A Platform Identity Authentication Method Based on TCM under a Dual Architecture

Abstract

This invention discloses a platform identity authentication method based on TCM under a dual-architecture system, comprising: S1: Trusted Management Center; S2: Cloud Management System; S3: Dual-architecture Server Platform; and S4: Threat Analysis and Monitoring Platform. Based on trusted boot and static measurement, a secure and reliable identity authentication mechanism is provided. This mechanism can perform trusted authentication of the platform's identity, and is particularly suitable for scenarios such as file transfer and trusted virtual machine migration in cloud computing environments. The TCM module authenticates the platform's identity, ensuring its legitimacy. Before data on one platform needs to be migrated to another, trusted authentication is performed on both platforms; migration can only be initiated after successful authentication, ensuring data security. By combining a dual-architecture system, this invention effectively separates the key generation process from the communication process with the Trusted Management Center, thereby improving system stability while ensuring authentication security.

Description

Technical Field

[0001] This invention relates to the field of information security, and specifically to a platform identity authentication method based on TCM under a dual-architecture system. Background Technology

[0002] Trusted computing is a secure computing technology built on the collaborative work of hardware and software. It uses a trusted chip as the root of trust, the motherboard as the platform, software as the core, and the network as the link, forming a self-protective, systematic security framework. The key feature of this mechanism is that while the terminal device is performing computational operations, it can also perform its own security protection, ensuring that the computation results always meet expectations under various environments, and that the entire process is monitorable and controllable. The core idea of ​​trusted computing is the transmission of a trust chain: starting from the root of trust, it extends to the hardware platform, the operating system, and finally to the application program, forming a trust chain. Each level expands trust through measurement and authentication, ultimately ensuring that trust covers the entire system, thereby ensuring the security and trustworthiness of computer systems and networks.

[0003] Trusted Computing 3.0 is an innovative concept proposed by my country for cyberspace security. The core of this concept is the establishment of a dual-architecture system, including a computing component and a protection component. The original functional flow of the computing component remains unchanged, while a logically independent protection component is established in parallel, capable of proactively implementing trusted monitoring of the computing component. Proactive immune trusted computing emphasizes security protection during system operation, ensuring that the computation results always meet expectations, and that the entire computation process is measurable, controllable, and uninterrupted.

[0004] A Trusted Cryptography Module (TCM) is a hardware security module widely used in trusted computing platforms, providing basic security functions and encryption support. As the root of trust for the system, the TCM implements a series of security mechanisms in hardware to ensure the integrity, authentication, and data protection of the computing system. The main functions of the TCM include integrity measurement, secure storage, authentication, and encryption / decryption. During system startup and operation, the TCM measures critical components (such as the BIOS, bootloader, and operating system) and stores the generated hash values ​​in the Platform Configuration Register (PCR) to check system integrity and prevent tampering. Furthermore, the TCM provides secure storage for encryption keys, ensuring that sensitive data (such as encryption keys and certificates) is not accessed or tampered with without authorization; even if an attacker gains access to the storage medium, the data remains encrypted. The TCM also provides device authentication by generating unique identity keys, ensuring the device's trustworthy identity in the network environment. Hardware-based encryption, decryption, and digital signature services are also a major function of the TCM; these cryptographic operations are performed in hardware, making them more secure and efficient. Through these functions, TCM provides integrity, identity trust, and data security guarantees for computing platforms, and is widely used in personal computing devices, servers, and other devices to ensure system and data security.

[0005] Remote authentication is a crucial security mechanism in trusted computing, enabling the verification of a computing platform's trustworthiness. Platform identity authentication is a core component of remote authentication. During this process, the platform proves its legitimacy using the TCM's endorsement key (EK) and authentication key (AK). The Trusted Management Center verifies the EK certificate and AK public key to ensure the platform's authenticity. This process guarantees that only authenticated, trusted platforms can participate in critical network operations, while preventing unauthorized devices or systems from impersonating legitimate platforms and gaining access.

[0006] The CN109951276 patent, titled "Remote Identity Authentication Method for Embedded Devices Based on TPM," is characterized by leveraging the advantages of trusted computing integrity measurement, key management, and platform binding. It first performs a trusted measurement on the platform configuration, then extends the measurement value to the platform configuration register, using this value as an item in the authentication information. An endorsement key (EK) within the TPM chip is bound to the platform identity, generating an authentication key (AIK). The AIK then signs the platform configuration measurement value, thus verifying both platform identity and integrity. However, this method lacks specific protection mechanisms against complex attacks (such as replay attacks) and relies primarily on a single architecture, failing to employ a dual-architecture approach, thus compromising security.

[0007] Patent CN114679284, titled "Trusted Remote Proof System and Its Storage, Verification Method, and Storage Medium," is characterized by a consortium blockchain composed of multiple trusted remote proof servers. This blockchain stores the expected values ​​of device measurements. Upon receiving a proof integrity verification request from a challenger and forwarding the proof integrity measurement data, it compares the actual proof integrity measurement data with the expected measurement value, derives the proof's verification result, and returns it to the challenger. The challenger, upon receiving the proof integrity measurement data, initiates a proof integrity verification request to the consortium blockchain and forwards the proof integrity measurement data to the prover. This method lacks a central system, preventing challenges from being unable to provide remote integrity verification services due to central system inaccessibility or server issues. However, this method relies heavily on external consortium blockchain servers for integrity verification, does not utilize a hardware-level security module (TPM), and does not employ a dual-architecture approach, thus failing to conform to the proactive measurement principles of Trusted Computing 3.0.

[0008] CN 114547656 A, titled "A Two-Stage Remote Proof Method Based on Intel SGX in a Cloud Environment," is characterized by: constructing a secure Remote Proof Proxy Center (VRAC) by modifying the KVM vTPM architecture and introducing Intel SGX technology to create a Trusted Execution Environment (TEE). A software-simulated vTPM instance is created within the VRAC, utilizing Intel SGX to protect the vTPM instance and NVRAM data from memory leaks and cracking attacks. A new two-stage remote proof protocol ensures protection against man-in-the-middle attacks between the challenger and the prover. An adaptive periodic dynamic measurement scheme ensures the operational security of cloud computing nodes while reducing the performance overhead of introducing dynamic measurement. However, this method uses a software-simulated virtual TPM (vTPM) for identity authentication and integrity verification instead of relying on a more secure hardware TPM. Its dependence on virtualization and Intel SGX makes it difficult to apply in non-virtualized and non-Intel architecture devices. Furthermore, it does not employ a dual-architecture approach, failing to meet the requirements of proactively immune trusted computing. Summary of the Invention

[0009] Based on TCM, this invention proposes a platform identity authentication method based on a dual-architecture approach. It provides a secure and reliable identity authentication mechanism on the basis of trusted boot and static measurement. This mechanism can perform trusted authentication of the platform's identity and is particularly suitable for scenarios such as file transfer and trusted virtual machine migration in cloud computing environments.

[0010] The purpose of this invention is to perform identity authentication on the platform after it starts up through the TCM module, ensuring the legitimacy of the platform's identity, and to perform trusted authentication on both platforms before data needs to be migrated to another platform. Migration can only be initiated after successful authentication, ensuring data security. By combining a dual-system architecture, this invention can effectively separate the key generation process from the communication process with the trusted management center, thereby improving system stability while ensuring authentication security.

[0011] The present invention provides a platform identity authentication method based on TCM under a dual-architecture system, comprising four parts:

[0012] S1: Trusted Management Center. The Trusted Management Center owns and is capable of using the physical TCM chip. Its main responsibilities include providing a remote authentication interface for the cloud management system to call, and initiating remote authentication challenges to the server platform. Through encryption, decryption, and challenge-response mechanisms, it generates an encrypted challenge credential and sends it to the source server platform. It completes the platform's identity authentication process and returns the authentication result to the cloud management system via the interface.

[0013] S2: Cloud Management System. The cloud management system is responsible for the management and scheduling of cloud resources. It plays the role of coordinator throughout the remote authentication process. During server platform data migration, the server platform first sends a migration request to the cloud management system. The cloud management system then calls the remote authentication interface on the Trusted Management Center, which initiates a remote authentication challenge to the server platform. The remote authentication interface returns the platform's authentication result to the cloud management system, which then decides whether to allow the migration operation based on the result.

[0014] S3: Dual-architecture server platform. The server platform consists of a computing component and a protection component. Only the protection component is directly connected to the TCM chip; the computing component is isolated from the protection component. The computing component acts as a bridge, communicating with both the Trusted Management Center and the protection component. After receiving a challenge from the Trusted Management Center, the computing component communicates with the protection component. The protection component then uses the TCM chip to generate keys and perform data encryption / decryption operations. After completion, it sends the keys and data to the computing component, which then forwards them to the Trusted Management Center.

[0015] S4: Threat Analysis and Monitoring Platform. This platform is responsible for real-time monitoring and analysis of security threats throughout the entire identity authentication process, ensuring platform security. By incorporating machine learning algorithms, it automatically analyzes logs and data streams generated during platform operation to predict potential security threats. Through continuous learning and updates, the platform can dynamically identify abnormal behavior and take timely defensive measures. Furthermore, it features adaptive security policies, dynamically adjusting the system's security strategies based on currently detected attack patterns.

[0016] Furthermore, an experimental environment based on Trusted 3.0 was deployed using a dual-architecture setup. Both the computing component and the protection component environments used Linux operating systems, and both were connected to the TCM. The specific implementation included the following processes.

[0017] Process 1: Initialization phase.

[0018] The Trusted Management Center implements an HTTP server, using the `MHD_start_daemon()` function from the `libmicrohttpd` library to create an HTTP daemon process based on an internal polling thread, listening on a specified port and handling incoming requests. The cloud management system initiates a remote authentication challenge from the Trusted Management Center to the server platform via a GET request to the specified interface. Communication between the Trusted Management Center and the server platform's computing component uses Linux Sockets. The server platform's computing component calls `listen()` to start listening, waiting for connection requests from the Trusted Management Center. The server platform's computing and protection components also communicate via Linux Sockets, each acting as both a server and a client, respectively listening for and actively connecting to the other. A threat analysis and monitoring platform is activated, providing real-time monitoring of security threats throughout the authentication and communication process.

[0019] Process 2: Platform Identity Authentication.

[0020] Platform identity authentication is the process of proving the true identity of a trusted computing platform through identity credentials. It employs a trusted management center to verify the EK certificate of the server platform's TCM chip and generates encrypted credentials for the server platform to decrypt, thereby proving the platform's trustworthiness. After the trusted management center initiates a remote authentication challenge to the server platform, the server platform's computing component sends a message to the protection component. The protection component reads the EK certificate from the TCM chip and uses it to generate an AK public key, which is then sent to the computing component. The computing component sends the read EK certificate and the generated AK public key to the Trusted Management Center. The Trusted Management Center uses OpenSSL to verify the validity of the received EK certificate. If the EK certificate verification is successful, the Trusted Management Center extracts the EK public key from the server platform's TCM chip. The Trusted Management Center imports the received AK public key to calculate the AKName, then loads the EK public key and AKName to generate an encrypted credential. The Trusted Management Center then sends the encrypted credential to the server platform's computing component, which forwards it to the protection component. The protection component decrypts the credential using the TCM chip's EK private key and sends the decrypted credential to the computing component. The computing component sends the decrypted credential to the Trusted Management Center, which compares the decrypted credential with the original data. If the comparison and verification are successful, the server platform's identity authentication is successful.

[0021] Process 3: Threat Analysis and Dynamic Adjustment;

[0022] The threat analysis and monitoring platform continuously runs and dynamically monitors the data flow and communication behavior during the authentication process. Upon detecting abnormal behavior or potential attacks, the platform immediately notifies the cloud management system and automatically adjusts security policies based on the specific threat pattern. The platform meticulously records key operations and data interactions at each authentication step, including the initiation of remote authentication requests, the generation and transmission of TCM keys, and the generation and decryption of encrypted credentials, for security personnel to analyze and assess.

[0023] Compared to existing technologies, this invention is based on a dual-system architecture, where the computing component and the protection component work closely together throughout the authentication process. The computing component is responsible for communication coordination and data transmission, while the protection component is responsible for the interaction and encryption operations of the TCM chip. Through this division of labor, the system achieves a high level of security, ensuring the stability of platform authentication and the credibility of remote verification. The authentication process uses the TCM to ensure the authenticity of the device's identity, employing the endorsement key (EK) and authentication key (AK) within the TCM to prevent identity forgery. By centralizing TCM operations in the protection component and isolating it from the computing component that performs computational tasks, the dual-system architecture effectively reduces security risks. This architecture not only enhances the platform's resistance to attacks but also ensures high availability and stability. The introduced threat analysis and monitoring platform uses machine learning algorithms to monitor data flow and behavior in real time, detect potential threats, dynamically adjust security policies based on attack patterns, and record and analyze logs to ensure the system's security and credibility in complex network environments. Through these methods, the platform can provide higher security in complex network environments, especially in scenarios such as cloud computing that are vulnerable to remote attacks, further ensuring the platform's trustworthiness and security, which is in line with the basic principles of Trusted Computing 3.0. Attached Figure Description

[0024] Figure 1 This is a platform identity authentication model based on a trusted management center.

[0025] Figure 2 This is a sequence diagram of platform identity authentication based on TCM under a dual-system architecture.

[0026] Figure 3 This is a flowchart of the platform identity authentication process based on TCM under a dual-system architecture. Detailed Implementation

[0027] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0028] like Figure 1 The image shows a platform identity authentication model based on a trusted management center.

[0029] like Figure 2The diagram shows the timing of platform identity authentication based on TCM under a dual-system architecture.

[0030] like Figure 3 The diagram shows the platform identity authentication process based on TCM under a dual-system architecture.

[0031] The purpose of this invention is to perform identity authentication on the platform after it starts up through the TCM module, ensuring the legitimacy of the platform's identity, and to perform trusted authentication on both platforms before data needs to be migrated to another platform. Migration can only be initiated after successful authentication, ensuring data security. By combining a dual-system architecture, this invention can effectively separate the key generation process from the communication process with the trusted management center, thereby improving system stability while ensuring authentication security.

[0032] The present invention provides a platform identity authentication method based on TCM under a dual-system architecture, which mainly consists of three parts:

[0033] Part 1: Trusted Management Center. The Trusted Management Center owns and is capable of using the physical TCM chip. Its main responsibilities include providing a remote authentication interface for the cloud management system to call, and initiating remote authentication challenges to the server platform. It generates an encrypted challenge credential through encryption, decryption, and challenge-response mechanisms, and sends it to the source server platform. It completes the main platform authentication process and returns the authentication result to the cloud management system via the interface.

[0034] Part Two: Cloud Management System. The cloud management system is primarily responsible for the management and scheduling of cloud resources. It plays the role of coordinator throughout the remote authentication process. Taking server platform data migration as an example, the platform first initiates a migration request to the cloud management system. The cloud management system then calls the remote authentication interface on the Trusted Management Center, which initiates a remote authentication challenge against the server platform. The remote authentication interface returns the platform's authentication result to the cloud management system, which then decides whether to allow the migration operation based on the result.

[0035] Part Three: Dual-System Architecture Server Platform. The server platform consists of a computing component and a protection component. Since only the protection component is directly connected to the TCM chip, while the computing component and the protection component are isolated, the computing component acts as a bridge to send the keys and other data generated by the TCM to the Trusted Management Center. It communicates with both the Trusted Management Center and the protection component. After receiving a challenge from the Trusted Management Center, the computing component communicates with the protection component. The protection component then calls the TCM chip to perform key generation, data encryption and decryption, and other operations. After completion, it sends the keys and data to the computing component, which then sends them to the Trusted Management Center.

[0036] Part Four: Threat Analysis and Monitoring Platform. The threat analysis and monitoring platform is responsible for real-time monitoring and analysis of security threats throughout the entire identity authentication process, ensuring platform security. By incorporating machine learning algorithms, this platform can automatically analyze logs and data streams generated during platform operation to predict potential security threats, such as replay attacks and man-in-the-middle attacks. Through continuous learning and updates, the threat analysis and monitoring platform can dynamically identify abnormal behavior and take timely defensive measures. Simultaneously, the platform has an adaptive security policy function, capable of dynamically adjusting the system's security policies based on currently detected attack patterns.

[0037] This invention is based on the Trusted 3.0 technology solution and employs a dual-architecture deployment environment. Both the computing component and the protection component environments run on Linux, and are connected to a TCM (Tracking Management Module). This approach offers a degree of versatility and effectiveness. The specific implementation includes the following processes.

[0038] Process 1: Initialization phase.

[0039] The Trusted Management Center implements a simple HTTP server. It uses the `MHD_start_daemon()` function from the `libmicrohttpd` library to create an HTTP daemon process based on an internal polling thread, listening on a specified port and handling incoming requests. The cloud management system can initiate a remote authentication challenge to the server platform by sending a GET request to the specified interface. Simultaneously, the Trusted Management Center communicates with the server platform's computing component using Linux Sockets. The server platform's computing component calls `listen()` to start listening, waiting for connection requests from the Trusted Management Center. The server platform's computing and protection components also communicate via Linux Sockets, acting as both servers and clients, respectively listening for and actively connecting to each other. Meanwhile, a threat analysis and monitoring platform is activated, providing real-time monitoring of security threats throughout the authentication and communication process.

[0040] Process 2: Platform Identity Authentication.

[0041] Platform identity authentication is the process of proving the true identity of a trusted computing platform through identity credentials. This scheme employs a trusted management center to verify the EK certificate of the server platform's TCM chip and proves the platform's identity by generating encrypted credentials for the server platform to decrypt. After the trusted management center initiates a remote authentication challenge to the server platform, the server platform's computing component sends a message to the protection component. The protection component reads the EK certificate from the TCM chip, generates an AK public key using the TCM chip, and then sends the generated file to the computing component. The computing component sends the read EK certificate and the generated AK public key to the Trusted Management Center. The Trusted Management Center uses OpenSSL to verify the validity of the received EK certificate. If the EK certificate verification is successful, the Trusted Management Center extracts the EK public key from the server platform's TCM chip. The Trusted Management Center imports the received AK public key to calculate the AKName, then loads the EK public key and AKName to generate an encrypted credential. The Trusted Management Center then sends the encrypted credential to the server platform's computing component, which forwards it to the protection component. The protection component decrypts the credential using the TCM chip's EK private key and sends the decrypted credential to the computing component. The computing component sends the decrypted credential to the Trusted Management Center, which compares the decrypted credential with the original data. If the comparison and verification are successful, the server platform's identity authentication is successful.

[0042] Process 3: Threat Analysis and Dynamic Adjustment

[0043] The threat analysis and monitoring platform continuously runs and dynamically monitors data flow and communication behavior throughout the authentication process. Upon detecting abnormal behavior or potential attacks, the platform immediately notifies the cloud management system and automatically adjusts security policies based on the specific threat pattern. Furthermore, the platform meticulously records key operations and data interactions at each authentication step, including the initiation of remote authentication requests, the generation and transmission of TCM keys, and the generation and decryption of encrypted credentials, for security personnel to analyze and assess.

[0044] Compared to existing technologies, this invention is based on a dual-system architecture, where the computing component and the protection component work closely together throughout the authentication process. The computing component is responsible for communication coordination and data transmission, while the protection component is responsible for the interaction and encryption operations of the TCM chip. Through this division of labor, the system achieves a high level of security, ensuring the stability of platform authentication and the credibility of remote verification. The authentication process uses the TCM to ensure the authenticity of the device's identity, employing the endorsement key (EK) and authentication key (AK) within the TCM to prevent identity forgery. By centralizing TCM operations in the protection component and isolating it from the computing component that performs computational tasks, the dual-system architecture effectively reduces security risks. This architecture not only enhances the platform's resistance to attacks but also ensures high availability and stability. The introduced threat analysis and monitoring platform uses machine learning algorithms to monitor data flow and behavior in real time, detect potential threats, dynamically adjust security policies based on attack patterns, and record and analyze logs to ensure the system's security and credibility in complex network environments. Through these methods, the platform can provide higher security in complex network environments, especially in scenarios such as cloud computing that are vulnerable to remote attacks, further ensuring the platform's trustworthiness and security, which is in line with the basic principles of Trusted Computing 3.0.

Claims

1. A platform identity authentication method based on TCM under a dual-system architecture, characterized in that, It includes four parts: S1: Trust Management Center; The Trusted Management Center owns and is able to use the physical TCM chip normally. It is mainly responsible for providing a remote proof interface for the cloud management system to call, and for initiating remote proof challenges to the server platform. Through encryption, decryption and challenge-response mechanisms, it generates an encrypted challenge credential and sends it to the source server platform. Complete the platform identity authentication process and return the authentication result to the cloud management system via the interface; S2: Cloud Management System; The cloud management system is responsible for the management and scheduling of cloud resources; it plays the role of coordinator in the entire remote verification process; during the server platform data migration, the server platform will first send a migration request to the cloud management system, the cloud management system calls the remote verification interface on the Trusted Management Center, the Trusted Management Center sends a remote verification challenge to the server platform, the remote verification interface returns the platform's identity authentication result to the cloud management system, and the cloud management system decides whether to allow the migration operation based on the result; S3: Dual-architecture server platform; The server platform consists of a computing component and a protection component. Since only the protection component is directly connected to the TCM chip, the computing component is isolated from the protection component. The computing component acts as a bridge, communicating with the Trusted Management Center on one hand and with the protection component on the other. After receiving a challenge from the Trusted Management Center, the computing component communicates with the protection component. The protection component calls the TCM chip to perform key generation and data encryption / decryption operations. After completion, it sends the key and data to the computing component, which then sends them to the Trusted Management Center. S4: Threat Analysis and Monitoring Platform; This platform is responsible for real-time monitoring and analysis of security threats throughout the entire identity authentication process, ensuring platform security. By incorporating machine learning algorithms, it can automatically analyze logs and data streams generated during platform operation to predict potential security threats. Through continuous learning and updates, the platform can dynamically identify abnormal behavior and take timely defensive measures. Simultaneously, the platform possesses adaptive security policy capabilities, dynamically adjusting the system's security policies based on currently detected attack patterns.

2. The platform identity authentication method based on TCM under a dual-architecture system according to claim 1, characterized in that, The experimental environment is deployed using a dual architecture based on Trusted 3.

0. The computing component environment is a Linux operating system, the protection component environment is a Linux operating system, and it is connected to TCM.

3. The platform identity authentication method based on TCM under a dual-system architecture according to claim 1, characterized in that, The initialization phase includes the following: The Trusted Management Center implements an HTTP server, using the `MHD_start_daemon()` function from the libmicrohttpd library to create an HTTP daemon process based on an internal polling thread, listening on a specified port and handling incoming requests. The cloud management system initiates a remote authentication challenge from the Trusted Management Center to the server platform via a GET request to the specified interface. Communication between the Trusted Management Center and the server platform's computing component uses Linux Sockets. The server platform's computing component calls `listen()` to start listening, waiting for connection requests from the Trusted Management Center. The server platform's computing and protection components also communicate via Linux Sockets, acting as both servers and clients, respectively listening for and actively connecting to each other. A threat analysis and monitoring platform is activated, providing real-time monitoring of security threats throughout the authentication and communication process.

4. The platform identity authentication method based on TCM under a dual-system architecture according to claim 1, characterized in that, Platform identity verification includes the following: Platform identity authentication is the process of proving the true identity of a trusted computing platform through identity credentials. It adopts the approach of a trusted management center to verify the EK certificate of the server platform's TCM chip and proves the identity of the trusted platform by generating encrypted credentials for the server platform to decrypt. After the Trusted Management Center initiates a remote authentication challenge to the server platform, the server platform's computing component sends a message to the protection component. The protection component reads the EK certificate from the TCM chip and uses the TCM chip to generate the AK public key. After generation, it sends the file to the computing component. The computing component then sends the read EK certificate and the generated AK public key to the Trusted Management Center. The Trusted Management Center uses OpenSSL to verify the validity of the received EK certificate. If the EK certificate verification is successful, the Trusted Management Center extracts the EK public key from the server platform's TCM chip. The Trusted Management Center imports the received AK public key to calculate AKName, and then loads the EK public key and AKName to generate an encrypted credential. The Trusted Management Center then sends the encrypted credential to the server platform's computing component, which forwards the encrypted credential to the protection component. The protection component uses the TCM chip's EK private key to decrypt the credential and sends the decrypted credential to the computing component. The computing component sends the decryption credential to the Trusted Management Center. The Trusted Management Center compares the decryption credential with the original data. If the comparison and verification are successful, the server platform's identity authentication is successful.

5. The platform identity authentication method based on TCM under a dual-system architecture according to claim 1, characterized in that, Threat analysis and dynamic adjustments are as follows: The threat analysis and monitoring platform continuously runs and dynamically monitors the data flow and communication behavior in the authentication process. Once abnormal behavior or potential attacks are detected, the threat analysis and monitoring platform will immediately notify the cloud management system and automatically adjust the security policy according to the specific threat pattern. The threat analysis and monitoring platform will record in detail the key operations and data interactions in each authentication step, including the initiation of remote proof requests, the generation and transmission of TCM keys, and the generation and decryption process of encrypted credentials, for security personnel to analyze and judge.

Images