Security measurement methods, security architecture systems and computer equipment

Abstract

The present application proposes a security measurement method, a security architecture system and a computer device. The method is applied to a security architecture system, which includes REE, TEE and SE. A trusted computing service support platform is constructed in a subsystem other than REE, and the trusted computing service support platform includes TCM, TPM and TPCM; TCM includes a TCM service module and a TCM password module, and TPM includes a TPM service module and a TPM password module; TCM password module and TCM service module run in different subsystems other than REE, and / or, TPM password module and TPM service module run in different subsystems other than REE; the method includes: when an active security measurement function is triggered, using TPCM to perform security measurement on a target object to obtain a security measurement result; or, in response to a security service request, using TCM and / or TPM to provide a security measurement service for the target object to obtain a security measurement result. The solution can ensure the security of the processor architecture.

Description

Technical Field

[0001] The present application relates to the field of processor technology, and in particular to a security measurement method, a security architecture system, and a computer device. Background Art

[0002] As users' requirements for device security continue to increase, more and more security technologies are applied to computer devices. As device software functions become increasingly rich and the amount of device data continues to increase, more and more diverse data and programs are running in the device chip architecture system, making the security of the chip architecture system an important means of ensuring the security of computer devices. Therefore, it is necessary to study technical solutions that can ensure the security of the chip architecture system to improve device security. Summary of the invention

[0003] Based on the above technical status, this application proposes a security measurement method, a security architecture system and a computer device to achieve the purpose of providing security measurement services for the target object compatible with TCM, TPM and TPCM, and can realize the security measurement of the processor architecture system, which is beneficial to ensure the security of the processor architecture system and the equipment.

[0004] In order to achieve the above technical objectives, this application proposes the following technical solutions:

[0005] In a first aspect, the present application proposes a security measurement method, which is applied to a security architecture system, wherein the security architecture system includes a common execution environment subsystem REE, a trusted execution environment subsystem TEE and a security element subsystem SE, and a trusted computing service support platform is constructed in subsystems other than REE, and the trusted computing service support platform includes a trusted cryptographic module TCM, a trusted platform module TPM and a trusted platform control module TPCM; TCM includes a TCM service module and a TCM cryptographic module, and TPM includes a TPM service module and a TPM cryptographic module; the TCM cryptographic module and the TCM service module run in different subsystems other than REE, and / or the TPM cryptographic module and the TPM service module run in different subsystems other than REE; the method includes: when an active security measurement function is triggered, using TPCM to perform security measurement on a target object to obtain a security measurement result; or, in response to a security service request, using TCM and / or TPM to provide security measurement services for the target object to obtain a security measurement result; the target object includes a running object in REE and / or TEE, and the security measurement result indicates the degree of trustworthiness of the target object. This solution can achieve security measurement of running objects in the chip architecture system, so that the security of running objects can be clarified in a timely manner, thereby identifying dangerous running objects, which is conducive to ensuring the security of the processor architecture. Furthermore, the solution integrates the trusted cryptographic module TCM, the trusted platform module TPM and the trusted platform control module TPCM in the chip architecture system, so that it can provide various types of security measurement services, which can meet the security measurement needs of different applications or different users, and at the same time ensure the security of the processor architecture, it can also improve the versatility of the processor architecture system.

[0006] In addition, it should be noted that in the related prior art, the implementation of external TPM, TCM and TPCM will additionally increase the consumption of hardware resources in computer devices. The inventive concept proposed in this application can directly upgrade the settings of the processor in traditional technology in scenarios that do not involve trusted computing; in scenarios involving trusted computing, the settings of trusted technology in the processor can be directly updated. Here, the implementation scheme for trusted technology may include: one or more of external TPM, TCM and TPCM; or, a TPM integrated inside the processor; or, a TCM integrated inside the processor; or, a TPM and a TCM integrated inside the processor, and so on.

[0007] In one implementation, the TPM cryptographic module and the TCM cryptographic module run in the same subsystem, rather than running separately on different processor cores. In this way, processor resources can be saved; in addition, setting them in a homogeneous manner can reduce design complexity.

[0008] In one implementation, the TPCM, TCM service module and TPM service module run in the TEE, and the TCM cryptographic module and TPM cryptographic module run in the SE. Separating the service module and the cryptographic module can effectively improve the security of the cryptographic module. At the same time, it improves the flexibility of the development and design of the TPCM, TPM service module and TCM service module software products.

[0009] In one implementation, TEE and SE run in the first processor core, or TEE runs in the first processor core and SE runs in the second processor core. TEE and SE run on the same processor core, rather than running separately on different processor cores. In this way, processor resources can be saved; in addition, setting up in an isomorphic manner can reduce design complexity. TEE and SE run on different processor cores respectively, which enables SE to independently process tasks and respond to requests, making SE's task execution completely independent and unaffected by the execution environment of other subsystems, which is beneficial to improving the security of the security architecture system, and is also beneficial to improving the task execution efficiency of SE.

[0010] In one implementation, the TCM service module is also used to directly respond to the security service request and provide security services for the target object; the TPM service module is also used to directly respond to the security service request and provide security services for the target object; in response to the security service request, using TCM and / or TPM to provide security measurement services for the target object, including: selecting a security service module corresponding to the security service request to provide security measurement services for the target object; the security service module includes at least one of a TCM cryptographic module, a TCM service module, a TPM cryptographic module and a TPM service module, and the security service request includes at least one of a first type of TCM security service request, a second type of TCM security service request, a first type of TPM security service request and a second type of TPM security service request; the first type of TCM security service request corresponds to the TCM cryptographic module, the second type of TCM security service request corresponds to the TCM service module, the first type of TPM security service request corresponds to the TPM cryptographic module, and the second type of TPM security service request corresponds to the TPM service module. Based on this implementation, the security architecture system can implement more security measurements, thereby improving the applicability of security measurements.

[0011] In one implementation, the target object includes a trusted application and a common application, a common application runs in the REE, a trusted application runs in the TEE, and the security service request includes a TCM security service request and / or a TPM security service request; the TCM also includes a TCM driver module, and the TPM also includes a TPM driver module; the TCM driver module is used to respond to the TCM service initiation request of the common application or the trusted application and initiate the TCM security service request; the TPM driver module is used to respond to the TPM service initiation request of the common application or the trusted application and initiate the TPM security service request. Based on this implementation, the TCM driver module and the TPM driver module can meet the needs of the application program to initiate a security service request and realize the smooth triggering of the security service request.

[0012] In one implementation, the TCM security service request includes a first type of TCM security service request and / or a second type of TCM security service request, and the TPM security service request includes a first type of TPM security service request and / or a second type of TPM security service request; the TCM service module is further used to directly respond to the second type of TCM security service request and provide a security measurement service for the target object; the TPM service module is further used to directly respond to the second type of TPM security service request and provide a security measurement service for the target object. In this implementation, the TCM service module and the TPM service module can provide security measurement services, thereby further improving the system security measurement performance and applicability.

[0013] In one implementation, the TCM driver module is set in the REE and / or TEE, and the TPM driver module is set in the REE and / or TEE. The setting of the TCM driver module and the TPM driver module in the REE and / or TEE can implement security architecture systems with different structures, and at the same time, the application programs in the REE and / or TEE can initiate security service requests in various ways.

[0014] In one implementation, when a TCM driver module and a TPM driver module are provided in the REE, the security service request includes: a first type of TCM security service request directly initiated by an ordinary application to a TCM cryptographic module through the TCM driver module, a first type of TPM security service request directly initiated by an ordinary application to a TPM cryptographic module through the TPM driver module, a first type of TCM security service request or a second type of TCM security service request initiated by an ordinary application to a TCM service module through the TCM driver module, and at least one of a first type of TPM security service request or a second type of TPM security service request initiated by an ordinary application to a TPM service module through the TPM driver module. In this implementation, ordinary applications in the REE can send security service requests to the SE in a step-by-step or cross-level manner, thereby realizing security metrics of different modes and meeting the security metric requirements of ordinary applications in different scenarios.

[0015] In one implementation, when a TCM driver module and a TPM driver module are provided in the REE, and a TCM driver module and a TPM driver module are provided in the TEE, the security service request also includes: a first type of TCM security service request directly initiated by a trusted application to a TCM cryptographic module through the TCM driver module in the TEE, a first type of TCM security service request or a second type of TCM security service request initiated by a trusted application to a TCM service module through the TCM driver module in the TEE, a first type of TPM security service request directly initiated by a trusted application to a TPM cryptographic module through the TPM driver module in the TEE, and at least one of a first type of TPM security service request or a second type of TPM security service request initiated by a trusted application to a TPM service module through the TPM driver module in the TEE. Based on this implementation, the TCM driver module and the TPM driver module are provided in both the REE and the TEE, so that ordinary applications in the REE and trusted applications in the TEE can each independently initiate security service requests, thereby improving the efficiency of security measurement.

[0016] In one implementation, when a TCM driver module and a TPM driver module are provided in the REE, and a TCM driver module is provided in the TEE, the security measurement service request also includes: a first-class TCM security service request directly initiated by a trusted application to a TCM cryptographic module through the TCM driver module in the TEE, a first-class TCM security service request or a second-class TCM security service request initiated by a trusted application to a TCM service module through the TCM driver module in the TEE. In this implementation, not only can ordinary applications in the REE initiate TCM security service requests and / or TPM security service requests, but also trusted applications in the TEE can initiate TCM security service requests, taking into account the security measurement requirements of different applications and different scenarios, and improving the applicability of the solution.

[0017] In one implementation, when a TCM driver module and a TPM driver module are provided in the REE, and a TPM driver module is provided in the TEE, the security service request also includes: at least one of a first-class TPM security service request directly initiated by a trusted application to a TPM cryptographic module through the TPM driver module in the TEE, and a first-class TPM security service request or a second-class TPM security service request initiated by a trusted application to a TPM service module through the TPM driver module in the TEE. In this implementation, not only can ordinary applications in the REE initiate TCM security service requests and / or TPM security service requests, but also trusted applications in the TEE can initiate TPM security service requests, taking into account the security measurement requirements of different applications and different scenarios, and improving the applicability of the solution.

[0018] In one implementation, when a TCM driver module and a TPM driver module are provided in the TEE, the security service request includes: a first type of TCM security service request directly initiated by a trusted application to a TCM cryptographic module through the TCM driver module, a first type of TCM security service request or a second type of TCM security service request initiated by a trusted application to a TCM service module through the TCM driver module, a first type of TPM security service request directly initiated by a trusted application to a TPM cryptographic module through the TPM driver module, and at least one of a first type of TPM security service request or a second type of TPM security service request initiated by a trusted application to a TPM service module through the TPM driver module. In this implementation, the TCM driver module and the TPM driver module are provided in the TEE. Thanks to the higher security of the TEE, the TCM driver module and the TPM driver module can be placed in a more secure execution environment, which is conducive to improving the security of triggering security service requests.

[0019] In one implementation, when a TCM driver module and a TPM driver module are provided in the TEE, and a TCM driver module is provided in the REE, the security service request also includes: at least one of the first type of TCM security service request directly initiated by an ordinary application to the TCM cryptographic module through the TCM driver module in the REE, and the first type of TCM security service request or the second type of TCM security service request initiated by an ordinary application to the TCM service module through the TCM driver module in the REE. In this implementation, not only can the trusted application in the TEE initiate a TCM security service request and / or a TPM security service request, but also the ordinary application in the REE can initiate a TCM security service request step by step or across levels, taking into account the security measurement requirements of different applications and different scenarios, and improving the applicability of the solution.

[0020] In one implementation, when a TCM driver module and a TPM driver module are provided in the TEE, and a TPM driver module is provided in the REE, the security measurement service request also includes: at least one of a first-type TPM security service request directly initiated by an ordinary application to a TPM cryptographic module through the TPM driver module in the REE, and a first-type TPM security service request or a second-type TPM security service request initiated by an ordinary application to a TPM service module through the TPM driver module in the REE. In this implementation, not only can the trusted application in the TEE initiate a TCM security service request and / or a TPM security service request, but also the ordinary application in the REE can initiate a TPM security service request step by step or across levels, taking into account the security measurement requirements of different applications and different scenarios, and improving the applicability of the solution.

[0021] In one implementation, when a TCM driver module is set in the REE and a TPM driver module is set in the TEE, the security service request includes: a first-class TPM security service request directly initiated by a trusted application to a TPM cryptographic module through the TPM driver module in the TEE, a first-class TPM security service request or a second-class TPM security service request initiated by a trusted application to a TPM service module through the TPM driver module in the TEE, a first-class TCM security service request directly initiated by an ordinary application to a TCM cryptographic module through the TCM driver module in the REE, and a first-class TCM security service request or a second-class TCM security service request initiated by an ordinary application to a TCM service module through the TCM driver module in the REE. In this implementation, ordinary applications in the REE can send TCM security service requests to the SE step by step or across levels, while trusted applications in the TEE can directly send TPM security service requests to the SE, which can take into account the security and execution efficiency of TCM security service requests initiated by ordinary applications in different scenarios, thereby improving the applicability of the solution.

[0022] In one implementation, when a TPM driver module is set in the REE and a TCM driver module is set in the TEE, the security measurement service request includes: a first-class TCM security service request directly initiated by a trusted application to a TCM cryptographic module through the TCM driver module in the TEE, a first-class TCM security service request or a second-class TCM security service request initiated by a trusted application to a TCM service module through the TCM driver module in the TEE, a first-class TPM security service request directly initiated by an ordinary application to a TPM cryptographic module through the TPM driver module in the REE, and a first-class TPM security service request or a second-class TPM security service request initiated by an ordinary application to a TPM service module through the TPM driver module in the REE. In this implementation, ordinary applications in the REE can send TPM security service requests to the SE step by step or across levels, while trusted applications in the TEE can directly send TCM security service requests to the SE, which can take into account the security and execution efficiency of TPM security service requests initiated by ordinary applications in different scenarios, thereby improving the applicability of the solution.

[0023] In one implementation, TEE and SE run in the first processor core, or TEE runs in the first processor core and SE runs in the second processor core; the first processor core is virtualized as a security core; if the TCM driver module runs on the security core, the TCM driver module is also used to: when the TCM service initiation request is a first type of service initiation request, directly respond to the TCM service initiation request and provide security measurement services for the target object; if the TPM driver module runs on the security core, the TPM driver module is also used to: when the TPM service initiation request is a second type of service initiation request, directly respond to the TPM service initiation request and provide security measurement services for the target object. In this implementation, the TCM driver module and the TPM driver module can respond to specific service initiation requests under specific circumstances, thereby improving security measurement efficiency.

[0024] In one implementation, the TPM driver module further includes a first key table, and the TCM driver module further includes a second key table, wherein the first key table includes a first key and a key type supported by the TPM, and the second key table includes a second key and a key type supported by the TCM; the TPM driver module is also used to determine the key type requested in the TPM service initiation request, and when the determined key type is not in the first key table, the key type requested in the TPM service initiation request is updated to the first key; the TCM driver module is also used to determine the key type requested in the TCM service initiation request, and when the determined key type is not in the second key table, the key type requested in the TCM service initiation request is updated to the second key. Based on this implementation, the support and adaptation of the security measurement method and the security architecture system to the newly added key type can be improved.

[0025] In one implementation, the security architecture system stores security measurement priority information corresponding to TPCM, TCM and TPM. When the active security measurement function is triggered and a security service request is received at the same time, the security measurement method is determined according to the security measurement priority information corresponding to TPCM, TCM and TPM; the security measurement method includes using TPCM to perform security measurement on the target object to obtain a security measurement result, and, in response to the received security service request, using TCM and / or TPM to provide security measurement services for the target object to obtain one or more security measurement methods in the security measurement result. In this implementation, when active measurement and passive measurement are triggered at the same time, various response mechanisms can be set, which improves the flexibility and adaptability of security measurement.

[0026] In one implementation, when the active security measurement function is triggered and a security service request is received at the same time, the TPCM is used to perform security measurement on the target object to obtain a security measurement result, and in response to the received security service request, the TCM and / or TPM is used to provide security measurement services for the target object to obtain a security measurement result. In this implementation, active security measurement and passive security measurement can be performed in parallel, which improves the comprehensiveness of security measurement.

[0027] In one implementation, when the security service request includes a TCM security service request and a TPM security service request, the TCM and TPM are used to provide a security measurement service for the target object, including: in response to the TCM security service request, the TCM is used to provide a security measurement service to obtain a first security measurement result; and in response to the TPM security service request, the TPM is used to provide a security measurement service to obtain a second security measurement result; and the first security measurement result and the second security measurement result are used as security measurement results. This implementation can realize the simultaneous execution of two different types of passive security measurements, thereby improving the comprehensiveness of passive security measurements.

[0028] In the second aspect, the present application proposes a security architecture system, which includes a normal execution environment subsystem REE, a trusted execution environment subsystem TEE and a security element subsystem SE. A trusted computing service support platform is constructed in the subsystems other than REE, and the trusted computing service support platform includes a trusted cryptographic module TCM, a trusted platform module TPM and a trusted platform control module TPCM; TCM includes a TCM service module and a TCM cryptographic module, and TPM includes a TPM service module and a TPM cryptographic module; TCM cryptographic module and TCM service module run in different subsystems other than REE, and / or, TPM cryptographic module and TPM service module run in different subsystems other than REE; the trusted computing service support platform is configured to: when the active security measurement function is triggered, use TPCM to perform security measurement on the target object to obtain a security measurement result; or, in response to a security service request, use TCM and / or TPM to provide security measurement services for the target object to obtain a security measurement result; the target object includes a running object in REE and / or TEE, and the security measurement result indicates the degree of trustworthiness of the target object.

[0029] In a third aspect, the present application proposes a computer device, which includes the above-mentioned security architecture system.

[0030] Based on the second aspect and / or the third aspect, it is possible to implement security measurement of running objects in the chip architecture system, so that the security of the running objects can be clarified in a timely manner, thereby identifying dangerous running objects, which is conducive to ensuring the security of the processor architecture. Furthermore, the above scheme integrates the trusted cryptographic module TCM, the trusted platform module TPM and the trusted platform control module TPCM in the chip architecture system, so that various types of security measurement services can be provided, which can meet the security measurement requirements of different applications or different users, and improve the versatility of the processor architecture system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0032] Figure 1 A schematic diagram of the structure of a two-level processor architecture provided in an embodiment of the present application;

[0033] Figure 2 A schematic diagram of the structure of a three-level processor architecture provided in an embodiment of the present application;

[0034] Figure 3 A schematic diagram of the structure of a three-level security architecture system compatible with TCM, TPM and TPCM provided in an embodiment of the present application;

[0035] Figure 4 A schematic diagram of the structure of another three-level security architecture system compatible with TCM, TPM and TPCM provided in an embodiment of the present application;

[0036] Figure 5(a)-Figure 5(i) Schematic diagram of various distribution settings of the TCM driver module and the TPM driver module in the REE and TEE provided in the embodiments of the present application;

[0037] Figure 6-Figure 14 Schematic diagram of various different security calling methods provided in the embodiments of the present application;

[0038] Fig.15 A schematic diagram of a safety measurement method provided in an embodiment of the present application;

[0039] Fig.16 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0041] Generally speaking, the processor architecture of a computer device can be composed of three types of subsystems, namely, a Rich Execution Environment (REE) subsystem, a Trusted Execution Environment (TEE) subsystem, and a Secure Element (SE) subsystem.

[0042] The common execution environment subsystem REE may include a general operating system running on a general-purpose embedded processor, in which an application is installed. The application running in REE can be called a common application (Client Application, CA), which has low security and is vulnerable to attacks. For example, the application running in REE may be a program involving a payment scenario, in which basic services such as browsing goods, selecting goods, and submitting orders are implemented. Although many security measures such as device access control, device data encryption mechanism, isolation mechanism during application runtime, and access control based on permission verification are taken in REE, the security of important data in the application cannot be guaranteed.

[0043] The trusted execution environment subsystem TEE can be an independent operating environment running outside the general operating system, which can provide trusted services to REE and be isolated from REE. One or more trusted applications (TEEApplication, TA) can be executed in TEE, which provides a trusted operating environment for the general execution environment subsystem REE through trusted applications, and then ensures end-to-end security through the protection of confidentiality, integrity and control of data access rights. In addition, TEE can run in parallel with REE, and for example, TEE interacts with REE through a secure application programming interface (Application ProgrammingInterface, API).

[0044] TEE provides an operating environment with a higher security level than REE, but cannot provide a secure key storage and key operating environment at the hardware isolation level. Generally, TEE can provide many application programming interfaces for REE to call TEE resources. The more application programming interfaces TEE provides for services, the greater the risk TEE faces. It is difficult to ensure that the application programming interface itself does not have security risks, such as security vulnerabilities, which in turn lead to security risks for resources such as keys in TEE. Furthermore, multiple trusted applications TA will run in TEE, and the trusted applications TA are completely dependent on the isolation mechanism provided by the TEE operating system, without hardware-level isolation. This means that if the trusted application TA itself has security vulnerabilities or the trusted application TA actively accesses the keys or root keys corresponding to other trusted applications TA, it will also lead to great security risks for sensitive resources such as keys.

[0045] The software system in the security element subsystem SE is relatively simple, including fewer hardware components, so it is easy to establish physical protection and implement security assurance, thereby improving the security strength of the security element subsystem SE to serve security systems with higher security requirements. As an example, TEE can transmit a security service request to SE to request the provision of corresponding security services and respond based on the request, for example, the security service can be a request to SE to perform services related to cryptographic operations, etc.

[0046] The application running in the security element subsystem SE can be called a security element application (Applet), and its security is the highest among these three types of subsystems. Since the security element subsystem SE is the most secure compared to the ordinary execution environment subsystem REE and the trusted execution environment subsystem TEE, the security element subsystem SE generally stores important resources, such as root keys and other information, and the security of important resources stored in the security element subsystem SE is guaranteed by means of permission verification, cryptographic technology, etc. As an implementation method, the security element subsystem SE includes an execution engine, a static random access memory (SRAM), a non-volatile memory, or may also include a key derivation module (Key Derivation Function, KDF). Among them, important resources such as root keys can be stored in the non-volatile memory in the security element subsystem SE, and the security element subsystem SE firmware or hardware ensures that the root key does not have a software or hardware path to pass out of the security element subsystem SE. In addition, the key derivation module KDF integrated in the security element subsystem SE can be implemented as software or hardware and used to generate derived keys based on the root key. For example, the key derivation module KDF may be a hash function, which is often used to transform a short password into a long password.

[0047] In the processor architecture system, the security of the computing environment is ensured through the cooperation between these three subsystems. Specifically, a processor architecture can be composed of REE and TEE. Figure 1 The two-level architecture system shown in FIG. 1 can also be composed of REE, TEE and SE. Figure 2 The three-level architecture system shown.

[0048] See also Figure 1 As shown, the REE in the secondary architecture system runs system firmware, operating system OS or virtual machine VM. Among them, the system firmware can be implemented as an extensible firmware interface (Unified Extensible Firmware Interface, UEFI) for desktops, servers and other fields, or it can be implemented as a boot loader (U-Boot) for embedded fields. In addition, the basic firmware, system firmware and operating system OS can communicate with out-of-band control systems (such as embedded controllers EC, baseboard management controllers BMC, etc.). The TEE can run a secure operating system (TEE OS) that TEE depends on.

[0049] See also Figure 2 As shown, the structure of the three-level architecture system is Figure 1 The structure of the two-level architecture system shown has SE added.

[0050] In some implementations, there is no physical path for REE and TEE to directly access SE, and they can only make requests to SE through interactive methods such as shared memory, and SE provides services to REE and TEE. Regarding SE, as an implementation, SE may include an execution engine, static random access memory (SRAM), non-volatile memory, or may also include a key derivation function (KDF). Among them, important resources such as root keys can be stored in non-volatile memory in SE, and the firmware or hardware of SE ensures that the root key does not have a software or hardware path to pass out of SE. In addition, the key derivation module KDF integrated in SE can be implemented as software or hardware and used to generate derived keys based on the root key. For example, the key derivation module KDF can be a hash function, which is usually used to convert short passwords into long passwords. Specifically, the above-mentioned shared memory can refer to a large-capacity memory that can be accessed by different processors in a multi-processor computer system. In some embodiments, resources such as the execution engine included in SE can be used as trusted computing resources for TCM and / or TPM.

[0051] For the above three-level architecture system, TEE and SE can run on the same processor core or on different processor cores. For example, both TEE and SE run on the first processor core, thus forming a processor architecture system in which TEE and SE are homogeneous, or TEE runs on the first processor core and SE runs on the second processor core, thus forming a processor architecture system in which TEE and SE are heterogeneous.

[0052] For the above-mentioned processor architecture system with isomorphic TEE and SE, TEE and SE run on the same processor core (i.e., the first processor core) instead of running separately on different processor cores. In this way, processor resources can be saved; in addition, setting up in an isomorphic manner can reduce design complexity.

[0053] For the above-mentioned TEE and SE heterogeneous processor architecture system, TEE and SE run on different processor cores, which enables SE to independently process tasks and respond to requests, making SE's task execution completely independent and unaffected by the execution environment of other subsystems, which is conducive to improving the security of the security architecture system and the efficiency of SE's task execution. Furthermore, this implementation method can reduce the hardware resource consumption of the processor and improve the processing performance of the processor.

[0054] Whether TEE and SE are set on the same processor core or on different processor cores, it does not affect the security measurement function of the entire processor architecture system and the specific process of the implemented security measurement method. Therefore, the introduction of the structure of various types of security architecture systems in the subsequent embodiments of this application all defaults to including the situation where TEE and SE are set on the same or different processor cores. At the same time, the security measurement function and security measurement method implemented in the security architecture system introduced in the subsequent embodiments of this application all default to including the security measurement function and security measurement method implemented when TEE and SE are set on the same or different processor cores. In the subsequent embodiments of this application, the specific contents of the security measurement function and the implemented security measurement method when TEE and SE are set on the same or different processor cores will no longer be introduced one by one.

[0055] As users' requirements for device security continue to increase, more and more security technologies are applied to computer devices. As device software functions become increasingly rich and the amount of device data continues to increase, more and more diverse data and programs are running in the device processor architecture, making it an important means to ensure the security of the processor architecture system. Therefore, it is necessary to study technical solutions that can ensure the security of the processor architecture system to improve device security.

[0056] Trusted Computing (TC) is a technology promoted and developed by TCG (Trusted Computing Group). One of the core goals of trust is to ensure the integrity of systems and applications, so as to ensure that the system or software runs in the trusted state expected by the design goal. Adding trusted verification to systems and applications can reduce the possibility of being attacked due to the use of unknown or tampered systems / software. Taking PC trust as an example, in layman's terms, trust means detecting the integrity and correctness of the BIOS and operating system when each PC is started, ensuring that the hardware configuration and operating system have not been tampered with when you use the PC, and all system security measures and settings will not be bypassed; after startup, all applications, such as social software, music software, video software, etc., can be monitored in real time, and if the application is found to be tampered with, stop-loss measures will be taken immediately.

[0057] Trust is mainly achieved through technical means of measurement and verification. Measurement is to collect the status of the software or system being tested, and verification is to compare the measurement results with the reference value to see if they are consistent. If they are consistent, the verification is passed, and if they are inconsistent, the verification fails. Trusted computing ensures trust by measuring and verifying the software stack through the algorithms and keys implanted in the trusted hardware by the chip manufacturer, as well as the integrated dedicated microcontroller. According to the classification of security chips and the trusted software stack running on them, there are currently three mainstream trusted computing standards in the industry: Trusted Platform Module (TPM), Trusted Cryptography Module (TCM) and Trusted Platform Control Module (TPCM).

[0058] The TPM standard is launched by TCG, and the TPM technical specifications follow the corresponding international specifications. Therefore, it provides standard services that comply with the TPM international specifications. Specifically, the TPM module can include two parts: the TPM cryptographic module and the TPM service module. The TPM cryptographic module and the TPM service module work together to support the implementation of TPM trusted computing technology services.

[0059] Among them, the TPM cryptographic module is used to provide trusted computing resources for the TPM trusted computing service. The trusted computing resources specifically include storage space for storing data such as keys and random numbers, and hardware resources such as algorithm modules for various cryptographic algorithms. For example, under normal circumstances, the TPM cryptographic module can support digest algorithm units SHA-1, SHA-256, signature verification and encryption and decryption algorithm units RSA, ECC, AES, and in future evolutionary iterations, it can also support new algorithms. The TPM specification is evolving and iterating, and the types of algorithms supported and the inherent technical methods of different versions of the specification are somewhat different. However, the essential security technology implementation purposes and methods are the same. Therefore, the solutions mentioned in this article are applicable to different versions of the TPM specification.

[0060] The TPM service module is used to provide TPM trusted computing services by calling the computing resources of the TPM cryptographic module. The TPM service module mainly includes programs and algorithms that call TPM trusted computing resources to execute TPM trusted computing services.

[0061] Normally, when the TPM service module responds to a security service request, it needs to call the computing resources of the TPM cryptographic module to implement it. That is, when the TPM service module receives a security service request, it calls the computing resources of the TPM cryptographic module to implement security measurement and provide security measurement services. In some cases, the TPM cryptographic module can directly respond to certain security service requests and directly provide security measurement services; or the TPM service module can also independently respond to certain security service requests and provide security measurement services through its own software calculations.

[0062] In actual applications, the TPM cryptographic module and the TPM service module can be set in the same operating environment to form an integrated TPM module; alternatively, the TPM cryptographic module and the TPM service module can also be set in different operating environments. When the TPM service module responds to a security service request, if it needs to call the computing resources of the TPM cryptographic module, it can call the computing resources of the TPM cryptographic module through a cross-operating environment call.

[0063] In order to gain technical and industrial dominance in the field of trusted computing and ensure that the core technology of international information security is in our own hands, my country has launched the TCM (Trusted Cryptography Module) standard in the field of trusted computing. Specifically, the TCM module also includes the TCM cryptographic module and the TCM service module. The cooperation of the TCM cryptographic module and the TCM service module can support the implementation of TCM trusted computing technology services.

[0064] Among them, the TCM cryptographic module is an independent cryptographic algorithm module with protected storage space, which can safely provide basic hardware computing resources such as cryptographic operations, TRNG, trusted roots, and storage for trusted computing. The algorithms of the TCM cryptographic module include the summary algorithm unit SM3, signature verification and encryption and decryption algorithm units SM2 and SM4, etc., and new algorithms can also be supported in future evolutions and iterations. The TCM specification is evolving, and the types of algorithms and inherent technical methods supported by different versions of the specification are somewhat different. However, the essential security technology implementation purposes and methods are the same. Therefore, the solutions mentioned in this article are applicable to different versions of the TCM specification.

[0065] The TCM service module can provide security services such as trusted measurement, trusted reporting, and trusted storage to applications by calling the hardware resources of the TCM cryptographic module.

[0066] Normally, when the TCM service module responds to a security service request, it needs to call the computing resources of the TCM cryptographic module to implement it. That is, when the TCM service module receives a security service request, it calls the computing resources of the TCM cryptographic module to implement security measurement and provide security measurement services. In some cases, the TCM cryptographic module can directly respond to certain security service requests and directly provide security measurement services; or, the TCM service module can also independently respond to certain security service requests and provide security measurement services through its own software calculations.

[0067] In actual applications, the TCM cryptographic module and the TCM service module can be set in the same operating environment to form an integrated TCM module; alternatively, the TCM cryptographic module and the TCM service module can also be set in different operating environments. When the TCM service module responds to a security service request, if it needs to call the computing resources of the TCM cryptographic module, it can call the computing resources of the TCM cryptographic module through a cross-operating environment call.

[0068] Exemplarily, the above-mentioned TPM and TCM can both be used as the core of trusted computing, and their specific implementation form can be a system-level chip installed on the motherboard, which includes a hardware module (cryptographic module) and a software module (service module), and can provide secure and reliable key storage, integrity reporting, and basic cryptographic operations for trusted computing. The difference is that TPM and TCM are based on different technical routes and provide security services through different algorithms to achieve security measurement of the system.

[0069] The security measurement services provided by TPM and TCM are both passive security measurement services. When the system starts, the BIOS must be started first. After the hardware and system detection is completed, the BIOS loads the TPM chip or TCM chip to play a security measurement role. This provides hackers with opportunities to invade and attack the BIOS.

[0070] In order to further enhance the protection of the system by security measurement, my country has studied the TPCM standard which can perform active security measurement on the system.

[0071] TPCM can measure the integrity of the firmware before the CPU runs the firmware code to ensure that the firmware has not been tampered with. The TPCM technology includes a TPCM software (hereinafter referred to as the TPCM module) and a TCM module. The TPCM software must be combined with the TCM module to implement the cryptographic support function for the trusted software base. The TPCM module is a secure independent module that uses TCM to implement active measurement. It contains two types of measurement processes: one is that during the system power-on and startup process, the TPCM module must be powered on first to actively measure and verify the firmware; the second is that when the system is running, the TPCM module will actively measure, verify and record the application at a certain frequency.

[0072] When TPM or TCM is applied to a processor architecture system, TPM or TCM is the called resource, and the application realizes the security measurement of the target object by requesting security services from TPM or TCM.

[0073] The application program calls the TPM or TCM with the help of the corresponding driver module. Specifically, the TPM also includes a TPM driver module, and the application program calls the TPM through the TPM driver module; the TCM also includes a TCM driver module, and the application program calls the TCM through the TCM driver module.

[0074] The TPM driver module is also called the TPM user-side protocol unit or firmware-TPM (fTPM for short), which is used to respond to the TPM service initiation request of the application and initiate a TPM security service request; the TCM driver module is also called the TCM user-side protocol unit or firmware-TCM (fTCM for short), which is used to respond to the TCM service initiation request of the application and initiate a TCM security service request. When the application needs to call TPM or TCM, it first sends a TPM service initiation request or a TCM service initiation request to the TPM driver module or the TCM driver module. When the TPM driver module or the TCM driver module receives the TPM service initiation request or the TCM service initiation request, it sends a TPM security service request to the TPM or sends a TCM security service request to the TCM. When the TPM or TCM receives the TPM security service request or the TCM security service request, it responds to the request and provides security measurement services. In actual applications, the TPM driver module can be set together with the TPM or separately. Similarly, the TCM driver module can be set together with the TCM or separately.

[0075] TPCM is more proactive and can measure the security of the system according to preset rules. For example, during the system power-on process, the TPCM module actively measures and verifies the firmware; or when the system is running, the TPCM module periodically measures, verifies and records the application program at a certain frequency.

[0076] In summary, TPM, TCM, and TPCM can all achieve security measurement of the system. Therefore, applying TPM, TCM, and TPCM to processor architecture systems, such as the above-mentioned two-level architecture system, three-level architecture system, etc., can achieve trusted computing of the processor architecture system, which will be beneficial to ensure system security and solve processor system security issues. Therefore, this application studies the application of the above-mentioned TPM, TCM, and TPCM to the processor architecture system, thereby obtaining a more secure security architecture system, and based on the specific system structure of the security architecture system, proposes a corresponding security measurement method to achieve security measurement of the security architecture system and ensure system security.

[0077] Since TPCM requires TCM to provide cryptographic support functions, when TPCM, TCM, and TPM are integrated into the same processor architecture system, TPCM can be only a software module, which can realize active security measurement in combination with the cryptographic support functions provided by TCM, or TPCM can contain TCM alone without using the functions and resources of other TCMs outside TPCM. That is, both TPM and TCM are software and hardware modules that can respond to security services independently; while TPCM can be a software module that realizes active security measurement by calling the hardware resources of TCM.

[0078] In the related prior art, the implementation of external TPM, TCM and TPCM will increase the consumption of hardware resources in computer devices. However, the inventive concept proposed in this application can directly upgrade the settings of the processor in the traditional technology in scenarios that do not involve trusted computing; in scenarios that involve trusted computing, the settings of the trusted technology in the processor can be directly updated. Here, the implementation scheme of trusted technology may include: one or more of external TPM, TCM and TPCM; or, a TPM integrated inside the processor; or, a TCM integrated inside the processor; or, a TPM and a TCM integrated inside the processor, and so on.

[0079] Below, an exemplary introduction is given to the settings of TPM (including TPM cryptographic module, TPM service module, TPM driver module), TCM (including TCM cryptographic module, TCM service module, TCM driver module), and TPCM in a three-level processor architecture system, as well as various implementation methods of security measurement methods that can be achieved based on these settings.

[0080] In the three-level architecture system, there are common execution environment subsystem REE, trusted execution environment subsystem TEE and secure element subsystem SE. Common applications run in REE and trusted applications run in TEE. Both common applications and trusted applications can be used as target objects for security measurement.

[0081] By configuring TPM, TCM and TPCM to form a trusted computing service support platform and setting it in a three-level architecture system to implement trusted computing of the architecture system, a secure architecture system with security measurement functions can be formed, thereby improving the security of the architecture system. Generally speaking, the security of REE is lower than that of TEE, and the security of TEE is lower than that of SE. Therefore, the trusted computing service support platform composed of TPM, TCM and TPCM is preferably set in TEE and / or SE, while the TPM driver module and TCM driver module can be set in REE and / or TEE according to actual needs and design requirements.

[0082] When TPM and / or TCM are set in TEE and / or SE, the service modules and cryptographic modules respectively included in TPM and / or TCM may be dispersedly set in TEE and / or SE.

[0083] Referring to the foregoing, since the TPM service module, TPM cryptographic module, TCM service module, and TCM cryptographic module can all independently respond to security service requests in some cases, the security architecture system of the above structure can respond to different types of security service requests.

[0084] In order to facilitate the distinction between various situations, the embodiment of the present application first classifies the security service requests that the above-mentioned security architecture system can respond to, specifically classifying them into first-class TCM security service requests, second-class TCM security service requests, first-class TPM security service requests and second-class TPM security service requests.

[0085] Among them, the first type of TCM security service request is a security service request corresponding to the TCM cryptographic module, specifically a security service request that can only be responded to with the help of the trusted computing resources provided by the TCM cryptographic module. In actual situations, the first type of TCM security service request can be sent directly to the TCM cryptographic module, which will respond directly to it, or it can be sent to the TCM service module, which will respond by calling the computing resources of the TCM cryptographic module.

[0086] The second type of TCM security service request is a security service request corresponding to the TCM service module, specifically a security service request that can be independently responded to by the TCM service module.

[0087] The first type of TPM security service request is a security service request corresponding to the TPM cryptographic module, specifically a security service request that can only be responded to with the help of the trusted computing resources provided by the TPM cryptographic module. In actual situations, the first type of TPM security service request can be sent directly to the TPM cryptographic module, which will respond directly to it, or it can be sent to the TPM service module, which will respond by calling the computing resources of the TPM cryptographic module.

[0088] The second type of TPM security service request is a security service request corresponding to the TPM service module, specifically a security service request that can be independently responded to by the TPM service module.

[0089] In the actual working process, ordinary applications in REE and / or trusted applications in TEE may issue any of the above-mentioned types of security service requests. The trusted computing service support platform can first identify the type of security service request obtained, and then select the corresponding security service module from the TCM service module, TCM cryptographic module, TPM service module and TPM cryptographic module to respond to the security service request. This may involve the design of processing such as the service module calling the cryptographic module and forwarding the security service request. The specific process will be introduced in the subsequent embodiments.

[0090] In some cases, in order to adapt to the computing device type or certain application scenarios, the TCM cryptographic module and TCM service module included in the TCM may be set in different subsystems, and the TPM cryptographic module and TPM service module included in the TPM may be set in different subsystems. At the same time, TPCM can also be flexibly set in TEE or SE.

[0091] Specifically, in some embodiments, a security architecture system is composed of a common execution environment subsystem REE, a trusted execution environment subsystem TEE and a security element subsystem SE, and a trusted computing service support platform is constructed in subsystems other than the REE, and the trusted computing service support platform includes a trusted cryptographic module TCM, a trusted platform module TPM and a trusted platform control module TPCM; the TCM includes a TCM service module and a TCM cryptographic module, and the TPM includes a TPM service module and a TPM cryptographic module; the TCM cryptographic module and the TCM service module run in different subsystems other than the REE, and / or the TPM cryptographic module and the TPM service module run in different subsystems other than the REE.

[0092] TPCM can be set in TEE or SE.

[0093] The trusted computing service support platform in the above security architecture system is configured to: when the active security measurement function is triggered, use the TPCM to perform security measurement on the target object to obtain a security measurement result; or, in response to a security service request, use the TCM and / or the TPM to provide security measurement services for the target object to obtain a security measurement result;

[0094] The target object includes a running object in the REE and / or the TEE, and the security measurement result indicates the trustworthiness of the target object.

[0095] That is, the trusted computing service support platform in the above security architecture system can execute the following security measurement method: when the active security measurement function is triggered, the TPCM is used to perform security measurement on the target object to obtain a security measurement result; or, in response to a security service request, the TCM and / or the TPM is used to provide a security measurement service for the target object to obtain a security measurement result;

[0096] The target object includes a running object in the REE and / or the TEE, and the security measurement result indicates the trustworthiness of the target object.

[0097] The security measurement method applied to the security architecture system proposed in the embodiment of the present application is equipped with a common execution environment subsystem REE and a trusted execution environment subsystem TEE. The trusted execution environment subsystem TEE includes a trusted cryptographic module TCM, a trusted platform module TPM and a trusted platform control module TPCM. Based on the above settings, the security architecture system can use TPCM to perform security measurement on the target object when the active security measurement function is triggered to obtain a security measurement result, or, in response to a security service request, provide security measurement services to the target object through TCM and / or TPM to obtain a security measurement result. This solution can realize the security measurement of the running objects in the processor architecture system, so that the security of the running objects can be clarified in time and dangerous running objects can be identified, which is conducive to ensuring the security of the processor architecture system.

[0098] Furthermore, the embodiment of the present application integrates a trusted cryptographic module TCM, a trusted platform module TPM and a trusted platform control module TPCM in the processor architecture system, thereby being able to provide passive security measurement services based on TCM and / or TPM and active security measurement services based on TPCM, which can meet the security measurement requirements of different applications or different users and improve the versatility of the processor architecture system.

[0099] Furthermore, in the present embodiment, the cryptographic modules (TCM cryptographic modules and TPM cryptographic modules) for providing trusted computing resources and the service modules (TPM service modules and TCM service modules) for calling the cryptographic modules are arranged in different subsystems. On the basis of providing security services for the target objects, the security isolation characteristics between different subsystems can be utilized to improve the isolation characteristics between the cryptographic modules and the service modules, thereby ensuring the security of the security architecture system.

[0100] In general, the deployment of TPM service module, TPM cryptographic module, TCM service module, TCM cryptographic module and TPCM in TEE and SE can be divided into two aspects: on the one hand, the deployment of TPM service module, TPM cryptographic module, TCM service module and TCM cryptographic module in TEE and SE; on the other hand, the deployment of TPCM in TEE or SE.

[0101] Among them, deploying TPCM in TEE or SE does not affect the functions and working methods of TPM service module, TPM cryptographic module, TCM service module and TCM cryptographic module; moreover, the deployment of TPM service module, TPM cryptographic module, TCM service module and TCM cryptographic module in TEE and SE does not affect the functions and working methods of TPCM.

[0102] On the basis of various security architecture system structures obtained by distributing the TCM service module, TCM cryptographic module, TPM service module and TPM cryptographic module in TEE and SE, TPCM is further set in the TEE or SE of the security architecture system, that is, the specific structures of various security architecture systems obtained by distributing the TPM service module, TPM cryptographic module, TCM service module, TCM cryptographic module and TPCM in TEE and SE are obtained.

[0103] As a preferred implementation, the TPM cryptographic module and the TCM cryptographic module can be set in the same subsystem, that is, they can be set together in TEE or SE. Other modules, such as TPCM, TPM service module and TCM service module, can be arbitrarily distributed in TEE and SE. For example, TPCM can be set in TEE or SE, and TPM service module and TCM service module can be set in TEE or SE or in TEE and SE. The specific structure of the security architecture system obtained by these specific settings will not be illustrated one by one.

[0104] For example, in Figure 2 The TCM cryptographic module and the TPM cryptographic module are set in the SE of the three-level processor architecture system shown in the figure, and the TCM service module, the TPM service module and the TPCM are set in the TEE, so as to obtain the following Figure 3The security architecture system shown in Figure 2 The TCM cryptographic module, the TPM cryptographic module and the TPCM are set in the SE of the three-level processor architecture system shown in the figure, and the TCM service module and the TPM service module are set in the TEE, so as to obtain the following Figure 4 The security architecture system shown.

[0105] exist Figure 3 and Figure 4 In the security architecture system shown, the layout of the TCM service module, TCM cryptographic module, TPM service module and TPM cryptographic module, as well as the functions that can be achieved and the specific processes of the security measurement methods executed under different layouts are not affected by the layout and functions of the TPCM; similarly, when the TPCM is set in the TEE or SE, its functions and the specific processes of the implemented security measurement methods are not affected by the layout of the TCM service module, TCM cryptographic module, TPM service module and TPM cryptographic module.

[0106] Therefore, for the sake of simplicity, in the subsequent embodiments, the main focus is on the situations where the TCM service module, TCM cryptographic module, TPM service module and TPM cryptographic module are dispersedly set in TEE and SE, as well as the security measurement functions and security measurement methods that can be implemented in these situations. In each of these introductions, combined with the setting of TPCM in TEE or SE, and the active security measurement functions and active security measurement methods implemented by TPCM, the specific structures of various security architecture systems obtained by "distributing TPM service module, TPM cryptographic module, TCM service module, TCM cryptographic module and TPCM in TEE and SE" can be obtained. Similarly, the security measurement methods compatible with active security measurement and passive security measurement implemented under these system structures can be clearly defined.

[0107] Regarding the active security measurement function and active security measurement method implemented by the above-mentioned security architecture system, specifically, when the system is powered on, TPCM actively measures and verifies the security of the firmware, or during the operation of the system, TPCM is periodically started at a certain frequency to perform active security measurement on the application and record the security measurement results.

[0108] In practical applications, the trigger mechanism of the active safety measurement function can be flexibly set, for example, it can be set to event triggering, periodic triggering, specific working state triggering, etc.

[0109] Since the implementation method of active security measurement is not affected by passive security measurement, when introducing the security measurement functions and security measurement methods of the trusted computing service support platform in security architecture systems with different structures in the following text, the active security measurement part will no longer be specifically introduced, but various forms of passive security measurement parts will be specifically introduced.

[0110] Since the processor architecture system proposed in the embodiment of the present application includes TCM, TPM and TPCM, during the operation of the system, the active security measurement function may be triggered and a security service request may be received at the same time. In this case, different processing mechanisms can be designed.

[0111] Specifically, security metric priorities may be set in advance for TPCM, TCM, and TPM, and security metric priority information of TPCM, TCM, and TPM may be stored in the security architecture system.

[0112] When the active security measurement function is triggered and a security service request is received at the same time, a security measurement method is determined according to the security measurement priority information of TPCM, TCM and TPM. The security measurement method specifically includes using the TPCM to perform security measurement on the target object to obtain a security measurement result, and, in response to the received security service request, using the TCM and / or the TPM to provide security measurement services for the target object to obtain one or more security measurement methods in the security measurement result.

[0113] That is, by querying the preset security measurement mode priority, it is determined to use TPCM to perform security measurement on the target object to obtain a security measurement result; and / or, in response to the received security service request, TCM and / or TPM are used to provide security measurement services for the target object to obtain a security measurement result. That is, it is determined to perform active security measurement and / or passive security measurement. When performing passive security measurement, TCM and / or TPM can be used to perform security measurement.

[0114] or,

[0115] When the active security measurement function is triggered and a security service request is received at the same time, active security measurement and passive security measurement are performed simultaneously, that is, TPCM is used to perform security measurement on the target object at the same time to obtain a security measurement result, and, in response to the received security service request, TCM and / or TPM are used to provide security measurement services for the target object to obtain a security measurement result.

[0116] In practical applications, a security metric priority may be set for the security architecture system, for example, setting the priority of active security metric higher than that of passive security metric, or setting the priority of passive security metric higher than that of active security metric.

[0117] In the case where the priority of active security measurement is set higher than that of passive security measurement, if the active security measurement function is triggered and a security service request is received at the same time, the active security measurement method is preferred at this time, that is, the TPCM is used to perform security measurement on the target object to obtain the security measurement result. Then, the security service request can be responded to, and the TCM and / or TPM can be used to provide security measurement services for the target object to obtain the security measurement result.

[0118] In the case where the priority of passive security measurement is set higher than that of active security measurement, if the active security measurement function is triggered and a security service request is received at the same time, the passive security measurement mode is preferentially selected at this time, that is, in response to the received security service request, the TCM and / or TPM is used to provide security measurement services for the target object to obtain a security measurement result. Then, the TPCM can be used to perform security measurement on the target object to obtain a security measurement result.

[0119] Alternatively, the priorities of active security measurement and passive security measurement may not be distinguished. When the active security measurement function is triggered and a security service request is received at the same time, security measurement is performed from two aspects at the same time, that is, security measurement is performed on the target object using TPCM to obtain a security measurement result, and, in response to the received security service request, security measurement services are provided to the target object using TCM and / or TPM to obtain a security measurement result.

[0120] Figure 3 and Figure 4 The trusted computing service support platform in the security architecture system shown uses the TCM and / or the TPM to provide security measurement services for the target object, which is divided into the following situations: using TCM to provide security measurement services for the target object, using TPM to provide security measurement services for the target object, and using TCM and TPM to provide security measurement services for the target object.

[0121] refer to Figure 3 and Figure 4 In order to accurately match the requirements of security service requests, the security architecture system shown in the specification subdivides the security service requests into TCM security service requests and TPM security service requests in one embodiment of the specification, so that the trusted computing service support platform can respond in a targeted manner. Specifically, the trusted computing service support platform uses the TCM and / or the TPM to provide security measurement services for the target object, which are specifically used for:

[0122] A security service module corresponding to the security service request is selected to provide a security measurement service for the target object.

[0123] The security service module includes the TCM and / or the TPM, the security service request includes a TCM security service request and / or a TPM security service request, the TCM security service request corresponds to the TCM, and the TPM security service request corresponds to the TPM.

[0124] In this embodiment, when certain applications (trusted applications or common applications) support the TPM or TCM standard, a corresponding TCM security service request or TPM security service request may be initiated to request the corresponding security service module to provide security services.

[0125] In some implementations, there may be some applications that support both TPM and TPM standards, and in some application scenarios, it is necessary to call both TPM and TCM to provide security services. In this case, when the security service request includes both the TCM security service request and the TPM security service request, the trusted computing service support platform uses the TCM and the TPM to provide security services for the target object, specifically for: responding to the TCM security service request, using the TCM to provide security services to obtain a first security measurement result, responding to the TPM security service request, using the TPM to provide security services to obtain a second security measurement result, and using the first security measurement result and the second security measurement result as the security measurement result.

[0126] In this way, the security service requirements of applications supporting both the TPM standard and the TCM standard can be met, thereby improving the applicability of the security service system.

[0127] In some implementations, after receiving a security service request, the service module will call the cryptographic module to execute the cryptographic algorithm according to the security service request to complete the security measurement service. However, in some implementations, in order to improve response efficiency, for certain security service requests, the service module may also directly respond and provide security measurement services.

[0128] Specifically, in some embodiments, the TCM service module is further used to directly respond to the security service request and provide a security measurement service for the target object.

[0129] The TPM service module is further configured to directly respond to the security service request and provide a security measurement service for the target object.

[0130] The trusted computing service support platform uses the TCM and / or the TPM to provide security services for the target object, specifically for:

[0131] A security service module corresponding to the security service request is selected to provide a security measurement service for the target object.

[0132] The security service module includes at least one of the TCM cryptographic module, the TCM service module, the TPM cryptographic module and the TPM service module, and the security service request includes at least one of a first type TCM security service request, a second type TCM security service request, a first type TPM security service request and a second type TPM security service request.

[0133] The first type of TCM security service request corresponds to the TCM cryptographic module, the second type of TCM security service request corresponds to the TCM service module, the first type of TPM security service request corresponds to the TPM cryptographic module, and the second type of TPM security service request corresponds to the TPM service module.

[0134] In this embodiment, TCM security service requests are subdivided into first-category TCM security service requests and second-category TCM security service requests, wherein first-category TCM security service requests (such as requests to measure the security of a target object) are requests that require calling a cryptographic algorithm in a TCM cryptographic module for a response, and such requests correspond to the TCM cryptographic module.

[0135] The second type of TCM security service request is a request that the TCM service module can directly respond to without calling the TCM cryptographic module. This type of request corresponds to the TCM service module.

[0136] Similarly, TPM security service requests are subdivided into first-class TPM security service requests and second-class TPM security service requests, where first-class TPM security service requests (such as requests to measure the security of a target object) are requests that require calling a cryptographic algorithm in a TPM cryptographic module for a response, and this type of request corresponds to a TPM cryptographic module.

[0137] The second type of TPM security service request is a request that the TPM service module can directly respond to without calling the TPM cryptographic module. This type of request corresponds to the TPM service module.

[0138] In this embodiment, by subdividing the types of security service requests, different types of security service requests are respectively matched with cryptographic modules and service modules, thereby increasing the response rate of the security architecture system to security service requests and improving the execution efficiency of the security architecture system.

[0139] In some embodiments, service proxy modules of TCM and TPM are also designed in the security architecture system: TCM driver module and TPM driver module, to meet the needs of applications to safely initiate security service requests. Specifically, the target objects include trusted applications and ordinary applications, the TEE runs the trusted applications, the REE runs the ordinary applications, and the security service requests include: TCM security service requests and / or TPM security service requests.

[0140] The TCM further includes a TCM driver module, and the TPM further includes a TPM driver module.

[0141] The TCM driver module is used to respond to the TCM service initiation request of the common application or the trusted application and initiate the TCM security service request.

[0142] The TPM driver module is used to respond to the TPM service initiation request of the common application or the trusted application and initiate the TPM security service request.

[0143] The TCM driver module is part of the TCM. The TCM driver module can be built in REE and / or TEE to meet the needs of ordinary applications or trusted applications to initiate TCM security service requests through the TCM driver module. A TCM service initiation request refers to a request initiated to the TCM driver module to request TCM to provide security services when ordinary applications or trusted applications need to request TCM to provide security services in certain scenarios to meet the service requirements of the scenario. When the TCM driver module receives the TCM service initiation request, it responds to the TCM service initiation request and initiates a TCM security service request to TCM.

[0144] Similarly, the TPM driver module is part of the TPM. The TPM driver module can be built in the REE and / or TEE to meet the needs of ordinary applications or trusted applications to initiate TPM security service requests through the TPM driver module. A TPM service initiation request refers to a request initiated to the TPM driver module to request TPM to provide security services when an ordinary application CA or a trusted application TA needs to request TPM to provide security services in certain scenarios to meet the service requirements of the scenario. When receiving the TPM service initiation request, the TPM driver module responds to the TPM service initiation request and initiates a TPM security service request to the TPM.

[0145] The TCM driver module and the TPM driver module can be built in REE at the same time, can be built in TEE at the same time, or can be built in the same subsystem at different times. Figure 5(a) to Figure 5(i) The various configuration modes of the TCM driver module and the TPM driver module in REE and TEE shown in FIG. 1 can be applied to a processor architecture system, for example, Figure 3 In the security architecture system shown, various different types of three-level security architecture systems are obtained.

[0146] The different configuration methods of the TCM driver module and the TPM driver module in REE and TEE will result in differences in the security measurement method of the entire security architecture system, or the specific execution process of the implemented security measurement method.

[0147] Below Figure 3 Taking the security architecture system shown in the figure as an example, they are introduced respectively in combination with the accompanying drawings.

[0148] refer to Figure 6 and Figure 7 , the TCM driver module and the TPM driver module are built in the REE.

[0149] The security service request includes at least one of a first type of TCM security service request directly initiated by the common application to the TCM cryptographic module through the TCM driver module, a first type of TPM security service request directly initiated by the common application to the TPM cryptographic module through the TPM driver module, a second type of TCM security service request initiated by the common application to the TCM service module through the TCM driver module, a second type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module, a first type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module, and a first type of TPM security service request initiated by the common application to the TCM service module through the TCM driver module.

[0150] Figure 6 The initiation and transmission paths of the first type of TCM security service request and the first type of TPM security service request are shown. Taking the first type of TCM security service request as an example, the ordinary application CA initiates a TCM service initiation request to the TCM driver module, and the TCM driver module responds to the TCM service initiation request, generates a first type of TCM security service request and transmits it to the TCM service module or directly to the TCM cryptographic module. If the TCM service module receives the first type of TCM security service request, it forwards it to the TCM cryptographic module. The TCM cryptographic module responds to the first type of TCM security service request forwarded by the TCM service module and returns the security measurement result to the TCM service module. The TCM service module receives the returned security measurement result and returns it to the TCM cryptographic module. If the TCM cryptographic module receives the first type of security service request directly sent by the TCM driver module, it directly returns the security measurement result obtained in response to the TCM driver module.

[0151] Similarly, for the first type of TPM security service request, the general application CA initiates a TPM service initiation request to the TPM driver module, the TPM driver module responds to the TPM service initiation request, generates a first type of TPM security service request and transmits it to the TPM service module or directly to the TPM password module. If the TPM service module receives the first type of TPM security service request, it forwards it to the TPM password module. The TPM password module responds to the first type of TPM security service request forwarded by the TPM service module and returns the security measurement result to the TPM service module. The TPM service module receives the returned security measurement result and returns it to the TPM password module. If the TPM password module receives the first type of security service request sent directly by the TPM driver module, it directly returns the security measurement result obtained in response to the TPM driver module.

[0152] Figure 7 The initiation and transmission path of the second type of TCM security service request and the second type of TPM security service request are shown. For the second type of TCM security service request, the ordinary application CA initiates a TCM service initiation request to the TCM driver module, and the TCM driver module responds to the TCM service initiation request and sends the second type of TCM security service request to the TCM service module. The TCM service module directly responds to the second type of TCM security service request and returns the security measurement result to the TCM driver module.

[0153] Similarly, for the second type of TPM security service request, the ordinary application CA initiates a TPM service initiation request to the TPM driver module. The TPM driver module responds to the TPM service initiation request by sending the second type of TPM security service request to the TPM service module. The TPM service module directly responds to the second type of TPM security service request and returns the security measurement result to the TPM driver module.

[0154] exist Figure 7 The situation shown can quickly respond to the security service needs of common applications and improve the execution efficiency of the security architecture system.

[0155] exist Figure 6 In the two cases shown, the transmission path of the first type of TCM / TPM security service request forwarded to the TCM cryptographic module via the TCM / TPM service module has the characteristics of high security. The transmission path of the first type of TCM / TPM security service request directly transmitted to the TCM / TPM cryptographic module has the characteristics of high execution efficiency. The TCM / TPM driver module can select the corresponding transmission path according to the type of TCM / TPM service initiation request to achieve a balance between security and execution efficiency.

[0156] exist Figure 6 and Figure 7In the scenario shown, the location of the TCM cryptographic module, TCM service module, TPM cryptographic module, and TPM service module does not affect the request call and delivery process. Similarly, the location of the TPCM in the TEE or SE does not affect the request call and delivery process. Figure 6 and Figure 7 The location of the above modules is not shown. Figure 6 and Figure 7 The security measurement function and security measurement method represented by the security measurement process shown are not only applicable to Figure 3 and Figure 4 The security architecture system shown is actually applicable to the security architecture system constituted in various situations where the TCM cryptographic module, TCM service module, TPM cryptographic module, TPM service module and TPCM are distributed or centrally set in TEE and SE.

[0157] In some embodiments, Figure 8 and Fig. 9 As shown, the TCM driver module and the TPM driver module are built in the TEE.

[0158] The security service request includes at least one of a first type of TCM security service request directly initiated by the trusted application to the TCM cryptographic module through the TCM driver module, the first type of TCM security service request or the second type of TCM security service request initiated by the trusted application to the TCM service module through the TCM driver module, a first type of TPM security service request directly initiated by the trusted application to the TPM cryptographic module through the TCM driver module, and the first type of TPM security service request or the second type of TPM security service request initiated by the trusted application to the TPM service module through the TPM driver module.

[0159] Figure 8 and Fig. 9 In the embodiment shown, the TCM driver module and the TPM driver module are both set in the TEE. If the ordinary application CA wants to initiate a TCM / TPM service initiation request, it needs to first initiate a trusted application request to the trusted application TA in the TEE. The trusted application TA responds to the trusted application request. When it needs to request TCM / TPM to provide security services, it initiates a TCM / TPM service initiation request to the TCM / TPM driver module. The subsequent first-class TCM / TPM security service request and the second-class TCM / TPM security service request transmission process are the same as Figure 6 and Figure 7 Similar to the description of Figure 6 and Figure 7 The relevant part description.

[0160] In some optional embodiments, reference Fig.10 , the TCM driver module and the TPM driver module are also built in the REE.

[0161] The security service request also includes: a first type of TCM security service request directly initiated by the common application to the TCM cryptographic module through the TCM driver module in the REE, the first type of TCM security service request or the second type of TCM security service request initiated by the common application to the TCM service module through the TCM driver module in the REE, a first type of TPM security service request directly initiated by the common application to the TPM cryptographic module through the TPM driver module in the REE, and at least one of the first type of TPM security service request or the second type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module in the REE.

[0162] Fig.10 In the security architecture system shown, TCM driver modules and TPM driver modules are set in both REE and TEE, so that ordinary application CA can initiate corresponding security service requests through multiple paths, satisfying the path diversity of ordinary application CA initiating security service requests and improving the applicability of the security architecture system.

[0163] Specifically, the general application CA can initiate a security service request through the TCM / TPM driver module in REE, or send a trusted application request to the trusted application TA in TEE, and the trusted application TA will initiate a security service request to the TCM / TPM driver module in TEE. The transmission process after the security service request is initiated by the TCM / TPM driver module can be referred to Figure 6 to Figure 9 Related description.

[0164] In some embodiments, reference Fig.11 , the TCM driver module is built in the REE, and the TPM driver module is built in the TEE.

[0165] The security service request includes at least one of a first type of TPM security service request directly initiated by the trusted application to the TPM cryptographic module through the TPM driver module in the TEE, a first type of TPM security service request or a second type of TPM security service request initiated by the trusted application to the TPM service module through the TPM driver module in the TEE, a first type of TCM security service request directly initiated by the common application to the TCM cryptographic module through the TCM driver module, and a first type of TCM security service request or a second type of TCM security service request initiated by the common application to the TCM service module through the TCM driver module.

[0166] exist Fig.11 In the illustrated embodiment, the initiation, response and delivery paths of various security service requests may refer to the relevant descriptions above.

[0167] In this embodiment, the TCM driver module is set in the REE, and the TPM driver module is set in the TEE. The ordinary application CA in the REE can use the TCM driver module to initiate a TCM security service request, and can enable the trusted application TA to initiate a TPM security service request through the TPM driver module by requesting a trusted application request in the TEE. The security architecture system provided by this embodiment can meet the needs of ordinary applications CA to directly initiate TCM security service requests to TCM through the TCM driver module, and can also meet the needs of ordinary applications CA to initiate TCM security service requests through the TCM driver module and forward them through the TEE, taking into account the security and execution efficiency of ordinary applications initiating TCM security service requests in different scenarios, and improving the applicability of the system.

[0168] Optionally, refer to Fig.12 , the TCM driver module is also built in the TEE, and the security service request also includes: at least one of a first type of TCM security service request directly initiated by the trusted application to the TCM cryptographic module through the TCM driver module in the TEE, a first type of TCM security service request or a second type of TCM security service request initiated by the trusted application to the TCM service module through the TCM driver module in the TEE;

[0169] or

[0170] refer to Fig.13, the TPM driver module is also constructed in the REE, and the security service request also includes: at least one of a first type of TPM security service request directly initiated by the common application to the TPM cryptographic module through the TPM driver module located in the REE, a first type of TPM security service request or a second type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module located in the REE.

[0171] exist Fig.12 In the present invention, the TCM driver module is set in REE and TEE to meet the needs of ordinary application CA and trusted application TA to initiate various security service requests for TCM. That is, the security architecture system can meet the needs of ordinary application CA to directly initiate TCM security service requests to TCM through the TCM driver module, and can also meet the needs of ordinary application CA to initiate TCM security service requests through the TCM driver module and forward them through TEE. It takes into account the security and execution efficiency of ordinary applications initiating TCM security service requests in different scenarios, and improves the applicability of the system.

[0172] exist Fig.13 In the example, the TPM driver module is set in REE and TEE to meet the needs of ordinary applications CA and trusted applications TA to initiate various security service requests for TPM. Similarly, this security architecture system can meet the needs of ordinary applications CA to directly initiate TPM security service requests to TPM through the TPM driver module, and can also meet the needs of ordinary applications CA to initiate TPM security service requests through the TPM driver module and forward them through TEE, taking into account the security and execution efficiency of ordinary applications initiating TPM security service requests in different scenarios, and improving the applicability of the system.

[0173] exist Figure 12-13 In the illustrated embodiment, the initiation, response and delivery paths of various security service requests may refer to the relevant descriptions above.

[0174] Optionally, refer to Fig.14 , the TCM driver module is constructed in the TEE, and the TPM driver module is constructed in the REE;

[0175] The security service request includes at least one of a first type of TCM security service request directly initiated by the trusted application to the TCM cryptographic module through the TCM driver module in the TEE, a first type of TCM security service request or a second type of TCM security service request initiated by the trusted application to the TCM service module through the TCM driver module in the TEE, a first type of TPM security service request directly initiated by the common application to the TPM cryptographic module through the TPM driver module, and a first type of TPM security service request or a second type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module.

[0176] exist Fig.14 In the illustrated embodiment, the initiation, response and delivery paths of various security service requests may refer to the relevant descriptions above.

[0177] In this embodiment, the TPM driver module is set in the REE, and the TCM driver module is set in the TEE. The ordinary application CA in the REE can use the TPM driver module to initiate a TPM security service request, and can request a trusted application request in the TEE to enable the trusted application TA to initiate a TCM security service request through the TCM driver module. The security architecture system provided by this embodiment can meet the needs of ordinary applications CA to directly initiate TPM security service requests to TPM through the TPM driver module, and can also meet the needs of ordinary applications CA to initiate TPM security service requests through the TPM driver module and forward them through TEE, taking into account the security and execution efficiency of ordinary applications initiating TPM security service requests in different scenarios, and improving the applicability of the system.

[0178] Optionally, refer to Fig.13 , the TCM driver module is also constructed in the REE, and the security service request further includes: at least one of: a first type of TCM security service request directly initiated by the common application to the TCM cryptographic module through the TCM driver module located in the REE, a first type of TCM security service request or a second type of TCM security service request initiated by the common application to the TCM service module through the TCM driver module located in the REE;

[0179] or

[0180] refer to Fig.12, the TPM driver module is also built in the TEE, and the security service request also includes: at least one of a first type of TPM security service request directly initiated by the trusted application to the TPM cryptographic module through the TPM driver module in the TEE, a first type of TPM security service request or a second type of TPM security service request initiated by the trusted application to the TPM service module through the TPM driver module in the TEE.

[0181] As some supplementary embodiments, in the processing of various security measurement methods introduced in the above-mentioned various embodiments and / or in the security architecture system, the trusted application in the TEE can also respond to the call of the ordinary application in the REE and issue a corresponding service request to the TCM and / or TPM.

[0182] The common application in REE calls a trusted application TA in TEE, for example, the common application in REE sends a trusted application request to the trusted application TA in SE. The trusted application TA runs in response to the call of the common application, and requires the trusted computing support of TCM and / or TPM during operation. Therefore, the trusted application TA sends a security service request to TCM and / or TPM through the TCM driver module and / or TPM driver module in TEE. TCM and / or TPM respond to the security service request sent by the trusted application TA, provide security measurement services for the target object, and obtain security measurement results.

[0183] For example, when a shopping application running in REE needs to call a payment application in TEE to complete payment, the shopping application sends a payment application request to the payment application. When the payment application receives the call from the shopping application, it finds that it needs to perform a security measurement of the payment environment first. The payment application then sends a security service request to the TCM and / or TPM. The TCM and / or TPM responds to the request to complete the security measurement of the payment environment and feeds back the measurement results to the payment application. When the payment application confirms that the payment environment is secure, it responds to the call from the shopping application and performs the payment operation.

[0184] The above working mode is particularly suitable for the scenario where there is no TCM driver module and / or TPM driver module in REE, but only TCM driver module and / or TPM driver module are set in TEE. At this time, if the ordinary application in REE wants to request security services, it cannot directly request security services because there is no TCM driver module and / or TPM driver module in REE. However, the ordinary application in REE can call the trusted application in TEE, indirectly request security services through the trusted application, and obtain security measurement results. The trusted application can then feed back the security measurement results to the ordinary application in REE.

[0185] For example, there is no TCM driver module configured in REE, but a TCM driver module is configured in TEE. However, ordinary applications in REE need to request TCM security services to implement certain functions. At this time, ordinary applications in REE can first initiate a trusted application TA to TEE, that is, call the trusted application TA. When the trusted application TA responds to the call of the ordinary application and runs, it sends a TCM service initiation request to the TCM driver module of TEE, so that the TCM driver module sends a TCM security service request to TCM, thereby realizing the TCM security measurement function.

[0186] Based on the above-mentioned embodiments, whether in a two-level security architecture system composed of REE and TEE, or in a three-level security architecture system composed of REE, TEE and SE, the TCM driver module and the TPM driver module are either set in the REE or in the TEE. In some cases, the TCM driver module and the TPM driver module can provide some or all of the TCM services and TPM services, but the TCM driver module and the TPM driver module must be in a highly trusted execution environment before they can provide trusted computing services.

[0187] Based on the two-level security architecture system or the three-level security architecture system proposed in the above embodiments of the present application, the TEE uses software and hardware security architectures such as Trustzone, SGX (Software Guard Extensions) and other technologies, which can provide additional security protection for the execution environment for the entire TCM driver module and / or TPM driver module placed therein. Therefore, when specifically implementing the security architecture system proposed in the above embodiments of the present application, the processor core running the TEE can be virtualized as a security core. For example, when the TEE runs on the first processor core (at this time, the SE can run on the first processor core or the second processor core), the first processor core is virtualized as a security core.

[0188] For example, based on security technology (such as Trustzone or SGX, etc.), the first processor core is virtualized into a secure core and a non-secure core. Objects running on the secure core have the authority to access the resources of the entire first processor core, while objects running on the non-secure core have the authority to access the resources corresponding to the non-secure core.

[0189] On this basis, if the TCM driver module runs on the security core, when the TCM service initiation request received by the TCM driver module is a first type of TCM service initiation request, the TCM driver module directly responds to the TCM service initiation request and provides security measurement services for the target object. The first type of TCM service initiation request is specifically a type of service request that the TCM driver module can respond to.

[0190] Exemplarily, a list of service initiation requests that the TCM driver module can respond to locally is recorded in the TCM driver module. If the TCM service initiation request received by the TCM driver module is a service initiation request in the list, the TCM driver module responds to the service initiation request locally, otherwise a TCM security service request is sent to the TCM.

[0191] If the TPM driver module runs on the security core, when the TPM service initiation request received by the TPM driver module is a second type of service initiation request, the TPM driver module directly responds to the TPM service initiation request to provide security measurement services for the target object. The second type of TPM service initiation request is specifically a type of service request that the TPM driver module can respond to.

[0192] Exemplarily, a list of service initiation requests that the TPM driver module can respond to locally is recorded in the TPM driver module. If the TPM service initiation request received by the TPM driver module is a service initiation request in the list, the TPM driver module responds to the service initiation request locally, otherwise a TPM security service request is issued to the TPM.

[0193] In addition, the types of cryptographic algorithms required by TPM technology will change with the requirements of different security technologies, and the frequent replacement of TPM cryptographic module hardware will increase the cost of using TPM for encryption and decryption operations. Therefore, when designing or deploying TPM driver modules, you can add a mechanism to identify the type of cryptographic algorithm and the algorithm version number. If it is recognized that the TPM encryption and decryption algorithm requested in the TPM service initiation request is not in the configuration list, a preset encryption and decryption operation method will be used.

[0194] Similarly, when designing or deploying a TCM driver module, you can also add a mechanism to identify the type of cryptographic algorithm and the algorithm version number. If it is identified that the TCM encryption and decryption algorithm requested in the TCM service initiation request is not in the configuration list, a preset encryption and decryption operation method will be used.

[0195] Specifically, a first key table may be configured in the TPM driver module, and a second key table may be configured in the TCM driver module. The first key table includes a first key and a key type supported by the TPM, and the second key table includes a second key and a key type supported by the TCM.

[0196] When receiving a TPM service initiation request, the TPM driver module first determines the key type requested in the received TPM service initiation request. When the key type requested in the received TPM service initiation request is not in the first key table, the key type requested in the received TPM service initiation request is updated to the first key.

[0197] Similarly, when the TCM driver module receives a TCM service initiation request, it first determines the key type requested in the received TCM service initiation request. When the key type requested in the received TCM service initiation request is not in the second key table, the key type requested in the received TCM service initiation request is updated to the second key.

[0198] Among them, the above-mentioned first key and second key are the keys applicable to the above-mentioned "pre-set encryption and decryption operation method".

[0199] Finally, the security measurement methods proposed in the above embodiments of the present application are explained.

[0200] This application proposes a security measurement method, which can be applied to any of the above-mentioned security architecture systems including TCM, TPM and TPCM, and can be specifically executed by a trusted computing service support platform in any of the above-mentioned security architecture systems including TCM, TPM and TPCM. Fig.15 As shown, the method includes:

[0201] S201, when the active safety measurement function is triggered, using the TPCM to perform safety measurement on the target object to obtain a safety measurement result;

[0202] or,

[0203] S202, in response to the security service request, using the TCM and / or the TPM to provide a security measurement service for the target object, and obtaining a security measurement result;

[0204] The target object includes a running object in the REE and / or TEE in the above security architecture system, and the security measurement result represents the credibility of the target object.

[0205] The functions implemented by the various security architecture systems introduced in the above embodiments of the present application, as well as the security measurement methods implemented in the security architecture systems of various different structures, all belong to the same application concept, and the various security architecture systems introduced in the above embodiments can execute the security measurement methods provided in these embodiments, and have the corresponding functional modules and beneficial effects of the execution methods. Therefore, the specific contents of the security measurement methods implemented in the security architecture systems of various different structures and the security measurement functions implemented by the partial structures or platforms in the corresponding security architecture systems can be understood and executed with reference to each other, and the embodiments of the present application will no longer be described in detail one by one.

[0206] An embodiment of the present application also proposes a computer device, which includes the security architecture system proposed in any of the above embodiments.

[0207] Another embodiment of the present application also provides a computer device, see Fig.16 As shown, the device includes:

[0208] Memory 200 and processor 210;

[0209] The memory 200 is connected to the processor 210 and is used to store programs;

[0210] The processor 210 is used to implement the security measurement method disclosed in any of the above embodiments by running the program stored in the memory 200.

[0211] Specifically, the above-mentioned computer device may further include: a bus, a communication interface 220 , an input device 230 and an output device 240 .

[0212] The processor 210, the memory 200, the communication interface 220, the input device 230 and the output device 240 are connected to each other via a bus.

[0213] A bus may include a pathway that transfers information between components of a computer system.

[0214] The processor 210 may be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the scheme of the present invention. It may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0215] The processor 210 may include a main processor, and may also include a baseband chip, a modem, and the like.

[0216] The memory 200 stores a program for executing the technical solution of the present invention, and may also store an operating system and other key services. Specifically, the program may include a program code, and the program code includes a computer operation instruction. More specifically, the memory 200 may include a read-only memory (ROM), other types of static storage devices that can store static information and instructions, a random access memory (RAM), other types of dynamic storage devices that can store information and instructions, a disk storage, a flash, and the like.

[0217] The input device 230 may include a device for receiving data and information input by a user, such as a keyboard, a mouse, a camera, a scanner, a light pen, a voice input device, a touch screen, a pedometer, or a gravity sensor.

[0218] Output device 240 may include devices that allow information to be output to a user, such as a display screen, printer, speaker, etc.

[0219] The communication interface 220 may include any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, a radio access network (RAN), a wireless local area network (WLAN), etc.

[0220] The processor 210 executes the program stored in the memory 200 and calls other devices, which can be used to implement each step of any security measurement method provided in the above embodiments of the present application.

[0221] In addition to the above methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps in the security measurement method described in any of the above embodiments of this specification.

[0222] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0223] In addition, an embodiment of the present application may also be a storage medium on which a computer program is stored, and the computer program is executed by a processor to execute the steps of the security measurement method described in any of the above embodiments of this specification.

[0224] For the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0225] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0226] The steps in the methods of each embodiment of the present application can be adjusted in sequence, combined and deleted according to actual needs, and the technical features recorded in each embodiment can be replaced or combined.

[0227] The modules and sub-modules in the devices and terminals of the various embodiments of the present application can be combined, divided and deleted according to actual needs.

[0228] In the several embodiments provided in the present application, it should be understood that the disclosed terminals, devices and methods can be implemented in other ways. For example, the terminal embodiments described above are only schematic, for example, the division of modules or submodules is only a logical function division, and there may be other division methods in actual implementation, for example, multiple submodules or modules can be combined or integrated into another module, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0229] The modules or submodules described as separate components may or may not be physically separated, and the components of the modules or submodules may or may not be physical modules or submodules, that is, they may be located in one place, or they may be distributed on multiple network modules or submodules. Some or all of the modules or submodules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0230] In addition, each functional module or submodule in each embodiment of the present application may be integrated into one processing module, or each module or submodule may exist physically separately, or two or more modules or submodules may be integrated into one module. The above-mentioned integrated modules or submodules may be implemented in the form of hardware or in the form of software functional modules or submodules.

[0231] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0232] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly by hardware, software units executed by a processor, or a combination of the two. The software units may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0233] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0234] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A security measurement method, characterized in that: Applied to a security architecture system, the security architecture system includes a common execution environment subsystem REE, a trusted execution environment subsystem TEE and a security element subsystem SE, and a trusted computing service support platform is constructed in the subsystems other than the REE, the trusted computing service support platform includes a trusted cryptographic module TCM, a trusted platform module TPM and a trusted platform control module TPCM; The TCM includes a TCM service module and a TCM cryptographic module, and the TPM includes a TPM service module and a TPM cryptographic module; the TCM cryptographic module and the TCM service module are respectively run in different subsystems except the REE, and / or the TPM cryptographic module and the TPM service module are respectively run in different subsystems except the REE; The security architecture system stores security metric priority information corresponding to each of the TPCM, the TCM and the TPM; The method comprises: When the active security measurement function is triggered and a security service request is received at the same time, determining a security measurement mode according to security measurement priority information corresponding to each of the TPCM, the TCM and the TPM; The security measurement method includes one or more security measurement methods including using the TPCM to perform security measurement on the target object to obtain a security measurement result, and, in response to a received security service request, using the TCM and / or the TPM to provide a security measurement service for the target object to obtain a security measurement result; The target object includes a running object in the REE and / or the TEE, and the security measurement result indicates the trustworthiness of the target object.

2. The security measurement method according to claim 1, characterized in that: The TPM cryptographic module and the TCM cryptographic module run in the same subsystem.

3. The security measurement method according to claim 2, characterized in that: The TPCM, the TCM service module and the TPM service module run in the TEE, and the TCM cryptographic module and the TPM cryptographic module run in the SE.

4. The security measurement method according to any one of claims 1 to 3, characterized in that: The TEE and the SE run in a first processor core, or the TEE runs in the first processor core and the SE runs in a second processor core.

5. The security measurement method according to claim 1, characterized in that: The TCM service module is further used to directly respond to the security service request and provide security services for the target object; the TPM service module is further used to directly respond to the security service request and provide security services for the target object; In the case where the security measurement method includes providing a security measurement service for a target object by using the TCM and / or the TPM in response to a received security service request to obtain a security measurement result, the providing a security measurement service for a target object by using the TCM and / or the TPM in response to the received security service request includes: Selecting a security service module corresponding to the security service request to provide a security measurement service for the target object; The security service module includes at least one of the TCM cryptographic module, the TCM service module, the TPM cryptographic module and the TPM service module, and the security service request includes at least one of a first type of TCM security service request, a second type of TCM security service request, a first type of TPM security service request and a second type of TPM security service request; The first type of TCM security service request corresponds to the TCM cryptographic module, the second type of TCM security service request corresponds to the TCM service module, the first type of TPM security service request corresponds to the TPM cryptographic module, and the second type of TPM security service request corresponds to the TPM service module.

6. The security measurement method according to claim 1, characterized in that: The target object includes a trusted application and a common application, the common application is running in the REE, the trusted application is running in the TEE, and the security service request includes a TCM security service request and / or a TPM security service request; The TCM further includes a TCM driver module, and the TPM further includes a TPM driver module; The TCM driver module is used to respond to the TCM service initiation request of the common application or the trusted application and initiate the TCM security service request; The TPM driver module is used to respond to the TPM service initiation request of the common application or the trusted application and initiate the TPM security service request.

7. The security measurement method according to claim 6, characterized in that: The TCM security service request includes a first type of TCM security service request and / or a second type of TCM security service request, and the TPM security service request includes a first type of TPM security service request and / or a second type of TPM security service request; The TCM service module is further used to directly respond to the second type of TCM security service request and provide a security measurement service for the target object; The TPM service module is further configured to directly respond to the second type of TPM security service request and provide security measurement services for the target object.

8. The security measurement method according to claim 7, characterized in that: The TCM driver module is disposed in the REE and / or the TEE, and the TPM driver module is disposed in the REE and / or the TEE.

9. The security measurement method according to claim 8, characterized in that: In the case where the TCM driver module and the TPM driver module are provided in the REE, the security service request includes: at least one of the following: a first type of TCM security service request directly initiated by the common application to the TCM cryptographic module through the TCM driver module, a first type of TPM security service request directly initiated by the common application to the TPM cryptographic module through the TPM driver module, a first type of TCM security service request or a second type of TCM security service request initiated by the common application to the TCM service module through the TCM driver module, and a first type of TPM security service request or a second type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module.

10. The security measurement method according to claim 9, characterized in that: In the case where the TCM driver module and the TPM driver module are provided in the REE, and the TCM driver module and the TPM driver module are provided in the TEE, the security service request further includes: At least one of the following: a first type of TCM security service request directly initiated by the trusted application to the TCM cryptographic module through the TCM driver module in the TEE, a first type of TCM security service request or a second type of TCM security service request initiated by the trusted application to the TCM service module through the TCM driver module in the TEE, a first type of TPM security service request directly initiated by the trusted application to the TPM cryptographic module through the TPM driver module in the TEE, and the first type of TPM security service request or the second type of TPM security service request initiated by the trusted application to the TPM service module through the TPM driver module in the TEE.

11. The security measurement method according to claim 9, characterized in that: In the case where the TCM driver module and the TPM driver module are provided in the REE, and the TCM driver module is provided in the TEE, the security measurement service request further includes: At least one of the first type of TCM security service request directly initiated by the trusted application to the TCM cryptographic module through the TCM driver module in the TEE, the first type of TCM security service request or the second type of TCM security service request initiated by the trusted application to the TCM service module through the TCM driver module in the TEE.

12. The security measurement method according to claim 9, characterized in that: In the case where the TCM driver module and the TPM driver module are provided in the REE, and the TPM driver module is provided in the TEE, the security service request further includes: At least one of a first type of TPM security service request directly initiated by the trusted application to the TPM cryptographic module through the TPM driver module in the TEE, a first type of TPM security service request or a second type of TPM security service request initiated by the trusted application to the TPM service module through the TPM driver module in the TEE.

13. The security measurement method according to claim 8, characterized in that: In the case where the TCM driver module and the TPM driver module are provided in the TEE, the security service request includes: At least one of the following: a first type of TCM security service request directly initiated by the trusted application to the TCM cryptographic module through the TCM driver module, a first type of TCM security service request or a second type of TCM security service request initiated by the trusted application to the TCM service module through the TCM driver module, a first type of TPM security service request directly initiated by the trusted application to the TPM cryptographic module through the TPM driver module, and the first type of TPM security service request or the second type of TPM security service request initiated by the trusted application to the TPM service module through the TPM driver module.

14. The security measurement method according to claim 13, characterized in that: In the case where the TCM driver module and the TPM driver module are provided in the TEE, and the TCM driver module is provided in the REE, the security service request further includes: At least one of the first type of TCM security service request directly initiated by the common application to the TCM cryptographic module through the TCM driver module in the REE, the first type of TCM security service request or the second type of TCM security service request initiated by the common application to the TCM service module through the TCM driver module in the REE.

15. The security measurement method according to claim 13, characterized in that: In the case where the TCM driver module and the TPM driver module are provided in the TEE, and the TPM driver module is provided in the REE, the security measurement service request further includes: At least one of a first type of TPM security service request directly initiated by the common application to the TPM cryptographic module through the TPM driver module in the REE, a first type of TPM security service request or a second type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module in the REE.

16. The security measurement method according to claim 8, characterized in that: In the case where the TCM driver module is set in the REE and the TPM driver module is set in the TEE, the security service request includes: at least one of a first type of TPM security service request directly initiated by the trusted application to the TPM cryptographic module through the TPM driver module in the TEE, a first type of TPM security service request or a second type of TPM security service request initiated by the trusted application to the TPM service module through the TPM driver module in the TEE, a first type of TCM security service request directly initiated by the common application to the TCM cryptographic module through the TCM driver module in the REE, and a first type of TCM security service request or a second type of TCM security service request initiated by the common application to the TCM service module through the TCM driver module in the REE.

17. The security measurement method according to claim 8, characterized in that: In the case where the TPM driver module is set in the REE and the TCM driver module is set in the TEE, the security measurement service request includes: at least one of a first type of TCM security service request directly initiated by the trusted application to the TCM cryptographic module through the TCM driver module in the TEE, a first type of TCM security service request or a second type of TCM security service request initiated by the trusted application to the TCM service module through the TCM driver module in the TEE, a first type of TPM security service request directly initiated by the common application to the TPM cryptographic module through the TPM driver module in the REE, and a first type of TPM security service request or a second type of TPM security service request initiated by the common application to the TPM service module through the TPM driver module in the REE.

18. The security measurement method according to any one of claims 6 to 17, characterized in that: The TEE and the SE run in a first processor core, or the TEE runs in the first processor core and the SE runs in a second processor core; Virtualizing the first processor core as a security core; If the TCM driver module runs on the security core, the TCM driver module is further used to: directly respond to the TCM service initiation request when the TCM service initiation request is a first type service initiation request, and provide a security measurement service for the target object; If the TPM driver module runs on the security core, the TPM driver module is further used to: when the TPM service initiation request is a second type service initiation request, directly respond to the TPM service initiation request to provide a security measurement service for the target object.

19. The security measurement method according to any one of claims 6 to 17, characterized in that: The TPM driver module further includes a first key table, and the TCM driver module further includes a second key table, wherein the first key table includes a first key and a key type supported by the TPM, and the second key table includes a second key and a key type supported by the TCM; The TPM driver module is further used to determine the key type requested in the TPM service initiation request, and when the determined key type is not in the first key table, update the key type requested in the TPM service initiation request to the first key; The TCM driver module is also used to determine the key type requested in the TCM service initiation request, and when the determined key type is not in the second key table, update the key type requested in the TCM service initiation request to the second key.

20. The security measurement method according to claim 1, characterized in that: The security service request includes a TCM security service request and a TPM security service request. When the security measurement method includes providing a security measurement service for a target object by using the TCM and / or the TPM in response to a received security service request to obtain a security measurement result, providing a security measurement service for a target object by using the TCM and the TPM includes: In response to the TCM security service request, using the TCM to provide a security measurement service to obtain a first security measurement result; and, in response to the TPM security service request, providing a security measurement service using the TPM to obtain a second security measurement result; The first security metric result and the second security metric result are used as the security metric result.

21. A security architecture system, characterized in that: The security architecture system includes a common execution environment subsystem REE, a trusted execution environment subsystem TEE and a security element subsystem SE. A trusted computing service support platform is constructed in the subsystems other than the REE. The trusted computing service support platform includes a trusted cryptographic module TCM, a trusted platform module TPM and a trusted platform control module TPCM. The TCM includes a TCM service module and a TCM cryptographic module, and the TPM includes a TPM service module and a TPM cryptographic module; the TCM cryptographic module and the TCM service module are respectively run in different subsystems except the REE, and / or the TPM cryptographic module and the TPM service module are respectively run in different subsystems except the REE; The security architecture system stores security metric priority information corresponding to each of the TPCM, the TCM and the TPM; The trusted computing service support platform is configured to: determine a security measurement mode according to security measurement priority information corresponding to each of the TPCM, the TCM and the TPM when an active security measurement function is triggered and a security service request is received at the same time; The security measurement method includes one or more security measurement methods including using the TPCM to perform security measurement on the target object to obtain a security measurement result, and, in response to a received security service request, using the TCM and / or the TPM to provide a security measurement service for the target object to obtain a security measurement result; The target object includes a running object in the REE and / or the TEE, and the security measurement result indicates the trustworthiness of the target object.

22. A computer device, characterized in that: The computer device includes the security architecture system of claim 21.

Images