file to the assisted measurement processing module for processing; the operating system file includes the operating system kernel file and the operating system configuration file. The assisted measurement processing module reads the measurement content from the operating system file and sends the measurement content to the active measurement engine by calling the TPCM interface module. The active measurement engine then performs measurement verification based on the received measurement content from the operating system file sent by the assisted measurement processing module to verify whether the system status is trustworthy. The measurement content includes the operating system kernel file.

6. A measurement method based on a trusted computing system, characterized in that, Applied to an active measurement engine, which is located within the TPCM service module of TPCM, the method includes: During a predefined period or during the startup of the trusted computing system, an active measurement control command is sent to the TPCM interface module in the operating system loader. Based on the active measurement control command, the measurement content sent by the assisted measurement processing module in the operating system loader is obtained. The measurement content is then measured and calculated using a predefined algorithm provided by the TPCM to obtain the measurement result. A measurement benchmark value is obtained through the TPCM service module. Measurement verification is performed based on the measurement benchmark value and the measurement result to determine whether the system status is trustworthy. If the system status is trustworthy, a command to start the operating system is sent to the operating system loader. If the system status is untrustworthy, a command to prohibit starting the operating system is sent to the operating system loader. The TPCM interface module includes: a low-level device driver, a TPCM function execution module, and a security protocol stack. The low-level device driver establishes a channel between the hardware device and the TPCM to enable communication between the operating system loader and the TPCM. The TPCM function execution module, upon receiving an active measurement control command sent by the active measurement engine within a predefined period or during the startup of the trusted computing system, encapsulates the content to be measured based on a function determined by a predefined algorithm within the TPCM that corresponds to the content to be measured. The content to be measured includes the active measurement control command and the corresponding measurement data within the hardware device. The security protocol stack is used to process the encapsulated content. The content to be measured is encrypted, and the encrypted content is sent to the assisted measurement engine module. The assisted measurement engine module includes a protocol parsing and scheduling module and an assisted measurement processing module. The protocol parsing and scheduling module is used to decrypt the encrypted content to be measured based on a predefined protocol, schedule the corresponding type of operating system file, and send the operating system file to the assisted measurement processing module for processing. The operating system file includes an operating system kernel file and an operating system configuration file. The assisted measurement processing module is used to read the measurement content in the operating system file and call the TPCM interface module to send the measurement content to the active measurement engine. The measurement content includes the operating system kernel file.

7. An electronic device, characterized in that, include: A processor, a memory, and a computer program; wherein the computer program is stored in the memory and configured to be executed by the processor, the computer program including instructions for performing the measurement method based on a trusted computing system as described in claim 5 or 6.

Images