Trusted computing platform based on TEE and method for executing protection task

Abstract

A trusted computing platform based on TEE, a method for executing a security protection task, and a computing device, the trusted computing platform comprising a computing component and a protection component, the protection component comprising: a trusted software base TSB; the TPCM comprises a TPCM functional component and a light-weight TPCM management component, the TPCM functional component is used for carrying out safety protection on the computing component, and the light-weight TPCM management component is used for carrying out life cycle management on the TSB and the TPCM functional component. The trusted computing platform can improve the security of the TPCM.

Description

Technical Field

[0001] The present application relates to the field of security, and more specifically, to a trusted computing platform based on TEE, a method for performing protection tasks, and a computing device. Background Art

[0002] Trusted execution environment (TEE) is one of the mainstream security architectures of modern processors. The system architecture of TEE includes the non-secure world (NWd) and the secure world (SWd). TEE is an independent, isolated, secure operating environment. Since TEE provides an isolated environment to store the user's sensitive information (e.g., the user's code and data), TEE provides a more secure space for the execution of code and data, and ensures the confidentiality and security of the user's sensitive information (e.g., the user's code and data).

[0003] The trusted computing platform is composed of computing components and protection components, so that the trusted computing platform has two parallel features of computing and protection. The protection components include a trusted software base (TSB) and a trusted platform control module (TPCM). In a related solution of a trusted computing platform based on TEE, TPCM includes TPCM OS, and TPCM OS includes TPCM functional components and TEE OS. Since the software part of TPCM contains TEE OS code, the scale of TEE OS code is too large, resulting in a large attack surface of TPCM and low security, making it difficult to pass security audits and security certifications, and it cannot be used as a trusted root.

[0004] Therefore, how to improve the security of TPCM in trusted computing platforms has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides a TEE-based trusted computing platform, a method for executing protection tasks, and a computing device, wherein the trusted computing platform can improve the security of TPCM.

[0006] In a first aspect, a trusted computing platform based on a trusted execution environment TEE is provided, wherein the trusted computing platform includes a computing component and a protection component, wherein the protection component includes: a trusted software base TSB; a trusted platform control module TPCM, wherein the TPCM includes a TPCM functional component and a lightweight TPCM management component, wherein the TPCM functional component is used to perform security protection on the computing component, and the lightweight TPCM management component is used to perform life cycle management on the TSB and the TPCM functional component.

[0007] In the system architecture of the TEE-based trusted computing platform provided above, TPCM includes TPCM functional components and lightweight TPCM management components. The lightweight TPCM management component, as the basic software of TPCM, is responsible for the management of TSB and TPCM functional components in the trusted computing platform. Since the TPCM management component included in the basic software of TPCM is lightweight, the code size of the TPCM management component is small, which makes the code size of TPCM small, which can reduce the attack surface of TPCM from the design point of view and improve the security of TPCM.

[0008] In combination with the first aspect, in certain implementations of the first aspect, the TPCM functional component is a module in the lightweight TPCM management component, and the lightweight TPCM management component includes the TPCM functional component.

[0009] In combination with the first aspect, in certain implementations of the first aspect, the TPCM functional component is an independent TEE instance.

[0010] In the above technical solution, the TPCM functional component is deployed as an independent TEE instance, and the TPCM functional component and the lightweight TPCM management component are deployed separately, thereby improving the security of the TPCM functional component.

[0011] In combination with the first aspect, in some implementations of the first aspect, the lightweight TPCM management component also includes a first communication module, and the first communication module is used for communication between the TSB and the computing component to facilitate the lightweight TPCM management component to manage the TSB.

[0012] In combination with the first aspect, in some implementations of the first aspect, the lightweight TPCM management component also includes a second communication module, which is used for communication between the TSB and the TPCM functional component to facilitate the lightweight TPCM management component to manage the TPCM functional component.

[0013] In combination with the first aspect, in certain implementations of the first aspect, the TSB is used to build an independent TEE instance.

[0014] In the above technical solution, since TSB is built as an independent TEE instance, it can be a FW program and managed by the TPCM management component, and no longer relies on the management function of TEE OS, thereby decoupling TSB from TEE OS and further decoupling the entire trusted computing platform solution from TEE OS.

[0015] In combination with the first aspect, in certain implementations of the first aspect, the trusted computing platform is a trusted computing platform based on the ArmTrustzone S-EL2 architecture, the lightweight TPCM management component is built based on the secure partition manager SPM, and the TEE instance is an independent secure partition SP.

[0016] In combination with the first aspect, in certain implementations of the first aspect, the trusted computing platform is a trusted computing platform based on a secure virtualization architecture, namely, the Intel TDX architecture, the lightweight TPCM management component is built based on the TDX-Module, and the TEE instance is an independent trusted domain TD.

[0017] In combination with the first aspect, in certain implementations of the first aspect, the lightweight TPCM management component is specifically used to manage any one or more of the following life cycles of the TSB and the TPCM functional component: start, interrupt, resume, stop, and destroy.

[0018] In the above technical solution, the lightweight TPCM management component adopts coarse-grained life cycle management for the TSB and the TPCM functional component, which is relatively simple to implement.

[0019] In a second aspect, a method for a trusted computing platform to perform security protection tasks is provided, wherein the trusted computing platform includes a computing component and a protection component, the protection component includes a trusted software base TSB and a trusted platform control module TPCM, the TPCM includes a TPCM functional component and a lightweight TPCM management component, the method comprising: the lightweight TPCM management component receives protection request information sent by the computing component, the lightweight TPCM management component is used to manage the life cycle of the TPCM functional component and the trusted software base TSB; the lightweight TPCM management component sends the protection request information to the TSB; the TSB calls the TPCM functional component to perform the protection task, the TPCM functional component is used to perform security protection on the computing component; the TSB sends the execution result of the protection task to the computing component through the lightweight TPCM management component.

[0020] In combination with the second aspect, in certain implementations of the second aspect, the TPCM functional component is an independent TEE instance.

[0021] In combination with the second aspect, in some implementations of the second aspect, the TPCM functional component is a module in the lightweight TPCM management component, and the lightweight TPCM management component includes the TPCM functional component.

[0022] In combination with the second aspect, in certain implementations of the second aspect, the lightweight TPCM management component also includes a first communication module, which is used for communication between the TSB and the computing component to facilitate the lightweight TPCM management component to manage the TSB. The lightweight TPCM management component sends the protection request information to the TSB through the first communication module.

[0023] In combination with the second aspect, in certain implementations of the second aspect, the lightweight TPCM management component also includes a second communication module, which is used for communication between the TSB and the TPCM functional component, so that the lightweight TPCM management component can manage the TPCM functional component, and the TSB calls the TPCM functional component through the second communication module to perform protection tasks.

[0024] In combination with the second aspect, in some implementations of the second aspect, the method further includes: the TSB sends a trusted control request to the TSB agent in the computing component through a lightweight TPCM management component, so that the TSB agent performs trusted control on the computing component based on the trusted control request.

[0025] In combination with the second aspect, in certain implementations of the second aspect, the TSB is used to build an independent TEE instance.

[0026] In combination with the second aspect, in certain implementations of the second aspect, the trusted computing platform is a trusted computing platform based on the ArmTrustzone S-EL2 architecture, the lightweight TPCM management component is built based on the secure partition manager SPM, and the TEE instance is an independent secure partition SP.

[0027] In combination with the second aspect, in certain implementations of the second aspect, the trusted computing platform is a trusted computing platform based on the Intel TDX architecture, the lightweight TPCM management component is built based on the TDX-Module, and the TEE instance is an independent trusted domain TD.

[0028] In combination with the second aspect, in certain implementations of the second aspect, the lightweight TPCM management component is specifically used to manage any one or more of the following life cycles of the TSB and the TPCM functional component: start, interrupt, resume, stop, and destroy.

[0029] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method in the second aspect or any possible implementation of the second aspect.

[0030] Optionally, the processor may be a general-purpose processor, which may be implemented by hardware or software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory, which may be integrated in the processor or located outside the processor and exist independently.

[0031] In a fourth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the method in the second aspect and any one of the implementations of the second aspect.

[0032] In a fifth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method in the second aspect and any one of the implementations of the second aspect.

[0033] By way of example, these computer-readable storages include, but are not limited to, one or more of the following: read-only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), Flash memory, electrically EPROM (EEPROM), and hard drive.

[0034] Optionally, as an implementation manner, the above-mentioned storage medium may specifically be a non-volatile storage medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 The following is a schematic block diagram of the system architecture of a TEE.

[0036] Figure 2 It is a system architecture diagram of a trusted computing platform.

[0037] Figure 3 This is a system architecture of a trusted computing platform based on TEE provided in an embodiment of the present application.

[0038] Figure 4It is a schematic diagram of a storage method provided by an embodiment of the present application, which stores TSB 311, TPCM functional component 312, and lightweight TPCM management component 313 in the form of software.

[0039] Figure 5 This is another system architecture of a trusted computing platform based on TEE provided in an embodiment of the present application.

[0040] Figure 6 This is another system architecture of a trusted computing platform based on TEE provided in an embodiment of the present application.

[0041] Figure 7 It is a schematic flowchart of a method for a protection component to perform a protection task provided in an embodiment of the present application.

[0042] Figure 8 It is a schematic block diagram of a cloud scenario applicable to an embodiment of the present application.

[0043] Fig. 9 It is a schematic diagram of the architecture of a computing device 1500 provided in an embodiment of the present application.

[0044] Fig.10 It is a schematic diagram of the architecture of a computing device cluster provided in an embodiment of the present application.

[0045] Fig.11 It is a schematic diagram of the connection between computing devices 1500A and 1500B via a network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0047] The present application will present various aspects, embodiments or features around a system including multiple devices, components, modules, etc. It should be understood and appreciated that each system may include additional devices, components, modules, etc., and / or may not include all devices, components, modules, etc. discussed in conjunction with the figures. In addition, combinations of these schemes may also be used.

[0048] In addition, in the embodiments of the present application, words such as "exemplary" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present concepts in a concrete way.

[0049] In the embodiments of the present application, "corresponding (corresponding, relevant)" and "corresponding (corresponding)" can sometimes be used interchangeably. It should be pointed out that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0050] The business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0051] References to "one embodiment" or "some embodiments" etc. described in this specification mean that a particular feature, structure or characteristic described in conjunction with the embodiment is included in one or more embodiments of the present application. Thus, the phrases "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear at different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0052] In the present application, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: including the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0053] Trusted execution environment (TEE) is one of the mainstream security architectures of modern processors. Figure 1 This is a schematic block diagram of the system architecture of a TEE. Figure 1As shown, the system architecture of the TEE includes a non-secure world (NWd) 110 and a secure world (SWd) 120. That is, in the TEE system, one or more secure computing environments (i.e., SWd120) isolated from the normal computing environment (i.e., NWd 110) are constructed, and various security functions are deployed in SWd 120 to provide security services for NWd 110.

[0054] It should be understood that TEE is an independent, isolated, and secure operating environment. Since TEE provides an isolated environment to store the user's sensitive information (e.g., the user's code and data), TEE provides a more secure space for the execution of code and data, and ensures the confidentiality and security of the user's sensitive information (e.g., the user's code and data).

[0055] In the TEE system architecture, the processor CPU 130 is shared between NWd 110 and SWd 120 in a time-sharing manner, but the hardware (HW) resources between NWd 110 and SWd 120 are isolated from each other. For example, the Normal-HW 111 in NWd 110 and the Secure-HW 121 in SWd 120 are isolated from each other. Among them, the Normal-HW 111 may include but is not limited to: Normal-memory, hard disk resources, Normal-hardware interface, etc. The Secure-HW 121 is generally considered to be inherently secure, and the Secure-HW 121 may include but is not limited to: Secure-memory, Secure-cryptographic engine, Secure-hardware interface, etc.

[0056] In addition, the TEE system architecture still maintains the privilege level division of the processor, such as Figure 1 In the system, the main privilege levels include but are not limited to: PL0, PL1, PL2, PL3, etc. As an example, PL0 is generally a user mode, PL1 is generally a supervisor mode, PL2 is generally a hypervisor mode, and PL3 is generally a monitor mode.

[0057] The following takes NWd 110 and SWd 120 as examples to describe in detail the programs and components mainly deployed at each privilege level.

[0058] As an example, in NWd 110, PL0 generally runs one or more applications (Application, APP), responsible for executing computing business functions. PL1 generally runs an operating system (operating system, OS), responsible for managing one or more APPs, providing system services for one or more APPs, etc. When NWd 110 supports virtualization, PL2 generally runs a virtual machine monitor (hypervisor, HV), supports the deployment and management of multiple virtual machines (virtual machines, VMs), and OS and one or more APPs can be deployed in each VM.

[0059] As another example, in SWd 120, PL0 generally runs one or more trusted applications (TA) and is responsible for executing security service functions. PL1 generally runs TEE operating system (TEE OS) and is responsible for managing one or more TAs, providing system services for one or more TAs, etc. When SWd 120 supports secure virtualization, PL2 generally runs Secure-HV, supports the deployment and management of one or more TEE instances, and TEE OS and one or more TAs can be deployed in each TEE instance. PL3 generally runs Secure-firmware (FW), which is considered to be inherently secure, is responsible for the secure loading and startup of the system, and provides underlying firmware services, etc.

[0060] It should be understood that applications running on TEE are called trusted applications (TA). TEE divides independent trusted areas in the processor (e.g., central processing unit (CPU)) and memory, and isolates different TAs in the processor and memory to prevent different TAs from arbitrarily reading and accessing data from each other. TAs running in TEE can access all functions of the device's main processor and memory, and hardware isolation protects these components from being affected by user-installed applications running in the main operating system.

[0061] Figure 2 It is a system architecture diagram of a trusted computing platform. Figure 2 As shown, the trusted computing platform is composed of a computing component 210 and a protection component 220, so that the trusted computing platform has two parallel features of computing and protection.

[0062] The computing component 210 performs business-related computing tasks, and the protection component 220 actively measures and controls the computing component 110. Optionally, the above-mentioned trusted computing platform also includes a remote management center 230, and the protection component 220 can also communicate with the remote management center 230 through an external interface, including obtaining trusted policies and reporting audit results.

[0063] As an example, the computing component 210 includes one or more APP 211, OS 212, FW 213, and HW 214. Among them, the OS 212 includes a trusted software base (TSB) agent 2121, and the TSB agent 2121 communicates with the protection component 220 to transfer information, including initiating a measurement or control request to the TSB 221 in the protection component 220, so that the TSB 221 in the protection component 220 actively measures and controls the computing component 110.

[0064] It should be understood that the TSB is a collection of software elements that provide support for the trustworthiness of the trusted computing platform.

[0065] As an example, the protection component 220 includes a TSB 221, a trusted platform control module (TPCM) 222, a trusted cryptography module (TCM) 223, and a trusted platform module (TPM) 224. The functions of the components included in the protection component 220 are described in detail below.

[0066] TSB 221 is used to receive measurement, control and other requests from the computing component 110, and call the measurement, control, judgment and support service function interfaces provided by TPCM 222 to actively measure and control the computing component 110.

[0067] TCM 223\TPM 224 is a hardware module in the trusted computing platform, which provides cryptographic computing functions for the trusted computing platform and has a protected storage space.

[0068] TPCM 222 is a core protection component integrated in the trusted computing platform. It is the trust anchor of the trusted computing platform, that is, the trusted root, and provides functions such as trusted measurement, trusted control, trusted verification, encryption protection, trusted reporting, and password calling. TPCM 222 provides interfaces for various trusted functions to TSB 221 upward, and can call the hardware password capabilities of TCM223\TPM224 downward to complete the protection of computing components. As an example, TPCM 222 consists of a hardware part and a software part, wherein the software part includes TPCM functional components and basic software, and the hardware part includes trusted hardware. For example, TPCM functional components may include but are not limited to: trusted control, trusted measurement, judgment service, support mechanism service and policy library management components, as well as interfaces provided for TSB 221. For another example, the basic software may include but is not limited to: software components responsible for resource scheduling and task management of TPCM 222, and providing I / O interface driver and control. For example, trusted hardware may include but is not limited to: a CPU required for the operation of TPCM222, a trusted static random access memory (SRAM), a trusted dynamic random access memory (DRAM), a trusted cryptographic engine, a trusted network port, a trusted peripheral component interconnect express (PCIE), etc.

[0069] In a related solution of a trusted computing platform based on TEE, TPCM includes TPCM OS, and TPCM OS includes TPCM functional components and TEE OS. Since TEE OS can not only schedule and manage TPCM functional components and TSB, but also includes some driver modules, libraries, etc., the scale of TEE OS code is too large (the code scale is about 200KLoC). TPCM OS is implemented based on TEE OS, and the software part of TPCM includes TEE OS code, which leads to a large attack surface and low security of TPCM, making it difficult to pass security audits and security certifications, and cannot be used as a trusted root.

[0070] In view of this, the embodiment of the present application provides a trusted computing platform based on TEE, by constructing a lightweight TPCM management component in the TPCM of the trusted computing platform, the lightweight TPCM management component is responsible for managing the TSB and TPCM functional components in the TPCM. Since the TPCM management component included in the basic software of the TPCM is lightweight, the code size of the lightweight TPCM management component is small, so that the code size of the TPCM is small, which can reduce the attack surface of the TPCM from the design point of view and improve the security of the TPCM.

[0071] Figure 3 This is a system architecture of a trusted computing platform based on TEE provided in the embodiment of the present application. Figure 3 As shown in FIG. 1 , the system architecture of the trusted computing platform may include: a computing component 210 and a protection component 310. Figure 1 Taking the TEE system architecture shown as an example, the computing component 210 can be deployed in NWd 110 and the protection component 310 can be deployed in SWd 120.

[0072] As an example, the computing component 210 includes one or more APP 211, OS 212, FW 213, and HW 214. For details about the functions of each module included in the computing component 210, please refer to Figure 2 The description in will not be repeated here.

[0073] As an example, the protection component 310 includes: TSB 311, TPCM functional component 312, lightweight TPCM management component 313, Secure-FW 314, Secure-HW 315, TCM 316\TPM 317. Among them, TPCM functional component 312, lightweight TPCM management component 313, Secure-FW 314, Secure-HW 315 can all belong to TPCM.

[0074] The functions of each component included in the protective component 310 are described in detail below.

[0075] TSB 311 is managed by a lightweight TPCM management component 313 .

[0076] Optionally, in some embodiments, TSB 311 may be constructed as an independent TEE instance. As an example, the independent TEE instance may be a FW program.

[0077] It should be understood that the privilege level of TSB 311 may be SWd PL0 or SWd PL1.

[0078] The TPCM functional component 312 is managed by the lightweight TPCM management component 313. There are many ways to implement the TPCM functional component 312, and the embodiments of the present application do not specifically limit this. In one example, the TPCM functional component 312 can be constructed as a TEE instance, for example, it can be a FW program. For example, in this implementation, the privilege level of the TPCM functional component 312 can be SWd PL0 or SWd PL1. In another example, the TPCM functional component 312 can be constructed as a module in the lightweight TPCM management component 313, and the TPCM functional component 312 is a part of the lightweight TPCM management component 313. For example, in this implementation, the privilege level of the TPCM functional component 312 is the same as the privilege level of the lightweight TPCM management component 313, which is the Secure-FW layer of SWd PL2 or SWd PL3.

[0079] It should be noted that the specific functions provided by the TPCM functional component 312 can be found in Figure 2 The description in will not be repeated here.

[0080] The lightweight TPCM management component 313 is responsible for managing the TSB 311 and the TPCM functional component 312. For example, the lightweight TPCM management component 313 can be constructed in the Secure-FW layer of SWd PL2 or SWd PL3. The lightweight TPCM management component 313 is used to manage the life cycle of the TSB 311 and the TPCM functional component 312. The life cycle management may include but is not limited to the following management of the TSB 311 and the TPCM functional component 312: start, interrupt, resume, stop, and destroy.

[0081] Optionally, in some embodiments, the lightweight TPCM management component may also be referred to as a lightweight TPCMmanager.

[0082] In some embodiments, the lightweight TPCM management component 313 may include: a TSB-NWd communication module 3131, a TSB-TPCM communication module 3132, and a management module 3133. Optionally, if the TPCM functional component 312 is constructed as a module in the lightweight TPCM management component 313, the lightweight TPCM management component 313 also includes the TPCM functional component 312. The TSB-NWd communication module 3131 is used for communication interaction between the TSB 311 and the computing component 210 in the NWd 110, so that the lightweight TPCM management component 313 can manage the TSB 311. The TSB-TPCM communication module 3132 is used for communication interaction between the TSB 311 and the TPCM functional component 312, so that the lightweight TPCM management component 313 can manage the TPCM functional component 312. The management module 3133 is responsible for managing the TSB 311 and the TPCM functional component 312 , and mainly implements software functions such as starting, interrupting, resuming, stopping, and destroying the TSB 311 and the TPCM functional component 312 .

[0083] The system architecture of the TEE-based trusted computing platform provided in the embodiment of the present application includes TSB and TPCM, wherein the lightweight TPCM management component is the basic software of TPCM, responsible for the management of the TSB in the trusted computing platform and the TPCM functional components in TPCM. Since the TPCM management component included in the basic software of TPCM is lightweight, the code size of the TPCM management component is small (for example, in the trusted computing platform based on the secure virtualization architecture of Arm Trustzone S-EL2, the lightweight management component is built based on the lightweight SPM, and the open source SPM code size is about 20KLoC), so that the code size of TPCM is small, which can reduce the attack surface of TPCM from the design, improve the security of TPCM, facilitate security auditing and security certification, and can be used as a trusted root.

[0084] That is to say, the TPCM in the trusted computing platform provided in the embodiment of the present application does not include TEE OS, but includes a lightweight TPCM management component. Since the lightweight TPCM management component is responsible for the management of the TSB in the trusted computing platform and the TPCM functional components in the TPCM, and does not include other driver modules and other functions, the code size of the lightweight TPCM management component is smaller, thereby making the code size of TPCM smaller, reducing the attack surface of TPCM, improving the security of TPCM, making TPCM easy to security audit and security certification, and can be used as a trusted root.

[0085] In the embodiment of the present application, the above-mentioned TSB 311, TPCM functional component 312, and lightweight TPCM management component 313 are stored and called in the form of software. Figure 4 As shown, before the processor is started, these three software are stored in a non-volatile memory, such as a Flash memory. Among them, TSB 311 is stored as a TEE instance image; TPCM functional component 312 is stored as a TEE instance image or as a module in a lightweight TPCM management component 313, and is part of the lightweight TPCM management component 313; the lightweight TPCM management component 313 is stored as an image or as part of a Secure-FW image. After the processor startup program is loaded, the processor loads these three software into the processor's memory (such as SRAM, DRAM) for storage. For example, these three software can be loaded into the processor's Secure-memory and stored in the form of a program. When the processor executes a protection task in the running state, the instructions of these three software will be executed in the processor's unit (for example, CPU).

[0086] Optionally, in some embodiments, TSB can also be constructed as an independent TEE instance. Since TSB is constructed as an independent TEE instance, it can be a FW program managed by the TPCM management component and no longer rely on the management function of TEE OS, thereby decoupling TSB from TEE OS and further decoupling the entire trusted computing platform solution from TEE OS. This improves the flexibility of the trusted computing platform.

[0087] The embodiments of the present application do not specifically limit the secure virtualization architecture supported by the TEE system. In one example, the secure virtualization architecture is a secure virtualization architecture based on Arm Trustzone S-EL2. In another example, the secure virtualization architecture is a secure virtualization architecture based on Intel TDX.

[0088] The following takes the two security virtualization architectures supported by the TEE system as examples. Figure 5-Figure 6 , two specific implementation methods of the trusted computing platform based on TEE are described in detail. It should be understood that Figure 5-Figure 6 The examples are only intended to help those skilled in the art understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to Figure 5-Figure 6 The specific numerical values ​​or specific scenarios shown in the examples. Figure 5-Figure 6 The examples given below are obviously susceptible to various equivalent modifications or changes, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0089] Figure 5 This is another system architecture of a trusted computing platform based on TEE provided in the embodiment of the present application. Figure 5 As shown in the figure, in the Arm Trustzone S-EL2 secure virtualization architecture, the NWd privilege levels are EL0, EL1, and EL2; the SWd privilege levels are S-EL0, S-EL1, S-EL2, and S-EL3. Among them, a secure partition manager (SPM) can be deployed in S-EL2, which is equivalent to Secure-HV. SPM supports the construction of multiple isolated TEE instances, called secure partitions (SP). The privilege level of SP can be S-EL0 or S-EL1, and S-EL3 runs Secure-FW.

[0090] For example, Figure 5 As shown, in the protection component 510, TSB 511 is used to build an independent SP (which can be understood as an independent TEE instance, called TSB SP), which can be a FW program and is managed by a lightweight TPCM management component 513, and the privilege level can be S-EL0 or S-EL1. The TPCM functional component 512 is constructed as an independent SP (called TPCM SP), which can be a FW program and is managed by a lightweight TPCM management component 513, and the privilege level can be S-EL0 or S-EL1. At the S-EL2 privilege level, based on the lightweight SPM, a lightweight TPCM management component 513 is constructed, which is responsible for managing TSB 511 (TSBSP) and TPCM functional component 512 (TPCM SP). The lightweight TPCM management component 513, the TPCM functional component 512 (TPCMSP) and the Secure FW 514 constitute the software part of the TPCM.

[0091] It should be noted that the lightweight TPCM management component 513 has the same function as the lightweight TPCM management component 313. For details, please refer to Figure 3 The description of the lightweight TPCM management component 313 is not repeated here.

[0092] In the above-mentioned trusted computing platform based on the secure virtualization architecture of Arm Trustzone S-EL2, on the one hand, the lightweight TPCM management component built on the lightweight SPM is responsible for managing the TSB SP and TPCM SP. Since the TPCM software part no longer contains the TEE OS (code size is about 200KLoC), but contains a lightweight TPCM management component built on the lightweight SPM (open source SPM code size is about 20KLoC), the software size of TPCM is greatly reduced. On the other hand, TSB is built as an independent SP, which can be a FW program, managed by the lightweight TPCM management component, and no longer relies on the management function of TEE OS, so that TSB SP is decoupled from TEE OS, and further decoupled from the entire trusted computing platform solution and TEE OS.

[0093] Figure 6 This is another system architecture of a trusted computing platform based on TEE provided in the embodiment of the present application. Figure 6 As shown in the figure, in the Intel TDX secure virtualization architecture, the Intel TDX architecture supports running multiple Normal VMs. The VMs are managed by the virtual machine manager (VMM) in Hypervisor Mode, and the VMM can be equivalent to HV. Intel TDX also supports multiple secure trusted domains (TD), which can be equivalent to TEE instances. TD is managed by TDX-Module, which can be equivalent to Secure-HV. TD OS and TD Apps can run in TD, TD OS is equivalent to TEE OS, and TD Apps is equivalent to Tas. TDX-Module runs in the newly introduced privileged mode (Secure-Arbitration Mode (SEAM Mode)).

[0094] For example, Figure 6As shown, in the protection component 610, TSB 611 is used to be constructed as an independent TD (which can be understood as an independent TEE instance, called TSB TD), which can be a FW program and is managed by a lightweight TPCM management component 613. The TPCM functional component 612 is constructed as an independent TD (called TPCM TD), which can be a FW program and is managed by a lightweight TPCM management component 613. The lightweight TPCM management component 613 built based on TDX-Module is responsible for managing TSB 611 (TSBTD) and TPCM functional component 612 (TPCM TD). The lightweight TPCM management component 613, TPCM functional component 612 (TPCMTD) and Secure FW 614 constitute the software part of TPCM.

[0095] In the above-mentioned trusted computing platform based on Intel TDX secure virtualization architecture, on the one hand, the lightweight TPCM management component built on the lightweight TDX-Module is responsible for managing TSB TD and TPCM TD. Since the TPCM software part no longer contains TEE OS (code size is about 200KLoC), but contains a lightweight TPCM management component built on the lightweight TDX-Module, the software size of TPCM is greatly reduced. On the other hand, TSB is built as an independent TD, which can be a FW program, managed by the lightweight TPCM management component, and no longer relies on the management function of TEE OS, so that TSB TD is decoupled from TEE OS, and the entire trusted computing platform solution is further decoupled from TEE OS.

[0096] Below Figure 3 Taking the system architecture of the TEE-based trusted computing platform as an example, combined with Figure 7 , a method for a processor to perform a protection task provided by an embodiment of the present application is described in detail. It should be understood that Figure 7 The examples are only intended to help those skilled in the art understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to Figure 7 The specific numerical values ​​or specific scenarios shown in the examples. Figure 7 The examples given below are obviously susceptible to various equivalent modifications or changes, and such modifications and changes also fall within the scope of the embodiments of the present application.

[0097] Figure 7 is a schematic flow chart of a method for a protection component to perform a protection task provided by an embodiment of the present application. Figure 7 As shown, the method may include steps 710-770, and steps 710-770 are described in detail below.

[0098] It should be understood that during the initialization phase, the management module 3133 in the lightweight TPCM management component 313 is responsible for initializing the TSB 311 (TEE instance) and the TPCM functional component 312 .

[0099] Step 710 : The computing component 210 sends computing component information to the protection component through the TSB agent in the OS 212 in the computing component 210 .

[0100] As an example, the computing component information may include, but is not limited to: memory address information, TSB agent interception computing component behavior information, etc.

[0101] Step 720 : The TSB agent sends the computing component information to the lightweight TPCM management component 313 in the protection component 310 .

[0102] As an example, the TSB agent in the computing component 210 can send computing component information to the lightweight TPCM management component 313 in the protection component 310. Specifically, the TSB-NWd communication module 3131 in the lightweight TPCM management component 313 receives the information and forwards the information to the TSB 311 (TEE instance) in the protection component through the TSB-NWd communication module 3131.

[0103] Step 730: TSB 311 (TEE instance) determines the protection tasks to be performed based on the received information.

[0104] As an example, TSB 311 (TEE instance) may determine a protection task to be performed based on the received information, and the protection task may include but is not limited to: a trusted measurement task, a trusted control task, etc.

[0105] Step 740: TSB 311 (TEE instance) calls TPCM function component 312 through lightweight TPCM management component 313 according to the protection task to be executed.

[0106] As an example, after determining the protection task to be performed, TSB 311 (TEE instance) can call TPCM function component 312 through lightweight TPCM management component 313, so that TPCM function component 312 performs the protection task. For example, TSB 311 (TEE instance) can call TPCM function component 312 through TSB-TPCM communication module 3132 in lightweight TPCM management component 313.

[0107] Step 750: The TPCM functional component 312 executes the protection task and calls the Secure-HW resource.

[0108] As an example, the TPCM functional component 312 may perform protection tasks by calling Secure-HW resources.

[0109] In the embodiment of the present application, the TPCM functional component 312 can also call TCM 316\TPM 317 by calling the Secure-hardware interface (such as PCIE) in Secure HW.

[0110] Step 760: For the trusted measurement task, after returning to TSB 311 (TEE instance) through layer-by-layer calls, TSB 311 (TEE instance) completes the measurement task.

[0111] Step 770: For the trusted control task, TSB 311 (TEE instance) needs to send control instructions to the TSB agent in OS 212, and complete the control task of the computing component 210 with the assistance of the TSB agent.

[0112] As an example, the TSB 311 (TEE instance) may send control instructions to the TSB agent in the computing component 210 via the TSB-NWd communication module 3131 in the lightweight TPCM management component 313 .

[0113] In a possible implementation, the above method provided in the embodiment of the present application can be applied to a cloud service scenario, and the method is executed by a cloud management platform in the cloud service scenario. Figure 8 , describe the cloud service scenarios in detail.

[0114] Figure 8 is a schematic block diagram of a cloud scenario applicable to an embodiment of the present application. Figure 8 As shown, the cloud scenario may include: a cloud management platform 810 , the Internet 820 , and a client 830 .

[0115] like Figure 8 As shown, the cloud management platform 810 is used to manage the infrastructure that provides multiple cloud services. The infrastructure includes multiple cloud data centers, each of which includes multiple servers, each of which includes cloud service resources to provide corresponding cloud services for tenants.

[0116] The cloud management platform 810 may be located in a cloud data center, which may provide an access interface (such as an interface or an application program interface (API)). The tenant may operate the client 830 to remotely access the access interface to register a cloud account and password on the cloud management platform 810, and log in to the cloud management platform 810. After the cloud management platform 810 successfully authenticates the cloud account and password, the tenant may further pay to select and purchase a virtual machine of a specific specification (processor, memory, disk) on the cloud management platform 810. After the paid purchase is successful, the cloud management platform 810 provides the remote login account and password of the purchased virtual machine, and the client 830 may remotely log in to the virtual machine, install and run the tenant's application in the virtual machine. Therefore, the tenant may create, manage, log in and operate a virtual machine in the cloud data center through the cloud management platform 810. Among them, the virtual machine may also be called a cloud server (elastic compute service, ECS) or an elastic instance (different cloud service providers have different names).

[0117] It should be understood that tenants of cloud services can be individuals, enterprises, schools, hospitals, administrative agencies, etc.

[0118] The functions of the cloud management platform 810 include, but are not limited to, user console, computing management service, network management service, storage management service, authentication service, and image management service. The user console provides an interface or API to interact with tenants, the computing management service is used to manage servers running virtual machines and containers and bare metal servers, the network management service is used to manage network services (such as gateways, firewalls, etc.), the storage management service is used to manage storage services (such as data bucket services), the authentication service is used to manage tenant accounts and passwords, and the image management service is used to manage virtual machine images. Tenants can use the client 830 to log in to the cloud management platform 810 through the Internet 820 to manage the rented cloud services.

[0119] Combine the following Fig. 9, a computing device provided in an embodiment of the present application is described in detail. The computing device may also be referred to as a computer system. It includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer includes hardware such as a processing unit, a memory, and a memory control unit, and then the function and structure of the hardware are described in detail. The operating system is any one or more computer operating systems that implement business processing through a process, such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a Windows operating system. The application layer includes applications such as a browser, an address book, a word processing software, and an instant messaging software. Moreover, optionally, the computer system is a handheld device such as a smart phone, or a terminal device such as a personal computer, which is not particularly limited in the present application.

[0120] Fig. 9 1 is a schematic diagram of the architecture of a computing device 1500 provided in an embodiment of the present application. The computing device 1500 may be a server or a computer or other device with computing capabilities. Fig. 9 The computing device 1500 shown includes at least one processor 1510 and a memory 1520 .

[0121] It should be understood that the present application does not limit the number of processors and memories in the computing device 1500 .

[0122] The processor 1510 executes the instructions in the memory 1520, so that the computing device 1500 implements the method provided by the present application. Alternatively, the processor 1510 executes the instructions in the memory 1520, so that the computing device 1500 implements the functions of each component provided by the present application. As an example, the instructions in the memory 1520 may be software programs of the TSB 311, the TPCM functional component 312, and the lightweight TPCM management component 313. For a detailed description, please refer to Figure 4 , I will not go into details here.

[0123] Optionally, the computing device 1500 further includes a communication interface 1530. The communication interface 1530 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1500 and other devices or a communication network.

[0124] Optionally, the computing device 1500 further includes a system bus 1540, wherein the processor 1510, the memory 1520, and the communication interface 1530 are respectively connected to the system bus 1540. The processor 1510 can access the memory 1520 through the system bus 1540. For example, the processor 1510 can read and write data or execute code in the memory 1520 through the system bus 1540. The system bus 1540 is a peripheral component interconnect express (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus 1540 is divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0125] In a possible implementation, the function of the processor 1510 is mainly to interpret the instructions (or codes) of the computer program and process the data in the computer software. The instructions of the computer program and the data in the computer software can be stored in the memory 1520 or the cache 1516.

[0126] Optionally, the processor 1510 may be an integrated circuit chip with signal processing capabilities. As an example and not a limitation, the processor 1510 is a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. Among them, the general-purpose processor is a microprocessor, etc. For example, the processor 1510 is a central processing unit (CPU).

[0127] Optionally, each processor 1510 includes at least one processing unit 1512 and a memory control unit 1514 .

[0128] Optionally, the processing unit 1512 is also called a core or kernel, which is the most important component of the processor. The processing unit 1512 is manufactured from single crystal silicon using a certain production process, and all calculations, command reception, command storage, and data processing of the processor are performed by the core. The processing units run program instructions independently and use the ability of parallel computing to speed up the running speed of the program. Various processing units have a fixed logical structure. For example, the processing unit includes logical units such as a first-level cache, a second-level cache, an execution unit, an instruction-level unit, and a bus interface.

[0129] In one implementation example, the memory control unit 1514 is used to control data interaction between the memory 1520 and the processing unit 1512. Specifically, the memory control unit 1514 receives a memory access request from the processing unit 1512, and controls access to the memory based on the memory access request. As an example and not a limitation, the memory control unit is a device such as a memory management unit (MMU).

[0130] In one implementation example, each memory control unit 1514 addresses the memory 1520 through the system bus. And an arbiter ( Fig. 9 ), which is responsible for handling and coordinating competing accesses of multiple processing units 1512.

[0131] In an implementation example, the processing unit 1512 and the memory control unit 1514 are connected to each other through connection lines inside the chip, such as address lines, so as to achieve communication between the processing unit 1512 and the memory control unit 1514.

[0132] Optionally, each processor 1510 also includes a cache 1516, wherein the cache is a buffer for data exchange (called cache). When the processing unit 1512 wants to read data, it will first search for the required data from the cache. If it is found, it will be executed directly. If it is not found, it will be searched from the memory. Since the running speed of the cache is much faster than the memory, the role of the cache is to help the processing unit 1512 run faster.

[0133] The memory 1520 can provide a running space for the processes in the computing device 1500. For example, the computer program (specifically, the program code) used to generate the process is stored in the memory 1520. After the computer program is executed by the processor to generate the process, the processor allocates a corresponding storage space for the process in the memory 1520. Furthermore, the above storage space further includes a text segment, an initialized data segment, a bit initialized data segment, a stack segment, a heap segment, etc. The memory 1520 stores the data generated during the running of the process in the storage space corresponding to the above process, such as intermediate data, process data, etc.

[0134] Optionally, the storage is also called memory, and its function is to temporarily store the operation data in the processor 1510 and the data exchanged with the external storage such as the hard disk. As long as the computer is running, the processor 1510 will transfer the data to be calculated to the memory for calculation, and when the calculation is completed, the processing unit 1512 will transmit the result.

[0135] As an example and not limitation, memory 1520 is a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory is a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory is a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), and direct rambus RAM (DRRAM). It should be noted that the memory 1520 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0136] The structure of the computing device 1500 listed above is only an example, and the present application is not limited thereto. The computing device 1500 of the embodiment of the present application includes various hardware in the computer system in the prior art. For example, the computing device 1500 also includes other memories besides the memory 1520, such as disk storage, etc. Those skilled in the art should understand that the computing device 1500 may also include other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the above-mentioned computing device 1500 may also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the above-mentioned computing device 1500 may also include only the devices necessary to implement the embodiment of the present application, and does not necessarily include Fig. 9 All devices shown in .

[0137] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device may be a server. In some embodiments, the computing device may also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0138] like Fig.10 As shown, the computing device cluster includes at least one computing device 1500. The memory 1520 in one or more computing devices 1500 in the computing device cluster may store the same instructions for executing the above method.

[0139] In some possible implementations, the memory 1520 in one or more computing devices 1500 in the computing device cluster may also store some instructions for executing the above method. In other words, the combination of one or more computing devices 1500 may jointly execute the instructions of the above method.

[0140] It should be noted that the memory 1520 in different computing devices 1500 in the computing device cluster may store different instructions, which are respectively used to execute part of the functions of the above-mentioned apparatus. That is, the instructions stored in the memory 1520 in different computing devices 1500 may implement the functions of one or more modules in the above-mentioned apparatus.

[0141] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network, etc. Fig.11 A possible implementation is shown. Fig.11 As shown, two computing devices 1500A and 1500B are connected via a network. Specifically, they are connected to the network via a communication interface in each computing device.

[0142] It should be understood that Fig.11The functionality of the computing device 1500A shown in FIG. 1 may also be implemented by multiple computing devices 1500. Similarly, the functionality of the computing device 1500B may also be implemented by multiple computing devices 1500.

[0143] In this embodiment, a computer program product including instructions is also provided. The computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on a computing device, the computing device is caused to execute the method provided above, or the computing device is caused to implement the function of the apparatus provided above.

[0144] In this embodiment, a computer-readable storage medium is also provided. The computer-readable storage medium may be any available medium that can be stored by a computing device or a data storage device such as a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions. When the instructions in the computer-readable storage medium are executed on a computing device, the computing device executes the method provided above.

[0145] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0146] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0148] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0149] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0150] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0151] If this function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0152] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A trusted computing platform based on a trusted execution environment TEE, characterized in that: The trusted computing platform includes a computing component and a protection component, and the protection component includes: Trusted Software Base TSB; Trusted Platform Control Module TPCM, the TPCM includes a TPCM functional component and a lightweight TPCM management component, wherein the TPCM functional component is used to perform security protection on the computing component, and the lightweight TPCM management component is used to perform life cycle management on the TSB and the TPCM functional component.

2. The trusted computing platform according to claim 1, characterized in that: The TPCM functional component is an independent TEE instance.

3. The trusted computing platform according to claim 1, characterized in that: The TPCM functional component is a module in the lightweight TPCM management component, and the lightweight TPCM management component includes the TPCM functional component.

4. The trusted computing platform according to any one of claims 1 to 3, characterized in that: The lightweight TPCM management component also includes a first communication module, which is used for communication between the TSB and the computing component.

5. The trusted computing platform according to any one of claims 1 to 4, characterized in that: The lightweight TPCM management component also includes a second communication module, which is used for communication between the TSB and the TPCM functional component.

6. The trusted computing platform according to any one of claims 1 to 5, characterized in that: The TSB is used to build an independent TEE instance.

7. The trusted computing platform according to claim 6, characterized in that: The trusted computing platform is a trusted computing platform based on the ArmTrustzone S-EL2 architecture, the lightweight TPCM management component is built based on the secure partition manager SPM, and the TEE instance is an independent secure partition SP.

8. The trusted computing platform according to claim 6, characterized in that: The trusted computing platform is a trusted computing platform based on the Intel TDX architecture, the lightweight TPCM management component is built based on the TDX-Module, and the TEE instance is an independent trusted domain TD.

9. The trusted computing platform according to any one of claims 1 to 8, characterized in that: The lightweight TPCM management component is used to manage the life cycle of the TSB and the TPCM functional components in any one or more of the following ways: start, interrupt, resume, stop, and destroy.

10. A method for a trusted computing platform to perform security protection tasks, characterized in that: The trusted computing platform includes a computing component and a protection component, the protection component includes a trusted software base TSB and a trusted platform control module TPCM, the TPCM includes a TPCM functional component and a lightweight TPCM management component, and the method includes: The lightweight TPCM management component receives the protection request information sent by the computing component, and the lightweight TPCM management component is used to manage the life cycle of the TPCM functional component and the TSB; The lightweight TPCM management component sends the protection request information to the TSB; The TSB calls the TPCM functional component to perform a protection task, and the TPCM functional component is used to perform security protection on the computing component; The TSB sends the execution result of the protection task to the computing component through the lightweight TPCM management component.

11. The method according to claim 10, characterized in that The TPCM functional component is an independent TEE instance.

12. The method according to claim 10, characterized in that The TPCM functional component is a module in the lightweight TPCM management component, and the lightweight TPCM management component includes the TPCM functional component.

13. The method according to any one of claims 10 to 12, characterized in that The lightweight TPCM management component also includes a first communication module, which is used for communication between the TSB and the computing component. The lightweight TPCM management component sends the protection request information to the TSB, including: The lightweight TPCM management component sends the protection request information to the TSB through the first communication module.

14. The method according to any one of claims 10 to 13, characterized in that The lightweight TPCM management component also includes a second communication module, which is used for communication between the TSB and the TPCM functional component. The TSB calls the TPCM functional component to perform a protection task, including: The TSB calls the TPCM functional component through the second communication module to perform a protection task.

15. The method according to any one of claims 10 to 14, characterized in that The method further comprises: The TSB sends a trusted control request to the TSB agent in the computing component through the lightweight TPCM management component, so that the TSB agent performs trusted control on the computing component based on the trusted control request.

16. The method according to any one of claims 10 to 15, characterized in that The TSB is used to build an independent TEE instance.

17. The method according to claim 16, characterized in that The trusted computing platform is a trusted computing platform based on the ArmTrustzone S-EL2 architecture, the lightweight TPCM management component is built based on the secure partition manager SPM, and the TEE instance is an independent secure partition SP.

18. The method according to claim 16, characterized in that The trusted computing platform is a trusted computing platform based on the Intel TDX architecture, the lightweight TPCM management component is built based on the TDX-Module, and the TEE instance is an independent trusted domain TD.

19. The method according to any one of claims 10 to 18, characterized in that The lightweight TPCM management component is specifically used to manage any one or more of the following life cycles of the TSB and the TPCM functional components: start, interrupt, resume, stop, and destroy.

20. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 10 to 19.

21. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 10 to 19.

22. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, which, when executed by a computing device cluster, perform the method as claimed in any one of claims 10 to 19.

Images