A method for system trusted boot of a RAID card cooperating with a TPM chip

Abstract

The application relates to the technical field of computer system security, and particularly discloses a system trusted starting method based on cooperation of a RAID card and a TPM chip, which comprises the following steps: S1: after power-on of the system, the TPM chip is used as a trusted root to start and perform integrity measurement to establish a trusted starting chain; S2: after BIOS verification, before a BootLoader is loaded, the BIOS initiates integrity measurement and verification of the RAID card, and the measurement and verification of the RAID card at least comprises checking characteristic values of firmware of the RAID card and a system disk hard disk connected to the RAID card; S3: only after the verification of the RAID card is passed, the system loads and executes subsequent BootLoader and an operating system kernel from the system disk on the RAID card to complete starting; and S4: during normal operation of the system, the TPM chip performs periodic or triggered dynamic measurement on the RAID card and the system disk through a system management bus, and executes a security disposal strategy when the measurement is abnormal; the trust chain is extended to a storage subsystem, and comprehensive security protection is realized.

Description

Technical Field

[0001] This invention relates to the field of computer system security technology, specifically to a trusted boot method for a system that uses a RAID card and a TPM chip in tandem. Background Technology

[0002] In computer systems (especially servers, cloud computing platforms, and big data storage systems), data security and system startup integrity are core requirements. Trusted computing is a key technology for ensuring the secure startup and operation of computer systems from the hardware to the application layer. Its core mechanism is to establish a "chain of trust" starting with a trusted platform module. The TPM chip, as the hardware root of trust, follows the principle of "measure first, then execute" during system startup, performing integrity measurements (calculating hash values) on components such as the BIOS, BootLoader, and operating system kernel level by level, and securely storing the measurement values ​​in the platform configuration register inside the TPM. By comparing the current measurement value with a pre-stored, known, and secure "gold standard" benchmark value, the trusted state of each component is verified, thereby ensuring the integrity and security of the system startup environment.

[0003] However, existing trusted boot technologies have a significant security blind spot: their trust chain typically stops at the software level, neglecting the security measurement of critical hardware storage controllers (especially RAID cards). The existing trust chain only covers "TPM→BIOS→BootLoader→OS kernel→Application", failing to include the RAID card and its managed OS system disk in the measurement scope. If the hardware characteristics of the RAID card's OptionROM (boot component), firmware (core control program), and OS system disk are tampered with or replaced, malicious system components may be loaded without the TPM chip's detection. In servers and PCs with high security requirements, the operating system and data are usually stored on hard drive arrays managed by RAID cards. If the RAID card's own firmware is maliciously tampered with, or its connected hard drives are replaced with untrusted devices, then even if the subsequent operating system verification passes, the entire system is built on an insecure underlying storage foundation, facing serious risks of data leakage and system tampering.

[0004] Therefore, existing technologies lack source-level trust assurance for storage controllers and their connected hard drives, and there is an urgent need for a technical solution that can incorporate RAID cards and OS system disks into the TPM trust system and achieve full lifecycle security monitoring. Summary of the Invention

[0005] In order to overcome the above-mentioned technical problems in the prior art, the present invention provides a system trusted boot method in which a RAID card and a TPM chip work together, extending the trust chain to the storage subsystem, thereby achieving comprehensive and deep security protection for system startup and operation.

[0006] To achieve the above objectives, embodiments of the present invention provide a system trusted boot method in collaboration between a RAID card and a TPM chip, comprising the following steps: S1: After the system is powered on, the TPM chip acts as a trusted root to boot and performs integrity measurement to establish a trusted boot chain; S2: In the trusted boot chain, after BIOS verification is passed and before the bootloader is loaded, the BIOS initiates integrity measurement and verification of the RAID card. The measurement and verification of the RAID card includes at least verifying the firmware of the RAID card and the characteristic values ​​of the system disk hard drive connected to it; S3: Only after the verification of the RAID card is passed, the system loads and executes the subsequent Bootloader and operating system kernel from the system disk on the RAID card to complete the boot process; S4: During normal system operation, the TPM chip performs periodic or triggered dynamic measurement of the RAID card and its system disk through the system management bus, and executes security handling strategies when measurement anomalies occur.

[0007] Preferably, step S1 specifically includes: after the system powers on, the TPM chip boots as a trusted root, resets the TPM's platform configuration register (PCR) to its initial value, and the TPM chip has a built-in public key certificate for the RAID card; the TPM chip reads the BIOS firmware through the motherboard's internal bus, calculates the first hash value of the BIOS firmware, and calls the TPM chip API to write the first hash value into the PCR1 register in an extended manner, wherein the extended manner satisfies the formula: new value = hash(old value || newly measured data); the TPM chip compares the current value of the PCR1 register bit by bit with a preset BIOS security baseline value to see if they match. If there is a mismatch, the TPM chip triggers the aforementioned security handling strategy and prevents the system from starting. If a match is found, the BIOS will boot and load.

[0008] Preferably, step S2 specifically includes: the BIOS reading the RAID card's OptionROM file via the PCIe OptionROM mechanism, calculating the second hash value of the OptionROM file, and calling the TPM chip API to write the second hash value into the PCR2 register in the extended manner; the BIOS obtaining the RAID card's firmware hash value, the OS system disk's characteristic value, and the digest value of the RAID card's private key signature through a trusted API management and control interface pre-designed for the RAID card, wherein the characteristic value at least includes the OS system disk's manufacturer information, model, serial number, firmware version, and capacity; the BIOS calling the TPM chip API, using the RAID card's public key built into the TPM chip to verify the signature of the digest value, and determining subsequent operations based on the signature verification result. If the signature verification fails, the TPM chip triggers the aforementioned security handling strategy and prevents the system from starting. If the signature verification is successful, perform the following operations: (1) Write the firmware hash value into the PCR3 register in the extended manner; (2) Load and present the RAID card's virtual disk.

[0009] Preferably, S3 specifically includes: the BIOS reading the OS BootLoader on the virtual disk, calculating the third hash value of the OS BootLoader, calling the TPM chip API to write the third hash value into the PCR4 register in the extended manner, and the TPM chip comparing the current value of the PCR4 register with a preset BootLoader security baseline value; if they do not match, booting is prevented; if they match, the OS BootLoader is loaded and started. The BootLoader reads the operating system kernel from the virtual disk, calculates the fourth hash value of the operating system kernel, and calls the TPM chip API to write the fourth hash value into the PCR5 register in the extended manner. The TPM chip compares the current value of the PCR5 register with the preset operating system kernel security benchmark value. If they do not match, the boot process is blocked; if they match, the operating system kernel is loaded and started. The operating system kernel reads the core processes and core applications from the virtual disk, calculates the hash value of each core process or application, and calls the TPM chip API to write it into the respective platform configuration registers (PCR) in the extended manner. The TPM chip compares the current value of each register with the corresponding preset security benchmark value. If they do not match, the corresponding process or application is blocked; if they all match, the system boot process is completed, and the user is allowed to log in.

[0010] Preferably, S4 specifically includes: S41: During system operation, the TPM chip calls the RAID card's measurement management interface through the I2C management channel or PCIe channel to obtain the RAID card's OptionROM file, firmware hash value, and OS system disk characteristic value in real time or periodically, and repeats the measurement and signature verification logic of step S2; S42: If the measurement result in S41 does not match the corresponding security benchmark value or the signature verification fails, the TPM chip sends a control signal through the I2C management channel or the PCIe channel and executes the security handling strategy.

[0011] Preferably, the feature value of the OS system disk is calculated using SHA256, SHA-1, or MD5 algorithms.

[0012] Preferably, the hash value is calculated using any one of SHA256, SHA-1, or MD5.

[0013] Preferably, the triggering method of the dynamic measurement includes: (1) the TPM chip actively initiates a measurement request at a preset time interval; (2) when the RAID card detects a change in its own status, it actively reports status data to the TPM chip to trigger the measurement, the change in its own status includes hard disk insertion / removal and firmware version update; the security handling strategy includes one or more of the following: generating system alarm, stopping the RAID card from working, and shutting down the host system.

[0014] The present invention has at least the following technical effects through the technical solution provided by the present invention: The technical solution provided by this invention is the first to fully incorporate the RAID card (including its OptionROM, firmware, and connected hard drive) into the TPM trusted measurement trust chain, upgrading it to a complete trusted chain of "TPM→BIOS→RAID→BootLoader→OS". This ensures the security of the storage layer from the source, solves the long-standing security blind spot problem, and eliminates the risk of unauthorized RAID cards or tampered hard drives loading malicious systems. By designing a dedicated trusted API management and control interface for the RAID card and introducing a "RAID card private key signature + TPM public key verification" mechanism, the authenticity and reliability of the measurement data reported by the RAID card are ensured, resisting man-in-the-middle attacks and data breaches. This feature enhances the reliability of measurement results by overcoming the limitations of existing TPMs that only measure during startup. It enables real-time / periodic monitoring of RAID cards and OS system disks during system operation, promptly detecting threats such as hard drive replacement and firmware tampering after startup, and responding quickly through security measures to ensure continuous system reliability. It is implemented solely by upgrading RAID card firmware (adding trusted APIs and measurement interfaces) and optimizing TPM measurement logic, without requiring additional hardware components. It is compatible with existing server / PC hardware architectures, reducing implementation costs and facilitating industry-wide adoption. Furthermore, it enhances and improves the security of information systems such as servers or PC hosts, raising the level of security protection. Attached Figure Description

[0015] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a connection diagram of the components in the trusted system boot method provided in this embodiment of the invention; Figure 2 This is a flowchart of the system trusted boot method provided in the embodiments of the present invention; Figure 3 This is a business process diagram of the trusted startup process of the system trusted startup method provided in the embodiments of the present invention. Detailed Implementation

[0016] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0017] In this invention, the terms "system" and "network" are used interchangeably. "Multiple" refers to two or more; therefore, in this invention, "multiple" can also be understood as "at least two." "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / ", unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, it should be understood that in the description of this invention, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0018] This invention provides a system trusted boot method that coordinates a RAID card and a TPM chip. It is applied to computing platforms (such as servers or PCs) that include a TPM chip, a RAID card, a BIOS (or UEFI), and an OS system disk (connected to the RAID card, storing the Bootloader, operating system kernel (OS kernel), and applications). The core idea is to insert a pre-boot verification step for the RAID card in the traditional trusted boot chain, after BIOS verification and before the bootloader is loaded. During system runtime, the RAID card is dynamically measured and monitored. Figure 1 As shown, the connection relationships of the components in the trusted boot method provided in this embodiment are as follows: the TPM chip communicates with the BIOS through the motherboard's internal bus and connects to the RAID card through the PCIe service / management channel and the I2C management channel; the RAID card is directly connected to the OS system disk (storing the BootLoader, OS kernel, and applications); the BIOS reads the RAID card's OptionROM through the PCIe optionROM mechanism and obtains RAID card measurement data through the trusted API management and control interface; the TPM chip performs real-time measurement of the RAID card through the I2C management channel. Figure 2 As shown, the trusted boot method for a system co-operating RAID card and TPM chip provided in this embodiment of the invention includes the following steps: S1: After the system is powered on, the TPM chip is used as the trusted root to start and perform integrity measurement to establish a trusted startup chain; S2: In the trusted boot chain, after the BIOS verification is passed and before the bootloader is loaded, the BIOS initiates the integrity measurement and verification of the RAID card. The measurement and verification of the RAID card includes at least verifying the firmware of the RAID card and the characteristic values ​​of the system disk hard drive connected to it. S3: Only after the RAID card has been verified, the system loads and executes the subsequent BootLoader and operating system kernel from the system disk on the RAID card to complete the startup; S4: During normal system operation, the TPM chip performs periodic or triggered dynamic measurements on the RAID card and its system disk through the system management bus, and executes security handling strategies when measurement anomalies occur.

[0019] In this embodiment of the invention, step S1 mainly involves the TPM chip booting up and measuring the BIOS, establishing an initial chain of trust. Specifically, after the system powers on, the TPM chip, as the root of trust, boots up first and performs the following operations: resetting the platform configuration register (PCR) inside the TPM to its initial value (PCR = 0x00000..00, all 64 bits are 0 after resetting); the TPM chip has a pre-built public key certificate for the RAID card; the TPM chip reads the BIOS firmware data through the motherboard's internal bus (such as LPC, SPI), calculates the first hash value corresponding to the BIOS firmware using a hash algorithm (such as SHA256, SHA-1, or MD5), and then calls the TPM chip API to write the first hash value into the PCR1 register in an extended manner. This extended manner satisfies the formula: new value = Hash(old value || new measured data). If the hash algorithm uses SHA256, then PCR1 = SHA256(all 0s || BIOS); the TPM system pre-stores the baseline value of the BIOS under known security conditions, and the TPM chip compares the current value of the PCR1 register with the preset BIOS value. The security baseline value (the "gold standard" PCR value under known security conditions) is compared bit by bit to check if the comparison results match. If the comparison results do not match, the TPM chip triggers a security handling policy (such as preventing BIOS from starting) and prevents the system from continuing to start. If the comparison results match, the TPM releases control signals or policies to allow the BIOS to start and load normally, completing the initial trust chain establishment. After the BIOS measurement is successful, step S2 is then executed.

[0020] In this embodiment of the invention, step S2 mainly performs BIOS measurement of the RAID card and OS system disk to complete the trusted chain. After the BIOS measurement is successful and the BIOS starts, before loading the BootLoader, it actively initiates integrity measurement and verification of the RAID card to ensure the trustworthiness of the RAID card and OS system disk. Specifically, the BIOS reads the OptionROM file of the RAID card through the PCIe optionROM mechanism, calculates the second hash value corresponding to the OptionROM file using a hash algorithm, and calls the TPM chip API to write the second hash value into the PCR2 register in an extended manner. If the hash algorithm uses SHA256, then PCR2=SHA256(PCR1||RAID OptionROM) is written. The BIOS obtains three types of key data through the trusted API management and control interface pre-designed for the RAID card (this trusted API management and control interface is integrated into the RAID card firmware and only allows trusted components to access it): the firmware hash value of the RAID card (calculated by using a hash algorithm on the RAID firmware), the OS... The system disk's characteristic value (which includes at least the OS system disk's manufacturer information, model, serial number, firmware version, and capacity, calculated using a hash algorithm; if the hash algorithm uses SHA256, then the OS system disk's characteristic value = SHA256(SN / model / manufacturer information / firmware version / hard drive capacity) and the RAID card's private key's signature digest value of "firmware hash value + OS system disk characteristic value"; then the BIOS calls the TPM chip API, using the RAID card's built-in public key to verify the signature digest value. If the verification fails, it indicates that the RAID... If the card data is tampered with or the RAID card is invalid, the TPM chip triggers a security handling policy to prevent the system from booting. If the signature verification is successful, the following operations are performed: the firmware hash value of the RAID card is written to the TPM's PCR3 register in an extended manner (if the hash algorithm uses SHA256, then PCR3=SHA256(PCR2||RAID firmware value) is written), the RAID card loads and presents its virtual disk (VD, i.e., the RAID volume of the OS system disk), preparing for the subsequent BootLoader loading. The key technical points in this step are: a trusted API management and control interface is designed and added to the RAID card, enabling the TPM chip and the first-booted trusted BIOS to achieve a series of trusted controls and management of the RAID card through the RAID trusted API management and control interface; the RAID OptionROM component is introduced into the trusted measurement range, making the trusted measurement more complete; the RAID firmware or firmware hash value is introduced into the trusted measurement range, making the trusted measurement more complete; and the characteristic values ​​(serial number, model, firmware version and manufacturer, capacity) of the system hard drive storing the OS BootLoader, OS kernel, and applications are introduced into the trusted measurement range, making the trusted measurement more complete and secure.A public-private key signature verification method is introduced for RAID firmware and hard drive characteristic values, making the TPM chip and trusted BIOS verification of the RAID card's trustworthiness more comprehensive and secure. After the RAID card's OptionROM and firmware digest values ​​are successfully measured in step S2, step S3 is then executed.

[0021] In this embodiment of the invention, step S3 mainly involves loading the BootLoader and OS to complete the trusted system boot. Only after the RAID card and OS system disk have passed the measurement and verification, the system continues to load subsequent boot components, specifically including: (1) The BIOS reads the OS BootLoader on the RAID card virtual disk, calculates the third hash value corresponding to the BootLoader using a hash algorithm, and calls the TPM chip API to write the third hash value into the PCR4 register in an extended manner (if the hash algorithm uses SHA256, then write PCR4=SHA256(PCR3||BootLoader)); the TPM chip compares the current value of PCR4 with the preset BootLoader security baseline value. If the comparison result is mismatched, the boot is blocked; if the comparison result is a match, the OS BootLoader is loaded and started. (2) After the OS BootLoader measurement is successful (i.e. the comparison result of the above steps is a match and the OS BootLoader is loaded and started), the OS BootLoader reads the operating system kernel on the virtual disk, calculates the fourth hash value corresponding to the operating system kernel using a hash algorithm, and calls the TPM chip API to write the fourth hash value into the PCR5 register in an extended manner (if the hash algorithm uses SHA256, then write PCR5=SHA256(PCR4||BootLoader)); the TPM chip compares the current value of PCR5 with the preset operating system kernel security benchmark value. If the comparison result is a mismatch, the boot is blocked; if the comparison result is a match, the operating system kernel is loaded and started. (3) After the operating system measurement is successful, the operating system kernel reads the core processes and core applications on the virtual disk, calculates the hash value of each core process / application using a hash algorithm, and calls the TPM chip API to write these hash values ​​one by one into registers such as PCR6, PCR7, PCR8, etc. in an extended manner (for example, if the SHA256 hash algorithm is used, then PCR6=SHA256(PCR5||core process), PCR7=SHA256(PCR6||core application 1), PCR8=SHA256(PCR7||core application 2), etc.); the TPM chip compares the current value of each register with the corresponding preset security benchmark value. If the comparison result is mismatched, the loading of the corresponding process / application is blocked. If the comparison results of all links are matched, the system startup is completed, which means that the core process and core application measurement is successful. The operating system kernel loads the process and application, the entire server or PC host completes the entire startup and works normally. Users can log in to the system.

[0022] In this embodiment of the invention, step S4 mainly performs real-time dynamic measurement and security handling during system operation. After the system is running normally, the TPM chip continuously monitors the status of the RAID card and the OS system disk to avoid security threats after startup. The secure startup process of the server or PC host based on the trusted boot method of the RAID card is completed. During normal system operation, real-time / periodic measurement can be performed. Specifically, the TPM chip calls the trusted measurement API interface of the RAID card through the I2C management channel or PCIe channel (the RAID can be verified through the RAID card public key certificate) in real time or at preset intervals. The system retrieves the RAID card's OptionROM file, firmware hash value, and OS system disk characteristic value at intervals (e.g., 1-60 minutes), and repeats the measurement and signature verification logic of step S2 (recalculating the hash value, verifying the signature digest, and comparing the baseline value). It can also perform anomaly-triggered measurement: when the RAID card detects a change in its own status (e.g., hard drive insertion / removal, firmware version update), it proactively reports status data to the TPM chip, triggering the TPM chip to immediately perform measurement and signature verification. If the aforementioned measurement result does not match the corresponding security baseline value, or if signature verification fails, the TPM chip will trigger the measurement and signature verification via the I2C management channel or PCIe. The channel sends control signals and executes security handling strategies, which include one or more of the following: generating system alarms (such as controlling hardware alarm lights to flash, recording system alarm logs, and sending notifications to the administrator via the IPMI remote management interface); stopping the RAID card (cutting off the RAID card data transmission channel to prevent data tampering and reading / writing); and shutting down the host system (to prevent the unsafe system from continuing to run). In step S4, because the TPM has a built-in RAID card certificate, the TPM can measure the RAID card's OptionROM, firmware, and hard drive characteristics in real time / periodically through its own I2C management interface during CPU system operation (the RAID card supports and provides this measurement management interface), thereby improving the system's real-time security protection capabilities and compensating for the deficiency that TPM measurement can only achieve a trusted measurement once during the boot process. Furthermore, this operation step adds the TPM's ability to handle measurement failures. During real-time system operation, if the TPM determines that the RAID card is untrusted, it can use the control interface to control the RAID. This prevents the RAID card data from being tampered with or the hard drive from undergoing dynamic changes after the measurement is completed during system power-on.

[0023] In this embodiment of the invention, the calculation algorithm for each hash value can be selected from any one of SHA256, SHA-1 or MD5, and can be flexibly configured according to system security requirements; the "Trusted API Management and Control Interface" has access control function, which only allows access by BIOS or TPM chip itself that has been certified by TPM, and refuses calls from unauthorized external devices / programs to prevent the interface from being tampered with or abused.

[0024] Please refer to Figure 3 The trusted boot method for a system that coordinates a RAID card and a TPM chip, provided by this invention, includes a business process diagram for the trusted boot process. The process starts from system power-on and sequentially executes TPM boot → BIOS measurement → RAID card measurement → BootLoader measurement → OS kernel measurement → OS application and service measurement. After booting, it enters the TPM real-time measurement stage. Each measurement stage includes the steps of "calculating hash value → writing PCR → comparing benchmark value". If any stage fails, a security policy is triggered to prevent the system from booting or stop the RAID card from working.

[0025] Compared with the prior art, the present invention has the following significant advantages: This invention provides a system trusted boot method that, for the first time, incorporates the OptionROM, firmware, and OS system disk characteristic values ​​of the RAID card into the TPM measurement scope. This solves the problem of trust chain breakage caused by neglecting the RAID link in existing technologies, upgrading the trust chain to a complete trusted chain of "TPM→BIOS→RAID→BootLoader→OS", eliminating the risk of unauthorized RAID cards or tampered hard drives loading malicious systems. By designing a dedicated trusted API management and control interface for the RAID card and introducing a "RAID card private key signature + TPM public key verification" mechanism, the invention ensures the authenticity and reliability of the measurement data reported by the RAID card, resists man-in-the-middle attacks and data tampering, and further enhances the reliability of the measurement results. It breaks through the limitation of existing TPMs that only measure during the boot phase, realizing real-time / periodic monitoring of the RAID card and OS system disk during system operation, promptly detecting threats such as hard drive replacement and firmware tampering after boot, and responding quickly through security handling strategies to ensure continuous system trust, achieving full lifecycle monitoring. This invention is implemented only by upgrading the RAID card firmware (adding trusted API and measurement interface) and optimizing the TPM measurement logic, without adding any new hardware components, is compatible with existing server / PC hardware architectures, reduces implementation costs, and is easy to promote and apply in the industry.

[0026] Furthermore, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the present invention.

[0027] The optional embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details in the above embodiments. Within the scope of the technical concept of the embodiments of the present invention, various simple modifications can be made to the technical solutions of the embodiments of the present invention, and these simple modifications all fall within the protection scope of the embodiments of the present invention.

[0028] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the embodiments of the present invention will not describe the various possible combinations separately.

[0029] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a microcontroller, chip, or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0030] Furthermore, various different implementations of the present invention can be combined arbitrarily, as long as they do not violate the spirit of the present invention, they should also be regarded as the content disclosed in the present invention.

Claims

1. A system trusted boot method in which a RAID card and a TPM chip work together, characterized in that, Includes the following steps: S1: After the system is powered on, the TPM chip is used as the trusted root to start and perform integrity measurement to establish a trusted startup chain. Specifically, this includes resetting the TPM's platform configuration register (PCR) to its initial value and the TPM chip's built-in RAID card public key certificate. The TPM chip reads the BIOS firmware through the motherboard's internal bus, calculates the first hash value of the BIOS firmware, and calls the TPM chip API to write the first hash value into the PCR1 register in an extended manner. The extended manner satisfies the formula: new value = hash(old value || new measured data). The TPM chip compares the current value of the PCR1 register bit by bit with the preset BIOS security baseline value to see if they match: If there is a mismatch, the TPM chip will trigger a security handling strategy and prevent the system from starting. If a match is found, the BIOS will boot and load. S2: In the trusted boot chain, after the BIOS verification is passed and before the bootloader is loaded, the BIOS initiates the integrity measurement and verification of the RAID card. The measurement and verification of the RAID card includes at least verifying the firmware of the RAID card and the characteristic values ​​of the system disk hard drive connected to it. Specifically, the BIOS reads the OptionROM file of the RAID card through the PCIe optionROM mechanism, calculates the second hash value of the OptionROM file, and calls the TPM chip API to write the second hash value into the PCR2 register in the extended manner. The BIOS obtains the firmware hash value of the RAID card, the characteristic value of the OS system disk, and the digest value of the RAID card private key signature through a trusted API management and control interface pre-designed for the RAID card. The characteristic value includes at least the manufacturer information, model, serial number, firmware version, and capacity of the OS system disk. The BIOS calls the TPM chip API, uses the RAID card public key built into the TPM chip to verify the digest value, and determines the subsequent operation based on the verification result: If the signature verification fails, the TPM chip triggers the aforementioned security handling strategy and prevents the system from starting. If the signature verification is successful, perform the following steps: (1) Write the firmware hash value into the PCR3 register in the extended manner; (2) The RAID card loads and renders its virtual disk; S3: Only after the RAID card has been verified, the system loads and executes the subsequent BootLoader and operating system kernel from the system disk on the RAID card to complete the startup; S4: During normal system operation, the TPM chip performs periodic or triggered dynamic measurements on the RAID card and its system disk through the system management bus, and executes security handling strategies when measurement anomalies occur.

2. The system trusted boot method for RAID card and TPM chip collaboration according to claim 1, characterized in that, S3 specifically includes: The BIOS reads the OS BootLoader on the virtual disk, calculates the third hash value of the OS BootLoader, calls the TPM chip API to write the third hash value into the PCR4 register in the extended manner, and the TPM chip compares the current value of the PCR4 register with the preset BootLoader security baseline value. If they do not match, the boot process is blocked; if they match, the OS BootLoader is loaded and started. The OS BootLoader reads the operating system kernel on the virtual disk, calculates the fourth hash value of the operating system kernel, calls the TPM chip API to write the fourth hash value into the PCR5 register in the extended manner, and the TPM chip compares the current value of the PCR5 register with the preset operating system kernel security benchmark value. If they do not match, the boot process is blocked; if they match, the operating system kernel is loaded and started. The operating system kernel reads the core processes and core applications on the virtual disk, calculates the hash value of each core process or core application, and calls the TPM chip API to write them into the respective platform configuration registers (PCRs) in the extended manner. The TPM chip compares the current value of each register with the corresponding preset security benchmark value. If they do not match, it prevents the loading of the corresponding process or application. If they all match, the system starts up and allows the user to log in.

3. The system trusted boot method for RAID card and TPM chip collaboration according to claim 1, characterized in that, S4 specifically includes: S41: During system operation, the TPM chip calls the RAID card's measurement management interface through the I2C management channel or PCIe channel to obtain the RAID card's OptionROM file, firmware hash value, and OS system disk characteristic value in real time or periodically, and repeats the measurement and signature verification logic in step S2. S42: If the measurement result in S41 does not match the corresponding security benchmark value or the signature verification fails, the TPM chip sends a control signal through the I2C management channel or the PCIe channel and executes the security handling strategy.

4. The system trusted boot method for RAID card and TPM chip collaboration according to claim 1, characterized in that, The feature value of the OS system disk is calculated using SHA256, SHA-1, or MD5 algorithms.

5. The system trusted boot method for RAID card and TPM chip collaboration according to any one of claims 1-2, characterized in that, The hash value can be calculated using any one of SHA256, SHA-1, or MD5.

6. The system trusted boot method for RAID card and TPM chip collaboration according to claim 1, characterized in that: The triggering methods for the dynamic measurement include: (1) the TPM chip actively initiates a measurement request at a preset time interval; (2) when the RAID card detects a change in its own status, it actively reports status data to the TPM chip to trigger the measurement, and the change in its own status includes hard drive plugging and unplugging and firmware version update. The security handling strategy includes one or more of the following: generating system alarms, stopping the RAID card, and shutting down the host system.

Images