A trusted computing method, chip and server

Abstract

The application provides a trusted computing method, a chip and a server. The method comprises the following steps: a trusted chip sends an authentication request to an authentication node, the authentication request being used for the authentication node to perform trusted authentication on the trusted chip; and the trusted chip performs trusted authentication on components, wherein the components comprise input and output (IO) components and storage components, so that other components in the server except a service processor can also be subjected to trusted authentication by the trusted chip, and the security of the server is improved.

Description

[0001] This application is a divisional application, the original application number is 202210191235.8, the original application date is February 28, 2022, and the entire contents of the original application are incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of computers, and in particular to a trusted computing method, a chip and a server. BACKGROUND

[0003] Since the 1980s, Microsoft and Intel have formed the Wintel alliance to promote the development of the personal computer (PC) industry. The two companies have worked closely together in the PC industry to drive faster development of the computing industry and gradually influence other computing devices such as servers. The application scenarios of servers and other computing devices are diverse, the configuration types are diverse, and the reliability requirements are relatively high. At the same time, servers have a huge commercial volume and are the focus of open industry ecosystem construction.

[0004] Taking a traditional server as an example, the current traditional server industry ecosystem has the following characteristics:

[0005] Low standardization: Traditional servers already have a certain component standardization basis, for example, memory sticks, solid state drives (SSDs), peripheral component interconnect express (PCIE) cards, and other components already have their own standards. Component standardization has made a great contribution to the industry ecosystem and resource sharing, reducing the development work of a portion of server manufacturers. However, the proportion of standardized components in the entire server is small, which makes the development of the server motherboard still need to invest more manpower to complete the adaptation of standardized components and non-standardized components.

[0006] Insufficient diversity of computing power: In the context of massive data, big data analysis, machine learning, and the rapid development of artificial intelligence, specialized processors such as graphics processing units (GPUs), data processing units (DPUs), and neural-network processing units (NPUs) are widely used. The traditional server device single system has been unable to meet current needs, and the complexity of server hardware devices has significantly increased. The server includes not only business processing systems but also management systems for chips such as GPUs, and multiple systems may exist in a variety of architecture mixtures, such as X86 architecture and ARM architecture mixtures.

[0007] Further, trusted computing is a technical means for ensuring the integrity of a server system and application, and ensuring that it runs in a trusted state as expected by the design target. Servers are subject to threats such as near-end attacks on hardware, disassembly, etc. For example, during transportation, storage, installation, etc., a third party replaces the hardware or replaces the tampered firmware to obtain the highest authority of the computing system. At the same time, servers are also subject to remote attacks on data, business systems, and firmware. For example, when a third party replaces components or upgrades software and hardware during maintenance, the third party also has the ability to control the computing system by replacing unknown components or upgrading risky software and hardware. Trusted computing can ensure that the server has a trusted protection capability throughout the life cycle and prevent third parties from obtaining the ability to control the computing system.

[0008] However, the traditional server can only perform trusted authentication on the business processing system. In the diversified computing power scenario, the management system of other diversified computing power of the server, such as GPU and the like, cannot perform trusted authentication, resulting in vulnerabilities in the trusted computing of the current traditional server and low security of the server. SUMMARY

[0009] The present application provides a trusted computing method, a chip and a server, which are used to solve the problem that the traditional server can only perform trusted authentication on the business processing system, resulting in vulnerabilities in trusted computing and low security of the server.

[0010] In a first aspect, a trusted computing method is provided. The method is applied to a server, and the server includes a trusted chip and components. The trusted chip and the components are communicatively connected through a bus. The method includes the following steps: the trusted chip sends an authentication request to an authentication node, the authentication request is used for the authentication node to perform trusted authentication on the trusted chip, the trusted chip performs trusted authentication on the components, and the components include input / output (IO) components and storage components.

[0011] In specific implementations, the IO components include a network card or a PCIE riser, and the storage components include one or more of a hard disk backboard, an expander, and a PCIE switch.

[0012] Optionally, the components include a computing component, an acceleration component, a memory expansion component, and a heat dissipation component, wherein the computing component includes a central processing unit (CPU), a double data rate (DDR) memory, and a power supply; the acceleration component includes a carrier board and an acceleration card interconnection switch, wherein the acceleration card includes one or more of a graphics processing unit (GPU), a data processing unit (DPU), and a neural-network processing unit (NPU); the memory expansion component includes a carrier board, and one or more of a memory expansion chip, a dual in-line memory module (DIMM), and a storage class memory (SCM) medium; and the heat dissipation component includes one or more of air cooling and liquid cooling.

[0013] By implementing the method described in the first aspect, after the trusted chip is authenticated by the authentication node, the trusted chip performs trusted authentication on the components, thereby realizing integrity verification of the entire server, so as to solve the problem of low server security caused by the vulnerability of current trusted computing.

[0014] In a possible implementation, the trusted chip is integrated in a baseboard management controller (BMC) chip of the server, or the trusted chip is externally connected to the BMC chip.

[0015] In the above implementation, the trusted chip is integrated in or externally connected to the BMC chip. The BMC chip is a server embedded management system facing the whole life cycle of the server, so that the trusted computing no longer depends on the business server (CPU). Even if the CPU is not powered on, the trusted protection of the server can be performed through the BMC chip, so that the server can be trusted and protected when the CPU is not powered on (such as during installation, transportation, and scrapping in the whole life cycle). Moreover, the BMC chip has the advantage of isolation of computing resources and network resources from the CPU itself, so that the trusted computing no longer needs to consider how to isolate the computing resources, thereby reducing the design threshold and realizing the double-system security architecture of independent hardware protection. Meanwhile, the exposure surface of the BMC chip is less than that of the CPU, and the possibility of connection between the third party and the BMC chip is lower than that of the CPU, so that the attack risk is reduced.

[0016] In a possible implementation, before the trusted chip sends the authentication request to the trusted authentication node, the method further includes: the trusted chip performing integrity verification on the firmware of the trusted chip. Specifically, the firmware can be verified by using a secure and trusted startup mode to ensure the integrity of the firmware. In a specific implementation, the trusted chip can be set to be unmodifiable at the factory and support custom security startup strategies, and the code security protection settings can be made according to business requirements. The specific implementation of the firmware verification is not limited in the present application. After the firmware integrity verification is successful, the BMC chip can be started, otherwise, a warning is given that the firmware is incomplete or the server is powered off and the like.

[0017] With the above implementation, the trusted chip can avoid third parties from obtaining control of the server by replacing the firmware in the first stage of the server life cycle (such as storage, transportation, and the like), and further improve the security of the server.

[0018] In a possible implementation, the authentication request includes a first certificate, the first certificate being generated by the trusted chip according to a first preset key, and the first certificate being used for the authentication node to perform trusted authentication on the first certificate according to a first preset certificate. If the authentication is successful, it indicates that the trusted chip 110 has not been tampered with and is an integrity chip, and if the authentication fails, it indicates that the trusted chip has been tampered with.

[0019] Similarly, when the trusted chip performs trusted authentication on the component, the trusted chip can first receive a second certificate sent by the component, the second certificate being generated by the component according to a second preset key; and the trusted chip performs trusted authentication on the second certificate according to a second preset certificate. If the authentication is successful, it indicates that the component 120 has not been tampered with and is a component with integrity and security, and if the authentication fails, it indicates that the component has been tampered with. The second preset certificate can be burned into the trusted chip when the trusted chip 110 is manufactured.

[0020] It should be noted that the first key and the second key can be a private key in an encryption algorithm, and the first preset certificate and the second preset certificate can be a public key certificate in the encryption algorithm. The trusted chip generates a signature and a first certificate according to the first key (private key), and sends the first certificate carrying the signature to the authentication node. The authentication node can perform an unsigned operation on the received first certificate by using the first preset certificate (public key certificate) to achieve trusted authentication of the trusted chip. Similarly, the component can also generate a signature and a second certificate according to the second key (private key), and send the second certificate carrying the signature to the trusted chip for trusted authentication. Details are not repeated here. The encryption algorithm can be a non-symmetric encryption algorithm (RSA), MD5, a symmetric encryption algorithm, and the like. The specific implementation of the encryption algorithm is not limited in the present application.

[0021] By implementing the above implementation manner, the trusted chip performs trusted authentication on the components, which can not only solve the shortcoming that the current server can only perform trusted authentication on the CPU, but also achieve the purpose of performing trusted authentication on the complete server, and the authentication of the components does not bring pressure to the authentication node.

[0022] In a possible implementation manner, the first key is used to indicate the integrity of the trusted chip, and the second key is used to indicate the integrity of the components. The integrity includes the integrity of the physical firmware and the integrity of the software system.

[0023] In a specific implementation, the first key can be stored in the trusted chip through an eFuse, so as to achieve integrity protection and secure storage of the key. The eFuse has a one-time programmable characteristic. After the key is burned into the eFuse, if a third party programs the eFuse in a wrong way and with a wrong key, the eFuse will be fused and cannot be recovered. In addition, the eFuse of the chip usually stores information of the chip, such as a power supply voltage that can be used by the chip, a version number, a production date, and the like. The chip reads data in the eFuse during initial power-on, so that storing the key in the eFuse can not only ensure the integrity of the key, but also ensure that the trusted chip has not been tampered with by a third party from the factory to the power-on. Similarly, the second key can also be processed in a similar manner, which is not repeated here. It should be understood that the above method of protecting the integrity and securely storing the first key through the eFuse technology is used for illustration, and the application can also use other secure storage technologies to ensure the integrity of the first key.

[0024] Optionally, after the trusted chip successfully performs trusted authentication on the components, each component, the BMC, and the processor of the server can be powered on, loaded, and run, otherwise a loss mitigation measure can be taken, such as warning notification of authentication failure or server power-off.

[0025] In the above implementation manner, when the trusted chip is tampered with or destroyed by a third party, the first key will be destroyed, and the first certificate generated by the destroyed first key cannot pass the trusted authentication of the authentication node. If the trusted chip is not tampered with or destroyed by a third party, the first certificate generated by the first key will pass the trusted authentication. Similarly, when the components are tampered with or destroyed by a third party, the second key will be destroyed, and the second certificate generated by the destroyed second key cannot pass the trusted authentication of the trusted chip, so as to achieve the trusted authentication of the components by the trusted chip, and further achieve the purpose of performing trusted authentication on the complete server, thereby improving the security of the server.

[0026] In a possible implementation, the method further includes the following steps: the trusted chip sends a first measurement request to the authentication node, the first measurement request is used for the authentication node to perform trusted measurement on the trusted chip, and the trusted chip performs trusted measurement on the component.

[0027] In specific implementations, the trusted chip can perform trusted measurement on the service when the server is powered on for the first time, or can periodically perform trusted measurement on the server during service running. The measurement refers to collecting a measurement report of the server during running, and analyzing and determining whether the system is illegally tampered with during running according to a rule or a model. For example, the measurement report can be a software and hardware state or a running feature during server running. When performing trusted measurement according to the measurement report, the software and hardware state parameters during server running can be compared with preset reference values. If the comparison result is consistent, it indicates that the authentication is passed, and the server is not illegally tampered with during running. If the comparison result is inconsistent, it indicates that the authentication fails, and the server may be illegally tampered with during running. It should be understood that the above example is used for illustration, and the rule or the model used for trusted measurement is not specifically limited in the present application.

[0028] In specific implementations, the trusted chip can first send a trusted measurement request to the authentication node, where the trusted measurement request is used for the authentication node to perform trusted measurement on the trusted chip, and then the trusted chip performs trusted measurement on the component. The trusted measurement request can include a measurement report of the trusted chip. When performing trusted measurement on the component, the trusted chip can first obtain a measurement report of the component, and then verify the measurement report according to a measurement model. If the verification is passed, it indicates that the component has not been tampered with by a third party during server running. The measurement model can be a measurement model downloaded to the local trusted chip in advance, or can be a measurement report verified by a verification node connected remotely and having the measurement model. The present application does not make specific limitation thereon.

[0029] The above implementation, by performing trusted measurement on the component by the trusted chip, can not only solve the shortcoming that the current server can only perform trusted measurement on the CPU, but also achieve trusted measurement on all components of the server, avoid that a third party obtains control authority of the server by replacing components or upgrading and mirroring illegal software in the third phase (for example, server running, maintenance, and update phase) of the server life cycle, and the trusted measurement on the component does not burden the authentication node, so that the present application has high feasibility.

[0030] In a possible implementation, the method further includes the following steps: the trusted chip clears sensitive data in the component in the case of component replacement. The specific operations can include locking or clearing sensitive data in the component, and the present application does not make specific limitation thereon.

[0031] The implementation manner makes it possible to lock or clear sensitive data in the component when the component is scrapped, avoids third parties from cracking sensitive data in the component in the fourth stage (recycling, scrapping, etc.) of the server life cycle, and thus realizes trusted protection of the server in the whole life cycle.

[0032] In a second aspect, a chip is provided, which is applied to a server, the server comprising the chip and a component, the chip and the component being communicatively connected through a bus, the chip comprising: a sending unit configured to send an authentication request to an authentication node, the authentication request being configured to enable the authentication node to perform trusted authentication on the chip; and an authentication unit configured to perform trusted authentication on the component, the component comprising an input / output (IO) component and a storage component.

[0033] The chip described in the second aspect is implemented, and after the chip is trusted authenticated by the authentication node, the chip performs trusted authentication on the component, thereby realizing integrity verification of the whole server, so as to solve the problem of low server security caused by the vulnerability of current trusted computing.

[0034] In a possible implementation manner, the authentication request comprises a first certificate, the first certificate being generated by the chip according to a first preset key, and the first certificate being configured to enable the authentication node to perform trusted authentication on the first certificate according to a first preset certificate.

[0035] In a possible implementation manner, the authentication unit is configured to receive a second certificate sent by the component, the second certificate being generated by the component according to a second preset key, and the authentication unit is configured to perform trusted authentication on the second certificate according to a second preset certificate.

[0036] In a possible implementation manner, the first key is used to indicate the integrity of the chip, and the second key is used to indicate the integrity of the component.

[0037] In a possible implementation manner, the chip comprises a measurement unit, the sending unit is configured to send a first measurement request to the authentication node, the first measurement request being configured to enable the authentication node to perform trusted measurement on the chip, and the measurement unit is configured to perform trusted measurement on the component.

[0038] In a possible implementation manner, the chip further comprises a verification unit, the verification unit is configured to perform integrity verification on firmware of the chip itself before the sending unit sends the authentication request to the trusted authentication node.

[0039] In a possible implementation manner, the chip further comprises a desensitization unit, the desensitization unit is configured to clear sensitive data in the component in the case of replacement of the component.

[0040] In a possible implementation manner, the IO component comprises a network card or a riser, and the storage component comprises one or more of a hard disk backboard, an Expander, and a PCIE switch.

[0041] In a possible implementation, the components include a computing component, an acceleration component, a memory expansion component, and a heat dissipation component, wherein the computing component includes a CPU, a DDR, and a power supply; the acceleration component includes a carrier board and an acceleration card interconnection switch, wherein the acceleration card includes one or more of a graphics processor (GPU), a DPU, and an NPU; the memory expansion component includes a carrier board, and further includes one or more of a memory expansion chip, a DIMM, and an SCM medium; and the heat dissipation component includes one or more of air cooling and liquid cooling.

[0042] In a possible implementation, the chip is integrated into a baseboard management controller (BMC) chip of the server, or the chip is externally connected to the BMC chip.

[0043] In a third aspect, a server is provided, which includes a trusted chip and components. The trusted chip is configured to send an authentication request to an authentication node, and the authentication request is configured to enable the authentication node to perform trusted authentication on the trusted chip. The trusted chip is configured to perform trusted authentication on the components, and the components include input / output (IO) components and storage components.

[0044] The server described in the third aspect is implemented, and after the trusted chip in the server is authenticated by the authentication node, the trusted chip performs trusted authentication on the components, thereby achieving integrity verification of the entire server, to solve the problem of low security of the server due to vulnerabilities in current trusted computing of the server.

[0045] In a possible implementation, the IO components include a network card or a riser, and the storage components include one or more of a hard disk backboard, an Expander, and a PCIE switch.

[0046] In a possible implementation, the components include a computing component, an acceleration component, a memory expansion component, and a heat dissipation component, wherein the computing component includes a CPU, a DDR, and a power supply; the acceleration component includes a carrier board and an acceleration card interconnection switch, wherein the acceleration card includes one or more of a graphics processor (GPU), a DPU, and an NPU; the memory expansion component includes a carrier board, and further includes one or more of a memory expansion chip, a DIMM, and an SCM medium; and the heat dissipation component includes one or more of air cooling and liquid cooling.

[0047] In a possible implementation, the server includes a baseboard management controller (BMC) chip, the trusted chip is integrated into the BMC chip, the trusted chip is connected to the BMC chip in communication through a high-speed bus, the high-speed bus includes one or more of a PCIE bus, a UB bus, and a CXL bus, or the chip is externally connected to the BMC chip, and the trusted chip is connected to the BMC chip in communication through an out-of-band bus, and the out-of-band bus includes a serial bus and a parallel bus.

[0048] In a fourth aspect, a chip is provided, the chip comprising a business core and a security core, the security core being configured to execute instructions to implement the method of any of the above aspects, and a management core being configured to execute instructions to implement a management function.

[0049] In a fifth aspect, a chip is provided, the chip comprising a computing unit and a memory, the memory being configured to store code, and the computing unit being configured to execute the code to implement the method of any of the above aspects.

[0050] In a sixth aspect, a computer readable storage medium is provided, the computer readable storage medium having stored therein instructions which, when executed on a computer, cause the computer to perform the method of any of the above aspects.

[0051] In a seventh aspect, a computer program product comprising instructions is provided, the computer program or instructions, when executed on a computer, causing the computer to perform the method of any of the above method embodiments.

[0052] On the basis of the implementation manners of the above aspects, the present application can be further combined to provide more implementation manners. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1 is a framework diagram of server trustable capability requirements;

[0054] Figure 2 is a structural schematic diagram of a trustable computing system provided by the present application;

[0055] Figure 3 is a structural schematic diagram of a trustable chip provided by the present application;

[0056] Figure 4 is a logical architecture schematic diagram of a trustable computing system provided by the present application;

[0057] Figure 5 is a step flow schematic diagram of a trustable computing method provided by the present application;

[0058] Figure 6 is a step flow schematic diagram of a trustable computing method provided by the present application under the server full life cycle;

[0059] Figure 7 is a structural schematic diagram of a chip provided by the present application;

[0060] Figure 8 is another structural schematic diagram of a chip provided by the present application. DETAILED DESCRIPTION

[0061] Clearly, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work are within the protection scope of the present application.

[0062] First, a new server architecture provided by the present application is explained.

[0063] The technical threshold for developing a traditional server mainboard is high. In addition to a central processing unit (CPU), it also includes bus fan-out, power supply fan-out, maintenance management and other functions. The CPU-related circuits on these mainboards all come from the reference design provided by the CPU manufacturer, and the reference designs provided by different CPU manufacturers are completely different, which makes the development and design of the mainboard require a large amount of resources and time. In order to meet the demand for rapid updating and upgrading of server and other computing products, the whole machine manufacturer needs to invest more effort in differentiation innovation, but often can only focus on low-level hardware specification comparison. This not only cannot meet the needs of customers in various scenarios and computing power, but also forces the whole machine manufacturer to fall into inefficient homogenization competition. With the trend of computing power diversity, more processor manufacturers emerge and launch more processor products with different architectures, and the iteration speed of various processors also increases rapidly. At the same time, the power consumption of processors also continues to increase, and the traditional server cooling technology cannot meet the demand. In addition, in order to improve system performance, the industry has also launched new media types (for example, Intel launches 3D Xpoint new non-volatile media, etc.) and forms, which also need new architecture support and adaptation. In order to develop servers that adapt to the above technical trends, the whole machine manufacturer needs to invest a lot of development workload, but due to the difference of different products, the design scheme of the same mainboard or whole machine cannot be reused. Therefore, the industry puts forward higher requirements for the cross-architecture common components of the server, cross-generation evolution, shortening of time to market (TTM), reduction of total cost of operation (TCO), etc. The further development of the industry needs to build a more open and standardized server architecture, improve the development efficiency, improve the component reuse degree, and provide more flexibility and differentiation.

[0064] The present application proposes an innovative peer-to-peer interconnection architecture (may also be referred to as a new server architecture or a new architecture). In this architecture, the traditional motherboard is first split into a basic computing unit (BCU) and an extension unit (EXU), and the basic computing unit is matched with the extension unit to support the specifications and forms of the motherboard required for different scenarios. In addition, the same computing device can include one basic computing unit and one extension unit, the same computing device can also include multiple basic computing units and one extension unit, and the same computing device can also include one basic computing unit and multiple extension units. The basic computing unit includes a CPU, a double data rate (DDR), and related power supplies, and provides general computing capabilities and extension interfaces for peripheral storage, input / output (IO), acceleration, etc. The basic computing unit supports CPUs of different series. Optionally, the basic computing unit supports heterogeneous processors, i.e., the basic computing unit can support different types of processors, for example, the basic computing unit supports a CPU, and any one of an application-specific integrated circuit (ASIC), a programmable logic device (PLD), a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), a system on chip (SoC), a software-defined infrastructure (SDI) chip, an artificial intelligence (AI) chip, or any combination thereof.

[0065] Further, at least six different forms of baseboards are provided according to business requirements and hardware attributes, which are respectively for different computing performance and memory configuration. For the convenience of description, the six forms of baseboards are referred to as A1, A2, B1, B2, C1 and C2 respectively. In the embodiment, the number of processors is represented by “P”, P is an integer greater than 0, and “DPC” represents dual in-line memory module per channel (DIMM Per Channel). For example, the A1 form of baseboard supports one processor, and one DIMM is inserted per channel (referred to as 1P1DPC); the A2 form of baseboard supports one processor, and one or two DIMMs are inserted per channel (referred to as 1P2DPC or 1P1DPC); the B1 form of baseboard supports two processors, and one DIMM is inserted per channel (referred to as 2P1DPC), or one processor, and one or two DIMMs are inserted per channel (referred to as 1P2DPC or 1P1DPC); the B2 form of baseboard supports two processors, and one or two DIMMs are inserted per channel (referred to as 2P2DPC or 2P1DPC), or one processor, and one or two DIMMs are inserted per channel (referred to as 1P2DPC or 1P1DPC); the C1 form of baseboard supports four processors, and one DIMM is inserted per channel (referred to as 4P1DPC), or two processors, and one or two DIMMs are inserted per channel (referred to as 2P2DPC or 2P1DPC); and the C2 form of baseboard supports four processors, and one or two DIMMs are inserted per channel (referred to as 4P2DPC or 4P1DPC), or two processors, and one or two DIMMs are inserted per channel (referred to as 2P2DPC or 2P1DPC). With the development of technology, the CPU package size, memory channel and DIMM number may change, but the standard size and mounting hole of the motherboard will remain unchanged, so that the baseboard can be updated and replaced while ensuring compatibility across generations and series. For example: the B2 form of baseboard supports 2P2DPC (2P32DIMM) when the current CPU has 8 channels of DDR. After the number of CPU memory channels is increased to 12, 2P2DPC (2P48DIMM) cannot be realized. Then, the B2 form can support 2P1DPC (2P24DIMM), and 2P2DPC (2P48DIMM) can be realized by other forms such as C1, because the mounting hole position and the size of the baseboard are standard, and can be directly replaced and installed.

[0066] The expansion board includes a baseboard management controller (BMC) chip and a management system, a bridge (for example, a platform controller hub (PCH) of an Intel system), is a management expansion of the baseboard, serves as a management center of the entire system, and provides device, security, energy efficiency, reliability, and other management functions. The BMC can also be referred to as a baseboard management controller.

[0067] In the new architecture, the baseboard is connected to the components through a high-speed bus such as PCIE, compute express link (CXL), or a unified bus (UB or Ubus), and is connected to the expansion board through a management interface. In specific implementation, the specific connection manner of the baseboard and the components, and the baseboard and the expansion board includes a soft connection manner in which the above connection is implemented by a cable, or a hard connection manner in which the above connection is implemented by a connector. Further, the components are a collective term of a type of devices or equipment. According to different functions, the components include a storage unit (STU), an input output unit (IOU), an acceleration unit (ACU), a memory expansion unit (MEU), a cooling component, a computing component, a management component, and the like. The baseboard supports different series of CPUs such as Kunpeng, The expansion board provides management functions and power supply for the baseboard and each expansion component. The power supply and the radiator can be variously selected under the support of the expansion board.

[0068] It is worth noting that the baseboard including devices such as a processor, a memory, and a baseboard management controller, or the expansion board can also be a type of component.

[0069] The storage component includes a hard disk backboard, an expansion board (Expander), a PCIE switch, and the like, expands system storage, and supports various media and forms such as a hard disk drive (HDD), a solid-state drive (SSD), a non-volatile memory express (NVMe), and a storage class memory (SCM).

[0070] The IO component includes a Riser and other components, realizes expansion of system IO, and supports a PCIE card and an Open Compute Project (OCP) card.

[0071] The acceleration component includes a Riser, a carrier board, an acceleration card interconnection switch, and the like, and provides system acceleration component expansion and interconnection functions.

[0072] The memory expansion component includes a carrier board, a memory expansion chip, a dual in-line memory module (DIMM), an SCM medium, and the like, and provides system expansion memory bandwidth and content capacity functions.

[0073] The heat dissipation component is used for heat dissipation of a computing device or hardware in the computing device, and includes air cooling, liquid cooling, or a combination of the two. It should be understood that the structure, type, and number of the heat dissipation component do not constitute a limitation on the technical solutions to be protected in the present application.

[0074] The computing component includes a central processing unit (CPU), a memory, and the like, and provides general computing capability.

[0075] The management component includes a baseboard management controller and the like, and provides device management.

[0076] On the other hand, in a conventional server architecture, due to power supply, memory channel number, IO number, rate, and the like, evolution reasons, a processor (for example, a CPU) socket is generally only compatible with each generation (Tick / Tock two small upgrades), and it is difficult to be compatible across generations. The mainboard provided in the present application can set external interfaces in a standardized manner, and various external expansions can be performed in a soft connection manner such as a cable, and can shield differences caused by processor-related power supply, different processors and components, and interconnections between components. Changes in memory and the like are only contained in the mainboard, and the function of mainboard compatibility across generations is realized. In this way, for various manufacturers, when the processor is updated, the matching whole machine, components, and the like can not be replaced, and therefore the matching components have a longer life cycle. For customers, without the need to replace the case and increase the hardware development workload, the latest components can be replaced at any time, and the latest computing power in the industry can be used as soon as possible. For whole machine manufacturers, after the new server architecture realizes cross-generation upgrade and cross-series evolution, the processor needs to be upgraded or replaced with a different processor manufacturer, and only the basic board needs to be replaced, which overturns the original development mode and derives a new industrial mode.

[0077] The embodiment provides a server new architecture, which supports diversified computing power and diversified devices and realizes hardware standardization, including standardization of a baseboard and standardization of a component interface.

[0078] The standardization of the baseboard includes standardization of size, mounting hole position, interface electrical property, management interface protocol and parameter, etc. Table 1 is an example of a baseboard interface description table provided by the application.

[0079] Table 1 is an example of a baseboard interface description provided by the application

[0080]

[0081]

[0082] The power supply adopts a unified 12V input, and the baseboard is internally converted into various required power supplies through a DC / DC converter. Considering the evolution of future I / O and the differentiation of different CPUs, the embodiment defines a Flexible I / O interface based on a UBC and a UBCDD connector, which is used to replace the original PCIE interface. The Flexible I / O interface can be flexibly configured into a PCIE / HCCS / SAS / SATA / ethernet interface according to requirements. The BCU management interface mainly includes common low-speed maintenance interfaces such as I2C, UART, JTAG and the like, and is compatible with the management of common processor platforms.

[0083] Standardization of internal component interfaces of the computing system: the components include an expansion board, a power supply component, a heat dissipation component, a storage component, an IO component, an acceleration component, a memory component and the like, and the electrical interface, the management interface and the parameter of the components are standardized, and the physical size, the installation and the position of the components are not defined and constrained, which provides a wide innovation space and supports differentiation and flexible expansion. The external interface of the component is defined as shown in Table 2 except for the power supply and the high-speed signal.

[0084] Table 2 is an example of a component low-speed management interface definition table provided by the application

[0085]

[0086] In addition to the interface between the EXU and the BCU, other interfaces are connected to each component through the EXU. It is worth noting that the embodiment only defines the functions of the interfaces, and does not limit the specific pin layout (PINMAP) mode, and any implementation mode capable of realizing the functions is within the protection scope of the embodiment.

[0087] It should be noted that the contents of the above table 1 and table 2 are only an example for assisting in explaining the technical solution of the present application, and in specific implementation, the server new architecture, the interface of the baseboard and the low-speed interface of the functional component can each include more or less contents.

[0088] In addition, the present application also provides a kind of intelligent management software, according to the standardization requirement of server new architecture, realizes management object template, after power-on, management software is automatically detected component and obtains the self-description information of component by standard management bus, then according to management object template creates management object instance, to realize management software self-adapting management, supports component automatic discovery and automatic adaptation.

[0089] Secondly, the "trusted computing" application scenario involved in the present application is described.

[0090] Trusted computing is a technical means for ensuring the integrity of server system and application, and ensuring that it runs in the trusted state expected by the design target. Trusted computing can ensure that the server has trusted protection capability throughout its life cycle, and prevent third parties from obtaining the ability to control the computing system.

[0091] Figure 1 It is the demand framework diagram of server trusted capability, and as shown in Figure 1 , the full life cycle of the server includes four stages. In the first stage, transportation and storage, third parties can obtain the ability to control the computing system by replacing hardware or tampering with firmware. In the second stage, startup and access, third parties can obtain the ability to control the computing system by replacing or tampering with software and hardware, and tampering with pre-made data. In the third stage, running, third parties can obtain the ability to control the computing system by tampering with running code and destroying system capabilities. In the fourth stage, scrapping, third parties can obtain customer sensitive data through reverse recovery. Therefore, the server needs to have trusted protection capability throughout its life cycle, including access authentication capability, secure power-on startup capability, dynamic measurement capability during running, and trusted protection capability when upgrading and scrapping components.

[0092] However, the current trusted computing system usually takes the main business processor (CPU) as the core, and the trusted computing chip for implementing server trusted protection is integrated in the CPU or externally connected to the CPU. Since the trusted computing chip depends on the main business processor, there are vulnerabilities in the trusted protection capability of the first and fourth stages when the main business processor is not powered on. Moreover, it is difficult to achieve perfect resource isolation between trusted computing resources and business processing resources for the trusted computing chip integrated in the main business processor, which requires very high isolation design technology, resulting in high threshold for trusted computing design.

[0093] Meanwhile, it can be known from the foregoing that, under the background of massive data, big data analysis, machine learning and artificial intelligence, GPUs, DPUs and NPUs are widely applied, the complexity of hardware devices of a server is significantly improved, the server internally includes not only a business processing system but also a management system of a chip such as a GPU, and current trusted computing can only enable a main business processor to have trusted protection capability and cannot perform trusted protection on other components in a computing system, such as IO components, storage components and components of a chip such as a GPU, if trusted protection is to be performed on other components, a corresponding trusted computing chip needs to be separately deployed for each component, which not only has high cost but also occupies a large amount of system resources, resulting in that current trusted computing lacks integrity verification of the entire server.

[0094] In conclusion, current trusted computing is integrated with a CPU of a server, trusted computing resources and business processing resources are difficult to isolate, the design threshold is high, the CPU is strongly dependent, trusted protection cannot be performed when the CPU is not powered on, and integrity verification of the entire server is lacking, resulting in that current trusted protection of a server has vulnerabilities and the server has low security performance.

[0095] The application proposes a trusted computing scheme on the basis of the above-mentioned new architecture of a server, the scheme integrates or externally hangs a trusted chip in a BMC chip in the new architecture of the server, so that trusted protection of the server no longer depends on a CPU of the server, trusted protection can be performed on the server regardless of whether the CPU is powered on or not, isolation of business processing resources and trusted computing resources is achieved, the design threshold is reduced, and after the trusted chip is authenticated by an authentication node, the trusted chip can perform trusted verification on various components of the server, integrity verification of the entire server is achieved, so as to solve the problem that current trusted computing of a server has vulnerabilities and results in low security of the server.

[0096] Next, the technical scheme provided by the application will be described in detail in combination with the drawings.

[0097] Figure 2 is a structural schematic diagram of a trusted computing system provided by the application, as Figure 2 shown, the trusted computing system includes a server 100 and an authentication node 200, wherein the number of the server 100 can be one or more, Figure 2 One server 100 is taken as an example for illustration, and the application does not make specific limitation thereon. The servers 100 and the server 100 and the authentication node 200 can be connected through a network 300, which can be a wired network or a wireless network, such as an Ethernet or a UBUS-N bus, and the application does not make specific limitation thereon.

[0098] The authentication node 200 can be a physical server, such as an x86 or ARM server; it can also be a virtual machine (VM) implemented based on a general-purpose physical server and combined with network functions virtualization (NFV) technology. A virtual machine refers to a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment. This application does not impose specific limitations on this. In specific implementation, the authentication node 200 is used to receive authentication requests or measurement requests sent by the server 100, and to perform trusted authentication or trusted measurement on the authentication request or measurement request.

[0099] Server 100 can be a physical server with the new architecture described above. In this architecture, the server's motherboard is divided into a base board, expansion boards, and components. The descriptions of the new architecture, base board, expansion boards, and components are as described above and will not be repeated here. In specific implementations, server 100 can be a single server or a node in a server cluster; this application does not impose specific limitations. Optionally, server 100 can also be a storage server or an edge computing device, wherein the architectures of the aforementioned storage servers and edge computing devices are the new architectures described above.

[0100] Furthermore, the server 100 can be divided into multiple unit modules, for example, such as Figure 2 As shown, server 100 includes a trusted chip 110 and components 120, wherein the trusted chip 110 and components 120 establish a communication connection via bus 130. The number of components 120 can be one or more. Figure 2 This application uses four components (IO component, storage component, computing component and acceleration component) as an example for illustration. It does not specifically limit the type and number of components.

[0101] The trusted chip 110 can include an interface and a processor, wherein the processor can include an integrated circuit and / or a device, and the integrated circuit can be a programmable logic device (PLD) or a combination thereof. The PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The trusted chip 110 can also include a mainboard for printing the processor, also known as a printed circuit board (PCB). Alternatively, the trusted chip 110 can be an advanced RISC machine (ARM) architecture processor.

[0102] The component 120 can include a storage component, an IO component, an acceleration component, a computing component, the IO component including a network card or a riser; the storage component including one or more of a hard disk backboard, an Expander, and a PCIE switch. Alternatively, the component also includes a computing component, an acceleration component, a memory expansion component, and a heat dissipation component, wherein the computing component includes a CPU, a DDR, and a power supply; the acceleration component includes a carrier board and an acceleration card interconnection switch, wherein the acceleration card includes one or more of a graphics processor GPU, a DPU, and an NPU; the memory expansion component includes a carrier board, and further includes one or more of a memory expansion chip, a DIMM, and a SCM medium; and the heat dissipation component includes one or more of air cooling and liquid cooling.

[0103] Briefly, the IO component and the acceleration component can be the IO component and the acceleration component in the foregoing description of the new architecture of the server, the storage component includes the storage component and the memory expansion component in the foregoing description of the new architecture of the server, and the computing component is the baseboard in the foregoing description of the new architecture of the server. It should be understood that, for the convenience of understanding, the baseboard is divided into a computing component in the component 120, and the component can also have more kinds of division manners, such as the component 120 can also include the heat dissipation component in the foregoing description, and the division can be performed according to an actual business processing scene, which is not limited specifically herein.

[0104] Optionally, the trusted chip 110 can be integrated in the BMC chip in the foregoing, which can also be referred to as a server intelligent management system (intelligent baseboard management controller, iBMC) or a baseboard management controller. As known from the foregoing, the BMC chip is located on an expansion board of a new architecture server and is a management expansion of a baseboard. As a management center of the entire system, the BMC chip is a server embedded management system for the whole life cycle of the server, which provides a series of management tools such as hardware state monitoring, deployment, energy saving, and security.

[0105] The bus 130 can include an out-of-band bus and a high-speed bus. The high-speed bus can include a PCIE, a CXL, or a UB, etc. The out-of-band bus can be a serial peripheral interface (SPI) bus, a system management bus (SMBUS), an RS202C, an RS422C, a USB bus, etc. The present application does not make specific limitations.

[0106] When the trusted chip 110 is integrated in the BMC chip, the trusted chip 110 is communicatively connected to the IO component, the storage component, and the acceleration component through the out-of-band bus, such as an SPI bus or an SMBUS bus. The trusted chip 110 can also be deployed with a corresponding out-of-band bus controller to realize the communication connection with the IO component, the storage component, and the acceleration component. The trusted chip 110 is communicatively connected to the computing component through the high-speed bus, such as a PCIE bus or a UB bus. The trusted chip 110 can also be deployed with a corresponding high-speed bus controller, such as an end point (EP) controller of PCIE or an EP controller of UB. The present application does not make specific limitations. The bus 130 between the CPU and the trusted chip 110 can include a management interface. The management interface types can include GE, VGA, USB, UART, PWR BTN, UID BTN, etc. The specific description of the management interface can refer to Table 2 in the foregoing, which will not be repeated here.

[0107] When the trusted chip 110 is externally hung on the BMC chip in the foregoing, the trusted chip 110 is communicatively connected to the BMC chip, the storage component, the IO component, and the acceleration component through the out-of-band bus, such as an SPI bus or an SMBUS bus. The trusted chip is deployed with a corresponding out-of-band bus controller to realize the communication connection. The trusted chip 110 is communicatively connected to the computing component (such as the CPU) through the high-speed bus, such as a PCIE bus or a UB bus. The present application does not make specific limitations.

[0108] It can be understood that the application integrates or externally connects the trusted chip 110 to the BMC chip. The BMC chip is a server embedded management system facing the whole life cycle of the server, so that the trusted computing no longer depends on the business server (CPU). Even if the CPU is not powered on, the trusted protection of the server can be performed through the BMC chip, so that the server can also be trusted and protected when the CPU is not powered on (such as the installation, transportation, and scrap stages in the whole life cycle). Moreover, due to the resource isolation advantage of the BMC chip and the CPU itself, the trusted computing no longer needs to consider how to perform resource isolation, reduces the design threshold, and realizes the double-system security architecture of independent hardware protection.

[0109] In the embodiment of the application, the trusted chip 110 can verify the firmware in a secure and trusted starting mode when the BMC starts, ensure the integrity of the firmware itself, and avoid that a third party obtains the control authority of the server by replacing the firmware in the first stage (such as storage, transportation, etc.) of the server life cycle. In a specific implementation, the power-on protection can be realized by BSBC software. The trusted chip 110 can be set as unchangeable after leaving the factory, and supports custom security startup strategy, sets the code security protection according to the business requirements, and the specific implementation of the firmware verification is not limited in the application. After the firmware integrity verification is successful, the BMC chip can start, otherwise, the processing of warning that the firmware is incomplete or the server is powered off is performed.

[0110] In the embodiment of the application, the trusted chip 110 can perform access trusted authentication on the server after the BMC starts, avoid that a third party obtains the control authority of the server by installing or replacing illegal software and hardware in the second stage (such as installation, debugging, and starting stage) of the server life cycle. In a specific implementation, the trusted chip 110 is configured to send an authentication request to the authentication node 200, wherein the authentication request is configured to be used for the authentication node 200 to perform trusted authentication on the trusted chip 110, and the trusted chip 110 is further configured to perform trusted authentication on the component 120. It can be understood that after the trusted chip 110 successfully performs trusted authentication on the component 120, each component, the BMC, and the processor of the server can be powered on, loaded, and run, otherwise, the loss mitigation measures such as warning notification of authentication failure or server power off can be taken.

[0111] It should be noted that after the BMC starts, the trusted chip 110 first sends an authentication request to the authentication node 200 to perform trusted authentication, and after the authentication is passed, the trusted chip 110 performs trusted authentication on the component 120 again, thereby avoiding the situation that the tampered trusted chip 110 performs trusted authentication on the component 120, and improving the accuracy of the trusted authentication of the server.

[0112] Optionally, the trusted chip 110 can be pre-provisioned with a first key, the authentication node 200 is provided with a first preset certificate for authenticating the trusted chip 110, after the BMC is started, the trusted chip 110 can generate a first certificate according to the first key, and then send an authentication request carrying the first certificate to the authentication node 200. The authentication node 200 can authenticate the first certificate according to the preset first preset certificate, and if the authentication is successful, it indicates that the trusted chip 110 has not been tampered with and is a chip with integrity and security, and if the authentication fails, it indicates that the trusted chip has been tampered with.

[0113] Optionally, the component 120 can be pre-provisioned with a second key, and the trusted chip 110 is provided with a second preset certificate for authenticating the component 120, after the trusted chip 110 is authenticated by the authentication node 200, the component 120 can generate a second certificate according to the second key, and the trusted chip 110 receives the second certificate sent by the component 120 and authenticates the second certificate according to the preset second preset certificate, if the authentication is successful, it indicates that the component 120 has not been tampered with and is a component with integrity and security, and if the authentication fails, it indicates that the component has been tampered with, wherein the second preset certificate can be burned into the chip when the trusted chip 110 is manufactured.

[0114] It should be noted that the first key and the second key can be private keys in an encryption algorithm, and the first preset certificate and the second preset certificate can be public key certificates in the encryption algorithm, the trusted chip 110 generates a signature and a first certificate according to the first key (private key), and sends the first certificate carrying the signature to the authentication node 200, the authentication node 200 can perform an unsigned signature operation on the received first certificate through the first preset certificate (public key certificate) to achieve trusted authentication of the trusted chip 110, and similarly, the component 120 can also generate a signature and a second certificate according to the second key (private key), and send the second certificate carrying the signature to the trusted chip 110 for trusted authentication, which will not be repeated here. Wherein, the above-mentioned encryption algorithm can be asymmetric encryption algorithm (RSA), MD5, symmetric encryption algorithm, etc., and the specific implementation of the encryption algorithm is not limited in the present application.

[0115] Optionally, the first key is used to indicate the integrity of the trusted chip 110, which includes the integrity of the physical firmware of the trusted chip 110, and also includes the integrity of the software system on the trusted chip 110. The trusted chip 110 can protect the integrity of the first key and securely store the first key. When the trusted chip 110 is tampered with or destroyed by a third party, the first key will be destroyed, indicating that the integrity of the trusted chip 110 is low. The first certificate generated by the destroyed first key will not pass the trusted authentication of the authentication node 200. If the trusted chip 110 is not tampered with or destroyed by a third party, the integrity of the trusted chip 110 is high, and the first certificate generated by the first key will pass the trusted authentication. Similarly, the second key is used to indicate the integrity of the component 120, which includes the integrity of the physical firmware of the component 120, and also includes the integrity of the software system on the component 120. The component 120 can also be processed in a similar manner, which is not repeated here.

[0116] In a specific implementation, the first key can be stored in the trusted chip through an eFuse, to realize the integrity protection and secure storage of the key. The eFuse has a one-time programmable feature. After the key is burned into the eFuse, if a third party programs the eFuse in a wrong way and with a wrong key, the eFuse will be fused and cannot be restored. In addition, the eFuse of the chip usually stores information of the chip, such as the power supply voltage that can be used by the chip, the version number, the production date, and the like. The chip reads the data in the eFuse during the initial power-on process. Therefore, storing the key in the eFuse not only ensures the integrity of the key, but also ensures that the trusted chip 110 has not been tampered with by a third party from the factory to the power-on. Similarly, the component 120 can also be processed in a similar manner, which is not repeated here. It should be understood that the above method of protecting the integrity and securely storing the first key through the eFuse technology is used for illustration. Other secure storage technologies can also be used to ensure the integrity of the first key.

[0117] It can be understood that the trusted chip 110 performs trusted authentication on the component 120, which not only solves the shortcoming that the current server can only perform trusted authentication on the CPU, but also realizes the purpose of performing trusted authentication on the complete server. The authentication of the component does not affect the authentication node 200, so that the feasibility of the present application is high.

[0118] In the embodiment of the present application, the trusted chip 110 can perform a running trust measurement on the server during the server power-on running process, so as to avoid that a third party obtains the control right of the server by replacing components or upgrading and mirroring illegal software in the third stage (for example, the server running, maintenance and updating stage) of the server life cycle. The measurement refers to collecting a measurement report of the server in the running process, and analyzing and judging whether the system is illegally tampered in the running process according to a rule or a model. For example, the measurement report can be a hardware and software state or a running feature in the server running process. When the trusted measurement is performed according to the measurement report, the hardware and software state parameters in the server running process can be compared with preset reference values. If the comparison result is consistent, it means that the authentication is passed, and the server is not illegally tampered in the running process. If the comparison result is inconsistent, it means that the authentication fails, and the server may be illegally tampered in the running process. It should be understood that the above example is used for illustration, and the rule or the model used in the trusted measurement is not limited in the present application.

[0119] In the specific implementation, the trusted chip 110 can first send a trusted measurement request to the authentication node 200, where the trusted measurement request is used for the authentication node 200 to perform trusted measurement on the trusted chip. Then, the trusted chip 110 performs trusted measurement on the component 120. The trusted measurement request can include a measurement report of the trusted chip 110. When the trusted chip 110 performs trusted measurement on the component 120, the measurement report of the component 120 can be obtained first, and then the measurement report is verified according to a measurement model. If the verification is passed, it means that the component 120 is not tampered by a third party in the server running process. The measurement model can be a measurement model downloaded to the local by the trusted chip 110 in advance, or the measurement report can be verified by a verification node connected remotely and having the measurement model. The present application does not make a specific limitation in this regard.

[0120] It can be understood that the trusted measurement on the component 120 by the trusted chip 110 can not only solve the shortcoming that the current server can only perform trusted measurement on the CPU, but also achieve trusted measurement on all components of the server, avoid that a third party obtains user data or server control right by tampering with components other than the CPU in the server running process, and the trusted measurement on the component does not burden the authentication node 200, so that the present application has high feasibility.

[0121] In the embodiment of the present application, the trusted chip 110 can perform a scrapping process on the component 120 when the component is replaced, which can include operations such as locking or clearing sensitive data in the component 120, so as to avoid that a third party cracks the sensitive data in the component in the fourth stage (recycling, scrapping and the like) of the server life cycle, thereby achieving trusted protection of the server in the whole life cycle.

[0122] In a specific implementation, component 120 may be deployed with a trusted root. The trusted root can be used to perform trusted authentication and trusted measurement operations of component 120. The trusted root can be a hardware chip that is integrated inside the component or attached to the outside of the component to support trusted authentication and trusted measurement operations of component 120.

[0123] Understandably, by deploying a trusted root in component 120, the trusted computing function is handed over to the trusted root for implementation. This ensures that the trusted authentication and trusted measurement operations of the component will not affect the business processing of component 120 itself. Furthermore, the trusted authentication and trusted measurement operations of component 120 are actually handled by the trusted chip 110, which reduces the trusted complexity of the component and is compatible with components of different forms.

[0124] In one implementation, bus 130 can also deploy a root of trust. This root of trust can possess capabilities such as interface security verification, encrypted transmission, access control, authentication, and security measurement. Before the trusted chip 110 is powered on, the root of trust of bus 130 can verify the integrity of the component firmware, further ensuring that server 100 is not tampered with by a third party before power-on. Optionally, the root of trust of bus 130 can have the capability to perform measurement operations, ensuring that bus 130 is not tampered with by a third party during the operation, maintenance, and upgrade of server 100, further improving the trusted protection capability of server 100. The root of trust of bus 130 is deployed on the bus controller in chip form. For example, referring to the foregoing, bus 130 can be an out-of-band bus or a high-speed bus. The root of trust for an out-of-band bus can be an out-of-band bus controller, and the root of trust for a high-speed bus can be a high-speed bus controller. For example, a high-speed bus may include a PCIE bus and a UB bus. Therefore, the root of trust for the PCIE bus can be the PCIE endpoint (EP) controller, and the root of trust for the UB high-speed bus can be the UB EP controller. It should be understood that the above examples are for illustrative purposes only and are not intended to be specific limitations in this application.

[0125] Furthermore, the trusted chip 110 can be divided into multiple units or modules, for example, such as... Figure 3 As shown, the trusted chip 110 may include a register 1101, a one-time programmable memory 1102, an encryption module 1103, a secure boot module 1104, secure memory 1105, a secure core 1106, and an in-band / out-of-band bus controller 1107. The trusted chip 110 may establish a communication connection between the register 1101, the one-time programmable memory 1102, the encryption module 1103, the secure boot module 1104, the secure memory 1105, the secure core 1106, and the in-band / out-of-band bus controller 1107 via a bus.

[0126] The secure start module 1104 can be deployed with the BSBC software, and the BSBC software can realize power-on protection, chip factory unchangeable, firmware detection, and the like before access authentication is performed on the server 100, and can also support configuration of a self-defined security policy, and a user can set code security protection according to a business requirement. In a specific implementation, the secure start module 1104 can be implemented by using a BootROM, where the BootROM is a small piece of ROM or write-protected flash memory embedded in a chip.

[0127] The one-time programmable memory 1102 is configured to store the first key, and to securely store and protect the integrity of the first key. Optionally, the one-time programmable memory 1102 can also support dual-root signature, to further improve the security of the first key. In a specific implementation, the one-time programmable memory 1102 can be the efuse described in the foregoing content, and details can be referred to the foregoing content, which will not be described herein.

[0128] The encryption module 1103 is configured to generate a first certificate according to the first key, and can also be used for key acceleration, anti-side channel attack, certificate verification, and the like, which are not limited herein.

[0129] The register 1101 can be a platform configuration register (PCR), and is configured to store a measurement report of the component 120, and to verify the legality of the measurement report by using a local attestation or a remote attestation.

[0130] The secure memory 1105 is configured to store code, and the secure core 1106 is configured to execute the code in the secure memory 1105, to implement various functions of the trusted chip 110 described in the foregoing content, such as trusted authentication and trusted measurement of the component 120.

[0131] The in-band / out-of-band bus controller 1107 is configured to ensure that the bus 130 cannot be tampered with by a third party during operation, maintenance, and upgrade of the server 100, to further improve the trusted protection capability of the server 100. The in-band bus controller is configured to implement trusted protection of a high-speed bus, and the in-band bus can be a PCIE EP controller or a UB EP controller. The out-of-band bus controller is configured to implement trusted protection of an out-of-band bus, and the out-of-band bus controller can be a SPI bus controller or a SMBUS bus controller, which are not limited herein.

[0132] It should be understood that Figure 3 For example, the trusted chip 110 can further include more components, such as an out-of-band bus controller, a PCIE EP controller, or a UB EP controller. Details of the out-of-band bus controller, the PCIE EP controller, or the UB EP controller can be referred to the foregoing content, which will not be described herein. Figure 2The related description in the embodiments will not be repeated here. It should be noted that Figure 3 The trusted chip 110 shown can be integrated in the BMC chip or externally attached to the BMC chip. The implementation manner can refer to the related content in the foregoing embodiments, which will not be repeated here.

[0133] It should be noted that if the server 100 is one of the servers in the server cluster, in the access trusted authentication process, the management node in the server cluster first sends a second authentication request to the authentication node, and the second authentication request is used for the authentication node to perform trusted authentication on the management node in the server cluster. After the authentication node authenticates that the management node is trusted, the management node can perform trusted authentication on the trusted chip of the server, and after the authentication succeeds, the trusted chip performs trusted authentication on the local component, and so on. It should be understood that the processing result of the first measurement request is similar to it, which will not be expanded here.

[0134] Exemplarily, Figure 4 is a logical block diagram of the trusted computing system provided by the present application, wherein Figure 4 The trusted computing system shown is for Figure 2 Detailed explanation of the trusted computing system shown, such as Figure 4 The trusted computing system provided by the present application can include a system trusted center, a node trusted center, a trusted component, and a trusted system bus. Among them, the system trusted center is deployed in the authentication node 200 in Figure 2 The node trusted center is deployed in the server 100 in Figure 2 The trusted component is deployed in the component 120 in Figure 2 The trusted system bus is the bus 130 in Figure 2

[0135] The system trusted center is used for access trusted authentication and trusted measurement of the node, and is a system trusted management software. The system trusted center can include a system proof center, a system secret pipe center, a system trusted root, a system discretionary policy control, and an access authentication service end. Among them, the system proof center is used for trusted measurement of the node trusted center, the system secret pipe center is used for decryption and authentication of the first certificate sent by the node trusted center according to the first preset certificate, the system discretionary policy control is used for realizing policy distribution and control and improving system resilience, and the access authentication service end is used for access trusted authentication of the server. Among them, the system trusted root is used to support the realization of the above various functions.

[0136] ​The node trusted center is used to perform trusted authentication and trusted measurement for components, and undertakes trusted protection for multiple components. The node trusted center can be the trusted chip mentioned above, integrated inside the BMC chip or externally attached to the BMC chip. The node trusted center includes at least the functions of node trusted root, trusted boot, secure boot, component access authentication, firmware encryption, and trusted platform control module (TPCM). It can also add functions such as one-click sensitive data clearing of components, centralized security upgrade of components, node resilience policy, and chassis security according to actual business needs. This application does not make specific limitations on these functions.

[0137] Trusted components may include trusted I / O components, trusted computing components, trusted storage components, and trusted acceleration components. Among them, trusted computing components are used for trusted protection of the computing runtime environment and data; trusted I / O components are used for high-performance trusted service transmission; trusted storage components are used for high-performance persistent trusted protection; trusted acceleration components are used for high-performance trusted service coprocessing acceleration; and trusted system bus is used to implement the trusted bus standard ecosystem.

[0138] Understandably, the aforementioned components can be designed with corresponding functional requirements for security and trust based on their characteristics and actual business needs. For example, a trusted acceleration component can set a component trust root to generate a second certificate based on a second key and send the second certificate to the node trust center (BMC chip) for access trusted authentication. Similarly, it can also implement operational trusted measurement. A trusted IO component can also set a component trust root to implement access trusted authentication and operational trusted measurement for the IO component. Furthermore, it can also set encrypted transmission functions, sensitive data cleanup functions, etc., to further improve the security and trusted protection of the IO component. The above examples are for illustration only and are not specific limitations in this application. It should be understood that components can combine security and trusted functions as needed, and the coupling between functions should be minimized when designing security and trusted functions. Moreover, the component's access trusted authentication and trusted measurement are handled by the node trusted center, thereby reducing the component's trusted complexity.

[0139] It needs to be explained that, Figure 4 The root of trust in a computer system is a protection mechanism for ensuring the integrity of the system and forms the foundation for building a trusted measurement environment. From a trusted measurement theory perspective, the chain of trust is passed down sequentially and cannot be broken. For building a secure boot chain, the hardware state at power-on is the trusted base of that chain, also called the root of trust. Strictly speaking, the root of trust is often implemented based on hardware-provided mechanisms; therefore, a more complete term would be hardware root of trust. Depending on its function, the hardware root of trust has various uses, such as reporting, booting, measurement, and storage.

[0140] In a specific implementation, the component main chip (i.e., the master control chip of the board card, that is, the chip that is first started when the board card is powered on) integrates a security subsystem or an external security chip (in a scenario where the main chip does not integrate a security subsystem) is connected to the component flash through a MUX (switching switch) to realize secure startup of the component firmware, collection of firmware verification and measurement report, support for sending the second certificate to the node trusted center for access authentication, and sending the measurement report to the node trusted center for trusted measurement.

[0141] It should be noted that for the computing component, the node trusted center can additionally support direct access to the flash of the component to realize secure startup verification and identity measurement of the CPU BIOS for trusted startup, and is responsible for firmware verification of BIOS security upgrade.

[0142] Optionally, the component is connected to the node trusted center through a trusted management channel to realize collection of the measurement report and the security upgrade function. The node trusted center can be a BMC chip, and the BMC chip can run node trusted management software.

[0143] As can be seen from the above, in the trusted computing system provided in the present application, the trusted chip is integrated or externally connected to the BMC chip in the new server architecture, so that the trusted protection of the server no longer depends on the CPU of the server, and the server can be trusted regardless of whether the CPU is powered on or not, the isolation of the business processing resource and the trusted computing resource is realized, the design threshold is reduced, and after the trusted chip is authenticated by the authentication node, the trusted chip can be authenticated as trusted, and the various components of the server can be trusted, the integrity of the entire server is verified, and the problem of low server security caused by the vulnerability of the current server trusted computing is solved.

[0144] Figure 5 The trusted computing method provided in the present application is applied to the new server architecture in the foregoing content, and specifically can be Figures 1-4 The server 100 in the embodiment, the server includes a trusted chip and a component, the trusted chip and the component are connected through a bus, and the method includes the following steps:

[0145] Step S510: The trusted chip 110 sends an authentication request to the authentication node 200, wherein the authentication request is used for the authentication node 200 to perform trusted authentication on the trusted chip 110.

[0146] In an embodiment, the trusted chip 110 is integrated in the baseboard management controller BMC chip of the server, or the trusted chip is externally connected to the BMC chip. The descriptions of the trusted chip 110, the BMC chip, and the authentication node 200 can refer to the related descriptions in the foregoing embodiments, which are not repeated here.

[0147] It can be understood that the trusted chip 110 is integrated or externally connected to the BMC chip, the BMC chip is a server embedded management system facing the whole life cycle of the server, so that the trusted computing no longer depends on the business server (CPU), and the trusted protection of the server can be performed through the BMC chip even if the CPU is not powered on, so that the server can also be trusted and protected when the CPU is not powered on (such as the installation, transportation, and scrap stages in the whole life cycle). Moreover, since the BMC chip has the isolation advantage of computing resources and network resources from the CPU itself, the trusted computing no longer needs to consider how to perform computing resource isolation, reduces the design threshold, realizes the double-system security architecture of independent hardware protection, and at the same time, the exposure surface of the BMC chip management network is less than that of the CPU, the possibility of connection of the third party with the BMC chip is lower than that of the CPU, and the attack risk is reduced.

[0148] In an embodiment, before the trusted chip sends the authentication request to the trusted authentication node, the method further includes: the trusted chip performs integrity verification on the firmware of the trusted chip. Specifically, the firmware can be verified by using a secure and trusted startup method to ensure the integrity of the firmware, and to avoid that a third party obtains the control authority of the server by replacing the firmware in the first stage of the server life cycle (such as storage, transportation, etc.). In a specific implementation, the power-on protection can be realized by BSBC software (a code that can be fixed in software), the trusted chip 110 can be set as unchangeable at factory, and supports custom security startup strategy, and the code security protection setting is performed according to the business demand. The specific implementation of the firmware verification is not limited in the present application. After the firmware integrity verification is successful, the BMC chip can be started, otherwise, the processing of warning that the firmware is incomplete or the server is powered off is performed.

[0149] Step S520: The trusted chip 110 performs trusted authentication on the components 120, and the components 120 include input and output IO components and storage components. The description of the components 120 can refer to the related description in the foregoing embodiments, which will not be repeated here.

[0150] In a specific implementation, after step S510, after the authentication node 200 receives the authentication request sent by the trusted chip 110 and the authentication is successful, the trusted chip 110 can perform step S520 to perform trusted authentication on the components 120, so as to avoid the situation that the tampered trusted chip 110 performs trusted authentication on the components 120, and improve the accuracy of the trusted authentication of the server.

[0151] Optionally, after the trusted chip 110 successfully performs trusted authentication on the components 120, each component, the BMC, and the processor of the server can be powered on, loaded, and run, otherwise, the loss mitigation measures such as the warning notification of authentication failure or the processing of powering off the server can be taken.

[0152] In an embodiment, at step S510, the authentication request sent by the trusted chip 110 to the authentication node 200 includes a first certificate, which is generated by the trusted chip according to a first preset key, and is used for the authentication node to perform trusted authentication on the first certificate according to a first preset certificate. If the authentication is successful, it indicates that the trusted chip 110 is not tampered with and is a chip with integrity and security, and if the authentication fails, it indicates that the trusted chip has been tampered with.

[0153] Similarly, at step S520, the component 120 can be preconfigured with a second key, and the trusted chip 110 is provided with a second preset certificate for performing trusted authentication on the component 120. After the trusted chip 110 is authenticated as trusted by the authentication node 200, the component 120 can generate a second certificate according to the second key, and the trusted chip 110 receives the second certificate sent by the component 120 and performs trusted authentication on the second certificate according to the second preset certificate. If the authentication is successful, it indicates that the component 120 is not tampered with and is a component with integrity and security, and if the authentication fails, it indicates that the component has been tampered with. The second preset certificate can be burned into the chip when the trusted chip 110 is manufactured.

[0154] It should be noted that the first key and the second key can be private keys in an encryption algorithm, and the first preset certificate and the second preset certificate can be public key certificates in the encryption algorithm. The trusted chip 110 generates a signature and a first certificate according to the first key (private key), and sends the first certificate carrying the signature to the authentication node 200. The authentication node 200 can perform an un-signature operation on the received first certificate through the first preset certificate (public key certificate) to achieve trusted authentication of the trusted chip 110. Similarly, the component 120 can also generate a signature and a second certificate according to the second key (private key), and send the second certificate carrying the signature to the trusted chip 110 for trusted authentication. Here, the encryption algorithm can be a non-symmetric encryption algorithm (RSA), MD5, a symmetric encryption algorithm, etc. The specific implementation of the encryption algorithm is not limited in the present application.

[0155] Optionally, the first key is used to indicate the integrity of the trusted chip 110, which includes the integrity of the physical firmware of the trusted chip 110, and also includes the integrity of the software system on the trusted chip 110. The trusted chip 110 can protect the integrity of the first key and securely store the first key. When the trusted chip 110 is tampered with or destroyed by a third party, the first key will be destroyed, indicating that the integrity of the trusted chip 110 is low. The first certificate generated by the destroyed first key will not pass the trusted authentication of the authentication node 200. If the trusted chip 110 is not tampered with or destroyed by a third party, the integrity of the trusted chip 110 is high, and the first certificate generated by the first key will pass the trusted authentication. Similarly, the second key is used to indicate the integrity of the component 120, which includes the integrity of the physical firmware of the component 120, and also includes the integrity of the software system on the component 120. The component 120 can also be processed in a similar manner, which is not repeated here.

[0156] In a specific implementation, the first key can be stored in the trusted chip through an eFuse, to realize the integrity protection and secure storage of the key. The eFuse has a one-time programmable feature. After the key is burned into the eFuse, if a third party programs the eFuse in a wrong way and with a wrong key, the eFuse will be fused and cannot be restored. In addition, the eFuse of the chip usually stores information of the chip, such as the power supply voltage that can be used by the chip, the version number, the production date, and the like. The chip reads the data in the eFuse during the initial power-on process. Therefore, storing the key in the eFuse not only ensures the integrity of the key, but also ensures that the trusted chip 110 has not been tampered with by a third party from the factory to the power-on. Similarly, the component 120 can also be processed in a similar manner, which is not repeated here. It should be understood that the above method of protecting the integrity and securely storing the first key through the eFuse technology is used for illustration. Other secure storage technologies can also be used to ensure the integrity of the first key.

[0157] It can be understood that the trusted chip 110 performs trusted authentication on the component 120, which not only solves the shortcoming that the current server can only perform trusted authentication on the CPU, but also realizes the purpose of performing trusted authentication on the complete server. The authentication of the component does not affect the authentication node 200, so that the feasibility of the present application is high.

[0158] In the embodiment of the present application, the trusted chip 110 can perform a running trust measurement on the server during the server power-on running process, so as to avoid that a third party obtains the control right of the server by replacing components or upgrading and mirroring illegal software in the third stage (for example, the server running, maintenance and updating stage) of the server life cycle. The measurement refers to collecting a measurement report of the server in the running process, and analyzing and judging whether the system is illegally tampered in the running process according to a rule or a model. For example, the measurement report can be a hardware and software state or a running feature in the server running process. When the trusted measurement is performed according to the measurement report, the hardware and software state parameters in the server running process can be compared with preset reference values. If they are consistent, it means that the authentication is passed, and the server is not illegally tampered in the running process. If they are inconsistent, it means that the authentication fails, and the server may be illegally tampered in the running process. It should be understood that the above example is used for illustration, and the rule or the model used in the trusted measurement is not specifically limited in the present application.

[0159] In a specific implementation, the trusted chip 110 can first send a trusted measurement request to the authentication node 200, where the trusted measurement request is used for the authentication node 200 to perform trusted measurement on the trusted chip. Then, the trusted chip 110 performs trusted measurement on the component 120. The trusted measurement request can include a measurement report of the trusted chip 110. When the trusted chip 110 performs trusted measurement on the component 120, the measurement report of the component 120 can be obtained first, and then the measurement report is verified according to a measurement model. If the verification is passed, it means that the component 120 has not been tampered by a third party in the server running process. The measurement model can be a measurement model downloaded to the local trusted chip 110 in advance, or the measurement report can be verified by remotely connecting other verification nodes having the measurement model. The present application does not make a specific limitation in this regard.

[0160] It can be understood that the trusted measurement of the component 120 by the trusted chip 110 in the present application not only can solve the shortcoming that the current server can only perform trusted measurement on the CPU, but also can achieve trusted measurement of all components of the server, avoid that a third party obtains user data or server control right by tampering with components other than the CPU in the server running process, and the trusted measurement of the component does not burden the authentication node 200, so that the present application has high feasibility.

[0161] In the embodiment of the present application, the trusted chip 110 can perform a scrapping process on the component 120 when the component is replaced, which can include operations such as locking or clearing sensitive data in the component 120, so as to avoid that a third party cracks the sensitive data in the component in the fourth stage (recycling, scrapping and the like) of the server life cycle, thereby achieving trusted protection of the server in the whole life cycle.

[0162] In a specific implementation, the component 120 can be deployed with a trusted root, and the access trusted authentication, running trusted measurement and other operations of the component 120 can be implemented by the trusted root. The trusted root can be a hardware chip integrated in the component or externally attached to the component to support the access trusted authentication and running trusted measurement operations of the component 120.

[0163] It can be understood that, by deploying the trusted root in the component 120, the trusted computing function is implemented by the trusted root, so that the component trusted authentication and the component running trusted measurement operation do not affect the business processing of the component 120 itself, and the trusted authentication and running trusted measurement of the component 120 are actually authenticated by the trusted chip 110, which reduces the complexity of the component trusted and can be compatible with different forms of components.

[0164] In an embodiment, the bus 130 can also be deployed with a trusted root, which can have the capabilities of interface security verification, encrypted transmission, access control, identity authentication, security measurement, and the like. Before the trusted chip 110 is powered on, the trusted root of the bus 130 can verify the integrity of the component firmware, further ensuring that the server 100 is not tampered with by a third party before being powered on. Alternatively, the trusted root of the bus 130 can have the ability to run measurement to ensure that the bus 130 will not be tampered with by a third party during the operation, maintenance and upgrade of the server 100, further improving the trusted protection capability of the server 100. The trusted root of the bus 130 is deployed in the form of a chip on the bus controller. For example, as described above, the bus 130 can be an out-of-band bus or a high-speed bus. The trusted root of the out-of-band bus can be an out-of-band bus controller, and the trusted root of the high-speed bus can be a high-speed bus controller. For example, the high-speed bus can include a PCIE bus and a UB bus, and the trusted root of the PCIE bus can be an endpoint (EP) controller of the PCIE. The trusted root of the high-speed bus UB can be an EP controller of the UB. It should be understood that the above examples are used for illustration, and the present application is not limited in this regard.

[0165] The trusted computing method provided by the present application can provide full-life-cycle trusted protection for the server 100, Figure 6 is a step flow diagram of a trusted computing method provided by the present application under the full life cycle of a server. Referring to Figure 1 As can be seen from the embodiments, the full life cycle of the server includes four stages, and the present application can implement the trusted protection requirements of the four stages, that is, the startup has verification, the access has authentication, the running has measurement, and the replacement / scraping has desensitization. As shown in Figure 6 The method can include the following steps:

[0166] Step 1, the trusted chip 110 of the server 100 verifies the integrity of the firmware itself.

[0167] Optionally, after the firmware integrity check is successful, the trusted chip 110 can perform step 2, otherwise, loss mitigation measures can be taken, such as warning notification of firmware missing or server power-off and the like. Step 1 can prevent the server 100 from being replaced or tampered with the hardware firmware by a third party during the transportation and storage process, and achieve the starting verification of the trusted protection requirement.

[0168] Step 2, the trusted chip 110 of the server 100 sends an authentication request to the authentication node 200, wherein the authentication request carries a first certificate generated by the trusted chip 110 according to a preset first secret key.

[0169] Specifically, the trusted chip 110 can first enable the component 120 to be powered on, and receive and respond to the challenge message initiated by the authentication node 200, while initiating a trusted challenge to the component 120. Further, after receiving the challenge message initiated by the access authentication center, the trusted chip 110 generates a first certificate based on the preset first secret key, and sends the first certificate to the authentication node 200 for trusted authentication of the trusted chip 110.

[0170] Step 3, the authentication node 200 returns an authentication success message to the trusted chip 110. It should be understood that if the authentication node 200 fails to authenticate the first certificate, it indicates that the trusted chip 110 has been damaged, and the authentication node 200 can return an authentication failure message to the trusted chip 110, and the server 100 can take loss mitigation measures, such as warning notification of access authentication failure or server power-off and the like.

[0171] Step 4, the trusted chip 110 performs trusted authentication on the component 120. The component 120 generates a second certificate according to a preset second secret key, and sends it to the trusted chip 110. The trusted chip 110 performs trusted verification on the second certificate according to the preset second preset certificate, which can be referred to in the foregoing step S520 and will not be repeated here.

[0172] Specifically, the trusted chip 110 initiates a trusted challenge to the trusted component at step 2. After receiving the trusted challenge message, the trusted component generates a second certificate based on a preset second secret key, and sends it to the trusted chip 110 for trusted authentication. The trusted chip 110 can verify the second certificate based on the second preset certificate. If the verification is passed, the trusted chip 110 sends a challenge success message to the component 120. After receiving the challenge success message, the component 120 can continue to the next operation, such as loading a basic input output system (BIOS) or firmware. If the verification fails, the server 100 can take loss mitigation measures, such as warning notification of component trusted authentication failure or component power-off or server power-off and the like.

[0173] It can be understood that steps 2-4 can prevent the server 100 from being installed with an untrusted version of software by a third party during the installation and startup process, or from being tampered with data by a third party, to achieve the trusted protection requirement of access authentication.

[0174] Step 5, the trusted chip 110 sends a trusted measurement request to the authentication node 200. The trusted measurement request includes the measurement report of the trusted chip 110, and the specific description of the measurement report can refer to the related description of the embodiments, which is not repeated here. Figures 2-5

[0175] Step 6, the authentication node 200 returns a measurement verification success message to the trusted chip 110. It should be understood that if the authentication node 200 confirms that the measurement fails after processing the trusted measurement request, it means that the trusted chip 110 has been tampered with or destroyed by a third party during operation. The authentication node 200 can return a measurement failure message to the trusted chip 110, and the server 100 can take loss mitigation measures, such as warning notification of untrusted operation measurement or server power-off processing.

[0176] Step 7, the trusted chip 110 performs trusted measurement on the components.

[0177] It can be understood that steps 5-7 can prevent the server 100 from being tampered with running code, stealing customer data, or destroying the system by a third party during operation, to achieve the trusted protection requirement of running measurement.

[0178] Step 8, the trusted chip 110 empties the sensitive data in the scrapped components. It can be understood that step 8 can prevent the server 100 from being reverse recovered by a third party when replacing / scraping components, to achieve the trusted protection requirement of replacement / scraping desensitization. In specific implementation, the trusted chip 110 can send a notification to the component 120 to empty the sensitive data, and the component 120 can perform local sensitive data emptying or locking processing after receiving the notification.

[0179] As can be seen from the above, the trusted computing method provided by the present application integrates or externally hangs the trusted chip in the BMC chip in the new architecture of the server, so that the trusted protection of the server no longer depends on the CPU of the server. Whether the CPU is powered on or not, the server can be trusted, the isolation of business processing resources and trusted computing resources is realized, and the design threshold is reduced. Moreover, after being authenticated as trusted by the authentication node, the trusted chip can perform trusted verification on various components of the server, and implement integrity verification of the entire server, to solve the problem of vulnerability of current server trusted computing, and low server security.

[0180] Figure 7 ​This application provides a chip 700, which can be the trusted chip 110 mentioned above. This chip is applied to the server 100 mentioned above, such as... Figure 7 As shown, the chip 700 may include a sending unit 710, an authentication unit 720, a measurement unit 730, a verification unit 740, and a desensitization unit 750.

[0181] The sending unit 710 is used to send an authentication request to the authentication node, which is used by the authentication node to perform trusted authentication of the chip.

[0182] The authentication unit 720 is used to perform trusted authentication on components, including input / output (I / O) components and storage components.

[0183] In one embodiment, the authentication request includes a first certificate, which is generated by the chip based on a preset first key. The first certificate is used by the authentication node to perform trusted authentication of the first certificate based on the first preset certificate.

[0184] In one embodiment, the authentication unit 720 is used to receive a second certificate sent by the component, the second certificate being generated by the component according to a preset second key, and the authentication unit 720 is used to perform trusted authentication on the second certificate according to the second preset certificate.

[0185] In one embodiment, a first key is used to indicate the integrity of the chip, and a second key is used to indicate the integrity of the component.

[0186] In one embodiment, the sending unit 710 is used to send a first measurement request to the authentication node, the first measurement request being used by the authentication node to perform a trust measurement on the chip, and the measurement unit 730 is used to perform a trust measurement on the component.

[0187] In one embodiment, the verification unit 740 is used to perform integrity verification on the chip's own firmware before the sending unit 710 sends an authentication request to the trusted authentication node.

[0188] In one embodiment, the desensitization unit 750 is used to remove sensitive data within a component in the event of component replacement.

[0189] In one embodiment, the I / O component includes a network interface card (NIC) or a riser; the storage component includes one or more of a hard disk backplane, an expander, and a PCIe switch.

[0190] In a possible implementation, the components include a computing component, an acceleration component, a memory expansion component, and a heat dissipation component, wherein the computing component includes a CPU, a DDR, and a power supply; the acceleration component includes a carrier board and an acceleration card interconnection switch, wherein the acceleration card includes one or more of an image processor GPU, a DPU, and an NPU; the memory expansion component includes a carrier board, and further includes one or more of a memory expansion chip, a DIMM, and a SCM medium; and the heat dissipation component includes one or more of air cooling and liquid cooling.

[0191] In an embodiment, the chip is integrated in a baseboard management controller (BMC) chip of the server, or the chip is externally connected to the BMC chip.

[0192] In summary, the chip provided in the present application is integrated in or externally connected to the BMC chip in the new architecture of the server, so that the trusted protection of the server is no longer dependent on the CPU of the server, and the trusted protection of the server can be performed regardless of whether the CPU is powered on or not, the isolation of the business processing resource and the trusted computing resource is realized, the design threshold is reduced, and after the chip is authenticated by the authenticated node, the chip can perform trusted verification on various components of the server, and the integrity of the entire server is verified, so as to solve the problem of low server security caused by the vulnerability of the current trusted computing of the server.

[0193] Figure 8 is a structural schematic diagram of a chip provided in the present application. The chip 800 is Figures 1 to 7 a trusted chip in the embodiments. Further, the chip 800 includes a computing unit 801, a memory 802, and a communication interface 803, wherein the computing unit 801, the memory 802, and the communication interface 803 communicate through a bus 804, and also communicate through other means such as wireless transmission.

[0194] The computing unit 801 is a programmable logic device (PLD). For example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The computing unit 801 executes various types of digital storage instructions, such as a software or firmware program stored in the memory 802, which enables the chip 800 to provide a wide variety of services.

[0195] The memory 802 is used to store program codes, and is controlled by the computing unit 801 to execute, so as to execute the above Figures 1-8The processing steps of the trusted chip 110 in any of the embodiments can be implemented by program codes. The program codes include one or more software units, and the one or more software units are Figure 7 The sending unit and the authentication unit in the embodiments, wherein the sending unit is configured to send a trusted authentication request to the authentication node, and the authentication unit is configured to perform trusted authentication on the component. For specific implementation manners, refer to Figures 1-7 The description of the embodiments is not repeated here.

[0196] The memory 802 includes read-only memory and random access memory, and provides instructions and data for the computing unit 801. The memory 802 also includes non-volatile random access memory. For example, the memory 802 can be used to store a first secret key used to generate a first certificate, and can also be used to store a second preset certificate used to perform trusted authentication on the component.

[0197] The memory 802 is a volatile memory or a non-volatile memory, or includes both volatile and non-volatile memories. Among them, the non-volatile memory is a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory is a random access memory (RAM) used as an external cache. By way of example and not limitation, many forms of RAM are used, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), and direct rambus RAM (DR RAM). Also, the hard disk is a hard disk drive (HDD), a solid state disk (SSD), a mechanical hard disk (HDD), and the like, and the application does not make specific limitations.

[0198] The communication interface 803 is a wired interface (such as an Ethernet interface), an internal interface (such as a Peripheral Component Interconnect express (PCIE) bus interface), a wired interface (such as an Ethernet interface), or a wireless interface (such as a cellular network interface or a wireless local area network interface), for communication with other servers or units. In a specific implementation, the communication interface 803 is used to send a trusted authentication request to an authentication node, and receive a second certificate sent by a component, for the computing unit 801 to perform trusted authentication processing of the component. In a specific implementation, the specific implementation of the communication interface 803 can refer to the interface description of the BMC chip in the foregoing Table 2 implementation, which is not repeated here.

[0199] The bus 804 is a Peripheral Component Interconnect Express (PCIE) bus, or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), or the like. The bus 804 includes an out-of-band bus and a high-speed bus, and descriptions of the out-of-band bus and the high-speed bus can be referred to Figures 1-7 Embodiments, which are not repeated here. For the sake of clarity, various buses are all marked as the bus 804 in the figure.

[0200] Need to explain, Figure 8 Only one of the possible implementation modes of the embodiments of the present application, in actual application, the chip 800 further includes more or less components, which are not limited here. For the content not shown or described in the embodiments of the present application, refer to the foregoing Figures 1-7 Embodiments, which are not repeated here.

[0201] The embodiments of the present application provide a chip, comprising a business core and a security core, wherein the security core is used to realize the management function of the BMC chip in the foregoing content, and the security core is used to realize Figure 5 And Figure 6 The trusted measurement method described in the embodiments.

[0202] The embodiments of the present application provide a computer readable storage medium, comprising: the computer readable storage medium stores computer instructions; when the computer instructions run on the computer, the computer executes the trusted computing method described in the foregoing method embodiments.

[0203] The embodiments of the present application provide a computer program product containing instructions, comprising a computer program or instructions, when the computer program or instructions run on the computer, the computer executes the trusted computing method described in the foregoing method embodiments.

[0204] The above-described embodiments, all or part of which, are realized by software, hardware, firmware, or any combination thereof. When realized by software, the above-described embodiments, all or part of which, are realized in the form of a computer program product. The computer program product includes at least one computer instruction. When the computer program instruction is loaded or executed in a computer, the flow or function according to the embodiments of the present application is generated, all or part of which. The computer is a general-purpose computer, a special-purpose computer, a computer network, or other programming devices. The computer instruction is stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instruction is transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.). The computer readable storage medium is any medium that the computer can access or is a data storage node such as a server, data center, etc. containing at least one medium set. The medium is a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD), or a semiconductor medium. The semiconductor medium is an SSD.

[0205] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A reliable computing method, characterized in that, The method is executed by a trusted chip, which is independent of a central processing unit (CPU) and is connected to at least one component via a bus. The method includes: Send an authentication request to the authentication node, the authentication request being used by the authentication node to perform trusted authentication on the trusted chip; Upon receiving a successful authentication message from the authentication node, trusted authentication is performed on the at least one component, which includes at least one of the following components: input / output (IO) component, storage component, acceleration component, computing component, and heat dissipation component.

2. The method according to claim 1, characterized in that, The authentication request includes a first certificate, which is generated by the trusted chip based on a preset first key. The first certificate is used by the authentication node to perform trusted authentication on the first certificate based on the first preset certificate.

3. The method according to claim 2, characterized in that, The trusted authentication of the at least one component includes: Receive a second certificate sent by the at least one component, wherein the second certificate is generated by the at least one component based on a preset second key; The second certificate is verified using the second preset certificate.

4. The method according to claim 3, characterized in that, The first key is used to indicate the integrity of the trusted chip, and the second key is used to indicate the integrity of the component.

5. The method according to claim 4, characterized in that, The method further includes: Send a first measurement request to the authentication node, the first measurement request being used by the authentication node to perform a trust measurement on the trusted chip; Perform a trust metric on the component.

6. The method according to claim 5, characterized in that, Before sending an authentication request to a trusted authentication node, the method further includes: performing an integrity check on its own firmware.

7. The method according to claim 6, characterized in that, The method further includes: In the event of replacement of at least one component, sensitive data within that component shall be cleared.

8. The method according to any one of claims 1 to 6, characterized in that, The I / O components include network cards or high-speed serial computer expansion bus standard PCIe expansion cards (risers). The storage components include one or more of the following: hard disk backplane, expansion board, and PCIe switch.

9. The method according to any one of claims 1 to 6, characterized in that, The components also include memory expansion components; The computing components include the CPU, double-data-rate synchronous dynamic random access memory (DDR), and a power supply. The acceleration component includes a carrier board and an accelerator card interconnection switch, wherein the accelerator card includes one or more of a graphics processing unit (GPU), a distributed processing unit (DPU), and a neural network processing unit (NPU); The memory expansion component includes a carrier board, and also includes one or more of the following: memory expansion chip, dual in-line memory module (DIMM), and memory-level storage medium (SCM). The heat dissipation components include one or more types of air cooling and liquid cooling.

10. The method according to any one of claims 1 to 6, characterized in that, The trusted chip is integrated into the baseboard management controller (BMC) chip of the server, or the trusted chip is externally attached to the BMC chip.

11. A chip, characterized in that, The chip is independent of the central processing unit (CPU), and the chip is connected to at least one component via a bus. The chip includes: A sending unit is used to send an authentication request to an authentication node, the authentication request being used by the authentication node to perform trusted authentication of the chip; An authentication unit is configured to perform trusted authentication on at least one component upon receiving a successful authentication message from the authentication node. The at least one component includes at least one of the following components: an input / output (I / O) component, a storage component, an acceleration component, a computing component, and a heat dissipation component.

12. The chip according to claim 11, characterized in that, The authentication request includes a first certificate, which is generated by the chip based on a preset first key. The first certificate is used by the authentication node to perform trusted authentication of the first certificate based on the first preset certificate.

13. The chip according to claim 12, characterized in that, The authentication unit is configured to receive a second certificate sent by the at least one component, wherein the second certificate is generated by the component based on a preset second key; The authentication unit is used to perform trusted authentication on the second certificate based on the second preset certificate.

14. The chip according to claim 13, characterized in that, The first key is used to indicate the integrity of the chip, and the second key is used to indicate the integrity of the component.

15. The chip according to claim 14, characterized in that, The chip includes a measurement unit; The sending unit is used to send a first measurement request to the authentication node, the first measurement request being used by the authentication node to perform a trust measurement on the chip; The measurement unit is used to perform a trust measurement on the at least one component.

16. The chip according to claim 15, characterized in that, The chip also includes a verification unit, which is used to perform integrity verification on the chip's own firmware before the sending unit sends an authentication request to the trusted authentication node.

17. The chip according to claim 16, characterized in that, The chip also includes a desensitization unit, which is used to remove sensitive data within the at least one component in the event of replacement of the at least one component.

18. The chip according to any one of claims 11 to 17, characterized in that, The I / O components include a network interface card (NIC) or a high-speed serial computer expansion bus standard PCIe expansion card (PCIe Riser); the storage components include one or more of a hard disk backplane, an expansion board, and a PCIe switch.

19. The chip according to any one of claims 11 to 17, characterized in that, The components also include memory expansion components; The computing components include a central processing unit (CPU), double-data-rate synchronous dynamic random access memory (DDR), and a power supply. The acceleration component includes a carrier board and an accelerator card interconnection switch, wherein the accelerator card includes one or more of a graphics processing unit (GPU), a distributed processing unit (DPU), and a neural network processing unit (NPU); The storage component includes a carrier board, and also includes one or more of the following: memory expansion chip, dual in-line memory module (DIMM), and memory-level storage medium (SCM). The heat dissipation components include one or more types of air cooling and liquid cooling.

20. The chip according to any one of claims 11 to 17, characterized in that, The chip is integrated into the baseboard management controller (BMC) chip of the server, or the chip is externally attached to the BMC chip.

21. A server, characterized in that, The server includes a central processing unit (CPU), a trusted chip, and at least one component, wherein the trusted chip is independent of the CPU. The trusted chip is used to send an authentication request to the authentication node, and the authentication request is used for the authentication node to perform trusted authentication on the trusted chip. The trusted chip is used to perform trusted authentication on the at least one component upon receiving a successful authentication message returned by the authentication node. The at least one component includes at least one of the following components: an input / output (I / O) component, a storage component, an acceleration component, a computing component, and a heat dissipation component.

22. The server according to claim 21, characterized in that, The I / O components include a network interface card (NIC) and a high-speed serial computer expansion bus standard PCIe expansion card (PCIe Riser); the storage components include a hard disk backplane, an expansion board (Expander), and a PCIe switch (Switch).

23. The server according to claim 21, characterized in that, The components also include memory expansion components; The computing components include a central processing unit (CPU), double-data-rate synchronous dynamic random access memory (DDR), and a power supply. The acceleration component includes a carrier board and an accelerator card interconnection switch, wherein the accelerator card includes one or more of a graphics processing unit (GPU), a distributed processing unit (DPU), and a neural network processing unit (NPU); The memory expansion component includes a carrier board, and also includes one or more of the following: memory expansion chip, dual in-line memory module (DIMM), and memory-level storage medium (SCM). The heat dissipation components include one or more types of air cooling and liquid cooling.

24. The server according to any one of claims 21 to 23, characterized in that, The server includes a Baseboard Management Controller (BMC) chip; The trusted chip is integrated into the BMC chip, and the trusted chip establishes a communication connection with the BMC chip through a high-speed bus, which includes one or more of the PCIE bus, UB bus, and CXL bus. or, The chip is externally attached to the BMC chip, and the trusted chip establishes a communication connection with the BMC chip through an out-of-band bus, which includes a serial bus and a parallel bus.

25. A chip, characterized in that, The chip includes a service core and a security core. The security core is used to run instructions to implement the method as described in any one of claims 1 to 10, and the service core is used to run instructions to implement management functions.

26. A chip, characterized in that, The chip includes a computing unit and a memory, the memory being used to store code, and the computing unit being used to execute the code to implement the method as claimed in any one of claims 1 to 10.

Images