Managing integrity verification of device

Abstract

The invention relates to integrity verification of a management device. In some examples, a secure processor receives measurement data of one or more second management devices from a first management device. The measurement data is calculated at the one or more second management devices based on information in the one or more second management devices and sent from the one or more second management devices to the first management device. The secure processor stores the measurement data in a secure storage of the secure processor, and provides a representation of the measurement data to verify the integrity of information in the one or more second management devices.

Description

Background Art

[0001] The computer system includes a central processing unit (CPU), an operating system (OS), firmware and other types of machine-readable instructions for executing application programs. The computer system may also include one or more management devices separate from the CPU that perform management tasks for the computer system. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Some embodiments of the disclosure are described with respect to the following figures.

[0003] Figure 1 is a block diagram of an arrangement including a computer system having a host domain and a management domain with a security processor for verifying the integrity of a management device in the management domain, according to some examples.

[0004] Figure 2 is a flow chart of a startup process according to some examples.

[0005] Figure 3 and Figure 4 is a flow diagram of a process for managing recovery after a device reset, according to some examples.

[0006] Figure 5 is a block diagram of an apparatus according to some examples.

[0007] Figure 6 is a block diagram of a storage medium storing machine-readable instructions according to some examples.

[0008] Figure 7 is a flow diagram of a process according to some examples.

[0009] Throughout the drawings, the same reference numerals refer to similar, but not necessarily identical, elements. The drawings are not necessarily drawn to scale, and the dimensions of some parts may be exaggerated to more clearly illustrate the examples shown. In addition, the drawings provide examples and / or implementations consistent with the description; however, the description is not limited to the examples and / or implementations provided in the drawings. DETAILED DESCRIPTION

[0010] A computer system may include a host domain and an administrative domain. The host domain includes electronic components for performing the operational functions of the computer system. The "operational functions" of a computer system include the target functions that the computer system is deployed to perform, such as in response to a request from a client (e.g., a person, program, or machine). For example, if the computer system is a server computer, the operational functions may include application or network server operations, database server operations, etc. If the computer system is a communication node such as a router or switch, the operational functions may include data communications. If the computer system is a storage system, the operational functions may include data storage.

[0011] The electronic components of a computer system include a central processing unit (CPU), memory, (multiple) input / output (I / O) devices, and other components. The CPU comprises the main processor (or multiple main processors) of the computer system, and the CPU can execute machine-readable instructions, such as application programs, operating systems (OS), firmware (such as basic input / output system (BIOS) code), etc.

[0012] The management domain of a computer system includes management devices for performing management operations of the computer system. Examples of management devices include any one or some combination of the following: a baseboard management controller (BMC), a management processor, an integrated circuit or a programmable logic device (such as a complex programmable logic device (CPLD), a field programmable gate array (FPGA) or other type of logic device), a system on a chip (SOC), or other types of management devices. Operations performed in the management domain can be independent of operations in the host domain. The management devices in the management domain are separate from the CPU in the host domain of the computer system.

[0013] In some examples, a security processor may be provided in each of a host domain and a management domain to support trusted operations in a computer system. The security processor in the host domain may be referred to as a host security processor, and the security processor in the management domain may be referred to as a management security processor. The security processor may support attestation of a management device to ensure the credibility of program code (including machine-readable instructions such as firmware, software, or other types of machine-readable instructions) executed in the management device. The management device may provide a measurement value to the security processor based on applying integrity measurements to the program code. The security processor saves the measurement value, and the saved measurement value may be accessed by another entity to perform attestation.

[0014] If the management domain includes multiple different management devices, it may be challenging to ensure trusted operations in the management domain. For example, multiple management security processors connected to corresponding different management devices are deployed in the management domain to ensure the trustworthiness of the management devices, which leads to increased cost and complexity of the product.

[0015] Additionally, different management devices of a management domain may be in different reset domains. A "reset domain" refers to a domain that includes one or more electronic components that can be reset without resetting any electronic components in another reset domain. Resetting an electronic component may refer to causing the electronic component to transition to an initial state, such as by performing a power cycle (i.e., power is removed and then reapplied to the electronic component), or by activating a reset control input of the electronic component, or by any other reset technique. If a management device in a given reset domain is reset, the security processor may not be able to obtain correct measurements of the reset management device and / or other management devices in other reset domains after the reset of the management device (explained further below).

[0016] According to some embodiments of the present disclosure, a shared security processor can support security operations (such as security operations based on proof) of multiple different management devices in a management domain. In some examples of the present disclosure, one of the different management devices is designated as a primary management device that interacts directly with the security processor. Other management devices in the management domain (referred to as "secondary management devices") can provide measurement values ​​to the primary management device. The primary management device provides the measurement values ​​of the secondary management device to the security processor for verifying the security operations of the secondary management device (such as security operations based on proof of measurement values).

[0017] It should be noted that management devices in a management domain may be in different reset domains, wherein resetting a first management device in a first reset domain does not cause any other management device to be reset in another reset domain. Different reset domains of a computer system may include different system boards and / or different system chassis. A system board may be a circuit board to which electronic components are mounted. A system chassis may include a portion of a computer system housed in a separate housing frame. For example, a multi-server system may include multiple computer servers, each housed in a separate housing frame. More generally, different reset domains of a computer system are domains of electronic components that can be reset independently (e.g., electronic components in a first reset domain can be reset independently of electronic components in a second reset domain).

[0018] According to some examples of the present disclosure, in response to a reset of any management device in any reset domain, the security processor can obtain refreshed measurements of the reset management device and / or any other management devices in other reset domains.

[0019] Figure 11 is a block diagram of an example computer system 100 including a host domain 102 and a management domain 104. The host domain 102 includes a CPU 106, a memory 108, an input / output (I / O) device 109, and a bridge chipset 110. The bridge chipset 110 includes one or more electronic chips and performs various functions, including interacting with the I / O devices 109 (such as display devices, network interface controllers (NICs), storage devices, etc.). In further examples, the bridge chipset 110 can be integrated into the CPU 106 or an integrated device including the CPU 106.

[0020] CPU 106 can execute a variety of different types of machine-readable instructions. Figure 1 In the example of FIG. 1 , memory 108 stores the following types of machine-readable instructions: OS 114 , application programs 116 , and firmware 118 . The machine-readable instructions may be loaded from memory 108 to be executed by CPU 106 .

[0021] Memory 108 may be implemented using one or more memory devices. Examples of memory devices may include any one or some combination of dynamic random access memory (DRAM) devices, static random access memory (SRAM) devices, flash memory devices, or any other type of memory device.

[0022] Bridge chipset 110 also allows electronic components in host domain 102 , such as CPU 106 , to communicate with management devices in management domain 104 .

[0023] Host domain 102 includes a host trusted platform module (TPM) 112. A TPM is an example of a security processor that can perform various hardware-based security functions. Although this discussion refers to a TPM as an example of a security processor, in other examples, other types of security processors can be used.

[0024] Examples of security functions that may be performed by a TPM may include any one or some combination of the following: cryptographic computations, including applying a cryptographic hash function to information to obtain a hash value; key management and generation, which generates keys used in security operations; secure storage of keys and other secret information; random number generation, which is used to generate random numbers; integrity measurements, which generate or store measurements provided by a target (where a target may include machine-readable instructions, hardware components, or configuration information); or other security functions. Although a specific list of example security functions is provided above, in other examples, the security processor may perform additional or alternative security functions.

[0025] The TPM may also include security mechanisms that make the TPM tamper-resistant so that malicious programs will not be able to tamper with the secure operations of the TPM. In some examples, the TPM may be a hardware component or may be part of a virtual computing environment, such as a hypervisor.

[0026] It should be noted that if computer system 100 has multiple system boards and / or multiple system chassis, multiple instances of CPU 106, memory 108, I / O device 109, and bridge chipset 110 may exist in the corresponding system boards and / or system chassis.

[0027] Management domain 104 includes various management devices, including primary management device 120 and secondary management devices 121, 122, 123, and 124. Management devices 120 through 124 are programmable management devices because they are programmed with machine-readable instructions (e.g., firmware or software) to perform management tasks. Figure 1 A specific number of management devices are depicted in FIG. 1 , but it should be noted that in different examples, different numbers (2 or more) of management devices may perform different types of management operations. Examples of different management operations that may be performed by a management device are further provided below.

[0028] Different management devices 120 to 124 may be part of respective different reset domains. For example, the primary management device 120 is part of the reset domain 130, and the secondary management devices 121 to 124 are part of the corresponding reset domains 131 to 134. Figure 1 The example of shows that each reset has a single management device, but in other examples, the reset domain can include multiple management devices. In some examples, the reset domain can be part of a corresponding different system board, a different system chassis, or other domains.

[0029] Each reset domain may include a corresponding independent clock source that generates one or more clock signals provided to the electronic components in the reset domain. A clock signal is an oscillating signal of a specified frequency. The electronic component has a clock input that receives the clock signal, and the electronic component can operate according to the frequency of the clock signal. With independent clock sources in different reset domains 130 to 134, a reset of an electronic component in one reset domain does not cause a reset in any other reset domain.

[0030] Management domain 104 includes management TPM 126, which is an example of a secure processor in management domain 104. Management TPM 126 can perform security functions for management devices 120-124. Instead of providing multiple management TPMs (or more generally, multiple secure processors) for multiple different management devices, a shared TPM (126) can be used to provide security functions for multiple management devices that are part of different reset domains. Although Figure 1The management TPM 126 is shown as a discrete device separate from the host management device 120, but in other examples, the management TPM 126 may be embedded in the host management device 120. Alternatively, the management TPM 126 may be a virtual TPM within the host management device 120.

[0031] The primary management device 120 is a management device that interacts directly with the management TPM 126. The secondary management devices 121 to 124 do not interact directly with the management TPM 126. Instead, the secondary management devices 121 to 124 send their measurement values ​​(generated by integrity measurements) to the primary management device 120, which in turn provides the measurement values ​​of each secondary management device to the management TPM 126.

[0032] In general, integrity measurements refer to measurements calculated based on machine-readable instructions (e.g., firmware and software), hardware information in the computer system, and configuration information regarding the configuration of the computer system 100. In management domain 104, each management device 120-124 is capable of generating measurements based on integrity measurements applied to machine-readable instructions to be executed by the management device.

[0033] In some examples, when the management device boots up (e.g., after a reset or power cycle), machine-readable instructions such as firmware and software may be loaded for execution by the management device. The measurement value calculated by measuring the integrity of the machine-readable instructions of the management device may include a hash value calculated from applying a cryptographic hash function to the machine-readable instructions (and possibly other information such as input data of the machine-readable instructions).

[0034] The measured values ​​are used in the attestation to verify the integrity of the management device. The verification of the integrity of the management device can be performed by a local verifier 160 within the computer system 100 or a remote verifier 162 external to the computer system 100. The verification of the machine-readable instructions executed by the target component allows the verifier (local verifier 160 or remote verifier 162) to confirm that the machine-readable instructions of the management device are authentic and have not been corrupted, such as by malware or by a bug in the computer system 100.

[0035] Remote authenticator 162 may be connected to computer system 100 via management network 164 so that remote authenticator 162 may access management TPM 126. For example, remote authenticator 162 may include a computer.

[0036] The local authenticator 160 may be connected to the host management device 120 via a bus 165. Alternatively, the local authenticator 160 may be embedded in the host management device 120. The local authenticator 160 may include a controller in the management domain 104 or another domain of the computer system 100.

[0037] For management domain 104 , management TPM 126 can store measurements from management devices 120 - 124 , enabling a verifier (eg, local verifier 160 or remote verifier 162 ) to attest to machine-readable instructions (eg, firmware and / or software) executed by each management device 120 - 124 .

[0038] The management TPM 126 includes various platform configuration registers (PCRs) 170. The host management device 120 can issue various commands to the management TPM 126, such as commands according to a trusted platform module library, for example, commands according to the TPM 2.0 library specification published by the Trusted Computing Group (TCG). An example command that the host management device 120 can issue to the management TPM 126 is an extended command (e.g., TPM2_Extended Command). The extended command includes a digest value (which is a measurement value from the management device) and the number (identifier) ​​of the PCR to be updated with the digest value.

[0039] When management TPM 126 is reset, PCR 170 may be reset to an initial value (e.g., zero). An extend command received by management TPM 126 causes management TPM 126 to perform an extend operation that calculates a cryptographic hash of the current information of the PCR combined with new data (digest value). Management TPM 126 uses the result of the cryptographic hash as the new value stored in the PCR. More specifically, if the PCR contains a current value (current PCR value), a new value to be stored in the PCR (new PCR value) is calculated according to the following equation 1:

[0040] New PCR value = H (digest value || current PCR value), (Equation 1)

[0041] Wherein, H() is a cryptographic hash function, and the || operator represents concatenation. Examples of cryptographic hash functions include a Secure Hash Algorithm (SHA) hash function or other types of secure hash functions.

[0042] More generally, PCR 170 is an example of a register that may be included in a security processor to store a value. A "register" may refer to any storage element (eg, memory, buffer, latch, etc.) that may hold a value.

[0043] The host management device 120 includes a TPM interface 166 that can interact with the management TPM 126. For example, the TPM interface 166 can operate according to a TPM software stack (TSS) specification that provides an application programming interface (API) for accessing the functions of the management TPM 126. In other examples, the host management device 120 can include other types of security processor interfaces to interact with different types of security processors. The "stack" includes the following items:

[0044] The primary management device 120 is connected to the secondary management devices 121 to 124 through respective links 171 to 174. Each link 171 to 174 may be a bus or another type of link.

[0045] Each management device includes a corresponding root of trust (RoT) engine, which is a trusted component in the management device. As used herein, "engine" may refer to one or more hardware processing circuits, which may include any one or some combination of a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or other hardware processing circuits. Alternatively, "engine" may refer to a combination of one or more hardware processing circuits and machine-readable instructions (software and / or firmware) that can be executed on the one or more hardware processing circuits.

[0046] The primary management device 120 includes a RoT engine 180, the secondary management device 121 includes a RoT engine 181, the secondary management device 122 includes a RoT engine 182, the secondary management device 123 includes a RoT engine 183, and the secondary management device 124 includes a RoT engine 184. In some examples, the RoT engine can be implemented using hardware so that the RoT engine cannot be compromised by an attacker. Therefore, the RoT engine can be trusted to start in a known valid state and perform trusted operations.

[0047] The RoT engine in the corresponding management device calculates the measurement value performed on the management device (e.g., by calculating a hash value based on applying a cryptographic hash function to the machine-readable instructions of the corresponding management device). For example, if the machine-readable instructions include firmware, the RoT engine can perform integrity measurements by continuously calculating the measurement value based on consecutive segments of the firmware as the firmware segments are loaded for execution by the measurement device. More specifically, the RoT engine performs a first integrity measurement on a first segment of firmware to be executed to produce a first measurement value, performs a second integrity measurement on a second segment of firmware to be executed to produce a second measurement value, and so on. As each measurement value is calculated, the measurement value is provided to the management TPM 126 to be expanded into the corresponding PCR 170.

[0048] The RoT engines 181 to 184 provide their respective measurements to the primary management device 120 via corresponding links 171 to 174. The primary management device 120 includes a secure link interface 167 that cooperates with a corresponding secure link interface (not shown) in a secondary management device (any one of 121 to 124) to perform secure communication of the measurements over the corresponding links.

[0049] In some examples, secure communications between secondary management devices 121-124 and primary management device 120 over links 171-174 can be based on a secure communications protocol, such as the Security Protocol and Data Model (SPDM) security protocol, the Mutual Transport Layer Security (MTLS) protocol, or any other secure communications protocol that protects information transmitted between devices from unauthorized access by an attacker or another authorized entity.

[0050] In response to receiving the measurement value from the secondary management device, the measurement forwarding engine 168 in the primary management device 120 uses the TPM interface 166 to issue an extension command to extend the measurement value to the corresponding PCR 170 of the management TPM 126. Additionally, the RoT engine 180 in the primary management device 120 can perform integrity measurements to generate the measurement value. The primary management device 120 can also use the TPM interface 166 to issue an extension command to extend the measurement value of the primary management device 120 to the PCR 170 of the management TPM 126.

[0051] According to some embodiments of the present disclosure, the management TPM 126 is shared between multiple management devices (e.g., 120 to 124) in different reset domains 130 to 134. The measurement values ​​of the management devices 120 to 124 stored in the PCR 170 can be used in the attestation of the management devices 120 to 124, such as by the local verifier 160 or the remote verifier 162.

[0052] The management TPM 126 also includes a persistent memory 128, which includes one or more persistent memory devices, such as a flash memory device, an erasable programmable read-only memory device (EEPROM), or any other type of persistent memory device. The persistent memory 128 can be used to store a persistent PCR record 136, which is a persistent representation of the contents of the measurements in the PCR 170. When power is removed from the management TPM 126 or when the management TPM 126 is reset, the PCRs can be initialized to initial values, such as zero. However, even if power is removed from the management TPM 126 or the management TPM 126 is reset, the persistent PCR record 136 is still maintained. The use of the persistent PCR record 136 is discussed further below.

[0053] Figure 2 is a flow chart of a boot process performed by various components including a secondary management device 200 (eg, any one of 121 to 124), a primary management device 120, and a management TPM 126. Figure 2 Only one secondary management device is shown, but it should be noted that other secondary management devices may perform the same Figure 2 The secondary management device 200 performs similar tasks.

[0054] Figure 2 The task sequence performed by various components is shown. In other examples, tasks may be performed in a different order, some tasks may be omitted, and / or other tasks may be added.

[0055] The boot process may be responsive to providing power to the computer system 100 after power was previously removed. Figure 1 ) is triggered by the application of power, or is triggered in response to a restart or other type of reset of the computer system 100.

[0056] The RoT engine 201 in the secondary management device 200 (e.g., any one of the RoT engines 181 to 184) may perform (at 202) an integrity measurement of a first code segment (e.g., a first segment of firmware and / or software) for initial execution during boot-up in the secondary management device 200. Similarly, the RoT engine 180 in the primary management device 120 performs (at 204) an integrity measurement of a first code segment for initial execution during boot-up in the primary management device 120.

[0057] Host admin device 120 extends (at 206) the master measurement value generated by the integrity measurement of the first code snippet of host admin device 120 to admin TPM 126. The master measurement value may be provided as part of an extension command that extends the master measurement value to corresponding PCRs 170 of admin TPM 126. The PCRs 170 into which the master measurement values ​​of host admin device 120 are to be extended are referred to in this example as “PCR Ps”.

[0058] The RoT engine 201 in the secondary management device 200 sends (at 208) the secondary measurement value generated by the integrity measurement of the first code snippet in the secondary management device 200 to the primary management device 120. In response, the measurement forwarding engine 168 of the primary management device 120 extends (at 210) the measurement value of the secondary management device 200 (e.g., in an extension command) to the corresponding PCR 170 of the management TPM 126. The PCR 170 into which the secondary measurement value of the secondary management device 200 is to be extended is referred to as "PCR S" in this example.

[0059] In a specific example, the PCRs of the management TPM 126 to which the measurements of the primary management device 120 may be extended include PCR 0, PCR 1, PCR 8, and PCR 9, such as according to the TCG server management domain firmware profile specification. The PCRPs in these examples may be any one of PCR 0, PCR 1, PCR 8, and PCR 9. In some examples, the measurements of the secondary management device may be extended to PCR 2 and PCR 3. The PCR Ss in these examples may be any one of PCR 2 and PCR 3. In other examples, different PCRs of the management TPM 126 may be used to store the measurements of the corresponding management devices.

[0060] It should be noted that a PCR can be divided into multiple segments, wherein corresponding segments of the PCR ("PCR segments") are assigned to corresponding different management devices. The PCR segments assigned to a given management device are used to store the measurement values ​​of the management device. A "PCR segment" can refer to a portion of a PCR that is smaller than the entire PCR, or to the entire PCR.

[0061] In addition to extending the measurements of the primary management device 120 and the secondary management device 200 to the corresponding PCRs, the primary management device 120 also updates (at 212) the event log 138 with the measurements and information identifying the entity associated with each measurement. The entity associated with the measurements in the event log 138 can be the primary management device 120 or a secondary management device. When a measurement is created at the primary management device 120 or received by the primary management device 120 from a secondary management device, an additional entry is added to the event log 138. The entries of the event log 138 thus store consecutive measurements generated by the corresponding management device and corresponding information identifying the entity associated with the consecutive measurements.

[0062] The event log 138 is stored in a memory 140 coupled to the host management device 120. The memory 140 coupled to the host management device 120 may be part of the host management device 120 or may be external to the host management device 120.

[0063] It should be noted that the value stored in the PCR segment based on the measured value represents a combination (composite) of multiple measured values ​​from a given management device, wherein, in some examples, the value stored in the PCR segment is obtained according to the above equation 1. The value in the PCR segment represents the trust state up to the time when the PCR segment is read. Due to the nature of the extended process of updating the PCR segment, it is not feasible to obtain the individual measured values ​​that make up the value in the PCR segment.

[0064] On the other hand, event log 138 contains individual measurements of each management device. Event log 138 can be used to restore individual measurements of each management device to recover from unexpected events, including resets of management devices (discussed further below).

[0065] Additional integrity measurements are performed (at 214) by the primary admin device 120 to produce additional primary measurements when the additional code snippets are executed in the primary admin device 120. Additional integrity measurements are performed (at 216) by the secondary admin device 200 to produce additional secondary measurements when the additional code snippets are executed in the secondary admin device 200. The primary admin device extends (at 218) the additional primary measurements to corresponding PCRs of the admin TPM 126.

[0066] Additional secondary measurements generated from the additional integrity measurements in secondary management device 200 are sent (at 220) to primary management device 120. Primary management device 120 extends (at 222) the generated additional secondary measurements to corresponding PCRs of admin TPM 126.

[0067] Since the PCR values ​​in the PCRs of a given management device are based on multiple measured values ​​extending into the PCRs, the PCR values ​​constitute a representation of the history of all measured values ​​extending into the PCRs of the given management device.

[0068] The primary management device 12 further updates (at 224) the event log 138 with additional entries including the additional primary measurement and the additional secondary measurement, and information identifying the management device associated with the additional primary measurement and the additional secondary measurement.

[0069] Once the boot process is complete and the management domain 104, which includes multiple management devices, has transitioned to a runtime state (e.g., a state after the firmware has been executed), the master management device 120 issues (at 226) a PCR save command to the management TPM 126, which causes the management TPM 126 to save (at 228) the latest PCR value in PCR 170 to the persistent PCR record 136 in the persistent memory 128 of the management TPM 126.

[0070] When a verifier (e.g., local verifier 160 or remote verifier 162) performs attestation of a primary management device and a secondary management device, the verifier obtains PCR values ​​for the primary management device and the secondary management device from corresponding PCRs 170 in admin TPM 126. For example, the PCR values ​​may be included in a PCR reference, which is a PCR value (in PCRs) signed using a digital signature by admin TPM 126. The PCR reference (or more generally, the secure processor protection value) may be provided to the verifier from computer system 100 along with an attestation request.

[0071] The verifier compares the PCR value of each management device obtained with the corresponding value in the database of the verifier. If the PCR value obtained matches the corresponding value in the database, this indicates that the machine-readable instructions of the management device have not been changed and can therefore be trusted. The verifier sends an indication to the execution entity 163 as to whether the management device is trustworthy. The execution entity 163 can be outside the computer system 100 or can be a part of the computer system 100. If the indication indicates that the management device is trustworthy, the execution entity 163 allows the use of the management device. If the verifier indicates that the management device is not trustworthy (for example, because the machine-readable instructions of the management device have been changed), the execution entity 163 can issue an alarm to prohibit the computer system 100 from using the management device. The execution entity 163 may include a program or electronic device that applies an execution policy based on the result returned by the verifier.

[0072] Figure 3 and Figure 4 1 is a flow chart of a process for recovering from a reset in management domain 104 during a runtime state of management domain 104. In some examples, there are multiple categories of management devices. A first category of management devices includes management devices that can be reset without affecting OS 114 executing in host domain 102. In other words, a reset of the first category of management devices does not affect the operation of OS 114.

[0073] A second category of management devices are those that cannot be reset without impacting OS 114. An example of such a management device in the second category is a secondary management device that supports management of a file system of OS 114. If the secondary management device is reset, the file system may become unusable or may otherwise be in an uncertain state, which may result in OS 114 being unable to access or trust the state of the file system.

[0074] Figure 3 1 is a flow chart of a recovery process starting from a reset of the master admin device 120 in the first category. The reset of the master admin device 120 (302) results in a reset of the admin TPM 126. The reset of the admin TPM 126 causes a restart of the admin TPM 126 (304).

[0075] In response to the restart of management TPM 126, management TPM 126 performs (at 306) a PCR recovery operation that includes obtaining (at 308) the PCR values ​​of the secondary management device that have been saved to persistent PCR record 136 (e.g., Figure 2226 in task 226). The persistent PCR record 136 includes entries containing the PCR value of the secondary management device and information identifying the secondary management device. The management TPM 126 can determine which entries of the persistent PCR record 136 contain the PCR value of the secondary management device based on the information identifying the secondary management device.

[0076] The management TPM 126 stores (at 310) the retrieved PCR values ​​for the secondary management device in the corresponding PCRs (e.g., PCR2 and PCR 3). In this way, the correct PCR values ​​for the secondary management device at the time of the management TPM 126 reset can be restored to the PCRs of the secondary management device. It should be noted that extending the latest measurement values ​​from a given secondary management device after the management TPM 126 reset may result in different values ​​being stored in the PCRs of the given secondary management device (i.e., the values ​​are different from the saved PCR values ​​of the given secondary management device saved to the persistent PCR record 136). This is because the values ​​stored in the PCRs are based on a combination of the current PCR value and the latest measurement value (e.g., according to Equation 1 above). Due to the reset of the management TPM 126, the current PCR value of the given secondary management device is reset to zero. The combination of the latest measurement value and zero will result in a different PCR value than the combination of the latest measurement value and a non-zero value (the PCR value saved in the persistent PCR record 136 of the given secondary management device may have been generated based on the latest measurement value and the previous non-zero value saved to the PCR).

[0077] In a specific example, prior to a reset of primary management device 120 (and therefore prior to a reset of management TPM 126), the PCRs for a given secondary management device store PCR values ​​based on a combination of the latest measured value of the PCRs (M-latest) and a previous PCR value (P-previous). After a reset of management TPM 126 that causes the PCRs to be reset to zero, a PCR value for the PCRs will be calculated based on the combination of M-latest and zero, which will be different from the PCR value calculated based on the combination of M-latest and P-previous.

[0078] The admin TPM 126 further extends (at 308) the new measurement value of the master management device 120 in the corresponding PCR of the master management device 120. For example, after the master management device 120 has been restarted after a reset of the master management device 120, the master management device 120 can perform integrity measurements to obtain new measurement values, and issue an extend command to extend the new measurement values ​​to the corresponding PCR of the master management device 120.

[0079] Figure 4Flowchart of a recovery process starting from a reset of a secondary management device 200 (any one of 121 to 124) in the first or second category. It should be noted that the reset of the secondary management device 200 does not cause a reset of the management TPM 126. Therefore, the contents of the PCRs of the primary and secondary management devices remain intact in the management TPM 126 (i.e., the PCRs of the primary and secondary management devices are not reset, such as to zero).

[0080] After the secondary management device 200 is reset, the secondary management device 200 restarts (at 402). In response to the restart, the RoT engine in the secondary management device 200 performs (at 404) integrity measurements to generate new measurements of the secondary management device 200. The secondary management device 200 sends (at 406) the new measurements to the primary management device 120 over a link protected by a secure communication protocol. In some examples, the secondary management device 200 may push the new measurements to the primary management device 120 (without any specific request from the primary management device 120). In other examples, the primary management device 120 may issue a request to obtain new measurements from the secondary management device 200, such as in response to detecting by the primary management device 120 that the secondary management device 200 has been reset.

[0081] The primary management device 120 extends (at 408) the new measurement value to the PCR of the secondary management device 200. It should be noted that the current PCR value in the PCR of the secondary management device 200 is a non-zero value because the PCR has maintained the current PCR value of the secondary management device 200 even though the secondary management device 200 has been reset. Typically, it is expected that the reset of a management device will cause the PCR value of the management device to be initialized (e.g., to zero). However, since the secondary management device 200 is in a reset domain different from the reset domain of the primary management device 120, the reset of the secondary management device 200 does not cause the PCR value of the secondary management device 200 to be reset.

[0082] Extending (at 408) the new measurement value to a PCR containing a non-zero value will result in a different PCR value being stored in the PCR than if the new measurement value had been extended to a PCR containing a zero value.

[0083] As additional measurements are generated by the secondary management device 200 as successive code snippets are executed, the additional measurements are also sent to the primary management device 120 , which extends the additional measurements to the admin TPM 126 .

[0084] The primary management device 120 updates (at 410 ) the event log 138 with an entry containing the measurement of the secondary management device 200 .

[0085] Once the restart of the secondary management device 200 is complete (and all measurements of the secondary management device 200 have been extended to the management TPM 126), the primary management device 120 issues (at 412) a PCR save command to the management TPM 126, which causes the management TPM 126 to save (at 414) the latest PCR value in PCR 170 to the persistent PCR record 136 in the persistent memory 128 of the management TPM 126.

[0086] During attestation of the secondary management device 200 by a verifier (e.g., the local verifier 160 or the remote verifier 162), the verifier retrieves the PCR value of the secondary management device 200 from the corresponding PCR 170 in the management TPM 126. The verifier compares the retrieved PCR value of the secondary management device 200 with the corresponding value in the verifier's database. Since the PCR value of the secondary management device 200 that has been reset independently of the management TPM 126 is different from the PCR value of the secondary management device 200 if the secondary management device 200 has not been reset independently of the management TPM 126, the verifier will detect a mismatch between the PCR value of the secondary management device 200 and the corresponding value in the verifier's database. Rather than indicating a failure in attestation of the secondary management device 200, the verifier can access the event log 138 to compare separate measurements of the secondary management device 200 before and after the reset of the secondary management device 200. This allows the verifier to confirm whether the machine-readable instructions of the secondary management device 200 have been altered. If the individual measurements of the secondary management device 200 before and after the secondary management device 200 is reset remain the same, the verifier may confirm that the machine-readable instructions of the secondary management device 200 have not been altered and therefore the secondary management device 200 may be trusted.

[0087] Figure 5 is a block diagram of an apparatus 500 according to some examples. For example, the apparatus 500 may include Figure 1 The device 500 may be a part of the computer system 100, or alternatively, the device 500 may include the entire computer system 100.

[0088] The apparatus 500 includes a security processor 502 for performing various tasks. For example, the security processor 502 may execute instructions for performing the tasks. Alternatively, a hardware processing circuit of the security processor 502 performs the tasks.

[0089] The tasks of the security processor 502 include a second management device measurement data receiving task 504 that receives measurement data of a second management device from the first management device at the security processor 502. The measurement data is calculated at the second management device based on information (e.g., program code) in the second management device, and the measurement data is sent from the second management device to the first management device. In some examples, the measurement data includes a cryptographic hash value based on the program code executed in the second management device.

[0090] The first management device and the second management device perform respective different system management operations in the computer system, and the first management device and the second management device are separate from a CPU executing an OS of the computer system.

[0091] The tasks of the secure processor 502 include a measurement data storage task 506 to store the measurement data in a secure storage device 508 of the secure processor 502. The secure storage device 508 may include registers, such as PCRs of a TPM. In other examples, the secure storage device 508 may be implemented with another type of storage device. The secure storage device 508 is "secure" in the sense that the secure processor 502 includes a mechanism for preventing unauthorized access to the secure storage device 508.

[0092] The tasks of the security processor 502 include a measurement data representation providing task 510 to provide a representation of the measurement data to verify the integrity of the information in the second management device. The representation of the measurement data can be provided 502 by the security processor to the verifier. In some examples, the representation of the measurement data is in the form of a PCR reference. In some examples, the security processor 502 provides the representation of the measurement data as part of a certification process to verify the trustworthiness of the second management device.

[0093] In some examples, the secure processor 502 receives measurement data of the first management device from the first management device, and the secure processor 502 stores the measurement data of the first management device in another secure storage device (eg, PCR) of the secure processor.

[0094] In some examples, secure storage 508 includes a first register of secure processor 502. Secure processor 502 expands the measurement data into the first register.

[0095] In some examples, the security processor 502 receives measurement data of the first management device from the first management device. The security processor 502 extends the measurement data of the first management device to a second register of the security processor, wherein the second register is different from the first register.

[0096] In some examples, the secure processor 502 receives a request from the first management device to save the contents of the secure storage device to a persistent record (e.g., Figure 1 136) command in.

[0097] In some examples, after the secure processor 502 is reset, the secure processor 502 repopulates the measurement data from the persistent log back into the secure storage.

[0098] In some examples, the security processor 502 is reset in response to a reset of the first management device, and the security processor 502 is not reset in response to a reset of the second management device.

[0099] In some examples, the first management device and the second management device are in different reset domains.The security processor 502 receives refreshed measurement data of the second management device from the first management device after the second management device is reset.

[0100] In some examples, refreshed measurement data of the second management device is obtained by the first management device based on the first management device detecting a reset of the second management device.

[0101] Figure 6 is a block diagram of a non-transitory machine-readable or computer-readable storage medium 600 storing machine-readable instructions that, when executed, cause a security processor to perform various tasks.

[0102] The machine-readable instructions include first management device measurement data receiving instructions 602 for receiving, at the secure processor, first measurement data based on a program code in the first management device from a first management device in a first reset domain.

[0103] The machine-readable instructions include a first measurement data storage instruction 604 for storing the first measurement data in a first register of the security processor. For example, the first measurement data storage instruction 604 extends the first measurement data to a first PCR of the TPM, such as Figure 1 Management of TPM 126.

[0104] The machine readable instructions include second management device measurement data receiving instructions 606 for receiving, at the secure processor, second measurement data based on program code in a second management device from the first management device. The second management device is in a second reset domain different from the first reset domain.

[0105] The machine-readable instructions include a second measurement data storage instruction 608 for storing the second measurement data in a second register of the security processor. For example, the second measurement data storage instruction 608 extends the second measurement data to a second PCR of the TPM, such as Figure 1 Management of TPM 126.

[0106] The machine-readable instructions include measurement data representation providing instructions 610 for providing a representation of first measurement data to verify the integrity of program code in a first management device, and providing a representation of second measurement data to verify the integrity of program code in a second management device. In some examples, the representations of the first measurement data and the second measurement data may include PCR references.

[0107] The machine-readable instructions include a measurement data persistence instruction 612 for storing the second measurement data in a persistent memory of the security processor. For example, the second measurement data may be stored in a persistent memory in response to a save command from the first management device. Figure 1 The persistent PCR record is 136.

[0108] The machine-readable instructions include measurement data restoration instructions 614 for restoring the second measurement data from the persistent memory and saving the restored second measurement data to the second register in response to a reset of the security processor caused by a reset of the first management device.

[0109] In some examples, the security processor interacts directly with the first management device, and the security processor is not linked to the second management device. For example, the first management device includes an interface that allows the first management device to issue commands or otherwise communicate with the security processor (e.g., Figure 1 On the other hand, the second management device does not include any interface with the security processor. Instead, the second management device sends information (e.g., measurement data) to the first management device, which in turn forwards the measurement data to the security processor.

[0110] Figure 7 700 according to some examples. Process 700 can be implemented in a management domain of a computer system (e.g. Figure 1 Executed in the management domain 104).

[0111] Process 700 includes receiving (at 702) at a first management device in a first reset domain from a second management device in a second reset domain measurement data calculated at the second management device based on program code in the second management device. The measurement data may include a hash value resulting from applying a cryptographic hash function to the program code (or a fragment of the program code) in the second management device.

[0112] Process 700 includes sending (at 704) an extension command by the first management device to extend measurement data of the second management device to registers of a secure processor. The secure processor may be a TPM, and the registers may be PCRs of the TPM.

[0113] Process 700 includes extending (at 706) the measurement data of the second management device to the register of the security processor based on the command. Extending the measurement data to the register refers to calculating a value based on the measurement data and a value currently in the register.

[0114] Process 700 includes sending (at 708) a save command by the first management device to persist the measurement data of the second management device to the persistent memory of the secure processor. The measurement data of the second management device saved to the persistent memory is available after a reset of the secure processor.

[0115] As mentioned above, Figure 1 The management devices 120 to 124 of the management domain 104 in the computer system 100 can perform various different management operations in the computer system 100. In some examples, the management device includes a BMC that is a dedicated service controller that uses sensors to monitor the physical state of the computer system and communicates with a remote management system (remote from the computer system) through an independent "out-of-band" connection. The BMC can perform management tasks to manage components of the computer system. Examples of management tasks that can be performed by the BMC may include any one or some combination of the following: power control for power management of the computer system (such as transitioning the computer system between different power consumption states in response to detected events), thermal monitoring and control of the computer system (such as monitoring the temperature of the computer system and controlling the thermal management state of the computer system), fan control of fans in the computer system, system health monitoring based on monitoring measurement data of various sensors of the computer system, remote access to the computer system (for example, accessing the computer system through a network), remote restart of the computer system (using a remote command to trigger a restart of the computer system), system setup and deployment of the computer system, system security of implementing security programs in the computer system, etc.

[0116] In a further example, the management device can be different types of management devices that can perform any one or some combination of the following management tasks: managing a network or another communication link between parts of a computer system (such as between servers or system boards), coordinating the management of multiple parts of a computer system, defining node clusters, etc.

[0117] Storage media (e.g. Figure 6600) may include any one or some combination of the following: a semiconductor memory device, such as DRAM or SRAM, EPROM, EEPROM, and flash memory; a magnetic disk, such as a fixed disk, a floppy disk, and a removable disk; another magnetic medium, including a tape; an optical medium, such as a compact disk (CD) or a digital video disk (DVD); or another type of storage device. Note that the instructions discussed above may be provided on one computer-readable or machine-readable storage medium, or alternatively, may be provided on multiple computer-readable or machine-readable storage media distributed in a large system with possibly multiple nodes. Such one or more computer-readable or machine-readable storage media are considered to be part of an article (or product). An article or product may refer to any manufactured single component or multiple components. One or more storage media may be located in a machine running machine-readable instructions, or at a remote site, from which machine-readable instructions may be downloaded over a network for execution.

[0118] In the present disclosure, unless the context clearly indicates otherwise, the use of the terms "a", "an" or "the" is intended to include the plural forms as well. Similarly, when used in the present disclosure, the terms "includes / including / comprises / comprising", "have / having" specify the presence of stated elements, but do not exclude the presence or addition of other elements.

[0119] In the foregoing description, many details are set forth to enable an understanding of the subject matter disclosed herein. However, embodiments may be practiced without some of these details. Other embodiments may include modifications and variations of the details discussed above. The appended claims are intended to cover such modifications and variations.

Claims

1. A device comprising: A security processor, the security processor is used to: receiving, at the security processor, measurement data from a second management device from a first management device, the measurement data being calculated at the second management device based on information in the second management device and sent from the second management device to the first management device, wherein the first management device and the second management device are used to perform respective different system management operations in a computer system, and the first management device and the second management device are separate from a central processing unit (CPU) executing an operating system (OS) of the computer system; storing the measurement data in a secure storage device of the secure processor; and The representation of the measurement data is provided to verify the integrity of the information in the second management device.

2. The device according to claim 1, wherein: The security processor is used to: receiving measurement data of the first management device from the first management device; and The measurement data of the first management device is stored in another secure storage device of the secure processor.

3. The device according to claim 1, wherein: The security processor is configured to provide a representation of the measurement data as part of an attestation process to verify the trustworthiness of the second management device.

4. The device according to claim 3, wherein: The measurement data includes a cryptographic hash value based on program code executed in the second management device.

5. The device according to claim 1, wherein: The secure storage device comprises a first register of the secure processor, and the secure processor is configured to expand the measurement data into the first register.

6. The device according to claim 5, wherein: The security processor is used to: receiving measurement data of the first management device from the first management device; and The measurement data of the first management device is extended to a second register of the security processor, wherein the second register is different from the first register.

7. The device of claim 1, wherein: The secure processor is configured to receive a command from the first management device to save the contents of the secure storage device to a persistent record that is available after a reset of the secure processor.

8. The device according to claim 7, wherein: The security processor is used to: Following a reset of the secure processor, the measurement data is repopulated from the persistent log back into the secure storage device.

9. The device of claim 8, wherein: The security processor is reset in response to a reset of the first management device.

10. The device of claim 9, wherein: The security processor is not reset in response to a reset of the second management device.

11. The device of claim 10, wherein: The first management device and the second management device are in different reset domains, and wherein the security processor is used to: After the resetting of the second management device, refreshed measurement data of the second management device is received from the first management device.

12. The device of claim 11, wherein: The refreshed measurement data of the second management device is obtained by the first management device based on the first management device detecting a reset of the second management device.

13. The device of claim 1, wherein: The security processor is used to: The representation of the measurement data is sent to a verifier, which sends an indication to an execution entity whether the second management device is authentic based on the representation of the measurement data.

14. A non-transitory machine-readable storage medium comprising instructions that, when executed, cause a security processor to: receiving, at the security processor, first measurement data based on a program code in a first management device from a first management device in a first reset domain; storing the first measurement data in a first register of the security processor; receiving, at the security processor, from the first management device, second measurement data based on program code in a second management device, the second management device being in a second reset domain different from the first reset domain; storing the second measurement data in a second register of the security processor; providing a representation of the first measurement data to verify the integrity of the program code in the first management device, and providing a representation of the second measurement data to verify the integrity of the program code in the second management device; storing the second measurement data in a persistent memory of the security processor; as well as In response to a reset of the security processor caused by a reset of the first management device, the second measurement data is restored from the persistent memory and the restored second measurement data is saved to the second register.

15. The non-transitory machine-readable storage medium of claim 14, wherein: A reset of the second management device in the second reset domain does not cause a reset of the security processor.

16. The non-transitory machine-readable storage medium of claim 14, wherein: The security processor stores the second measurement data in the persistent memory of the security processor in response to a command received from the first management device to save the content of the second register.

17. The non-transitory machine-readable storage medium of claim 14, wherein: The security processor is used to interact directly with the first management device, and the security processor is not linked to the second management device.

18. The non-transitory machine-readable storage medium of claim 14, wherein: When executed, the instructions cause the security processor to perform the following operations: After a reset of the security processor caused by a reset of the first management device, new measurement data of the first management device are received at the security processor from the first management device.

19. A method comprising: receiving, at a first management device in a first reset domain, from a second management device in a second reset domain, measurement data calculated at the second management device based on a program code in the second management device; The first management device sends an extension command to extend the measurement data of the second management device to the register of the security processor; Based on the extended command, extending the measurement data of the second management device to the register of the security processor, wherein the measurement data in the register is used to verify the integrity of the second management device; as well as The first management device sends a save command to persistently save the measurement data of the second management device to the persistent memory of the security processor, wherein the measurement data of the second management device saved to the persistent memory is available after the security processor is reset.

20. The method of claim 19, further comprising: updating, by said first management device, an event log with an entry containing the measurement data of said second management device, The event log is accessible by a verifier to confirm that the program code of the second management device has not been altered.

Images