Trusted computing method and system for heterogeneous fusion platform

Abstract

The application relates to a trusted computing method and system for a heterogeneous fusion platform, which comprises the following steps: firstly, all computing units in the platform are uniformly abstracted and a platform identity profile is constructed through software-defined trusted middleware; meanwhile, a computing task is decomposed into a trusted task object containing an expected behavior portrait; runtime behavior indexes of each unit are collected in real time through a virtual trusted agent; a consistency judgment result is generated by comparing the indexes with the expected portrait; and a behavior integrity measurement register is dynamically updated. When verification is needed, the system collects multi-layered evidences such as platform identity, behavior measurement, hardware proof and accelerator declaration, forms a structured proof set, generates a layered unified proof report after signing by using a platform key, and issues a fine-grained trusted token to the platform that passes the verification after a remote verifier analyzes the report, compares trusted reference values and evaluates behavior compliance.

Description

Technical Field

[0001] This application relates to the field of trusted computing technology, and in particular to a trusted computing method and system for heterogeneous fusion platforms. Background Technology

[0002] With the deep integration of cloud computing, big data, and artificial intelligence technologies, computing platforms are rapidly evolving towards heterogeneity. Typical high-performance computing clusters, AI training platforms, and edge computing nodes often integrate hardware with multiple architectures, such as general-purpose CPUs, GPUs, FPGAs, and various dedicated AI acceleration chips. While this heterogeneous integration model greatly improves computing efficiency and energy efficiency, it also leads to frequent flow and processing of data and computing tasks between hardware with different architectures and security attributes, giving rise to serious new security threats such as data privacy breaches, computational process tampering, and attacks on the software and hardware supply chain.

[0003] Currently, an important technological direction is the remote verification scheme based on the integration of a hardware trusted execution environment (TEE) and a trusted platform module (vTPM). This scheme typically uses a CPU-provided TEE (such as Intel SGX / TDX, AMD SEV) as the core root of trust and introduces a virtualized trusted platform module to provide trusted computing capabilities for virtual machines. It primarily uses confidential containers or confidential virtual machines to protect the security of virtual TPM instances; designs encrypted communication channels to ensure the confidentiality of measurement data during transmission; and collects and verifies verification reports generated by the TEE hardware and vTPM respectively through a centralized remote verification service, thereby confirming the trusted state of a single computing node to the user.

[0004] The aforementioned technical solutions primarily limit their trust foundation and measurement scope to the CPU environment, lacking effective mechanisms for measuring and verifying the internal state and runtime behavior of dedicated accelerated computing units such as GPUs and FPGAs, resulting in blind spots in the security vision of computing platforms.

[0005] Based on this, this application provides a trusted computing method and system for heterogeneous fusion platforms. Summary of the Invention

[0006] To address the issue that the trust foundation and measurement scope are mainly limited to the CPU environment, lacking an effective mechanism for measuring and verifying the internal state and runtime behavior of dedicated accelerated computing units such as GPUs and FPGAs, resulting in blind spots in the security vision of computing platforms, this application provides a trusted computing method and system for heterogeneous fusion platforms.

[0007] Firstly, this application provides a trusted computing method for heterogeneous fusion platforms, employing the following technical solution: including:

[0008] Identify all computing units in the heterogeneous fusion platform, generate corresponding computing unit abstract description information for each computing unit, and construct a platform identity summary based on the computing unit abstract description information; decompose the computing job to be executed into multiple trusted computing task objects, each trusted computing task object containing a corresponding code hash and expected behavior profile;

[0009] Based on the platform identity summary, the virtual trusted agent corresponding to each computing unit is invoked to collect runtime behavior indicators of each computing unit according to a preset strategy; the collected runtime behavior indicators are compared with the expected behavior profile of the corresponding trusted computing task object to generate a runtime behavior consistency judgment result; based on the runtime behavior indicators and the behavior consistency judgment result, the software-defined runtime behavior integrity measurement register is updated.

[0010] The system receives a proof challenge random number from the verifier, and aggregates verification information to form a proof evidence set. The verification information includes: the platform identity summary, the current value of the runtime behavior integrity measurement register, a first hardware proof report from the trusted execution environment inside the general computing unit, and a state declaration report from the dedicated accelerated computing unit. The system uses the platform proof master key to digitally sign the proof challenge random number and the proof evidence set, and generates a hierarchical unified proof report.

[0011] The hierarchical unified proof report is sent to the remote proof server, which verifies the validity of the digital signature of the hierarchical unified proof report. Based on the platform identity summary, the hierarchical structure of the report is parsed, and the trusted reference values ​​corresponding to the hash values ​​of each component in the proof evidence set are obtained from the reference value service and compared. Based on the comparison results and the preset security policy, the runtime behavior consistency judgment result is verified. After all verifications are passed, a trusted authentication token for the current platform state and workload is generated and issued.

[0012] Optionally, the process involves identifying all computing units in the heterogeneous fusion platform, generating corresponding abstract description information for each computing unit, and constructing a platform identity summary based on the abstract description information, including:

[0013] When the heterogeneous converged platform starts or initializes, the software-defined trusted middleware scans and queries the device tree through the system bus, enumerates and identifies all available computing units in the platform, and generates an initial list of computing units. The computing units include at least general-purpose computing units with hardware trusted execution environments and at least one type of dedicated accelerated computing unit.

[0014] For each computing unit in the initial computing unit list, generate corresponding computing unit abstract description information. The computing unit abstract description information includes at least: device type identifier, hardware unique identifier, firmware or microcode metric hash value, and security capability description information supported by the computing unit. The security capability description information is used to indicate whether the computing unit supports hardware isolation, protected memory, or integrity measurement functions.

[0015] Based on the abstract description information of all computing units, the hardware unique identifiers and device type identifiers of all computing units are organized according to a predetermined sorting rule and their joint hash value is calculated as the core identifier of the platform identity summary.

[0016] The platform identity summary is obtained by combining the core identifier of the platform identity summary and the security capability description information of all computing units.

[0017] Optionally, the step of decomposing the computational job to be executed into multiple trusted computational task objects includes:

[0018] Receive computing jobs to be executed. A computing job contains one or more computing kernels, data handling instructions or algorithm models. Analyze the computing job and decompose it into multiple logically independent subtasks that can be scheduled to be executed on different computing units based on its inherent data dependencies and computing parallelism.

[0019] For each subtask, a corresponding trusted computing task object is created, where the code hash is obtained by performing a hash operation on the source code, binary kernel, or computing graph assigned to that subtask;

[0020] The expected behavior profile is generated through static analysis or historical learning. The expected behavior profile includes at least the range of system call sequences, expected resource access patterns, and the threshold for the maximum allowed execution time when the corresponding subtask is scheduled to be executed in a specific type of computing unit.

[0021] Optionally, based on the platform identity summary, the virtual trusted agent corresponding to each computing unit is invoked to collect runtime behavior indicators of each computing unit according to a preset strategy; the collected runtime behavior indicators are compared with the expected behavior profile of the corresponding trusted computing task object to generate a runtime behavior consistency judgment result; based on the runtime behavior indicators and the behavior consistency judgment result, the software-defined runtime behavior integrity measurement register is updated, including:

[0022] Based on the security capability description information of each computing unit recorded in the platform identity summary, a corresponding virtual trusted agent is instantiated for each computing unit. For general computing units that support hardware trusted execution environment, their virtual trusted agents are deployed inside the environment. For dedicated accelerated computing units that do not support hardware trusted execution environment, their virtual trusted agents are deployed in the secure enclave of the general computing unit protected by the hardware trusted execution environment, and interact with the dedicated accelerated computing unit through a secure driving channel.

[0023] Based on the virtual trusted agent of each computing unit, runtime behavior monitoring of the task execution process is initiated according to the trusted computing task object bound to it, and behavioral indicator data is collected according to the preset collection strategy and frequency. The behavioral indicator data includes: for general computing units, system call sequence, sensitive register access events, and memory access exception records during the execution of a specified code segment are collected; for dedicated accelerated computing units, the execution start and end timestamps of the computing unit kernel, stream processor cluster utilization, access address range and frequency of device memory, and abnormal execution status codes fed back by the computing unit performance counter are collected through the security driver channel.

[0024] The collected behavioral indicator data is compared and analyzed in real time or near real time with the predefined expected behavioral profile in the corresponding trusted computing task object to check whether the system call sequence deviates from the whitelist model, whether the resource access mode exceeds the expected range, and whether the execution time is within the preset threshold.

[0025] Based on the comparison results, a runtime behavior consistency judgment result is generated, which includes markers for conformity to expectations, slight deviations, or serious anomalies, and key evidence indicators leading to the judgment result are attached.

[0026] The key feature values ​​of the collected behavioral indicator data and the corresponding runtime behavior consistency judgment results are used to constitute a behavioral measurement event. A cryptographic hash chain algorithm that only allows expansion is used to update the hash value of the behavioral measurement event to the software-defined runtime behavior integrity measurement register, so that the current value of the corresponding register uniquely encodes the behavioral history sequence of all monitored computing units since the platform started.

[0027] Optionally, the step of receiving a proof challenge random number from the verifier and collecting verification information to form a proof evidence set includes: the platform identity summary, the current value of the runtime behavioral integrity metric register, a first hardware proof report originating from the trusted execution environment within the general-purpose computing unit, and a state declaration report originating from the dedicated accelerated computing unit; and digitally signing the proof challenge random number and the proof evidence set using the platform proof master key to generate a hierarchical unified proof report, including:

[0028] The system receives a random number of proof challenge sent by a remote proof server, and in response to the challenge, gathers verification information from different trusted sources to form a structured set of proof evidence, which includes: platform identity layer evidence, software behavior layer evidence, hardware trusted root layer evidence, and acceleration unit declaration layer evidence.

[0029] The collected evidence set is encapsulated into a layered, machine-readable data structure according to the hierarchical relationship from the underlying hardware to the upper software behavior. The platform identity layer evidence serves as the root layer, the hardware trusted root layer evidence and the acceleration unit declaration layer evidence serve as parallel hardware proof sub-layers, and the software behavior layer evidence serves as the top-level dynamic behavior proof sub-layer. Each layer of evidence data is accompanied by its type identifier and version information.

[0030] Using the private key of the platform's proof master key, a digital signature operation is performed on the data to be signed, which consists of a proof challenge random number and the set of proof evidence that has been structured and encapsulated. The trust chain of the platform's proof master key can be traced back to the hardware root of trust of the trusted execution environment inside the general computing unit or the platform's hardware trusted platform module.

[0031] The structured and encapsulated set of proof evidence, the received proof challenge random number, the digital signature, and the public key certificate or certificate chain information of the platform proof master key used to verify the signature are assembled together into the hierarchical unified proof report.

[0032] Optionally, the step of using the platform's proof master key's private key to perform a digital signature operation on the data to be signed, which consists of a proof challenge random number and the structured encapsulated set of proof evidence, includes:

[0033] The received proof challenge random number and the proof evidence set are concatenated and combined according to a predetermined data serialization format to generate initial data to be processed;

[0034] A cryptographic hash operation is performed on the initial data to be processed to generate a fixed-length data digest, which is the final data to be signed.

[0035] The platform proof master key is extracted from the hardware-protected secure key storage area. The platform proof master key is an asymmetric key pair whose trust chain is generated and protected by the trusted execution environment inside the general computing unit during initialization or derived from the trusted platform module on the heterogeneous fusion platform, and its endorsement key certificate provides identity verification.

[0036] Using the platform's proof master key's private key, the specified digital signature algorithm is executed on the data to be signed; after completing the digital signature operation, a standard signature value is output, which serves as the platform's proof master key's cryptographic commitment to the proof challenge random number and the set of proof evidence, making it tamper-proof.

[0037] Optionally, the step of sending the hierarchical unified proof report to a remote proof server, controlling the remote proof server to verify the validity of the digital signature of the hierarchical unified proof report, and parsing the hierarchical structure of the report according to the platform identity summary, obtaining trusted reference values ​​corresponding to the hash values ​​of each component in the proof evidence set from the reference value service for comparison, and verifying the runtime behavior consistency judgment result according to the comparison result and the preset security policy; after all verifications are passed, a trusted authentication token for the current platform state and workload is generated and issued, including:

[0038] The server receives the hierarchical unified proof report sent by the prover through a remote proof server. The server verifies the validity of the platform proof master key public key certificate chain contained in the report and confirms that it can be traced back to a trusted root certificate authority. Using the verified public key, the server verifies the digital signature in the report and confirms the integrity and authenticity of the proof challenge random number and the proof evidence set.

[0039] Based on the platform identity summary contained in the hierarchical unified proof report, the server parses the multi-layer data structure of the report and extracts hardware trust root layer evidence and software behavior layer evidence in sequence.

[0040] For the extracted hardware trusted root layer evidence and software behavior layer evidence, the remote proof server initiates a query request to the reference value based on the component identifiers recorded therein, and obtains the trusted reference value corresponding to the repeatable construction technology; the remote proof server compares the component hash value provided in the evidence with the returned trusted reference value to complete the static integrity verification of the platform firmware, microcode, startup components and key software;

[0041] Based on the server's preset security policy, the runtime behavior consistency judgment results are evaluated, and combined with the historical records of the runtime behavior integrity measurement register, the dynamic behavior of the platform is comprehensively judged to determine whether it meets the security requirements.

[0042] If the signature verification, static integrity verification, and dynamic behavior compliance verification all pass, the remote proof server makes a decision that the comprehensive verification is passed. The server generates a trusted authentication token that includes the verification conclusion, the platform identity summary, the token validity period, and the authorized workload range, and digitally signs the token using the server's private key. The signed trusted authentication token is then sent to the prover.

[0043] Secondly, this application provides a trusted computing device for heterogeneous fusion platforms, which adopts the following technical solution, including:

[0044] The unit description module is used to identify all computing units in the heterogeneous fusion platform, generate corresponding computing unit abstract description information for each computing unit, and construct a platform identity summary based on the computing unit abstract description information; decompose the computing job to be executed into multiple trusted computing task objects, each trusted computing task object containing a corresponding code hash and expected behavior profile;

[0045] The behavior determination module is used to call the virtual trusted agent corresponding to each computing unit according to the platform identity summary, and collect the runtime behavior indicators of each computing unit according to the preset strategy; compare the collected runtime behavior indicators with the expected behavior profile of the corresponding trusted computing task object to generate a runtime behavior consistency determination result; and update the software-defined runtime behavior integrity measurement register based on the runtime behavior indicators and the behavior consistency determination result.

[0046] The proof evidence module is used to receive a proof challenge random number from the verifier, and collect verification information to form a proof evidence set. The verification information includes: the platform identity summary, the current value of the runtime behavior integrity measurement register, the first hardware proof report from the trusted execution environment inside the general computing unit, and the state declaration report from the dedicated accelerated computing unit; the platform proof master key is used to digitally sign the proof challenge random number and the proof evidence set to generate a hierarchical unified proof report;

[0047] The trusted authentication module is used to send the hierarchical unified proof report to the remote proof server, control the remote proof server to verify the validity of the digital signature of the hierarchical unified proof report, parse the hierarchical structure of the report according to the platform identity summary, obtain trusted reference values ​​from the reference value service that correspond to the hash values ​​of each component in the proof evidence set, compare them, and verify the runtime behavior consistency judgment result according to the comparison result and the preset security policy. After all verifications are passed, a trusted authentication token for the current platform state and workload is generated and issued.

[0048] Thirdly, this application also provides a control device, the device comprising:

[0049] It includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed, such as the trusted computing method for heterogeneous converged platforms described above.

[0050] Fourthly, this application also provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described above for a trusted computing method for heterogeneous fusion platforms.

[0051] In summary, this application utilizes a software-defined trusted middleware to uniformly abstract all computing units within the platform and construct a platform identity summary. Simultaneously, it decomposes computing jobs into trusted task objects containing expected behavioral profiles. The core component is runtime collaborative measurement: the middleware invokes virtual trusted proxies for each computing unit to collect its runtime behavioral metrics in real time, compares them with the expected profiles of the task objects, generates a consistency judgment result, and dynamically updates a software-defined runtime behavioral integrity metric register accordingly. When proof is required, the system aggregates the platform identity summary, behavioral metric register values, CPU TEE hardware proof reports, and status declaration reports from each accelerator, forming a hierarchical set of proof evidence. This evidence is then signed using the platform's proof master key, generating a unified hierarchical proof report. Upon receiving the report, the remote verifier verifies the signature layer by layer, parses the structure, and performs integrity comparisons using trusted reference values ​​provided by repeatable construction technology. Simultaneously, it evaluates the behavioral consistency judgment result in conjunction with security policies, ultimately issuing fine-grained trusted authentication tokens to platforms that pass verification. By using software-defined collaborative metrics and hierarchical proof mechanisms, comprehensive and continuous reliable verification of generalized heterogeneous computing platforms, including various accelerators, is achieved from static configuration to dynamic behavior. This overcomes the shortcomings of existing technologies, such as being limited to the CPU environment, static verification, and unauditable reference values. It provides a unified, scalable, and reliable security measure for cloud-edge-device heterogeneous computing power integration scenarios. Attached Figure Description

[0052] Figure 1 This is a flowchart illustrating a trusted computing method for heterogeneous fusion platforms.

[0053] Figure 2 This is a block diagram of a trusted computing device for heterogeneous fusion platforms. Detailed Implementation

[0054] The following combination Figure 1 - Figure 2 This application will be described in further detail.

[0055] To overcome the inherent limitations of existing trusted computing solutions, such as their inability to cover generalized heterogeneous hardware, static verification, and reliance on unauditable reference values, this application proposes a novel, software-defined unified trusted measurement and remote proof system. The core of this application lies in constructing a "software-defined trusted middleware" layer to uniformly abstract and collaboratively monitor heterogeneous platforms, and to generate a structured, layer-by-layer verifiable proof report.

[0056] Reference Figure 1 The embodiments of this application include at least steps S10 to S40.

[0057] S10 identifies all computing units in the heterogeneous fusion platform, generates corresponding computing unit abstract description information for each computing unit, and constructs a platform identity summary based on the computing unit abstract description information; decomposes the computing job to be executed into multiple trusted computing task objects, each of which contains a corresponding code hash and expected behavior profile.

[0058] S20: Based on the platform identity summary, call the virtual trusted agent corresponding to each computing unit, and collect runtime behavior indicators of each computing unit according to the preset strategy; compare the collected runtime behavior indicators with the expected behavior profile of the corresponding trusted computing task object to generate runtime behavior consistency judgment results; based on the runtime behavior indicators and behavior consistency judgment results, update the software-defined runtime behavior integrity measurement register.

[0059] S30: Receive the proof challenge random number from the verifier, gather verification information to form a proof evidence set, including: platform identity summary, current value of runtime behavior integrity measurement register, first hardware proof report from the trusted execution environment inside the general computing unit, and state declaration report from the dedicated accelerated computing unit; use the platform proof master key to digitally sign the proof challenge random number and proof evidence set, and generate a hierarchical unified proof report.

[0060] S40: Send the hierarchical unified proof report to the remote proof server, control the remote proof server to verify the validity of the digital signature of the hierarchical unified proof report, and parse the hierarchical structure of the report according to the platform identity summary. Obtain the trusted reference value corresponding to the hash value of each component in the proof evidence set from the reference value service and compare it. Verify the runtime behavior consistency judgment result according to the comparison result and the preset security policy. After all verifications are passed, generate and issue a trusted authentication token for the current platform state and workload.

[0061] Among them, the reference value service is a remote service dedicated to providing benchmark information for trusted software components. Based on repeatable construction technology, this service ensures that the reference values ​​(cryptographic hash values) it provides can be directly reproduced by auditing the publicly available source code, thereby providing an objective trust benchmark for static integrity verification in remote proofs that does not depend on the software distributor or platform operator.

[0062] Specifically, the system first performs unified abstraction and task decomposition of heterogeneous computing platforms, establishing a platform identity summary and trusted task objects. Then, it monitors the runtime behavior of each unit in real time through a virtual agent, dynamically updating the behavior measurement register. When verification is required, the system gathers multi-layered evidence, including hardware proof and behavior measurement, generating a structured unified proof report and signing it. After remote verification parses the report, it compares trusted reference values ​​with behavioral compliance assessments, ultimately issuing fine-grained trusted tokens to platforms that pass verification. This achieves full-stack trusted measurement of heterogeneous platforms, from static configuration to dynamic behavior, solving the problems of narrow coverage and static verification in traditional methods, and significantly improving trust transparency and security controllability in complex computing scenarios.

[0063] In some embodiments, step S10 specifically includes the following steps: When the heterogeneous converged platform starts or initializes, the software-defined trusted middleware scans and queries the device tree through the system bus, enumerates and identifies all available computing units in the platform, and generates an initial computing unit list. The computing units include at least general-purpose computing units with a hardware trusted execution environment and at least one type of dedicated accelerated computing unit. For each computing unit in the initial computing unit list, corresponding computing unit abstract description information is generated. The computing unit abstract description information includes at least: device type identifier, hardware unique identifier, firmware or microcode metric hash value, and security capability description information supported by the computing unit. The security capability description information is used to indicate whether the computing unit supports hardware isolation, protected memory, or integrity measurement functions. Based on the computing unit abstract description information of all computing units, the hardware unique identifier and device type identifier of all computing units are organized according to a predetermined sorting rule and their joint hash value is calculated as the core identifier of the platform identity summary. The core identifier of the platform identity summary and the security capability description information of all computing units are combined to obtain the platform identity summary.

[0064] The system receives computational jobs to be executed, which contain one or more computational kernels, data handling instructions, or algorithm models. It parses the computational jobs and, based on their inherent data dependencies and computational parallelism, decomposes them into multiple logically independent subtasks that can be scheduled to different computational units for execution. For each subtask, a corresponding trusted computational task object is created. The code hash is obtained by hashing the source code, binary kernel, or computation graph assigned to that subtask. The expected behavior profile is generated through static analysis or historical learning. The expected behavior profile includes at least the allowed range of system call sequences, expected resource access patterns, and a threshold for the maximum allowed execution time when the corresponding subtask is scheduled to execute on a specific type of computational unit.

[0065] The generation of the core identifier is a deterministic cryptographic computation process, and the platform identity generation formula is as follows:

[0066] ;

[0067] PID represents the core identifier of the platform identity summary; H represents the cryptographic hash function; Sort represents the function that performs normalized sorting according to predetermined rules; and These represent the hardware unique identifier and device type identifier of the i-th computing unit, respectively; This represents data concatenation; n is the total number of computing units. This formula ensures a deterministic mapping from a collection of heterogeneous hardware to a unique identifier.

[0068] Specifically, the process first automatically discovers and standardizes the descriptions of all hardware units, generating unique platform identities. Then, complex computing tasks are broken down into measurable units, and their security behavior models are pre-defined. This process transforms disorganized physical hardware into manageable logical entities and ambiguous computing jobs into verifiable task sequences, providing precise benchmarks and objects for subsequent real-time monitoring and trusted verification. It fundamentally solves the problems of unknowability and uncontrollability caused by diverse hardware and complex tasks in heterogeneous environments, achieving standardization and structuring of converged computing resources and their loads, laying the foundation for full-stack dynamic trust.

[0069] In some embodiments, step S20 specifically includes the following steps: Based on the security capability description information of each computing unit recorded in the platform identity summary, instantiate a corresponding virtual trusted agent for each computing unit. For general-purpose computing units that support a hardware trusted execution environment, their virtual trusted agents are deployed inside that environment. For dedicated accelerated computing units that do not support a hardware trusted execution environment, their virtual trusted agents are deployed within the secure enclave of the general-purpose computing unit protected by the hardware trusted execution environment, and interact with the dedicated accelerated computing unit through a secure driver channel. Based on the virtual trusted agents of each computing unit, and according to the trusted computing task object bound to them, start runtime behavior monitoring of the task execution process, and collect behavioral indicator data according to a preset collection strategy and frequency. The behavioral indicator data includes: for general-purpose computing units, collecting system call sequences, sensitive register access events, and memory access exception records during the execution of a specified code segment; for dedicated accelerated computing units, collecting the execution process of the computing unit kernel through a secure driver channel. The system analyzes the collected behavioral metrics data, including start and end timestamps, stream processor cluster utilization, device memory access address range and frequency, and abnormal execution status codes fed back by computing unit performance counters. This data is compared in real-time or near real-time with predefined expected behavioral profiles in the corresponding trusted computing task objects to check whether system call sequences deviate from the whitelist model, whether resource access patterns exceed expected ranges, and whether execution durations are within preset thresholds. Based on the comparison results, a runtime behavior consistency judgment result is generated, including markers for conformity, slight deviation, or severe anomalies, along with key evidence indicators leading to the judgment result. The key feature values ​​of the collected behavioral metrics data and the corresponding runtime behavior consistency judgment results together constitute a behavioral measurement event. Using a cryptographic hash chain algorithm that only allows expansion, the hash value of the behavioral measurement event is updated to the software-defined runtime behavioral integrity measurement register, so that the current value of the corresponding register uniquely encodes the historical behavioral sequence of all monitored computing units since platform startup.

[0070] The above real-time comparison and decision-making process can be formally expressed as a judgment function based on security policy, with the behavioral consistency judgment formula as follows:

[0071] ;

[0072] Judgment represents the runtime behavior consistency determination result; This represents the decision function defined by the preset security policy; This represents a vector of measured behavioral metrics collected by the virtual trusted agent. This represents the expected behavioral profile vector from a trusted computing task object. This function encapsulates the complete logic from indicator comparison to qualitative judgment.

[0073] The cryptographic hash chain algorithm that only allows expansion follows the core cryptographic primitives of metric register updates in trusted computing, and its single update operation is defined by the following formula:

[0074] ;

[0075] Where RTMR represents the value of the runtime behavior integrity measurement register; the subscripts old and new represent the states before and after the update, respectively; H represents the cryptographic hash function; and m represents the hash value of the behavior measurement event to be recorded. By iteratively applying this formula, the final state of the register becomes a unique cryptographic digest of all historical behavior events.

[0076] Specifically, virtual trusted proxies are deployed in a differentiated manner based on hardware security capabilities to build a security monitoring network covering all computing units. Then, fine-grained behavioral indicators are collected based on the operational characteristics of CPUs and various accelerators, and these indicators are compared and judged in real time against preset security benchmarks. Finally, all monitoring events are solidified into immutable behavioral integrity records through a cryptographic hash chain. Its core effect lies in expanding traditional trusted computing from a single static startup verification to dynamic behavioral auditing covering all heterogeneous hardware and spanning the entire lifecycle of task execution. In particular, it solves the problem of the "black box" nature and uncontrollable behavior within the execution processes of dedicated accelerators such as GPUs and FPGAs, providing a real-time and verifiable chain of evidence to prove the overall trustworthy state of the platform during operation.

[0077] In some embodiments, step S30 specifically includes the following steps: receiving a proof challenge random number sent by a remote proof server; responding to the challenge, gathering verification information from different trusted sources to form a structured set of proof evidence, the set of proof evidence including: platform identity layer evidence, software behavior layer evidence, hardware trusted root layer evidence, and acceleration unit declaration layer evidence; encapsulating the gathered set of proof evidence into a layered, machine-readable data structure according to the hierarchical relationship from the underlying hardware to the upper-level software behavior, wherein the platform identity layer evidence serves as the root layer, the hardware trusted root layer evidence and the acceleration unit declaration layer evidence serve as parallel hardware proof sub-layers, and the software... As the top-level dynamic behavior proof sub-layer, each layer of evidence data is accompanied by its type identifier and version information. Using the private key of the platform proof master key, a digital signature operation is performed on the data to be signed, which consists of a proof challenge random number and a structured and encapsulated set of proof evidence. The trust chain of the platform proof master key can be traced back to the hardware root of trust of the trusted execution environment within the general computing unit or the platform's hardware trusted platform module. The structured and encapsulated set of proof evidence, the received proof challenge random number, the digital signature, and the public key certificate or certificate chain information of the platform proof master key used to verify the signature are assembled together into a layered unified proof report.

[0078] The evidence set includes at least: a. Platform identity layer evidence: a platform identity summary, serving as an index and contextual basis for the entire evidence report; b. Software behavior layer evidence: the current value of the runtime behavior integrity metric register, and optional, filtered key behavior event logs associated with that register value; c. Hardware trusted root layer evidence: a first hardware evidence report obtained from the trusted execution environment within the general-purpose computing unit, containing the hardware signature, security version information, and protected memory metric of the general-purpose computing unit; d. Acceleration unit declaration layer evidence: a status declaration report obtained from the virtual trusted agent of each dedicated acceleration computing unit, containing the firmware / microcode hash of the computing unit, the currently loaded workload identifier, and a declaration signature generated by the virtual trusted agent using its local key on the aforementioned information.

[0079] Specifically, the system first responds to the challenge by gathering full-stack evidence, from the hardware root of trust to the software runtime behavior, and encapsulates it according to logical layers, forming a clear chain of proof from the underlying hardware trust state to the upper-layer dynamic behavior records. Then, it digitally signs the entire evidence package using a key traceable back to the hardware root of trust, ensuring the integrity and authenticity of the report. This solves the problems of fragmented evidence, inconsistent formats, and complex verification logic in traditional heterogeneous platform proofs. Through a layered, machine-readable report structure, remote verifiers can efficiently and accurately parse and verify the trust state of each layer, providing a standardized and tamper-proof data foundation for automated, scalable, and unified trusted verification.

[0080] Furthermore, step S30 also includes the following steps: concatenating and combining the received proof challenge random number and the proof evidence set according to a predetermined data serialization format to generate initial data to be processed; performing a cryptographic hash operation on the initial data to be processed to generate a fixed-length data digest, which is the final data to be signed. Extracting the private key of the platform proof master key from the hardware-protected secure key storage area. The platform proof master key is an asymmetric key pair whose trust chain is generated and protected by the trusted execution environment within the general-purpose computing unit during initialization or derived from the trusted platform module on the heterogeneous fusion platform, and whose endorsement key certificate provides identity verification; performing a specified digital signature algorithm operation on the data to be signed using the private key of the platform proof master key; and outputting a standard signature value after completing the digital signature operation. The signature value serves as an immutable cryptographic commitment of the platform proof master key pair to the proof challenge random number and the proof evidence set.

[0081] The above signature operation is a crucial step in generating the entire report's cryptographic binding, and its objective function can be summarized by the following formula:

[0082] ;

[0083] This represents the final generated digital signature; This indicates the use of the platform to prove the master key and private key. The signature function; Nonce represents the proof challenge random number; This represents the various layers of evidence that have undergone serialization and encoding (such as the platform identity layer, hardware proof layer, and behavioral evidence layer). This formula ensures that tampering with evidence at any layer will cause signature verification to fail.

[0084] Specifically, this step is the core security operation for generating a hierarchical unified proof report, which uses cryptographic methods to firmly bind all proof evidence and challenges. First, the external challenge and internal evidence are serialized and hashed to generate a unique digest to be signed. Then, the master private key is extracted from storage protected by the hardware root of trust, and a digital signature algorithm is executed on the digest. This signature is essentially an undeniable commitment made using the platform's highest-level key to the "current state of the platform." This not only ensures the freshness and integrity of the proof report, preventing evidence from being tampered with or replayed, but more importantly, it anchors the scattered, multi-layered trust claims (from hardware identity to software behavior) in the report to a cryptographic origin traceable to the hardware root of trust. This provides remote verifiers with a clear and extremely reliable verification entry point, significantly reducing the verification complexity and risk of establishing trust in complex heterogeneous environments.

[0085] In some embodiments, step S40 specifically includes the following steps: receiving a hierarchical unified proof report sent by the prover through a remote proof server; the server verifies the validity of the platform proof master key public key certificate chain contained in the report and confirms that it can be traced back to a trusted root certificate authority; using the verified public key, verifying the digital signature in the report to confirm the integrity and authenticity of the proof challenge random number and the proof evidence set; based on the platform identity summary contained in the hierarchical unified proof report, the server parses the multi-layer data structure of the report and sequentially extracts the hardware trusted root layer evidence and the software behavior layer evidence; a) Hardware trusted root layer evidence: obtaining the first hardware proof report and the status declaration reports of each dedicated accelerated computing unit; b) Software behavior layer evidence: obtaining the current value of the runtime behavior integrity measurement register and the accompanying runtime behavior consistency judgment result.

[0086] For the extracted hardware trusted root layer evidence and software behavior layer evidence, the remote proof server initiates a query request to the reference value based on the component identifiers recorded therein, and obtains the trusted reference value corresponding to the repeatable construction technology; the remote proof server compares the component hash value provided in the evidence with the returned trusted reference value to complete the static integrity verification of the platform firmware, microcode, startup components and key software;

[0087] Based on the server's preset security policy, the runtime behavior consistency judgment result is evaluated, and combined with the historical records of the runtime behavior integrity measurement register, the dynamic behavior of the platform is comprehensively judged to determine whether it meets the security requirements. If the signature verification, static integrity verification and dynamic behavior compliance verification all pass, the remote proof server makes a decision that the comprehensive verification is passed. The server generates a trusted authentication token containing the verification conclusion, platform identity summary, token validity period and authorized workload scope, and digitally signs the token using the server's private key, and issues the signed trusted authentication token to the prover.

[0088] Among them, the reference value is the core trust anchor in the remote verification process. It refers to the cryptographic hash value that various software and firmware components in the heterogeneous fusion platform should have in an expected, correct, and tamper-free state.

[0089] Static integrity verification essentially verifies whether a cryptographic equation holds true. The verification logic is as follows:

[0090] ;

[0091] Indicates an integrity verification operation; This indicates the component metric hash value claimed by the platform in the proof report; Operators that verify equality; This represents the authoritative and trusted reference hash value obtained from the service provided by the reference value. The equation holding true is mathematical evidence that the component has not been tampered with.

[0092] As a portable credential of the platform's trusted state, the trusted authentication token can be validated by the verifier through an efficient cryptographic verification process during its subsequent use. This verification process is formalized as follows:

[0093] ;

[0094] This represents the token verification function; Represents a signed, trusted authentication token; This represents the widely trusted public key of the remote verification server; the output is valid or invalid. This formula demonstrates that complex platform-wide trust verification is ultimately abstracted into a simple signature verification problem, simplifying the overhead of establishing trust across entities.

[0095] Specifically, the process first verifies the authenticity and completeness of the verification report itself. Then, based on its hierarchical structure, it simultaneously performs static component verification based on authoritative reference values ​​and dynamic compliance assessment based on behavioral judgment results. By upgrading the traditional static "fingerprint comparison" to a dual verification model of "static integrity + dynamic behavior," remote verification parties can make more accurate and comprehensive trust decisions regarding heterogeneous platforms. The final generated and issued fine-grained trust token not only proves the platform's static trustworthiness at a specific moment but also proves the trustworthiness of its dynamic process of executing a specific workload, thus providing a solid and actionable basis for trust in cross-platform secure collaboration and sensitive computing task scheduling.

[0096] The implementation principle of a trusted computing method for heterogeneous fusion platforms according to an embodiment of this application is as follows: A software-defined trusted middleware is used to uniformly abstract all computing units in the platform and construct a platform identity summary. Simultaneously, computing jobs are decomposed into trusted task objects containing expected behavioral profiles. The core element is runtime collaborative measurement: the middleware calls the virtual trusted agents of each computing unit to collect its runtime behavioral indicators in real time, compares them with the expected profiles of the task objects, generates a consistency judgment result, and dynamically updates a software-defined runtime behavioral integrity measurement register accordingly. When proof is required, the system gathers the platform identity summary, behavioral measurement register values, CPU TEE hardware proof reports, and status declaration reports of each accelerator to form a hierarchical set of proof evidence. This evidence is then signed using the platform's proof master key to generate a unified hierarchical proof report. Upon receiving the report, the remote verifier verifies the signature layer by layer, parses the structure, and performs integrity comparison using trusted reference values ​​provided by repeatable construction technology. Simultaneously, it evaluates the behavioral consistency judgment result in conjunction with security policies, and finally issues a fine-grained trusted authentication token to the verified platform. By using software-defined collaborative metrics and hierarchical proof mechanisms, comprehensive and continuous reliable verification of generalized heterogeneous computing platforms, including various accelerators, is achieved from static configuration to dynamic behavior. This overcomes the shortcomings of existing technologies, such as being limited to the CPU environment, static verification, and unauditable reference values. It provides a unified, scalable, and reliable security measure for cloud-edge-device heterogeneous computing power integration scenarios.

[0097] Figure 1 This is a flowchart illustrating a trusted computing method for a heterogeneous fusion platform in one embodiment. It should be understood that, although... Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows; unless explicitly stated otherwise, there is no strict order requirement for the execution of these steps, and they can be executed in other orders; and Figure 1At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0098] Based on the same technical concept, referring to Figure 2 This application also provides a trusted computing device for heterogeneous fusion platforms, which adopts the following technical solution: the device includes:

[0099] The unit description module is used to identify all computing units in the heterogeneous fusion platform, generate corresponding computing unit abstract description information for each computing unit, and construct a platform identity summary based on the computing unit abstract description information; decompose the computing job to be executed into multiple trusted computing task objects, each of which contains a corresponding code hash and expected behavior profile;

[0100] The behavior determination module is used to call the virtual trusted agent corresponding to each computing unit according to the platform identity summary, and collect the runtime behavior indicators of each computing unit according to the preset strategy; compare the collected runtime behavior indicators with the expected behavior profile of the corresponding trusted computing task object to generate runtime behavior consistency determination results; and update the software-defined runtime behavior integrity measurement register based on the runtime behavior indicators and behavior consistency determination results.

[0101] The proof evidence module is used to receive proof challenge random numbers from the verifier, and to collect verification information to form a proof evidence set. The verification information includes: platform identity summary, current value of runtime behavior integrity measurement register, first hardware proof report from the trusted execution environment inside the general computing unit, and state declaration report from the dedicated accelerated computing unit; the platform proof master key is used to digitally sign the proof challenge random numbers and proof evidence set to generate a hierarchical unified proof report;

[0102] The trusted authentication module is used to send the hierarchical unified proof report to the remote proof server, control the remote proof server to verify the validity of the digital signature of the hierarchical unified proof report, parse the hierarchical structure of the report according to the platform identity summary, obtain trusted reference values ​​from the reference value service and compare them with the hash values ​​of each component in the proof evidence set, and verify the runtime behavior consistency judgment result according to the comparison result and the preset security policy; after all verifications are passed, a trusted authentication token for the current platform state and workload is generated and issued.

[0103] In some embodiments, the unit description module is specifically used to scan and query the device tree through the system bus when the heterogeneous fusion platform is started or initialized, enumerate and identify all available computing units in the platform, and generate an initial computing unit list. The computing units include at least a general computing unit with a hardware trusted execution environment and at least one type of dedicated accelerated computing unit.

[0104] For each computing unit in the initial computing unit list, generate corresponding computing unit abstract description information. The computing unit abstract description information includes at least: device type identifier, hardware unique identifier, firmware or microcode metric hash value, and security capability description information supported by the computing unit. The security capability description information is used to indicate whether the computing unit supports hardware isolation, protected memory, or integrity measurement functions.

[0105] Based on the abstract description information of all computing units, the hardware unique identifiers and device type identifiers of all computing units are organized according to a predetermined sorting rule and their joint hash value is calculated as the core identifier of the platform identity summary.

[0106] The platform identity summary is obtained by combining the core identifiers of the platform identity summary and the security capability descriptions of all computing units.

[0107] In some embodiments, the unit description module is specifically used to receive a computing job to be executed. The computing job includes one or more computing kernels, data handling instructions or algorithm models. The computing job is parsed and decomposed into multiple logically independent subtasks that can be scheduled to be executed on different computing units according to its inherent data dependencies and computing parallelism.

[0108] For each subtask, a corresponding trusted computing task object is created, where the code hash is obtained by performing a hash operation on the source code, binary kernel, or computing graph assigned to that subtask;

[0109] The expected behavior profile is generated through static analysis or historical learning. The expected behavior profile includes at least the range of system call sequences, expected resource access patterns, and the threshold for the maximum allowed execution time when the corresponding subtask is scheduled to be executed in a specific type of computing unit.

[0110] In some embodiments, the behavior determination module is specifically used to instantiate a corresponding virtual trusted agent for each computing unit based on the security capability description information of each computing unit recorded in the platform identity summary. For general computing units that support hardware trusted execution environment, their virtual trusted agents are deployed inside the environment. For dedicated accelerated computing units that do not support hardware trusted execution environment, their virtual trusted agents are deployed in the secure enclave of the general computing unit protected by the hardware trusted execution environment and interact with the dedicated accelerated computing unit through a secure driving channel.

[0111] Based on the virtual trusted agent of each computing unit, runtime behavior monitoring of the task execution process is initiated according to the trusted computing task object bound to it, and behavioral indicator data is collected according to the preset collection strategy and frequency. The behavioral indicator data includes: for general computing units, system call sequence, sensitive register access events, and memory access exception records during the execution of a specified code segment are collected; for dedicated accelerated computing units, the execution start and end timestamps of the computing unit kernel, stream processor cluster utilization, access address range and frequency of device memory, and abnormal execution status codes fed back by the computing unit performance counter are collected through the security driver channel.

[0112] The collected behavioral indicator data is compared and analyzed in real time or near real time with the predefined expected behavioral profile in the corresponding trusted computing task object to check whether the system call sequence deviates from the whitelist model, whether the resource access mode exceeds the expected range, and whether the execution time is within the preset threshold.

[0113] Based on the comparison results, a runtime behavior consistency judgment result is generated, which includes markers for conformity to expectations, slight deviations, or serious anomalies, and key evidence indicators leading to the judgment result are attached.

[0114] The key feature values ​​of the collected behavioral indicator data and the corresponding runtime behavior consistency judgment results are used to form a behavioral measurement event. A cryptographic hash chain algorithm that only allows expansion is used to update the hash value of the behavioral measurement event to the software-defined runtime behavioral integrity measurement register, so that the current value of the corresponding register uniquely encodes the behavioral history sequence of all monitored computing units since the platform started.

[0115] In some embodiments, the proof evidence module is specifically used to receive a proof challenge random number sent by a remote proof server, and in response to the challenge, to gather verification information from different trusted sources to form a structured proof evidence set, which includes: platform identity layer evidence, software behavior layer evidence, hardware trusted root layer evidence, and acceleration unit declaration layer evidence.

[0116] The collected evidence is encapsulated into a layered, machine-readable data structure according to the hierarchical relationship from the underlying hardware to the upper-level software behavior. Among them, the platform identity layer evidence serves as the root layer, the hardware trusted root layer evidence and the acceleration unit declaration layer evidence serve as parallel hardware proof sub-layers, and the software behavior layer evidence serves as the top-level dynamic behavior proof sub-layer. Each layer of evidence data is accompanied by its type identifier and version information.

[0117] Using the private key of the platform's proof master key, a digital signature operation is performed on the data to be signed, which consists of a proof challenge random number and a set of proof evidence that has been structured and encapsulated. The trust chain of the platform's proof master key can be traced back to the hardware root of trust of the trusted execution environment inside the general computing unit or the platform's hardware trusted platform module.

[0118] The structured and encapsulated set of proof evidence, the received proof challenge random number, the digital signature, and the public key certificate or certificate chain information of the platform proof master key used to verify the signature are assembled together into a layered unified proof report.

[0119] In some embodiments, the proof evidence module is specifically used to concatenate and combine the received proof challenge random number and the proof evidence set according to a predetermined data serialization format to generate initial data to be processed.

[0120] A cryptographic hash operation is performed on the initial data to be processed to generate a fixed-length data digest, which is the final data to be signed.

[0121] The platform proof master key is extracted from the hardware-protected secure key storage area. The platform proof master key is an asymmetric key pair whose trust chain is generated and protected by the trusted execution environment inside the general computing unit during initialization or derived from the trusted platform module on the heterogeneous fusion platform, and its endorsement key certificate provides identity verification.

[0122] Using the platform's proof master key's private key, the specified digital signature algorithm is executed on the data to be signed; after completing the digital signature operation, a standard signature value is output. The signature value serves as the platform's proof master key's cryptographic commitment to the immutability of the proof challenge random number and the set of proof evidence.

[0123] In some embodiments, the trusted authentication module is specifically used to receive a hierarchical unified proof report sent by the prover through a remote proof server. The server verifies the validity of the platform proof master key public key certificate chain contained in the report and confirms that it can be traced back to a trusted root certificate authority. Using the verified public key, the digital signature in the report is verified to confirm the integrity and authenticity of the proof challenge random number and the proof evidence set.

[0124] Based on the platform identity summary contained in the hierarchical unified proof report, the server parses the multi-layer data structure of the report and extracts hardware trust root layer evidence and software behavior layer evidence in sequence.

[0125] For the extracted hardware trusted root layer evidence and software behavior layer evidence, the remote proof server initiates a query request to the reference value based on the component identifiers recorded therein, and obtains the trusted reference value corresponding to the repeatable construction technology; the remote proof server compares the component hash value provided in the evidence with the returned trusted reference value to complete the static integrity verification of the platform firmware, microcode, startup components and key software;

[0126] Based on the server's preset security policy, the runtime behavior consistency judgment results are evaluated, and combined with the historical records of the runtime behavior integrity measurement register, the dynamic behavior of the platform is comprehensively judged to determine whether it meets the security requirements.

[0127] If the signature verification, static integrity verification, and dynamic behavior compliance verification all pass, the remote proof server makes a decision that the comprehensive verification is passed. The server generates a trusted authentication token that includes the verification conclusion, platform identity summary, token validity period, and authorized workload scope, and digitally signs the token using the server's private key. The signed trusted authentication token is then sent to the prover.

[0128] This application also discloses a control device.

[0129] Specifically, the control device includes a memory and a processor, with the memory storing computer programs that can be loaded and executed by the processor to implement the aforementioned trusted computing method for heterogeneous fusion platforms.

[0130] This application also discloses a computer-readable storage medium.

[0131] Specifically, the computer-readable storage medium stores a computer program that can be loaded by a processor and executed as described above for the trusted computing method for heterogeneous converged platforms. The computer-readable storage medium includes, for example, various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A trusted computing method for heterogeneous fusion platforms, characterized in that, include: Identify all computing units in the heterogeneous fusion platform, generate corresponding abstract description information for each computing unit, and construct a platform identity summary based on the abstract description information of the computing units; The computation job to be executed is decomposed into multiple trusted computing task objects, each of which contains a corresponding code hash and expected behavior profile; Based on the platform identity summary, the virtual trusted agent corresponding to each computing unit is invoked to collect runtime behavior indicators of each computing unit according to a preset strategy; the collected runtime behavior indicators are compared with the expected behavior profile of the corresponding trusted computing task object to generate a runtime behavior consistency judgment result. Update the software-defined runtime behavior integrity measurement register based on runtime behavior metrics and behavior consistency judgment results; The system receives a proof challenge random number from the verifier, and aggregates verification information to form a proof evidence set. The verification information includes: the platform identity summary, the current value of the runtime behavior integrity measurement register, a first hardware proof report from the trusted execution environment inside the general computing unit, and a state declaration report from the dedicated accelerated computing unit. The system uses the platform proof master key to digitally sign the proof challenge random number and the proof evidence set, and generates a hierarchical unified proof report. The hierarchical unified proof report is sent to the remote proof server, which verifies the validity of the digital signature of the hierarchical unified proof report. Based on the platform identity summary, the hierarchical structure of the report is parsed, and the trusted reference values ​​corresponding to the hash values ​​of each component in the proof evidence set are obtained from the reference value service and compared. Based on the comparison results and the preset security policy, the runtime behavior consistency judgment result is verified. After all verifications are passed, a trusted authentication token for the current platform state and workload is generated and issued.

2. The trusted computing method for heterogeneous fusion platforms according to claim 1, characterized in that, The system identifies all computing units in the heterogeneous fusion platform, generates corresponding abstract description information for each computing unit, and constructs a platform identity summary based on the abstract description information, including: When the heterogeneous converged platform starts or initializes, the software-defined trusted middleware scans and queries the device tree through the system bus, enumerates and identifies all available computing units in the platform, and generates an initial list of computing units. The computing units include at least general-purpose computing units with hardware trusted execution environments and at least one type of dedicated accelerated computing unit. For each computing unit in the initial computing unit list, generate corresponding computing unit abstract description information. The computing unit abstract description information includes at least: device type identifier, hardware unique identifier, firmware or microcode metric hash value, and security capability description information supported by the computing unit. The security capability description information is used to indicate whether the computing unit supports hardware isolation, protected memory, or integrity measurement functions. Based on the abstract description information of all computing units, the hardware unique identifiers and device type identifiers of all computing units are organized according to a predetermined sorting rule and their joint hash value is calculated as the core identifier of the platform identity summary. The platform identity summary is obtained by combining the core identifier of the platform identity summary and the security capability description information of all computing units.

3. The trusted computing method for heterogeneous fusion platforms according to claim 2, characterized in that, The process of decomposing the computational job to be executed into multiple trusted computational task objects includes: Receive computing jobs to be executed. A computing job contains one or more computing kernels, data handling instructions or algorithm models. Analyze the computing job and decompose it into multiple logically independent subtasks that can be scheduled to be executed on different computing units based on its inherent data dependencies and computing parallelism. For each subtask, a corresponding trusted computing task object is created, where the code hash is obtained by performing a hash operation on the source code, binary kernel, or computing graph assigned to that subtask; The expected behavior profile is generated through static analysis or historical learning. The expected behavior profile includes at least the range of system call sequences, expected resource access patterns, and the threshold for the maximum allowed execution time when the corresponding subtask is scheduled to be executed in a specific type of computing unit.

4. The trusted computing method for heterogeneous fusion platforms according to claim 1, characterized in that, According to the platform identity summary, the virtual trusted agent corresponding to each computing unit is invoked to collect runtime behavior indicators of each computing unit according to a preset strategy; the collected runtime behavior indicators are compared with the expected behavior profile of the corresponding trusted computing task object to generate a runtime behavior consistency judgment result. Based on runtime behavior metrics and behavior consistency determination results, update the software-defined runtime behavior integrity metric register, including: Based on the security capability description information of each computing unit recorded in the platform identity summary, a corresponding virtual trusted agent is instantiated for each computing unit. For general computing units that support hardware trusted execution environment, their virtual trusted agents are deployed inside the environment. For dedicated accelerated computing units that do not support hardware trusted execution environment, their virtual trusted agents are deployed in the secure enclave of the general computing unit protected by the hardware trusted execution environment, and interact with the dedicated accelerated computing unit through a secure driving channel. Based on the virtual trusted agent of each computing unit, runtime behavior monitoring of the task execution process is initiated according to the trusted computing task object bound to it, and behavioral indicator data is collected according to the preset collection strategy and frequency. The behavioral indicator data includes: for general computing units, system call sequence, sensitive register access events, and memory access exception records during the execution of a specified code segment are collected; for dedicated accelerated computing units, the execution start and end timestamps of the computing unit kernel, stream processor cluster utilization, access address range and frequency of device memory, and abnormal execution status codes fed back by the computing unit performance counter are collected through the security driver channel. The collected behavioral indicator data is compared and analyzed in real time or near real time with the predefined expected behavioral profile in the corresponding trusted computing task object to check whether the system call sequence deviates from the whitelist model, whether the resource access mode exceeds the expected range, and whether the execution time is within the preset threshold. Based on the comparison results, a runtime behavior consistency judgment result is generated, which includes markers for conformity to expectations, slight deviations, or serious anomalies, and key evidence indicators leading to the judgment result are attached. The key feature values ​​of the collected behavioral indicator data and the corresponding runtime behavior consistency judgment results are used to constitute a behavioral measurement event. A cryptographic hash chain algorithm that only allows expansion is used to update the hash value of the behavioral measurement event to the software-defined runtime behavior integrity measurement register, so that the current value of the corresponding register uniquely encodes the behavioral history sequence of all monitored computing units since the platform started.

5. A trusted computing method for heterogeneous fusion platforms according to claim 1, characterized in that, The process involves receiving a proof challenge random number from the verifier, compiling verification information to form a proof evidence set, the verification information including: the platform identity summary, the current value of the runtime behavior integrity metric register, a first hardware proof report originating from the trusted execution environment within the general-purpose computing unit, and a state declaration report originating from the dedicated accelerated computing unit; and digitally signing the proof challenge random number and the proof evidence set using the platform proof master key to generate a hierarchical unified proof report, including: The system receives a random number of proof challenge sent by a remote proof server, and in response to the challenge, gathers verification information from different trusted sources to form a structured set of proof evidence, which includes: platform identity layer evidence, software behavior layer evidence, hardware trusted root layer evidence, and acceleration unit declaration layer evidence. The collected evidence set is encapsulated into a layered, machine-readable data structure according to the hierarchical relationship from the underlying hardware to the upper software behavior. The platform identity layer evidence serves as the root layer, the hardware trusted root layer evidence and the acceleration unit declaration layer evidence serve as parallel hardware proof sub-layers, and the software behavior layer evidence serves as the top-level dynamic behavior proof sub-layer. Each layer of evidence data is accompanied by its type identifier and version information. Using the private key of the platform's proof master key, a digital signature operation is performed on the data to be signed, which consists of a proof challenge random number and the set of proof evidence that has been structured and encapsulated. The trust chain of the platform's proof master key can be traced back to the hardware root of trust of the trusted execution environment inside the general computing unit or the platform's hardware trusted platform module. The structured and encapsulated set of proof evidence, the received proof challenge random number, the digital signature, and the public key certificate or certificate chain information of the platform proof master key used to verify the signature are assembled together into the hierarchical unified proof report.

6. A trusted computing method for heterogeneous fusion platforms according to claim 5, characterized in that, The method of using the platform's proof master key's private key to perform digital signature operations on the data to be signed, which consists of a proof challenge random number and the structured encapsulated set of proof evidence, includes: The received proof challenge random number and the proof evidence set are concatenated and combined according to a predetermined data serialization format to generate initial data to be processed; A cryptographic hash operation is performed on the initial data to be processed to generate a fixed-length data digest, which is the final data to be signed. The platform proof master key is extracted from the hardware-protected secure key storage area. The platform proof master key is an asymmetric key pair whose trust chain is generated and protected by the trusted execution environment inside the general computing unit during initialization or derived from the trusted platform module on the heterogeneous fusion platform, and its endorsement key certificate provides identity verification. Using the platform's proof master key's private key, the specified digital signature algorithm is executed on the data to be signed; after completing the digital signature operation, a standard signature value is output, which serves as the platform's proof master key's cryptographic commitment to the proof challenge random number and the set of proof evidence, making it tamper-proof.

7. A trusted computing method for heterogeneous fusion platforms according to claim 1, characterized in that, The process involves sending the hierarchical unified proof report to a remote proof server, controlling the remote proof server to verify the validity of the digital signature of the hierarchical unified proof report, parsing the hierarchical structure of the report according to the platform identity summary, obtaining trusted reference values ​​corresponding to the hash values ​​of each component in the proof evidence set from the reference value service, comparing them, and verifying the runtime behavior consistency judgment result according to the comparison result and the preset security policy. After all verifications are successful, a trusted authentication token for the current platform state and workload is generated and issued, including: The remote proof server receives the hierarchical unified proof report sent by the prover. The remote proof server verifies the validity of the platform proof master key public key certificate chain contained in the report and confirms that it can be traced back to the trusted root certificate authority. Using the verified public key, the digital signature in the report is verified to confirm the integrity and authenticity of the proof challenge random number and the proof evidence set. Based on the platform identity summary contained in the hierarchical unified proof report, the multi-layer data structure of the report is parsed by the remote proof server, and hardware trusted root layer evidence and software behavior layer evidence are extracted in sequence. For the extracted hardware trusted root layer evidence and software behavior layer evidence, the remote proof server initiates a query request to the reference value based on the component identifiers recorded therein, and obtains the trusted reference value corresponding to the repeatable construction technology; the remote proof server compares the component hash value provided in the evidence with the returned trusted reference value to complete the static integrity verification of the platform firmware, microcode, startup components and key software; Based on the server's preset security policy, the runtime behavior consistency judgment results are evaluated, and combined with the historical records of the runtime behavior integrity measurement register, the dynamic behavior of the platform is comprehensively judged to determine whether it meets the security requirements. If the signature verification, static integrity verification, and dynamic behavior compliance verification all pass, the server makes a decision that the comprehensive verification is passed. The server generates a trusted authentication token that includes the verification conclusion, the platform identity summary, the token validity period, and the authorized workload range. The server then uses its private key to digitally sign the trusted authentication token and issues the signed trusted authentication token to the prover.

8. A trusted computing device for heterogeneous fusion platforms, characterized in that, The device includes: The unit description module is used to identify all computing units in the heterogeneous fusion platform, generate corresponding computing unit abstract description information for each computing unit, and construct a platform identity summary based on the computing unit abstract description information; decompose the computing job to be executed into multiple trusted computing task objects, each trusted computing task object containing a corresponding code hash and expected behavior profile; The behavior determination module is used to call the virtual trusted agent corresponding to each computing unit according to the platform identity summary, and collect the runtime behavior indicators of each computing unit according to the preset strategy; compare the collected runtime behavior indicators with the expected behavior profile of the corresponding trusted computing task object to generate a runtime behavior consistency determination result; and update the software-defined runtime behavior integrity measurement register based on the runtime behavior indicators and the behavior consistency determination result. The proof evidence module is used to receive a proof challenge random number from the verifier, and collect verification information to form a proof evidence set. The verification information includes: the platform identity summary, the current value of the runtime behavior integrity measurement register, the first hardware proof report from the trusted execution environment inside the general computing unit, and the state declaration report from the dedicated accelerated computing unit; the platform proof master key is used to digitally sign the proof challenge random number and the proof evidence set to generate a hierarchical unified proof report; The trusted authentication module is used to send the hierarchical unified proof report to the remote proof server, control the remote proof server to verify the validity of the digital signature of the hierarchical unified proof report, parse the hierarchical structure of the report according to the platform identity summary, obtain trusted reference values ​​from the reference value service that correspond to the hash values ​​of each component in the proof evidence set, compare them, and verify the runtime behavior consistency judgment result according to the comparison result and the preset security policy. After all verifications are passed, a trusted authentication token for the current platform state and workload is generated and issued.

9. A control device, characterized in that, The device includes: A memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer program is stored that can be loaded by a processor and executed as described in any one of claims 1 to 7.

Images