A single / multi-center trusted expansion method based on trusted computing 3.0 technology and blockchain technology

Abstract

The present invention relates to the fields of trusted computing and blockchain technology, and more particularly to a single / multi-center trusted expansion method based on Trusted Computing 3.0 and blockchain technologies. This method establishes a blockchain using a trusted server as a central node. First, the initial boot code of a common server joining the blockchain must be ensured to be trustworthy. The factory BIOS hash value of the common server is uploaded to the blockchain to store a trusted baseline value. When a common server wishes to join the blockchain, the central node compares the BIOS hash value of the server to confirm that the server's basic boot code has not been tampered with and that the underlying hardware has not been attacked. Secondly, the central node ensures that the initial boot code of the server where the common node resides has not been tampered with during the blockchain's operation, ensuring that the process remains trustworthy. The present invention ensures that the initial boot code of the server where the node resides in the blockchain is trustworthy and that the process remains trustworthy, enabling trusted upgrades of each common server without adding hardware, thus saving related costs.

Description

Technical Field

[0001] The present invention relates to the fields of trusted computing and blockchain technology, and in particular to a single / multi-center trusted expansion method based on Trusted Computing 3.0 technology and blockchain technology. Background Art

[0002] Due to the lack of a trusted underlying foundation, the security of protection software itself cannot be guaranteed, let alone system security. Therefore, the computing sector requires independent and controllable trusted technology support. To address the issue of computer platform trust, the international TCG organization launched trusted computing technology, allowing users and applications to run in a trusted environment. The Trusted Execution Environment (TEE) is the technical architecture that this technology creates. However, trusted computing technology cannot guarantee server hardware trustworthiness or fundamentally guarantee the integrity of boot code (such as BIOS code), and therefore cannot effectively address the trust issues in the computing sector.

[0003] Trusted Computing 3.0, a dual-system architecture proposed by my country, enables proactive immune trust from hardware to software and throughout operation, automatically monitoring various attacks. However, Trusted Computing 3.0 requires the use of a hardware Trusted Platform Control Module (TPCM). Due to the complex technical support involved in the design and manufacturing of TPCMs, their limited availability and high price make them unsuitable for direct integration into standard servers, leading to numerous inconveniences.

[0004] Blockchain, also known as distributed ledger technology, is a multi-party ledger technology that uses cryptography to ensure secure transmission and access, enabling consistent data storage, tamper resistance, and non-repudiation. Using blockchain technology, we extend the trust achieved by Trusted Computing 3.0 to servers without corresponding configurations, enabling trusted upgrades for other servers and achieving greater and deeper security while saving the cost of purchasing hardware. Furthermore, by combining my country's independently developed Trusted Computing 3.0 technology with the FISCO BCOS blockchain, an open-source, high-performance blockchain platform, FISCO BCOS provides a strong foundation for trusted computing. The combination of these two technologies will enable more efficient smart contract execution and data sharing, enhancing the independent innovation capabilities of this invention. Summary of the Invention

[0005] In order to solve the problems of high cost and high limitations of Trusted Computing 3.0 technology caused by hardware TPCM during trusted extension, the present invention provides a single / multi-center trusted extension method based on Trusted Computing 3.0 technology and blockchain technology.

[0006] The technical method adopted by the present invention to solve the technical problem is to construct a single / multi-center trusted expansion method based on Trusted Computing 3.0 technology and blockchain technology, including:

[0007] First, set the server with Trusted Computing 3.0 technology as the trusted server and the central node in the blockchain; the remaining servers are ordinary nodes in the blockchain.

[0008] Establish a FISCO BCOS alliance chain with the trusted server as the central node, upload relevant smart contracts, and upload the BIOS hash value of each server at the factory as the trusted benchmark value, that is, the standard trusted BIOS hash value; write code to receive requests and run it uninterruptedly on the trusted server; the server that wants to join the blockchain sends a joining request and the current BIOS hash value to the trusted server. After receiving the BIOS hash value, the trusted server calls the corresponding smart contract method to complete the trusted verification. If the verification passes, it will be added to the blockchain. If it fails, no processing will be done.

[0009] During blockchain operation, the central node first ensures that it has uploaded a trusted smart contract for the maintenance process and a scheduled call code. Regular nodes download the code from the blockchain and run it in their own trusted execution environment. During operation, the code automatically obtains the current server's BIOS hash value and passes it as a parameter to the corresponding smart contract method. The smart contract automatically performs a trustworthy verification of the uploaded BIOS hash value against the trusted reference value. If the verification fails, the result and the information of the uploading node are recorded. The central node then regularly queries the recorded results and sets the untrusted node as a free node, meaning it is disconnected from the blockchain's transactions, unable to obtain information on the blockchain and unable to participate in consensus activities.

[0010] The number of trusted servers can be single or multiple. If it is a single server, a consortium chain is established with the trusted server as the central node. If there are multiple servers, a consortium chain is first established with these trusted servers. Each trusted server is a central node in its own group, and ordinary nodes can subsequently choose different groups to join. In a multi-center consortium chain, group selection is random. Ordinary servers can randomly select a central node to send a joining request. If the joining trust verification passes, they can join the group to which the central node belongs. If smart contracts and code need to be uploaded to the blockchain, they only need to randomly select a trusted server to upload. Compared with the single-center trusted expansion solution, the multi-center trusted expansion solution greatly reduces the workload of the trusted server and improves the overall operation speed of the solution.

[0011] Trusted verification compares the newly received BIOS hash value with the trusted reference value initially stored on the blockchain. The BIOS is the first thing to run when the computer boots up, controlling the basic functions of the hardware. If the BIOS is tampered with, it may lead to system attacks or malware intrusion. By performing a BIOS hash value check to verify that the BIOS has not been tampered with, it prevents attacks and the initiation of malware. After the trusted verification, a query is made to see if the comparison results are consistent. If they are consistent, it proves that the initial hardware of the server where the node is located has not been tampered with, and the node can be added to the blockchain or remain in the blockchain. If they are inconsistent, it proves that the server where the node is located has been attacked and needs to be isolated from the blockchain. Compared with the existing technology, the single / multi-center trusted extension method of the present invention based on Trusted Computing 3.0 technology and blockchain technology first ensures that the initial startup code of the ordinary server joining the blockchain is trustworthy, and the factory BIOS hash value of the ordinary server is uploaded to the chain to store the trusted reference value. When the ordinary server with the trusted reference value stored wants to join the blockchain, the central node compares the BIOS hash value of the server to be joined to confirm that the basic startup code of the server has not been tampered with and the underlying hardware has not been attacked; secondly, it ensures that the initial startup code of the server where the ordinary node is located has not been tampered with during the operation of the blockchain, and the process remains trustworthy.

[0012] Through the present invention, the initial trustworthiness of the server startup code where the node in the blockchain is located and the continuous trustworthiness of the process can be guaranteed, and the trusted upgrade of each ordinary server can be achieved without adding hardware, saving related costs; at the same time, the trusted extension of the trusted server to the ordinary server is realized, expanding the application coverage of Trusted Computing 3.0. The entire method is autonomous and controllable, and the security and credibility of the entire blockchain are enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0014] Figure 1 This is a flow chart of a single / multi-center trusted expansion method based on Trusted Computing 3.0 technology and blockchain technology provided by the present invention.

[0015] Figure 2 This is a schematic diagram of the initial trusted operation of a single / multi-center trusted expansion method based on Trusted Computing 3.0 technology and blockchain technology provided by the present invention.

[0016] Figure 3 This is a schematic diagram of the trusted operation of the establishment process of a single / multi-center trusted expansion method based on Trusted Computing 3.0 technology and blockchain technology provided by the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical methods and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention, but are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without making creative work shall fall within the scope of protection of the present invention.

[0018] Figure 1 、 Figure 2 and Figure 3 As shown, the present invention provides a single / multi-center trusted expansion method based on Trusted Computing 3.0 technology and blockchain technology, including:

[0019] First, the server supported by Trusted Computing 3.0 technology is referred to as a trusted server and serves as the central node in the blockchain; the remaining servers serve as ordinary nodes in the blockchain.

[0020] Establish a FISCO BCOS alliance chain with the trusted server as the central node, upload relevant smart contracts, and upload the BIOS hash value of each server at the factory as the trusted benchmark value, that is, the standard trusted BIOS hash value; write code to receive requests and run it uninterruptedly on the trusted server; the server that wants to join the blockchain sends a joining request and the current BIOS hash value to the trusted server. After receiving the BIOS hash value, the trusted server calls the corresponding smart contract method to complete the trusted verification. If the verification passes, it will be added to the blockchain. If it fails, no processing will be done.

[0021] During blockchain operation, the central node first ensures that it has uploaded a trusted smart contract for the maintenance process and a scheduled call code. Regular nodes download the code from the blockchain and run it in their own trusted execution environment. During operation, the code automatically obtains the current server's BIOS hash value and passes it as a parameter to the corresponding smart contract method. The smart contract automatically performs a trustworthy verification of the uploaded BIOS hash value against the trusted reference value. If the verification fails, the result and the information of the uploading node are recorded. The central node then regularly queries the recorded results and sets the untrusted node as a free node, meaning it is disconnected from the blockchain's transactions, unable to obtain information on the blockchain and unable to participate in consensus activities.

[0022] The number of trusted servers can be single or multiple. If it is a single server, a consortium chain is established with the trusted server as the central node. If there are multiple servers, a consortium chain is first established with these trusted servers. Each trusted server is a central node in its own group, and ordinary nodes can subsequently choose different groups to join. In a multi-center consortium chain, group selection is random. Ordinary servers can randomly select a central node to send a joining request. If the joining trust verification passes, they can join the group to which the central node belongs. If smart contracts and code need to be uploaded to the blockchain, they only need to randomly select a trusted server to upload. Compared with the single-center trusted expansion solution, the multi-center trusted expansion solution greatly reduces the workload of the trusted server and improves the overall operation speed of the solution.

[0023] Trusted verification compares the newly received BIOS hash value with the trusted reference value initially stored on the blockchain. The BIOS is the first thing to run when the computer boots up, controlling the basic functions of the hardware. If the BIOS is tampered with, it may lead to system attacks or malware intrusion. By performing a BIOS hash value check to verify that the BIOS has not been tampered with, it prevents attacks and the initiation of malware. After the trusted verification, a query is made to see if the comparison results are consistent. If they are consistent, it proves that the initial hardware of the server where the node is located has not been tampered with, and the node can be added to the blockchain or remain in the blockchain. If they are inconsistent, it proves that the server where the node is located has been attacked and needs to be isolated from the blockchain. Compared with the existing technology, the single / multi-center trusted extension method of the present invention based on Trusted Computing 3.0 technology and blockchain technology first ensures that the initial startup code of the ordinary server joining the blockchain is trustworthy, and the factory BIOS hash value of the ordinary server is uploaded to the chain to store the trusted reference value. When the ordinary server with the trusted reference value stored wants to join the blockchain, the central node compares the BIOS hash value of the server to be joined to confirm that the basic startup code of the server has not been tampered with and the underlying hardware has not been attacked; secondly, it ensures that the initial startup code of the server where the ordinary node is located has not been tampered with during the operation of the blockchain, and the process remains trustworthy.

[0024] The present invention aims to address the problems of existing Trusted Computing 3.0 technology, which is widely used on single machines but cannot be trusted for expansion, and the difficulty and high cost of manufacturing the required hardware Trusted Platform Control Module (TPCM), making it difficult to widely promote. The present invention provides a single / multi-center trusted expansion method based on Trusted Computing 3.0 and blockchain technology. First, one or more existing servers that meet Trusted Computing 3.0 technology are used as central nodes to build a FISCO BCOS consortium chain. Then, a trust verification is performed on other servers that wish to join. Only servers that pass the verification can join the consortium chain. Simultaneously, trust verification is performed on ordinary nodes at the same interval during the operation of the consortium chain. In this way, a blockchain is maintained in which all servers on which nodes are located meet Trusted Computing 3.0. This achieves trusted upgrades for each server, improves the security of the entire blockchain system, reduces the difficulty of implementing Trusted Computing 3.0 on servers, and reduces related costs. Furthermore, both Trusted Computing 3.0 technology and the FISCO BCOS blockchain were proposed by my country, fully realizing independent control.

[0025] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0026] A single / multi-center trusted expansion method based on Trusted Computing 3.0 technology and blockchain technology includes the following steps:

[0027] Steps to establish initial trust:

[0028] Step 1. Build a FISCOBCOS alliance chain using a server with trusted computing 3.0 technology as the central node.

[0029] Step 2. Write the smart contract you need to use and deploy it on this blockchain. The main smart contract methods are as follows:

[0030] addNode(uint _number, string memory _hashvalue): stores the factory hash value of each server

[0031] compareIndex(string memory _index): Determine whether the uploaded BIOS hash value is credible

[0032] compareProcess(string memory _index): Determine whether each server is trustworthy during operation

[0033] getCNode(): Get the sending address of an untrusted node during operation

[0034] Step 3. The central node calls the addNode method in the smart contract to upload the factory BIOS hash value of each server to the blockchain. By default, this value is the trusted reference value.

[0035] Step 4. The remaining servers with trusted execution environments are used as nodes that want to join the blockchain. The server obtains its own BIOS hash value in its own trusted execution environment.

[0036] Step 5. The server where the central node is located runs the Python code file and continues to receive requests sent to it by other servers. The server that wants to join the blockchain runs another Python code file and sends a request and its own BIOS hash value.

[0037] Step 6. After receiving the BIOS hash value, the central node calls the compareIndex method with the BIOS hash value as a parameter to perform a credibility check. Based on the verification result, the central node decides whether to add the BIOS hash value to the blockchain. If the BIOS hash value matches the stored credibility reference value, it is considered credible and added to the blockchain. If it is not credible, it is not processed.

[0038] Step 7. When adding a new node to the blockchain, the central node generates a private key for it, which is used for subsequent node identity determination.

[0039] Steps to establish process credibility:

[0040] Step 1. The central node uploads a timed call code, which can automatically obtain the BIOS hash value of the server running this code at a fixed time, use it as a parameter to call the compareProcess method, and continuously complete the trust verification during the operation process.

[0041] Step 2. Ordinary nodes on the blockchain obtain the on-chain scheduled call code and run it in their own trusted execution environment to ensure that they will not be attacked during operation.

[0042] Step 3. The compareProcess method determines whether each uploaded BIOS hash value is credible and stores the address of the untrusted node by calling the getCNode() method.

[0043] Step 4. The central node periodically calls the getCNode() method to check the untrusted list and sets the blockchain node corresponding to the sender address on the list as a free node. The set node cannot participate in the blockchain consensus and cannot obtain information on the chain.

[0044] Specifically, to fully achieve autonomous control, this invention utilizes the FISCO BCOS consortium blockchain. FISCO BCOS fully supports national cryptographic algorithms, including SM2 (public key cryptography), SM3 (hash cryptography), and SM4 (symmetric cryptography). These algorithms, developed by the State Cryptography Administration, comply with national information security standards and ensure data security during transmission and storage.

[0045] The present invention solves the problem that Trusted Computing 3.0 technology is generally applied to a single server and cannot be trusted for expansion. Existing Trusted Computing 3.0 technology requires a specific hardware Trusted Platform Control Module (TPCM). On a server without this hardware, the trust achieved by Trusted Computing 3.0 technology cannot be achieved, and trust cannot be propagated and expanded. The present invention verifies the server's BIOS hash value to ensure that the boot code has not been tampered with, ensuring that the server loads certified firmware and software at startup, thereby maintaining the integrity and security of the entire blockchain. At the same time, with the server meeting Trusted Computing 3.0 as the central node, the overall deployment of the blockchain and the writing and uploading of related smart contracts and codes are carried out. By verifying the server's BIOS hash value to verify whether its boot code has been tampered with, Trusted 3.0 is extended to other servers without TPCM hardware, realizing trusted expansion and trusted upgrades for each server.

[0046] The present invention solves the problems of high cost and high limitation caused by hardware TPCM in Trusted Computing 3.0 technology. The design and manufacturing process of hardware TPCM involves relatively complex technology, so its quantity is small and the purchase price is high, which may be a significant burden for scientific researchers and enterprises with limited budgets. At the same time, integrating hardware TPCM into existing servers may require additional engineering and development work. Some old models may not be able to undergo hardware upgrades, and related software may not be compatible. The present invention compensates for the trusted loopholes that existed in the previous trusted computing by verifying the BIOS hash value, and more comprehensively implements the Trusted Computing 3.0 technology on the remaining servers without hardware TPCM, saving the cost of purchasing hardware, reducing the limitations of the Trusted Computing 3.0 technology on the server, and promoting the widespread application of the Trusted Computing 3.0 technology.

[0047] This invention achieves autonomous and controllable control over the entire method. Both the Trusted Computing 3.0 technology and the FISCO BCOS consortium blockchain used were independently developed in my country. Traditional blockchain security encryption systems utilize foreign security encryption algorithms such as ECC-256 and SHA-256, which are slow, power-intensive, and pose security risks. The FISCO BCOS blockchain used in this invention fully supports the national encryption algorithm system, complies with national information security standards, and supports penetrating supervision. Compared to other blockchain platforms, its security is more trustworthy, controllable, and reliable, eliminating most security risks.

[0048] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are protected by the present invention.

Claims

1. A single / multi-center trusted expansion method based on trusted computing 3.0 technology and blockchain technology, characterized in that: include: Set up a server with Trusted Computing 3.0 technology as a trusted server and a central node in the blockchain; The remaining servers act as ordinary nodes in the blockchain; First, the FISCO BCOS consortium chain is established with a trusted server as the central node. The smart contract is uploaded, along with the factory BIOS hash value of each server as a trusted baseline value. Code is written to receive requests and run continuously on the trusted server. Servers that want to join the blockchain send a joining request and their current BIOS hash value to the trusted server. After receiving the BIOS hash value, the trusted server calls the corresponding smart contract method to complete a trusted verification. If the verification passes, the server is added to the blockchain; otherwise, no further processing is done. During the operation of the blockchain, first ensure that the central node has uploaded a smart contract that is trusted for the maintenance process, and at the same time upload a timed call code; ordinary nodes download the code from the blockchain and run the timed call code in their own trusted execution environment. During the operation, the code will automatically obtain the BIOS hash value of the current server and pass it as a parameter to the corresponding smart contract method. The smart contract automatically performs a trustworthy verification of the uploaded BIOS hash value and the trusted reference value. If the verification fails, the result and the information of the uploading node are recorded. The central node sets the untrusted node as a free node through regular query records.

2. According to claim 1, a single / multi-center trusted expansion method based on trusted computing 3.0 technology and blockchain technology is characterized in that: The number of trusted servers can be single or multiple. If it is a single server, a consortium chain will be established with the trusted server as the central node; if it is multiple servers, these trusted servers will be used to establish a consortium chain first. Each trusted server is a central node in its own group, and ordinary nodes can subsequently choose different groups to join. In a multi-center consortium chain, the selection of the group is random. An ordinary server can randomly select a central node to send a joining request. If the trust verification of joining is passed, it can join the group where the central node is located. If you need to upload smart contracts and codes to the blockchain, you only need to randomly select a trusted server to upload them.

3. A single / multi-center trusted expansion method based on trusted computing 3.0 technology and blockchain technology according to claim 1 or 2, characterized in that: The trusted verification is to compare the newly received BIOS hash value with the trusted reference value initially stored on the blockchain; After the trusted verification, check whether there is a consistent comparison result. If it is consistent, it proves that the initial hardware of the server where the node is located has not been tampered with, and it can be added to the blockchain or continue to remain in the blockchain; if it is inconsistent, it proves that the server where the node is located has been attacked and needs to be isolated from the blockchain.

Images