Computer trusted security implementation method supporting active measurement and passive measurement

Abstract

The invention discloses a computer trusted security implementation method supporting active measurement and passive measurement, and relates to the field of electronic information. A TCM chip, a CPU and an analog switch control circuit are set up on a mainboard of the universal desk computer, when a system is started, a path of SPI1 signal is output through the TCM chip, the SPI1 signal is switched to a system BIOS through the analog switch control circuit, the system BIOS is measured, whether measurement succeeds or not is judged, if yes, the SPI1 signal is switched to the CPU through the analog switch control circuit to access the BIOS, the system BIOS is measured through the CPU, and if not, the SPI1 signal is output through the analog switch control circuit. The method comprises the following steps: firstly, measuring a general desktop computer, judging whether the measurement is successful or not, if so, starting a system, otherwise, accessing a reset end of a CPU (Central Processing Unit) through a TCM chip to destroy data so as to prevent information of the general desktop computer from being stolen and tampered, and meanwhile, outputting an SPI2 signal through the TCM chip, directly connecting to the CPU, and performing static measurement and dynamic measurement by the CPU.

Description

Technical Field

[0001] The present invention discloses a computer trusted security implementation method supporting active measurement and passive measurement, and relates to the field of electronic information. Background Art

[0002] Domestic general-purpose desktop computers are rapidly developing, with increasingly diverse functions and performance. However, with the passage of time, the security requirements for domestic general-purpose computer terminal systems are also becoming increasingly stringent. This is particularly true in the field of trusted computing security. Most computers only have a single active or passive measurement function during startup, leaving domestic general-purpose desktop computers with a relatively incomplete level of trustworthiness and security. Summary of the Invention

[0003] In response to the problems of the prior art, the present invention provides a computer trusted security implementation method that supports active measurement and passive measurement. The method can be used for domestic general-purpose desktop computers with active measurement and passive measurement functions during the secure startup process, ensuring trusted and secure computing during the startup process and enriching the performance of the entire computer.

[0004] The specific scheme proposed by the present invention is:

[0005] The present invention provides a computer trusted security implementation method that supports active measurement and passive measurement. A TCM chip, a CPU and an analog switch control circuit are built on the motherboard of a general desktop computer.

[0006] When the system starts up, the TCM chip outputs an SPI1 signal, which is switched to the system BIOS through the analog switch control circuit. The system BIOS is measured and it is judged whether the measurement is successful. If it is successful, the analog switch control circuit switches to the CPU to access the BIOS. The CPU measures the system BIOS and judges whether the measurement is successful. If it is successful, the system is started. Otherwise, the TCM chip is connected to the reset terminal of the CPU to destroy the data, preventing the information of the general desktop computer from being stolen and tampered with.

[0007] At the same time, the SPI2 signal is output through the TCM chip and directly connected to the CPU, which performs static and dynamic measurements.

[0008] Furthermore, the computer trusted security implementation method supporting active measurement and passive measurement outputs an SPI1 signal through the TCM chip, switches to the system BIOS through the analog switch control circuit, and measures the system BIOS, including: accessing the BIOS flash chip through the TCM chip; reading the BIOS code stored in the BIOS flash chip, and performing corresponding checks on the code. If the checks are correct, the measurement is successful.

[0009] Furthermore, the computer trusted security implementation method supporting active measurement and passive measurement described in the method switches to CPU access to BIOS through an analog switch control circuit, and measures the system BIOS through the CPU, including: allowing the CPU to access the BIOS flash chip, reading the BIOS code stored in the BIOS flash chip, performing initialization operations, and implementing power-on self-test. If the self-test passes, the measurement is successful.

[0010] Furthermore, in the computer trusted security implementation method supporting active measurement and passive measurement, the CPU measures the system image itself when performing static measurement, and when the CPU performs dynamic measurement, the software started first by the system performs hierarchical measurement on the software started at the next level.

[0011] Furthermore, the analog switch control circuit in the computer trusted security implementation method supporting active measurement and passive measurement includes an IC_Switch chip, wherein the NC terminal of the IC_Switch chip is connected to the TCM chip, the NO terminal is connected to the CPU, and the COM terminal is connected to the BIOS. The IC_Switch chip also includes a control enable IN port.

[0012] Circuit control switching is performed through the IC_Switch chip: when the IN-end enable voltage is less than 0.5V, the NO-end and COM-end signals are connected, enabling the CPU to measure the BIOS; when the IN-end enable voltage is greater than 1.6V, the NC-end and COM-end signals are connected, enabling the TCM chip to measure the BIOS; in the default state, the NC-end and COM-end signals are connected.

[0013] The present invention provides a trusted and secure computer that supports active and passive measurement. The TCM chip, CPU and analog switch control circuit are built on the motherboard of a general desktop computer to become a trusted and secure computer.

[0014] When the trusted secure computer system is booted up, an SPI1 signal is outputted through the TCM chip, which is then switched to the system BIOS through the analog switch control circuit. The system BIOS is measured and a determination is made as to whether the measurement is successful. If so, the analog switch control circuit switches to the CPU to access the BIOS. The CPU measures the system BIOS and a determination is made as to whether the measurement is successful. If so, the system is started. Otherwise, the data is destroyed through the reset terminal of the CPU connected to the TCM chip, thus preventing the information of a general desktop computer from being stolen or tampered with.

[0015] At the same time, the SPI2 signal is output through the TCM chip and directly connected to the CPU, which performs static and dynamic measurements.

[0016] Furthermore, in the trusted secure computer supporting active measurement and passive measurement, an SPI1 signal is output through the TCM chip, which is switched to the system BIOS through the analog switch control circuit to measure the system BIOS, including: accessing the BIOS flash chip through the TCM chip; reading the BIOS code stored in the BIOS flash chip, and performing corresponding checks on the code. If the checks are correct, the measurement is successful.

[0017] Furthermore, in the trusted secure computer supporting active measurement and passive measurement, the analog switch control circuit is used to switch to the CPU to access the BIOS, and the system BIOS is measured by the CPU, including: allowing the CPU to access the BIOS flash chip, reading the BIOS code stored in the BIOS flash chip, performing initialization operations, and realizing power-on self-test. If the self-test passes, the measurement is successful.

[0018] Furthermore, in the trusted secure computer supporting active measurement and passive measurement, the CPU measures the system image itself when performing static measurement, and when the CPU performs dynamic measurement, the software started first by the system performs hierarchical measurement on the software started later.

[0019] Furthermore, the analog switch control circuit in the trusted secure computer supporting active measurement and passive measurement includes an IC_Switch chip, wherein the NC terminal of the IC_Switch chip is connected to the TCM chip, the NO terminal is connected to the CPU, and the COM terminal is connected to the BIOS. The IC_Switch chip also includes a control enable IN port.

[0020] Circuit control switching is performed through the IC_Switch chip: when the IN-end enable voltage is less than 0.5V, the NO-end and COM-end signals are connected, enabling the CPU to measure the BIOS; when the IN-end enable voltage is greater than 1.6V, the NC-end and COM-end signals are connected, enabling the TCM chip to measure the BIOS; in the default state, the NC-end and COM-end signals are connected.

[0021] The benefits of the present invention are:

[0022] The method of the present invention implements active and passive measurement functions by integrating a trusted module (TCM) chip with the motherboard. Using an analog switch control circuit, it implements a switching control circuit for accessing the CPU and BIOS under active measurement. This ensures safe self-checking and trusted measurement during the host and system startup process, as well as active defense during data processing. Furthermore, the trusted module (TCM) chip is directly connected to the CPU reset terminal, enabling the destruction of internal CPU data in the event of a measurement failure, protecting the network and device from information tampering or theft during attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a schematic diagram of a computer mainboard of the present invention.

[0024] Figure 2 It is a schematic flow chart of the method of the present invention.

[0025] Figure 3 It is a logic schematic diagram of the analog switch control circuit of the present invention. DETAILED DESCRIPTION

[0026] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention.

[0027] Example 1

[0028] The present invention provides a computer trusted security implementation method supporting active measurement and passive measurement, which builds a TCM chip, a CPU and an analog switch control circuit on the mainboard of a general desktop computer.

[0029] refer to Figure 1 The TCM chip uses CCM3310S, and the analog switch control circuit includes an IC_Switch chip. The NC terminal of the IC_Switch chip is connected to the TCM chip, the NO terminal is connected to the CPU, and the COM terminal is connected to the BIOS. The IC_Switch chip also includes a control enable IN port.

[0030] Circuit control switching is performed through the IC_Switch chip: when the IN-end enable voltage is less than 0.5V, the NO-end and COM-end signals are connected, enabling the CPU to measure the BIOS; when the IN-end enable voltage is greater than 1.6V, the NC-end and COM-end signals are connected, enabling the TCM chip to measure the BIOS; in the default state, the NC-end and COM-end signals are connected.

[0031] When the system starts up, the TCM chip outputs an SPI1 signal, which is switched to the system BIOS through the analog switch control circuit. The system BIOS is measured and whether the measurement is successful is determined. The BIOS flash chip is accessed through the TCM chip; the BIOS code stored in the BIOS flash chip is read and the code is checked accordingly. When the reset signal is continuously high, it means that the measurement is successful.

[0032] If the measurement is successful, the analog switch control circuit switches to the CPU to access the BIOS. The CPU measures the system BIOS and determines whether the measurement is successful. The CPU is allowed to access the BIOS flash chip, read the BIOS code stored in the BIOS flash chip, perform initialization operations, and implement power-on self-test. If the self-test passes, the measurement is successful.

[0033] If the measurement succeeds, the system boots up. Otherwise, the TCM chip connects to the CPU's reset pin to destroy the data, preventing information theft and tampering on a general-purpose desktop computer. If the measurement fails, the reset signal outputs a low level, indicating that the BIOS code has been tampered with. This can continuously issue warnings and prevent the computer from booting.

[0034] At the same time, the SPI2 signal is output through the TCM chip and directly connected to the CPU, which performs static and dynamic measurements. The CPU performs static measurement on the system image itself, while the CPU performs dynamic measurement on the software started first by the system and the software started later by the system.

[0035] Example 2

[0036] The present invention provides a trusted and secure computer that supports active and passive measurement. The TCM chip, CPU and analog switch control circuit are built on the motherboard of a general desktop computer to become a trusted and secure computer.

[0037] When the trusted secure computer system is booted up, an SPI1 signal is outputted through the TCM chip, which is then switched to the system BIOS through the analog switch control circuit. The system BIOS is measured and a determination is made as to whether the measurement is successful. If so, the analog switch control circuit switches to the CPU to access the BIOS. The CPU measures the system BIOS and a determination is made as to whether the measurement is successful. If so, the system is started. Otherwise, the data is destroyed through the reset terminal of the CPU connected to the TCM chip, thus preventing the information of a general desktop computer from being stolen or tampered with.

[0038] At the same time, the SPI2 signal is output through the TCM chip and directly connected to the CPU, which performs static and dynamic measurements.

[0039] The information interaction, execution process, etc. of the various components in the above-mentioned computer are based on the same concept as the embodiment of the method of the present invention. The specific contents can be found in the description of the embodiment of the method of the present invention and will not be repeated here.

[0040] Similarly, the computer of the present invention implements active and passive measurement functions through a motherboard-based trusted module (TCM) chip. Using an analog switch control circuit, it implements a switching control circuit for accessing the CPU and BIOS under active measurement. This ensures secure self-checking and trusted measurement during the host and system startup process, as well as proactive defense during data processing. Furthermore, the trusted module (TCM) chip is directly connected to the CPU reset terminal, enabling the destruction of internal CPU data in the event of a measurement failure, protecting the network and device from information tampering or theft during attacks.

[0041] The above embodiments are merely preferred embodiments for the purpose of fully illustrating the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are within the scope of protection of the present invention. The scope of protection of the present invention shall be subject to the claims.

Claims

1. A computer trusted security implementation method supporting active measurement and passive measurement, characterized in that Build TCM chip, CPU and analog switch control circuit on the motherboard of general desktop computer. When the system is powered on, an SPI1 signal is output through the TCM chip, which is switched to the system BIOS through the analog switch control circuit, and the system BIOS is measured to determine whether the measurement is successful. If so, the analog switch control circuit switches to the CPU to access the BIOS, and the system BIOS is measured by the CPU to determine whether the measurement is successful. If so, the system is started, otherwise the data is destroyed through the reset terminal of the CPU connected to the TCM chip to prevent the information of the general desktop computer from being stolen and tampered with. At the same time, the SPI2 signal is output through the TCM chip and directly connected to the CPU, which performs static and dynamic measurements.

2. A computer trusted security implementation method supporting active measurement and passive measurement according to claim 1, characterized in that The method outputs an SPI1 signal through the TCM chip, switches to the system BIOS through the analog switch control circuit, and measures the system BIOS, including: accessing the BIOS flash chip through the TCM chip; reading the BIOS code stored in the BIOS flash chip, and performing corresponding checks on the code. If the checks are correct, the measurement is successful.

3. A computer trusted security implementation method supporting active measurement and passive measurement according to claim 1, characterized in that The analog switch control circuit switches to CPU access to BIOS, and the CPU measures the system BIOS, including: allowing the CPU to access the BIOS flash chip, reading the BIOS code stored in the BIOS flash chip, performing initialization operations, and realizing power-on self-test. If the self-test passes, the measurement is successful.

4. A computer trusted security implementation method supporting active measurement and passive measurement according to claim 1, characterized in that When the CPU performs static measurement, it measures the system image itself. When the CPU performs dynamic measurement, the software started first by the system performs hierarchical measurement on the software started at the next level.

5. A computer trusted security implementation method supporting active measurement and passive measurement according to claim 1, characterized in that The analog switch control circuit includes an IC_Switch chip, wherein the NC terminal of the IC_Switch chip is connected to the TCM chip, the NO terminal is connected to the CPU, and the COM terminal is connected to the BIOS. The IC_Switch chip also includes a control enable IN port. The circuit control switching is performed through the IC_Switch chip: when the enable voltage at the IN terminal is less than 0.5V, the NO terminal and the COM terminal signals are connected, realizing the CPU's measurement of the BIOS; When the enable voltage at the IN terminal is greater than 1.6V, the NC terminal and the COM terminal signals are connected, enabling the TCM chip to measure the BIOS; In the default state, the NC terminal and the COM terminal signals are connected.

6. A trusted secure computer supporting active measurement and passive measurement, characterized in that By building TCM chips, CPU and analog switch control circuits on the motherboard of a general-purpose desktop computer, it becomes a trusted and secure computer. When the system of a trusted and secure computer is powered on, an SPI1 signal is output through the TCM chip, which is switched to the system BIOS through the analog switch control circuit, and the system BIOS is measured to determine whether the measurement is successful. If so, the analog switch control circuit switches to the CPU to access the BIOS, and the system BIOS is measured through the CPU to determine whether the measurement is successful. If so, the system is started, otherwise the data is destroyed through the reset terminal of the CPU connected to the TCM chip to prevent the information of the general desktop computer from being stolen and tampered with. At the same time, the SPI2 signal is output through the TCM chip and directly connected to the CPU, which performs static and dynamic measurements.

7. A trusted secure computer supporting active measurement and passive measurement according to claim 6, characterized in that The method outputs an SPI1 signal through the TCM chip, switches to the system BIOS through the analog switch control circuit, and measures the system BIOS, including: accessing the BIOS flash chip through the TCM chip; reading the BIOS code stored in the BIOS flash chip, and performing corresponding checks on the code. If the checks are correct, the measurement is successful.

8. A trusted secure computer supporting active measurement and passive measurement according to claim 1, characterized in that The analog switch control circuit switches to CPU access to BIOS, and the CPU measures the system BIOS, including: allowing the CPU to access the BIOS flash chip, reading the BIOS code stored in the BIOS flash chip, performing initialization operations, and realizing power-on self-test. If the self-test passes, the measurement is successful.

9. A trusted secure computer supporting active measurement and passive measurement according to claim 6, characterized in that When the CPU performs static measurement, it measures the system image itself. When the CPU performs dynamic measurement, the software started first by the system performs hierarchical measurement on the software started at the next level.

10. A trusted secure computer supporting active measurement and passive measurement according to claim 6, characterized in that The analog switch control circuit includes an IC_Switch chip, wherein the NC terminal of the IC_Switch chip is connected to the TCM chip, the NO terminal is connected to the CPU, and the COM terminal is connected to the BIOS. The IC_Switch chip also includes a control enable IN port. The circuit control switching is performed through the IC_Switch chip: when the enable voltage at the IN terminal is less than 0.5V, the NO terminal and the COM terminal signals are connected, realizing the CPU's measurement of the BIOS; When the enable voltage at the IN terminal is greater than 1.6V, the NC terminal and the COM terminal signals are connected, enabling the TCM chip to measure the BIOS; In the default state, the NC terminal and the COM terminal signals are connected.

Images