Singlechip TEE system based on external TPCM and measurement method and device thereof

Abstract

The invention discloses a single-chip microcomputer TEE system based on an external TPCM and a measurement method and device thereof. The method comprises the steps that a measurement instruction is sent to a TEE measurement agent of a trusted execution environment TEE through an interrupt pin, the TEE measurement agent is used for executing logic codes of trusted measurement to measure content to be measured, a measurement result is obtained, and the trusted execution environment TEE is located in a single-chip microcomputer; obtaining a measurement result of the TEE measurement agent through a bus pin; verifying the measurement result according to a self-stored expected result or a strategy allowed result; and executing a corresponding security policy according to the verification result. According to the invention, the technical problem of low security of the MCU in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of computer security, and more specifically, to a microcontroller-based TEE system based on an external TPCM and its measurement method and apparatus. Background Technology

[0002] This section is intended to provide background or context for the content set forth in the claims or specification, and the content described herein is not acknowledged as prior art simply because it is included in this section.

[0003] A microcontroller system (MCU) is a highly integrated microcomputer system that integrates the basic components of a computer onto a single chip. The core of a typical MCU system is a single microcontroller chip. As a core component of embedded systems, MCUs, with their miniaturization, high reliability, low cost, and excellent control capabilities, have become crucial for the intelligence and automation of modern electronic products, and are widely used in industrial control, home appliances, automotive electronics, and other fields. However, secure MCU solutions are low in cost but also low in security.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a microcontroller TEE system based on an external TPCM and its measurement method and apparatus, in order to at least solve the technical problem of low security of MCUs in related technologies.

[0006] According to one aspect of the embodiments of this application, a microcontroller TEE system based on an external TPCM is provided, comprising: a microcontroller having a Trusted Execution Environment (TEE) with trusted measurement logic code in the TEE; and an external TPCM connected to a pin of the microcontroller, wherein the external TPCM controls the TEE to run the trusted measurement logic code through a TEE measurement proxy of the TEE and processes the measurement results of the TEE.

[0007] Optionally, the microcontroller has an interrupt pin and a bus pin, and the external TPCM is connected to the interrupt pin and the bus pin respectively. The external TPCM triggers the Trusted Execution Environment (TEE) to run the logic code of the trust measurement through the interrupt pin, and interacts with the Trusted Execution Environment (TEE) through the bus pin.

[0008] Optionally, the external TPCM includes: a storage module for storing the root key, policy file, measurement results, and verification report, the storage module having resistance to physical attacks; a cryptographic module for performing cryptographic operations using a cryptographic coprocessor; a policy module for storing and executing security policies; an adjudication module for verifying the measurement results of the Trusted Execution Environment (TEE); a control module for executing the corresponding security policy based on the verification results; an interrupt controller for managing interrupt signals sent to the TEE via the interrupt pin; an interface controller for managing the communication protocol of the bus pin; a clock and power management module for managing the chip's clock and power supply; and a processor for executing firmware and handling related tasks.

[0009] Optionally, the microcontroller also has a Rich Execution Environment (REE), and the external TPCM includes: a communication and interface module: serving as the sole controlled channel for communication with the outside; a measurement module: acting as an engine for performing measurement calculations; a memory access module: used to access the memory of the REE and the TEE; and a security support module: used to ensure the confidentiality and integrity of communication with the external TPCM, and to store the session key issued by the external TPCM for this session, thereby using the session key to encrypt and sign the content of this session.

[0010] According to another aspect of the embodiments of this application, a measurement method for a microcontroller TEE system based on an external TPCM is also provided, comprising: sending a measurement instruction to a TEE measurement agent of a Trusted Execution Environment (TEE) via an interrupt pin, wherein the TEE measurement agent is used to execute trusted measurement logic code to measure the content to be measured and obtain a measurement result, and the TEE is located within a microcontroller; obtaining the measurement result of the TEE measurement agent via a bus pin; verifying the measurement result according to its own stored expected result or the result allowed by the policy; and executing a corresponding security policy according to the verification result.

[0011] Optionally, a measurement command is sent to the TEE measurement agent of the Trusted Execution Environment (TEE) via an interrupt pin, including: the external TPCM triggers dynamic measurement on demand to send measurement commands to the TEE measurement agent according to the following measurement strategies: event-triggered measurement strategy: the external TPCM is triggered when a specific security-sensitive event occurs; random sampling measurement strategy: the true random number generator in the external TPCM generates a random delay, and an interrupt is initiated to perform measurement when the delay arrives; differential measurement strategy: after obtaining a trusted state of all memory regions, only the memory regions that have changed are measured.

[0012] According to another aspect of the embodiments of this application, a measurement method for a microcontroller-based TEE system based on an external TPCM is also provided, applied to a TEE measurement agent in a Trusted Execution Environment (TEE). The method includes: receiving a measurement instruction sent by an external TPCM via an interrupt pin; obtaining the content to be measured, executing trusted measurement logic code to measure the content to be measured, and obtaining a measurement result; and sending the measurement result to the external TPCM via a bus pin, wherein the external TPCM is used to verify the measurement result according to its own stored expected results or results allowed by the policy, and execute the security policy corresponding to the verification result.

[0013] According to another aspect of the embodiments of this application, a measurement device for a microcontroller-based TEE system based on an external TPCM is also provided. This device includes: a sending unit, configured to send a measurement instruction to a TEE measurement agent of a Trusted Execution Environment (TEE) via an interrupt pin, wherein the TEE measurement agent executes trusted measurement logic code to measure the content to be measured and obtain a measurement result, and the TEE is located within a microcontroller; an acquisition unit, configured to acquire the measurement result of the TEE measurement agent via a bus pin; a verification unit, configured to verify the measurement result according to its stored expected result or the result allowed by the policy; and an execution unit, configured to execute a corresponding security policy based on the verification result.

[0014] According to another aspect of the embodiments of this application, a measurement device for a microcontroller-based TEE system based on an external TPCM is also provided, applied to a TEE measurement agent in a Trusted Execution Environment (TEE). The device includes: a receiving unit, configured to receive a measurement instruction sent by the external TPCM via an interrupt pin; a measurement unit, configured to acquire the content to be measured, execute trusted measurement logic code to measure the content to be measured, and obtain a measurement result; and a transmission unit, configured to send the measurement result to the external TPCM via a bus pin, wherein the external TPCM is configured to verify the measurement result according to its stored expected result or the result allowed by the policy, and execute the security policy corresponding to the verification result.

[0015] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, the storage medium including a stored program that executes the above-described method when the program is run.

[0016] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor performs the above-described method through the computer program.

[0017] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the embodiments of the methods described above.

[0018] In this embodiment, a measurement instruction is sent to the TEE measurement agent of the Trusted Execution Environment (TEE) via an interrupt pin. The TEE measurement agent executes the trusted measurement logic code to measure the content to be measured and obtains the measurement result. The TEE is located within the microcontroller. The measurement result of the TEE measurement agent is obtained via a bus pin. The measurement result is verified according to the expected result stored in the microcontroller or the result allowed by the policy. The corresponding security policy is executed according to the verification result, thereby solving the technical problem of low security of MCUs in related technologies. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a schematic diagram of an optional microcontroller TEE system based on an external TPCM according to an embodiment of this application; Figure 2 This is a schematic diagram of an optional external TPCM structure according to an embodiment of this application; Figure 3 This is a schematic diagram of an optional microcontroller TEE system according to an embodiment of this application; Figure 4 This is a flowchart of an optional measurement method for a microcontroller TEE system based on an external TPCM, according to an embodiment of this application. Figure 5 This is a flowchart of an optional measurement method for a microcontroller TEE system based on an external TPCM, according to an embodiment of this application. Figure 6 This is a schematic diagram of a measurement scheme for a microcontroller TEE system based on an external TPCM according to an embodiment of this application; Figure 7 This is a schematic diagram of an optional collaborative work scheme according to an embodiment of this application; Figure 8 This is a schematic diagram of a measurement device for an optional microcontroller TEE system based on an external TPCM, according to an embodiment of this application. Figure 9This is a schematic diagram of a measurement device for an optional microcontroller TEE system based on an external TPCM, according to an embodiment of this application. Figure 10 This is a structural block diagram of a terminal according to an embodiment of this application. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] In scenarios with stringent security requirements, such as finance, government affairs, critical infrastructure, and industries needing to meet specific compliance requirements, basic microcontroller systems need to incorporate trusted computing technologies to enhance their security. Depending on actual security needs, cost budgets, and compliance requirements, microcontroller systems can choose different levels of trusted computing solutions to provide flexible and robust security for diverse application scenarios. Referring to relevant technologies, this can be achieved through three methods: secure MCUs, TEEs (Trusted Equipment Providers), and SEs (Secure Elements), which exhibit significant differences in security and cost.

[0023] 1) Secure MCU solutions are the most basic trusted computing implementation, suitable for applications with low security requirements and high cost sensitivity. The modification of secure MCUs is achieved within a single chip and execution environment by enhancing hardware security modules and firmware. This is an "intrinsic" modification, without adding a new security architecture. It enhances the security of traditional MCUs through hardware security modules (such as encryption engines and true random number generators), providing only basic encryption and anti-tampering capabilities. Due to the lack of strict execution environment isolation, its protection capabilities are limited; it lacks a root of trust and a complete dual-system architecture. Trusted computing functions rely on Bootloader + OS layer software, making dynamic TEE measurement impossible or limited, and easily bypassed. The essence of secure MCU modification is "hardware hardening + basic secure boot." The solution's flaws are fatal: there is no true isolation; keys can be stolen by DMA or debug interfaces; all code runs in the same kernel and memory space, relying solely on the MPU for soft isolation. Once the application layer is compromised, attackers may gain access to all security resources and keys. The solution's advantages lie in its low cost and ease of use, making it suitable for scenarios that require basic security features (such as device authentication and communication encryption), are extremely cost-sensitive, and have a low expected risk of physical attacks.

[0024] 2) The single-chip microcomputer TEE solution achieves a good balance between security and cost and is currently the most mainstream trusted computing implementation method in single-chip microcomputer systems. There are mainly two technical routes for the implementation of the TEE solution on single-chip microcomputers: ARM TrustZone technology and dual-core TEE architecture. The transformation of TEE creates two logically or physically isolated execution environments on a single processor chip: the secure world (TEE) and the normal world (REE). The trusted transformation based on TEE is a systematic project, usually achieved through software and hardware collaboration. Through the extension and transformation of hardware, system, and software, trusted functions can usually be achieved. The implementation of TEE strongly depends on the hardware isolation mechanism provided by the processor. The transformation solution relies on the hardware isolation mechanism. The core components are the hardware isolation environment + the trusted root of the trusted module inside TEE + the trusted measurement software of the trusted module inside REE. The trusted root is a hardware-assisted software trusted root, which is a trusted module running in TEE and can achieve dynamic measurement; the trusted software is the trusted measurement software code supporting the operating system layer in REE, which can collect system-related information. This solution establishes trust through a hardware-assisted software trusted root and can achieve functions such as dynamic measurement and trusted verification. The core system components are the trusted root inside TEE + the trusted measurement software of the operating system layer inside REE. Although TEE provides powerful security capabilities, it is not perfect and has some inherent defects and challenges. The defects of the solution include: the trusted root depends on hardware manufacturers, faces the threat of side-channel attacks, has poor isolation, is complex to develop, and has resource limitations. There is a gap in the integrity and security of the trust chain compared to the pure hardware trusted root solution. The endpoint of its security is the boundary of TEE. Once the TEE environment is successfully breached (e.g., by exploiting unpatched vulnerabilities), all the secrets inside it will be exposed. Moreover, the traditional solution relies on the trusted software inside REE for measurement, which is usually passive, initiated or responded to events from the REE side, and has weak dynamic measurement capabilities. In contrast, SE (secure element) is usually an independent physical chip, isolated from the main processor, and can provide stronger physical and logical protection, but its cost is also higher and the hardware modification is too large. The single-chip microcomputer TEE solution has higher performance requirements than secure MCUs and is suitable for demand scenarios such as consumer electronics.

[0025] 3) The SE (Security Entity) solution offers the highest level of security protection, but it is also the most expensive. This solution uses a dedicated security chip as the root of trust. The SE provides a hardware root of trust and has trusted computing capabilities. Dynamic metrics are initiated and adjudicated by the SE. The microcontroller itself is not modified (maintaining a generic design). The microcontroller only performs scanning and non-sensitive operations (such as data acquisition). The operating system layer deploys an SE communication agent (sending commands / receiving results). The SE solution provides physical-level security protection through a dedicated hardware security chip, possessing a complete hardware root of trust and powerful trusted functions, resulting in extremely high security. Although SE provides top-level security, its application also faces some inherent limitations and challenges. The solution's drawbacks include: high cost, poor flexibility and limited scalability, dependence on physical size and interfaces, increased supply chain complexity, and increased system complexity. The SE solution is very suitable for applications with extremely high security requirements and low cost sensitivity. However, its high cost and relatively low flexibility mean it is rarely used in ordinary, cost-sensitive microcontroller systems.

[0026] Secure MCU solutions are low-cost but also low-security; TEE solutions are moderately costly and moderately secure; SE solutions are high-cost but highly secure. TEE solutions strike a balance between security and cost and are currently the most mainstream trusted computing implementation method in microcontroller systems. However, with the evolution of artificial intelligence technology, new attack methods are constantly emerging, and the number of IoT terminal devices is surging, making the security threats they face increasingly complex and diverse. Traditional security architectures relying on pure software roots of trust are no longer effective in dealing with advanced persistent threats and physical attacks. Hardware-level security mechanisms have become an indispensable basic requirement. Against this backdrop, existing microcontroller TEE solutions also show certain limitations: their capabilities in dynamic defense, resource isolation, and cost control urgently need further improvement. Therefore, to meet the needs of microcontroller applications with highly limited resources, cost sensitivity, and continuously increasing security requirements, it is urgent to build a lightweight, high-strength, low-overhead, and highly secure new TEE security architecture. This architecture must be able to effectively resist evolving security risks, significantly reduce hardware modification costs and system complexity, while overcoming the key pain points of traditional TEE solutions in terms of isolation, security, and modification difficulty, providing a reliable security foundation for next-generation smart devices.

[0027] Resource-constrained MCU solutions suffer from weak security, lack of a root of trust, and absence of dynamic measurement. Traditional TEE solutions also have security risks, as their root of trust relies on software-based modifications to hardware isolation, with no physical separation between "decision-making" and "execution." For example, an attacker can directly obtain core assets such as keys by compromising the TEE's execution environment (e.g., by exploiting cache timing vulnerabilities). To overcome these problems, according to one aspect of this application, a method embodiment for measurement in a microcontroller TEE system based on an external TPCM is provided. An external hardware root is used to solve key storage, and the TEE enables rapid measurement. This method offers higher security than traditional secure MCU and TEE solutions and lower cost than SE solutions. This application possesses complete trust functionality, providing maximum security assurance, making it more suitable for high-security projects with limited budgets.

[0028] Optionally, in this embodiment, the above-described measurement method for a microcontroller-based TEE system using an external TPCM can be applied to, for example... Figure 1 The microcontroller-based TEE system shown is an external TPCM-based system, such as... Figure 1 As shown: The microcontroller has a Trusted Execution Environment (TEE), and the TEE contains logic code for trust measurement.

[0029] An external TPCM is connected to the pins of the microcontroller. The external TPCM controls the Trusted Execution Environment (TEE) to run the trusted measurement logic code through the TEE measurement agent of the Trusted Execution Environment (TEE) and processes the measurement results of the Trusted Execution Environment (TEE).

[0030] The microcontroller has an interrupt pin and a bus pin. The external TPCM is connected to the interrupt pin and the bus pin respectively. The external TPCM triggers the Trusted Execution Environment (TEE) to run the logic code of the Trusted Measurement through the interrupt pin, and interacts with the Trusted Execution Environment (TEE) through the bus pin.

[0031] The external TPCM includes: a storage module for storing the root key, policy file, measurement results, and verification report, the storage module being resistant to physical attacks; a cryptographic module for performing cryptographic operations using a cryptographic coprocessor; a policy module for storing and executing security policies; an adjudication module for verifying the measurement results of the Trusted Execution Environment (TEE); a control module for executing the corresponding security policy based on the verification results; an interrupt controller for managing interrupt signals sent to the TEE via the interrupt pin; an interface controller for managing the communication protocol of the bus pin; a clock and power management module for managing the chip's clock and power supply; and a processor for executing firmware and handling related tasks.

[0032] The following is combined Figures 1 to 3 Further details of the technical solution of this application: 1) External Root Trusted Module (TPCM): As an independent, highly secure hardware root of trust, it is responsible for trusted boot, policy execution, key management, interrupt triggering, trusted verification, and finally storing measurement results and verification reports. The TPCM is a "function-focused" chip. Its core task is not to execute complex applications or undertake core security computations. Instead, it focuses on control and decision-making, holding the highest decision-making authority (policy execution, final decision), core secrets (root key), and can directly initiate measurement tasks via interrupts (commands). It has low performance requirements and can utilize the computing power of the main SoC. The TPCM needs to hold the core key, possess encryption / decryption and signature verification capabilities, have simple policy execution logic, provide GPIO for interrupts, and SPI for communication. By reducing unnecessary general-purpose functions, the complexity and cost of the chip can be greatly reduced. For example, mature, mass-produced, low-cost security chips can be selected. These dedicated security chips offer high security levels, focused functions, controllable costs, and are easy to integrate into the motherboard. They are suitable for most IoT devices, industrial controllers, network devices, and other scenarios with comprehensive security and cost requirements, achieving the best balance between security, cost, and integration. This chip does not require the high-cost packaging common in SE solutions, nor does it need to implement complete security features (such as encryption engines, true random number generators, secure storage, Java Card virtual machines, etc.).

[0033] The main functional modules of TPCM include: Processor: A simple, low-power processor core used to execute firmware, process strategies, etc.

[0034] Storage module: Used to store root keys, policies, measurement results and verification reports. This part needs to be resistant to physical attacks.

[0035] Cryptographic Module: A cryptographic coprocessor that provides cryptographic operations such as encryption, decryption, signing, and hash verification.

[0036] Policy module: Stores and enforces security policies.

[0037] Decision module: Decision verification verifies the measurement results received from TEE.

[0038] Control module: Implements control measures (such as restart or shutdown) based on the judgment results.

[0039] Interrupt Controller: Manages interrupt signals sent to TEE. This is the physical manifestation of TPCM's "proactive measurement" capability, enabling it to initiate trust verification at any time.

[0040] Communication interface: SPI interface for communication with TEE.

[0041] Clock and power management: Manages the chip's clock and power.

[0042] 2) Trusted Measurement Code in the Microcontroller TEE: This protected execution environment (PEE) created or utilized within the microcontroller is responsible for running sensitive, secure code (trusted measurement code, hereinafter referred to as the measurement agent). It is solely responsible for performing measurements, protected memory scans, and secure communication (measurement only, no key). The "measurement agent" resides within the main processor, possessing high privileges and isolation. Responding to commands from the root of trust, it executes "tasks" requiring high-speed, large-scale access to main processor resources (such as memory measurements). It is a security component focused on efficient execution and protected access. Leveraging the hardware isolation mechanism of the TEE, the measurement agent has memory access permissions exceeding those of the REE operating system, enabling truly deep measurements that are imperceptible and uninterrupted by the REE. It can directly access memory and system resources at high speed, avoiding the performance bottleneck of moving large amounts of data to external chips in the SE solution, thus achieving "fast measurement." This module perfectly complements and securely collaborates with the external TPCM.

[0043] The external hardware root of trust + TEE in this application differs fundamentally from traditional TEE solutions (hardware-assisted software root of trust). This architecture essentially separates the TEE and the root of trust. In traditional solutions, the root of trust resides within the TEE; a breach of the TEE leads to complete failure. In contrast, in this solution, the root of trust is external and independent. A breach of the TEE only results in the loss of the frontline defense; the root of trust remains intact. Even in the worst-case scenario (complete breach of the TEE), the system's foundation of trust remains unbroken. This provides a fundamental guarantee for high-level security applications that traditional TEE solutions cannot match. The core differences lie in three aspects: Firstly, there's physical protection. Traditional TEE (Trusted Entity) trust roots are essentially "hardware-assisted software trust roots." Their security boundaries become blurred due to the intervention of REE (Reliable Root of Trust). The trust root is completely exposed on the MCU die. Once the TEE environment is compromised, all its internal secrets will be exposed, and attackers can directly steal or tamper with the trust root located on the same chip. This solution, however, uses an external hardware trust root architecture. Hardware-level security protection is provided. The TEE's hardware isolation mechanism (such as ARMTrustZone) ensures the integrity of the TEE code, preventing the measurement code within the TEE from being affected by the REE. The external TPCM (Trusted Root of Trust) provides independent triggering and decision-making capabilities, avoiding single points of failure. It not only prevents intrusion but also enables proactive deterrence (such as immediate power-off) and physical tamper detection—something traditional TEEs cannot do. Even if an attacker completely compromises the SoC and TEE, the trust root itself remains intact due to its independent physical packaging. Furthermore, it can perform immediate power-off protection based on preset strategies when an anomaly is detected. Moreover, attackers need to compromise two physically independent chips simultaneously, exponentially increasing the difficulty. An external TPCM is initialized to a known, trusted state during manufacturing. Its code and core key are virtually unalterable throughout its lifecycle. This provides a higher level of trust assurance and state stability compared to a "software root of trust" running in a TEE, which can be accidentally or maliciously modified through software updates.

[0044] Secondly, there's the key storage. In traditional solutions, keys are stored in the SoC's Flash memory or in memory protected by the MPU. Although protected by the MPU, keys may be leaked during voltage fault attacks, and even encrypted keys stored in Flash can still be extracted. In this solution, keys are stored in an external trusted root in independent hardware, preventing fault attacks and storage extraction. In TPCM, root keys and core key materials can be generated, used, and destroyed internally, but they will never appear in plaintext outside the chip pins. The TEE can only obtain the computation results (such as signature values ​​or decrypted session keys), achieving the effect that keys never leave the security boundary.

[0045] Finally, regarding the execution environment, in traditional TEE solutions, there are components in the REE, and the secure world of the TEE still shares the CPU cache with the ordinary OS of the REE, which may be compromised by side-channel attacks. However, the external TPCM+TEE hybrid architecture proposed in this application completely solves the core vulnerability of "the root of trust may be compromised from the execution environment" in traditional TEE solutions by physically isolating and decoupling functions and bypassing the REE.

[0046] This application achieves true defense in depth by creating two independent security boundaries: 1) The TEE boundary: protecting the measurement code and ephemeral session keys. 2) The TPCM boundary: protecting the root key and final adjudication logic. Even if an attacker breaches the first line of defense (TEE), they are only facing an empty shell—the most important asset (the root key) remains secure behind the second line of defense (TPCM). The key and adjudication logic reside within the TPCM; only the ephemeral session key is stored within the TEE and updated with each negotiation. Even if an attacker completely compromises the TEE, they can only obtain a memory snapshot (not the root key), fundamentally altering the offensive and defensive dynamics.

[0047] This application is fundamentally immune to attacks targeting CPU shared resources: since the storage and processing of the root key are performed entirely on an external trusted root, all transient execution attacks faced by the TEE and REE on the main SoC are ineffective against the root key in the TPCM.

[0048] This application separates the "execution" and "adjudication" of metrics, making each part more functionally focused and easier for formal verification and security auditing. The TEE code can focus on "how to measure correctly," while the TPCM code focuses on "what to do based on the metric results." This separation of responsibilities reduces the complexity of individual components and the attack surface.

[0049] This application enhances availability and resilience: TPCM can execute the most severe penalties (such as power outages) based on metric results, and this decision is entirely hardware-based, unaffected by compromised software systems. Simultaneously, because the root key is not leaked, the system can be recovered and rebuilt securely under the coordination of TPCM, whereas in traditional solutions, once the TEE is compromised from within, the entire trust foundation is permanently lost.

[0050] Figure 4 This is a flowchart illustrating an optional measurement method for a microcontroller TEE system based on an external TPCM, according to an embodiment of this application, applied to an external TPCM, such as... Figure 4 As shown, the method may include the following steps: Step S402: Send a measurement instruction to the TEE measurement agent of the Trusted Execution Environment (TEE) via the interrupt pin. The TEE measurement agent is used to execute the trusted measurement logic code to measure the content to be measured and obtain the measurement result. The Trusted Execution Environment (TEE) is located inside the microcontroller.

[0051] The external TPCM, based on the following measurement strategies, triggers dynamic measurement as needed to send measurement instructions to the TEE measurement agent: Event-triggered measurement strategy: The external TPCM is triggered when a specific security-sensitive event occurs; Random sampling measurement strategy: The true random number generator in the external TPCM generates a random delay, and an interrupt is initiated to perform measurement when the delay arrives; Differential measurement strategy: After obtaining a trusted state of all memory regions, only the memory regions that have changed are measured.

[0052] Step S404: Obtain the measurement results of the TEE measurement agent through the bus pin.

[0053] Step S406: Validate the measurement results according to the expected results stored in the system or the results allowed by the strategy.

[0054] Step S408: Execute the corresponding security policy based on the verification result.

[0055] Through the above steps, a measurement command is sent to the TEE measurement agent of the Trusted Execution Environment (TEE) via the interrupt pin. The TEE measurement agent executes the trusted measurement logic code to measure the content to be measured and obtain the measurement result. The TEE is located inside the microcontroller. The measurement result of the TEE measurement agent is obtained through the bus pin. The measurement result is verified according to the expected result stored in itself or the result allowed by the policy. The corresponding security policy is executed according to the verification result. This can solve the technical problem of low security of MCU in related technologies.

[0056] Figure 5 This is a flowchart illustrating an optional measurement method for a microcontroller-based TEE system based on an external TPCM, according to an embodiment of this application. It is applied to a TEE measurement proxy within a Trusted Execution Environment (TEE), such as... Figure 5 As shown, the method may include the following steps: Step S502: Receive the measurement command sent by the external TPCM via the interrupt pin.

[0057] Step S504: Obtain the content to be measured, execute the logic code for trusted measurement to measure the content to be measured, and obtain the measurement result.

[0058] Step S506: The measurement result is sent to the external TPCM via the bus pin. The external TPCM is used to verify the measurement result according to the expected result stored in its own memory or the result allowed by the policy, and to execute the security policy corresponding to the verification result.

[0059] This application presents an external TPCM combined with a microcontroller-based TEE trusted computing solution, an innovative security architecture designed to provide high-level trusted computing capabilities for resource-constrained embedded devices. The external TPCM+TEE trusted computing solution offers complete trusted computing functionality, featuring hardware isolation, proactive measurement, and dynamic security extension, providing resource-constrained microcontrollers with trusted computing capabilities comparable to secure chips. This solution is innovative in enhancing the trusted computing capabilities of resource-constrained MCUs and in the areas of lightweight MCU TEE dynamic measurement.

[0060] The collaborative architecture of "external TPCM + TEE metric agent" achieves high security through hardware isolation and dynamic interaction. It unifies security and performance through hardware decoupling: TPCM focuses on "decision-making" (root of trust + policy), while TEE focuses on "execution" (lightweight metric), and the two work together to overcome the conflict between resources and security. This solution decomposes the traditional TEE's three-in-one structure (storage / computing / control) into: TEE handles high-risk, exposed operations (memory scanning metrics); TPCM handles high-security, zero-exposure operations (key + verification + decision-making), achieving a "1+1>2" effect. It overcomes the cost, performance, and flexibility shortcomings of traditional SE solutions, achieving security comparable to SE solutions, realizing the highest level of security concept of physically isolated root keys, and leveraging the unique ability of the main processor to perform efficient and in-depth metrics.

[0061] In this application, the root of trust is not placed in the TEE, but rather an external root of trust is used. One GPIO pin of the TPCM is connected to an interrupt source of the TEE. Simultaneously, the code logic for trust measurement is built into the TEE, giving the TEE the ability to perform proactive measurement. An IPO interrupt is initiated through the external TPCM to trigger the measurement. After the measurement code in the TEE completes the measurement, it transmits the measurement result back to the TPCM via SPI. The TPCM then processes the result, such as restarting or shutting down.

[0062] As an optional embodiment, the following is combined with Figures 6-7 Further details of the technical solution of this application: Through the hardware interrupt mechanism and the independent GPIO interrupt, the TPCM takes the initiative in measurement rather than responding passively, ensuring that the measurement task can be actively triggered by the most trusted TPCM, realizing "surprise inspection anytime and anywhere".

[0063] 1) Trigger: The external TPCM actively sends an IPO interrupt signal to the microcontroller's TEE environment through its GPIO pin, which is equivalent to a "metric instruction".

[0064] 2) Execution: The measurement agent in the TEE is awakened / triggered by this interrupt and begins to execute the measurement task. The measurement code reads the REE's software state (e.g., REE operating system code segments, hash values ​​of critical data structures) from predefined memory addresses or storage areas. The measurement code calculates the hash values ​​or other measurement values ​​of these contents to form the measurement result.

[0065] 3) Feedback: After the TEE metric agent completes the metric calculation, it sends the obtained metric value (hash value) back to the external TPCM via the SPI interface.

[0066] 4) Verification and Decision: The external TPCM compares the received metric with the expected value or the value allowed by the policy stored in its own storage to verify and make a decision.

[0067] 5) Execution: Based on the verification results, the external TPCM executes predefined security policies. For example: If the metric matches the expected value: allow continued operation. If the metric does not match the expected value: trigger a security response, such as resetting the microcontroller, powering off, or issuing an alarm.

[0068] This solution achieves trusted measurement of the REE through the collaboration of an external TPCM and TEE, without relying on the REE, which requires no trusted components. The "external TPCM + TEE measurement proxy" architecture achieves a balance between security and performance through hardware decoupling. The TPCM focuses on "decision-making" (root of trust + policy), while the TEE focuses on "execution" (lightweight measurement). Together, they overcome the conflict between resources and security. This solution decomposes the traditional TEE's three-in-one structure (storage / computation / control) into: TEE: responsible for high-risk, exposed operations (memory scan measurement); TPCM: responsible for high-security, zero-exposure operations (key + verification + decision-making).

[0069] This solution creatively combines a high-security dedicated external TPCM chip with a resource-constrained microcontroller and its internal TEE. True hardware isolation is achieved through a hardware interface, enabling physical isolation and functional collaboration. The external TPCM, acting as a root of trust, provides independent triggering and decision-making capabilities, avoiding single points of failure. The TEE's hardware isolation mechanism ensures the integrity of the measurement code within the TEE, preventing it from being affected by the REE. Through interrupt triggering by the TPCM, the TEE can dynamically measure the REE on demand or periodically, achieving continuous and reliable verification.

[0070] While maintaining the advantages of low cost, low power consumption, and small size of microcontrollers, this solution introduces an independent root of trust and policy execution capabilities through external dedicated hardware. This addresses the problem that in traditional TEE trusted computing solutions, once the TEE environment is compromised, all internal secrets will be exposed. It achieves a security level far exceeding that of pure software-based TEE root of trust solutions.

[0071] This solution adopts an interrupt-driven proactive measurement triggering mechanism: through hardware interrupt mechanism and independent GPIO interrupt, TPCM takes the initiative in measurement rather than responding passively.

[0072] By connecting the TPCM's GPIO to the microcontroller's interrupt source, the external TPCM actively initiates an interrupt to trigger the measurement operation within the TEE. This achieves true "active measurement," where the measurement behavior is initiated by the Root of Trust (TPCM) on demand or according to a policy, rather than through the REE, and instead of passively triggering responses or periodic polling.

[0073] This solution addresses the challenge of implementing proactive, on-demand dynamic measurement on resource-constrained devices. Traditional dynamic measurement is passively triggered, with the REE issuing a measurement request and a trusted module in the TEE responding. Measurements are typically performed periodically, and periodic measurement incurs significant overhead. Passive measurement (e.g., triggered by system calls) can be bypassed. This mechanism, however, makes measurement timing more controllable and unpredictable (enhancing attack resistance) while having relatively low overhead (triggered only when needed). Through a hardware interrupt mechanism, it ensures that measurement tasks can be proactively triggered by the most trusted TPCM, enabling "surprise checks anytime, anywhere" as needed.

[0074] TEE Embedded Measurement Logic + Dynamic RAM Measurement Objects: This solution employs lightweight dynamic measurement technology, implementing lightweight dynamic measurement within the MCU's TEE. The solution particularly emphasizes achieving dynamic measurement at the microcontroller (MCU) level, where resources are extremely limited, which is itself a challenge and an innovation. How to efficiently complete measurement calculations within the TEE's constrained space and computing power is a key design consideration.

[0075] For general-purpose MCUs that do not yet have a TEE: Traditional secure MCU solutions typically lack a TEE. This solution can achieve trusted transformation and dynamic measurement for some general-purpose MCUs with acceptable performance that do not yet have a TEE. First, a simplified TEE needs to be built, requiring the use of an MPU to partition the secure / insecure worlds. No new IP cores or coprocessors need to be added; lightweight isolation hardware transformation is achieved through MPU multiplexing and security extensions, such as through MPU dynamic reconfiguration technology. After building the simplified TEE, the measurement agent code can then be executed within the TEE. An external TPCM actually lowers the implementation threshold of the MCU-side TEE because the most resource-intensive key management and policy execution are offloaded; the TEE only needs to perform the lightest measurement operations.

[0076] For MCUs already equipped with a TEE: The critical measurement agent's code logic can be executed within the TEE itself. Security is not about adding layers but about division of labor. Traditional TEE solutions involve a complex system engineering project requiring hardware and software collaboration, TEE modification, and REE modification, making it very difficult. This solution eliminates the need for REE modification, and the trust modification of the TEE is relatively less challenging, offering a high level of security and proactive dynamic measurement capabilities.

[0077] This solution executes the critical measurement logic within the TEE (Time-of-Effect) without requiring modification to the REE (Remote Execution Environment), and explicitly defines the measurement object as dynamically allocated RAM content. The measurement code runs under the protection of the TEE, preventing tampering and ensuring high security; the dynamic memory measurement directly monitors critical runtime states and data. This solution constitutes a highly efficient, low-overhead security protection system.

[0078] This solution addresses the challenge of achieving high-confidence dynamic measurement in resource-constrained environments. The measurement code is protected within the TEE, ensuring its inherent trustworthiness. Directly measuring runtime dynamic content (such as critical data and loaded code snippets) enables the detection of runtime tampering, code injection, and other attacks—something static measurement (which only measures firmware on the storage medium) cannot do. This is crucial for protecting sensitive applications running both inside and outside the TEE.

[0079] Traditional dynamic metrics can involve significant computation and memory access, which is difficult to implement directly on an MCU. Therefore, the key to lightweight implementation lies in reducing the frequency, scope, and computational load of metrics while maintaining effectiveness. The TEE metric agent directly monitors runtime status, scanning dynamic memory regions on demand or event-triggered to verify data integrity. This solution shifts from "full, continuous" metrics to "precise, on-demand, and layered" metrics. It doesn't aim to measure everything, but rather uses minimal resources to measure the most critical aspects at the most appropriate times. Under the "external TPCM + TEE metric agent" architecture, the collaborative workflow for lightweight dynamic metrics is as follows: 1) Trigger on demand: TPCM initiates a hardware interrupt via GPIO based on random timeout or specific event.

[0080] 2) Precise Measurement: The TEE measurement agent is awakened and quickly calculates the hash value using the MCU's hardware hash accelerator, based on a predefined list of minimized targets (such as measuring only program code segments and interrupt vector tables).

[0081] 3) Efficient decision-making: The TEE metrics agent sends the simplified hash result back to the TPCM via SPI.

[0082] 4) Decisive Execution: TPCM compares it with the baseline policy of internal storage, and if a mismatch is found, it immediately executes the predefined policy (such as resetting or isolating the device).

[0083] The Root of Trust (TPCM) proactively initiates dynamic measurements on demand: TPCM defines the core area, its detection frequency, and anomaly handling strategies through policy configuration. TPCM sends measurement commands to the measurement agent in the TEE as needed, waking up / triggering the agent to execute measurement tasks. The measurement policy is crucial; based on a preset policy, TPCM proactively initiates measurements, avoiding the overhead of periodic scanning by the measurement code. TPCM initiates a hardware interrupt via GPIO based on random timeouts or specific events, achieving "on-demand measurement," significantly reducing CPU load, avoiding periodic full-system scans, and saving resources.

[0084] Event-triggered measurement strategy: Instead of periodic scanning, measurement is triggered only when specific security-sensitive events occur. For example, when waking from low-power mode, before / after firmware updates, before receiving specific network commands, or before entering a critical operating mode, TPCM can initiate an interrupt based on these event conditions (such as specific GPIO level changes) to trigger measurement.

[0085] Random sampling measurement strategy: A true random number generator within TPCM generates a random delay, then suddenly interrupts the measurement process. This makes it impossible for attackers to predict the measurement timing, greatly increasing the difficulty of the attack, while also saving resources due to the low average measurement frequency.

[0086] Differential measurement strategy: After obtaining a trusted state for the first time, subsequent measurements are only taken of memory regions that have changed. For example, setting a critical memory region to "read-only" will trigger an exception for any write attempt, thus automatically triggering a measurement of that region. This achieves extremely high efficiency.

[0087] Precision and minimization of measurement objects: The core task of measurement is to measure the dynamically allocated RAM content in the TEE. Real-time monitoring of critical runtime data (such as sensitive states in the heap and stack) ensures its integrity. The content of dynamic RAM, depending on the application scenario, mainly includes heap memory allocation, stack memory data, global variable areas, memory-mapped hardware registers, and memory blocks allocated through dynamic memory allocation functions (malloc, etc.). Specific content may include: running sensitive application code segments; critical data (such as keys, session states); dynamically loaded modules or configurations; and specific areas of the heap / stack. This solution allows for predefined, minimized measurement targets for precise measurement.

[0088] Critical code segment integrity verification: This method does not measure the entire operating system or application, but only calculates the hash value of its most core code segments, which in MCUs are usually the critical functions of the firmware itself. Baseline hash values ​​for these critical code segments are pre-generated during the compilation phase and stored in the TPCM. During dynamic measurement, the TEE measurement agent directly reads the corresponding code segment from memory, calculates the hash value, and compares it with the expected value.

[0089] Critical data segment integrity verification: Identify and monitor critical data that changes very rarely during runtime, establish baseline values ​​for these data areas and store them in TPCM, and compare them during dynamic measurement. Examples include: interrupt vector table; system configuration register mapping area; safety-critical global variables, configuration parameters, and other data.

[0090] Lightweighting and Hardware-based Metric Algorithms: Lightweight metric computation is achieved through optimized hash and encryption algorithms. For example, reconfigurable computing arrays support multiple lightweight hash algorithms, allowing switching between them based on security requirements. For instance, a more streamlined TEE variant can be used when resources are limited, enabling the selection of hash algorithms with lower computational and memory consumption while maintaining sufficient security. SHA-256, for example, strikes a good balance, consuming significantly fewer resources than SHA-384 / 512 while providing sufficient security for MCU environments. Simultaneously, MCUs with built-in cryptographic hardware accelerators are selected. The metric agent in the TEE only needs to configure the address and length of the data to be measured to the accelerator to obtain the hash result in a very short time. During this period, the CPU can sleep or process other tasks, greatly reducing computational overhead.

[0091] System-level collaborative optimization: Measurement checks are implemented at different levels, dividing the system into "static" and "dynamic" parts, separating the measurement of static code and dynamic data. The static part (such as firmware code) undergoes a thorough static measurement during startup or update, with only random sampling verification at runtime, which can be very infrequent. The dynamic part (such as the stack and runtime data) employs a key-point monitoring strategy, such as monitoring only system call interfaces and function pointer tables. Instead of measuring the entire system from scratch each time, layered measurement decomposes the measurement target, making it smaller and more focused. After completing the measurement calculation, the measurement agent in the TEE transmits the obtained measurement value (hash value) back to the external TPCM via the SPI interface. Furthermore, the data transmitted between the TEE measurement agent and the TPCM is not the entire memory image, but only a hash value of a few tens of bytes. This minimal communication overhead makes the frequent, random interrupt-measurement-reporting process have a negligible impact on system performance.

[0092] This solution cleverly balances security with cost / resource constraints, providing a practical high-level trusted computing solution for low-end embedded devices in fields such as IoT and industrial control, and has excellent market application prospects and patent value.

[0093] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0094] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0095] According to another aspect of the embodiments of this application, a measurement device for a microcontroller TEE system based on an external TPCM is also provided for implementing the above-described measurement method for a microcontroller TEE system based on an external TPCM. Figure 8 This is a schematic diagram of an optional measurement device for a microcontroller-based TEE system using an external TPCM, according to an embodiment of this application. Figure 8 As shown, the device may include: The sending unit 801 is used to send a measurement instruction to the TEE measurement agent of the Trusted Execution Environment (TEE) via an interrupt pin. The TEE measurement agent is used to execute the trusted measurement logic code to measure the content to be measured and obtain the measurement result. The Trusted Execution Environment (TEE) is located in the microcontroller.

[0096] Optionally, the sending unit can also be used to: the external TPCM triggers dynamic measurement as needed according to the following measurement strategy to send measurement instructions to the TEE measurement agent.

[0097] Event-triggered measurement strategy: The external TPCM is triggered when a specific security-sensitive event occurs.

[0098] Random sampling measurement strategy: The true random number generator in the external TPCM generates a random delay, and an interrupt is initiated to perform measurement when the delay is reached.

[0099] Differential metric strategy: After obtaining a reliable state of all memory regions, only the memory regions that have changed are measured.

[0100] The acquisition unit 803 is used to acquire the measurement results of the TEE measurement agent through the bus pin; The verification unit 805 is used to verify the measurement result according to the expected result stored in its own memory or the result allowed by the strategy. The execution unit 807 is used to execute the corresponding security policy based on the verification result.

[0101] According to another aspect of the embodiments of this application, a measurement device for a microcontroller TEE system based on an external TPCM is also provided for implementing the above-described measurement method for a microcontroller TEE system based on an external TPCM. Figure 9 This is a schematic diagram of an optional measurement device for a microcontroller-based TEE system using an external TPCM, according to an embodiment of this application. Figure 9 As shown, the device may include: The receiving unit 901 is used to receive measurement commands sent by an external TPCM via an interrupt pin; The measurement unit 903 is used to acquire the content to be measured, execute the logic code for trusted measurement to measure the content to be measured, and obtain the measurement result; The transmission unit 905 is used to send the measurement result to the external TPCM via a bus pin. The external TPCM is used to verify the measurement result according to the expected result stored in its own memory or the result allowed by the policy, and to execute the security policy corresponding to the verification result.

[0102] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of the device, can run in a corresponding hardware environment and can be implemented in software or hardware.

[0103] According to another aspect of the embodiments of this application, a server or terminal is also provided for implementing the above-described measurement method for a microcontroller TEE system based on an external TPCM.

[0104] Figure 10 This is a structural block diagram of a terminal according to an embodiment of this application, such as... Figure 10 As shown, the terminal may include: one or more (only one is shown in the figure) processors 1001, memory 1003, and transmission devices 1005, such as... Figure 10 As shown, the terminal may also include input / output devices 1007.

[0105] The memory 1003 can be used to store software programs and modules, such as the program instructions / modules corresponding to the measurement method and device for a microcontroller TEE system based on an external TPCM in this embodiment. The processor 1001 executes various functional applications and data processing by running the software programs and modules stored in the memory 1003, thereby realizing the aforementioned measurement method for a microcontroller TEE system based on an external TPCM. The memory 1003 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1003 may further include memory remotely located relative to the processor 1001, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0106] The aforementioned transmission device 1005 is used to receive or send data via a network, and can also be used for data transfer between a processor and memory. Specific examples of the network described above may include wired networks and wireless networks. In one example, the transmission device 1005 includes a Network Interface Controller (NIC), which can be connected to other network devices and a router via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 1005 is a radio frequency (RF) module, used for wireless communication with the Internet.

[0107] Specifically, memory 1003 is used to store application programs.

[0108] The processor 1001 can invoke the application program stored in the memory 1003 via the transmission device 1005 to perform the following steps: A measurement command is sent to the TEE measurement agent of the Trusted Execution Environment (TEE) via an interrupt pin. The TEE measurement agent is used to execute the trusted measurement logic code to measure the content to be measured and obtain the measurement result. The Trusted Execution Environment (TEE) is located inside the microcontroller. The measurement results of the TEE measurement agent are obtained through the bus pin; The measurement results are verified according to the expected results stored in the system or the results allowed by the strategy. The corresponding security policy will be executed based on the verification results.

[0109] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0110] Those skilled in the art will understand that Figure 10 The structure shown is for illustrative purposes only. The terminal can be a smartphone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile internet device (MID), a PAD, or other terminal devices. Figure 10 This does not limit the structure of the aforementioned electronic device. For example, the terminal may also include components that are more... Figure 10 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 10 The different configurations shown.

[0111] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0112] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to execute program code for a measurement method of a microcontroller TEE system based on an external TPCM.

[0113] Optionally, in this embodiment, the storage medium may be located on at least one of the network devices in the network shown in the above embodiment.

[0114] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: A measurement command is sent to the TEE measurement agent of the Trusted Execution Environment (TEE) via an interrupt pin. The TEE measurement agent is used to execute the trusted measurement logic code to measure the content to be measured and obtain the measurement result. The Trusted Execution Environment (TEE) is located inside the microcontroller. The measurement results of the TEE measurement agent are obtained through the bus pin; The measurement results are verified according to the expected results stored in the system or the results allowed by the strategy. The corresponding security policy will be executed based on the verification results.

[0115] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0116] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0117] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0118] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0119] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0121] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0122] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0123] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A microcontroller-based TEE system based on an external TPCM, characterized in that, include: A microcontroller, wherein the microcontroller has a Trusted Execution Environment (TEE), and the TEE contains logic code for trust measurement; An external TPCM is connected to the pins of the microcontroller. The external TPCM controls the Trusted Execution Environment (TEE) to run the trusted measurement logic code through the TEE measurement agent of the Trusted Execution Environment (TEE) and processes the measurement results of the Trusted Execution Environment (TEE).

2. The system according to claim 1, characterized in that, The microcontroller has an interrupt pin and a bus pin. The external TPCM is connected to the interrupt pin and the bus pin respectively. The external TPCM triggers the Trusted Execution Environment (TEE) to run the logic code of the Trusted Measurement through the interrupt pin, and interacts with the Trusted Execution Environment (TEE) through the bus pin.

3. The system according to claim 2, characterized in that, The external TPCM includes: The storage module is used to store the root key, policy file, measurement results and verification report. The storage module is resistant to physical attacks. The cryptographic module uses a cryptographic coprocessor to perform cryptographic operations; The policy module is used to store and enforce security policies; The adjudication module is used to verify the measurement results of the Trusted Execution Environment (TEE). The control module is used to execute the corresponding security policy based on the verification results; An interrupt controller is used to manage interrupt signals sent to the Trusted Execution Environment (TEE) via the interrupt pin; An interface controller is used to manage the communication protocol of the bus pins; Clock and power management, used to manage the chip's clock and power; Processor: Used to execute firmware and handle related tasks.

4. The system according to claim 2, characterized in that, The microcontroller also has a rich execution environment (REE), and the external TPCM includes: Communication and Interface Module: Serves as the sole controlled channel for communication with the outside world; The metrics module, acting as the engine, is used to perform metric calculations; A memory access module is used to access the memory of the Rich Execution Environment (REE) and the Trusted Execution Environment (TEE). The security support module is used to ensure the confidentiality and integrity of communication with the external TPCM, and to store the session key issued by the external TPCM for this session, thereby using the session key to encrypt and sign the content of this session.

5. A measurement method for a microcontroller TEE system based on an external TPCM, characterized in that, Applied to an external TPCM, the method includes: A measurement command is sent to the TEE measurement agent of the Trusted Execution Environment (TEE) via an interrupt pin. The TEE measurement agent is used to execute the trusted measurement logic code to measure the content to be measured and obtain the measurement result. The Trusted Execution Environment (TEE) is located inside the microcontroller. The measurement results of the TEE measurement agent are obtained through the bus pin; The measurement results are verified according to the expected results stored in the system or the results allowed by the strategy. The corresponding security policy will be executed based on the verification results.

6. The method according to claim 5, characterized in that, Metric commands are sent to the TEE metrics agent of the Trusted Execution Environment (TEE) via the interrupt pin, including: The external TPCM sends measurement instructions to the TEE measurement agent by triggering dynamic measurement as needed according to the following measurement strategy: Event-triggered measurement strategy: The external TPCM is triggered when a specific security-sensitive event occurs; Random sampling measurement strategy: The true random number generator in the external TPCM generates a random delay, and an interrupt is initiated to perform measurement when the delay is reached; Differential metric strategy: After obtaining a reliable state of all memory regions, only the memory regions that have changed are measured.

7. A measurement method for a microcontroller TEE system based on an external TPCM, characterized in that, A TEE metrics agent applied to a Trusted Execution Environment (TEE), the method comprising: Receive measurement commands sent by an external TPCM via the interrupt pin; Obtain the content to be measured, execute the logic code for trusted measurement to measure the content to be measured, and obtain the measurement result; The measurement results are sent to the external TPCM via a bus pin. The external TPCM is used to verify the measurement results according to the expected results stored in its own memory or the results allowed by the policy, and to execute the security policy corresponding to the verification results.

8. A measurement device for a single-chip microcomputer TEE system based on an external TPCM, characterized in that, The device, used in an external TPCM, includes: The sending unit is used to send a measurement instruction to the TEE measurement agent of the Trusted Execution Environment (TEE) via an interrupt pin. The TEE measurement agent is used to execute the trusted measurement logic code to measure the content to be measured and obtain the measurement result. The Trusted Execution Environment (TEE) is located in the microcontroller. The acquisition unit is used to acquire the measurement results of the TEE measurement agent through the bus pin; The verification unit is used to verify the measurement result according to the expected result stored in its own memory or the result allowed by the strategy. The execution unit is used to execute the corresponding security policy based on the verification result.

9. A measurement device for a single-chip microcomputer TEE system based on an external TPCM, characterized in that, A TEE metrics agent applied to a Trusted Execution Environment (TEE), the apparatus comprising: The receiving unit is used to receive measurement commands sent by an external TPCM via an interrupt pin; The measurement unit is used to acquire the content to be measured, execute the logic code for trusted measurement to measure the content to be measured, and obtain the measurement result. The transmission unit is used to send the measurement result to the external TPCM via a bus pin. The external TPCM is used to verify the measurement result according to the expected result stored in its own memory or the result allowed by the policy, and to execute the security policy corresponding to the verification result.

10. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, wherein the program executes the method described in any one of claims 5 to 7 when it is run.

Images