Computing device, method for calling security service, method for starting ftpm, and related device

Abstract

Provided in the present application are a computing device, a method for calling a security service, a method for starting an fTPM, and a related device. The computing device comprises a processor, wherein the processor comprises a trusted execution environment (TEE) and an untrusted execution environment. When the computing device is running, an fTPM manager and a target TEE instance run in the TEE, wherein the fTPM manager is used for managing the target TEE instance, and the target TEE instance is used for implementing the function of an fTPM, so as to provide a security service for a program that runs in the untrusted execution environment. In the above implementation, the fTPM is implemented on the basis of the target TEE instance. The target TEE instance is managed by the fTPM manager. The fTPM manager can only be used for managing the target TEE instance. In this way, since it is only necessary to manage the target TEE instance, the footprint of the fTPM manager can be smaller. Therefore, a TEE instance of the fTPM is implemented by means of lightweight application program management, thereby reducing the trusted base of the fTPM, reducing the attack surface of the fTPM, and improving the security of the fTPM.

Description

Computing device, security service calling method, method for starting fTPM and related devices

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on November 27, 2023, with application number 202311550931.4 and invention name “Computing device, security service calling method, method for starting fTPM and related equipment”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of data processing technology, and in particular to a computing device, a security service calling method, a method for starting an fTPM, and related devices. Background Art

[0003] The Trusted Platform Module (TPM) is a standard secure cryptographic processor defined by the Trusted Computing Group (TCG). It provides security functions for computing devices based on cryptographic keys and serves as the root of trust for computing devices. A root of trust refers to the highly reliable hardware, firmware, and software components within a computing device that perform critical security functions.

[0004] In some computing devices, TPM can be implemented through hardware. For example, a dedicated microcontroller that complies with the TPM standard can be used to implement TPM. This dedicated microcontroller that complies with the TPM standard is called a TPM chip. A TPM chip is a small system-on-a-chip that contains cryptographic processing components and storage components. Alternatively, in some computing devices, TPM can be implemented through firmware. TPM implemented through firmware is called firmware TPM (fTPM).

[0005] However, the current fTPM has the problem of poor security.

[0006] Summary of the Invention

[0007] In view of this, embodiments of the present application provide a computing device, a method for invoking a security service, a method for enabling an fTPM, and related devices for optimizing the implementation of an fTPM. This application also provides corresponding apparatuses, a computing device cluster, a computer-readable storage medium, and a computer program product.

[0008] In a first aspect, embodiments of the present application provide a computing device comprising a processor, the processor comprising a trusted execution environment, and the processor comprising a trusted execution environment and an untrusted execution environment. When the computing device is running, an fTPM manager and a target TEE instance run in the trusted execution environment. The fTPM manager manages the target TEE instance, and the target TEE instance implements the fTPM's functionality, providing security services for programs running in the untrusted execution environment. In the above implementation, the fTPM is implemented based on the target TEE instance. The target TEE instance is managed by the fTPM manager. The fTPM manager can be used only to manage the target TEE instance. Since it only needs to manage the target TEE instance, the fTPM manager can be smaller in size. Thus, by implementing the fTPM TEE instance through lightweight application management, the fTPM's trusted base is reduced, the fTPM's attack surface is reduced, and the fTPM's security is improved. In other words, if multiple TEE instances run in the trusted execution environment, the fTPM manager can be used only to manage the target TEE instance. In this way, because the fTPM manager can only manage a single TEE instance, it has fewer functions, a simpler structure, and is less vulnerable to attack. This reduces the trusted base of the fTPM (i.e., the target TEE instance), reduces the attack surface, and improves the security of the computing device.

[0009] In some possible implementations, an untrusted domain operating system (OS) is running in an untrusted execution environment, and the untrusted domain OS can run multiple programs in the untrusted execution environment, and the multiple programs may include a first untrusted program. The above-mentioned security service may include a measurement reporting service. When the trusted domain OS runs the first untrusted program, the untrusted domain OS can obtain the measurement value of the first untrusted program, which can be referred to as the first measurement value. The untrusted domain OS can send the first measurement value to the fTPM manager. The fTPM manager can obtain the first measurement value sent by the untrusted domain OS and send the first measurement value to the target TEE instance, so that the target TEE instance performs a security measurement on the first untrusted program according to the first measurement value to obtain a first measurement result.

[0010] In some possible implementations, the target TEE instance can also provide security services for the untrusted domain OS. Specifically, before the untrusted domain OS runs, the fTPM manager can obtain the untrusted domain OS's measurement value and send it to the target TEE instance. The target TEE instance then performs a security measurement on the untrusted domain OS based on the untrusted domain OS's measurement value, obtaining a second measurement result. The measurement value of the untrusted domain OS can be referred to as the second measurement value.

[0011] In some possible implementations, the target TEE instance can also be used to provide security services for the boot program. The boot program is used to start the untrusted domain OS, and the above-mentioned second measurement value can be sent by the boot program to the fTPM manager. Specifically, before the boot program runs, the fTPM manager can obtain the boot program's measurement value and send the boot program's measurement value to the target TEE instance, so that the target TEE instance can perform a security measurement on the boot program based on the boot program's measurement value to obtain a third measurement result. The above-mentioned boot program's measurement value can be referred to as the third measurement value.

[0012] In some possible implementations, the fTPM manager can be used to provide information interaction and management services for the target TEE instance. Specifically, the fTPM manager can include a communication unit and a management unit. The communication unit can be used to communicate with programs in the untrusted execution environment. The management unit can be used to implement any one or more of the initialization, startup, shutdown, and destruction of the target TEE instance.

[0013] In some possible implementations, the fTPM manager may further include an fTPM management application programming interface (API). The fTPM management API may be used to implement information exchange between the fTPM manager and the target TEE instance.

[0014] In some possible implementations, the image files of the fTPM manager and the target TEE instance may be pre-stored in a storage device and loaded into the memory after the computing device is started. Specifically, the computing device may include a memory, a storage module, and a startup firmware. The memory may include a trusted domain memory and an untrusted domain memory. Before the computing device is started, the image file of the fTPM manager and the image file of the target TEE instance may be stored in the memory. When the computing device is started, the startup firmware may load the image file of the fTPM manager and the image file of the target TEE instance from the storage module to the trusted domain memory, so that the trusted execution environment of the processor reads the instructions of the fTPM manager and the instructions of the target TEE instance from the trusted domain memory.

[0015] In some possible implementations, the target TEE instance can be specifically started by the fTPM manager. Specifically, after the boot firmware loads the fTPM manager's image file and the target TEE instance's image file into memory, the fTPM manager is first started. Then, the fTPM manager can start the target TEE instance based on the target TEE instance's image file loaded into memory.

[0016] In a second aspect, the present application provides a security service invocation method, which is applied to an fTPM manager. The fTPM manager includes a function for managing the fTPM. The method includes:

[0017] Obtain security service call requests sent by the untrusted domain OS;

[0018] Send a security service call task to the target TEE instance, which is used to implement the fTPM function. The management device is the hypervisor of the target TEE instance.

[0019] Receive the security service processing result of the security service call task sent by the target TEE instance;

[0020] Send security service processing results to the untrusted domain OS.

[0021] In some possible implementations, the security service invocation request is used to request invocation of a metric reporting service;

[0022] Obtaining the security service call request sent by the untrusted domain operating system OS includes:

[0023] Obtaining a first metric value sent by the untrusted domain OS, where the first metric value is a metric value of a first untrusted program, and the first untrusted program is an application program running in an untrusted execution environment;

[0024] The task of sending a secure service call to the target trusted execution environment (TEE) instance includes:

[0025] Sending a first measurement value to a target trusted execution environment (TEE) instance, where the target TEE instance is configured to implement a function of an fTPM and the management device is a hypervisor of the target TEE instance;

[0026] The security service processing results received from the target TEE instance include:

[0027] Receiving a first measurement result for a first measurement value returned by the target TEE instance;

[0028] The security service processing results sent to the untrusted domain OS include:

[0029] The first measurement result is sent to the untrusted domain OS.

[0030] In some possible implementations, before obtaining the first metric value, the method further includes:

[0031] In response to the image text arriving at the target TEE instance being loaded into the trusted domain memory, the target TEE instance is started through the image file.

[0032] In some possible implementations, the image file of the target TEE instance is loaded into the trusted domain memory by the boot firmware.

[0033] In some possible implementations, the image file of the management device is loaded into the trusted domain memory by the boot firmware before the image file of the target TEE instance.

[0034] In some possible implementations, the time when the image file of the target TEE instance is loaded into the trusted domain memory is earlier than the time when the image file of the untrusted domain OS is loaded into the untrusted domain memory;

[0035] Before obtaining the first measurement value, the method further includes:

[0036] Obtaining a second metric value, where the second metric value is a metric value of the untrusted domain OS;

[0037] Sending the second metric value to the target TEE instance;

[0038] Receive a second measurement result for the second measurement value returned by the target TEE instance.

[0039] In some possible implementations, the target TEE instance's image file is loaded into the trusted domain memory earlier than the boot program's image file is loaded into the untrusted domain memory. The boot program is used to load the untrusted domain OS's image file into the untrusted domain memory.

[0040] Before obtaining the second measurement value, the method further includes:

[0041] Obtaining a third measurement value, where the third measurement value is a measurement value of the bootstrap program;

[0042] Send the third metric value to the target TEE instance;

[0043] Receive a third measurement result for the third measurement value returned by the target TEE instance.

[0044] In some possible implementations, the privilege level of the target TEE instance is lower than the privilege level of the fTPM manager.

[0045] In some possible implementations, it is characterized in that the target TEE instance and the management device run on a processor, the target TEE instance corresponds to the first secure partition (Secure Partition, SP) of the processor, and the management device corresponds to the secure partition manager (SP Manager, SPM) of the first secure partition.

[0046] In a third aspect, the present application provides a method for starting an fTPM, the method comprising:

[0047] The boot firmware loads the fTPM manager into the trusted domain memory;

[0048] The boot firmware loads the target Trusted Execution Environment (TEE) instance into the trusted domain memory. The target TEE instance is used to implement fTPM.

[0049] The fTPM manager starts the target TEE instance.

[0050] In some possible implementations, after loading the target TEE instance into the trusted domain memory, the method further includes:

[0051] Start the firmware to verify the digital signature of the target TEE instance.

[0052] In a fourth aspect, the present application provides a security service calling device, which is applied to the fTPM manager. The fTPM manager includes the function of managing the fTPM. The device includes: an acquisition module for obtaining a security service calling request sent by the untrusted domain OS; a first sending module for sending a security service calling task to the target TEE instance, the target TEE instance is used to implement the function of the fTPM, and the management device is the management program of the target TEE instance; a receiving module for receiving the security service processing result of the security service calling task sent by the target TEE instance; a second sending module for sending the security service processing result to the untrusted domain OS.

[0053] In some possible implementations, a security service call request is used to request a call to a measurement reporting service; an acquisition module is specifically used to obtain a first measurement value sent by an untrusted domain OS, where the first measurement value is a measurement value of a first untrusted program, and the first untrusted program is an application running in an untrusted execution environment; a first sending module is specifically used to send the first measurement value to a target trusted execution environment TEE instance, where the target TEE instance is used to implement the function of an fTPM, and the management device is a management program of the target TEE instance; a receiving module is specifically used to receive a first measurement result for the first measurement value returned by the target TEE instance; and a second sending module is specifically used to send the first measurement result to the untrusted domain OS.

[0054] In some possible implementations, the device further includes a startup module, which is configured to start the target TEE instance through the image file in response to the image text reaching the target TEE instance being loaded into the trusted domain memory.

[0055] In some possible implementations, the image file of the target TEE instance is loaded into the trusted domain memory by the boot firmware.

[0056] In some possible implementations, the image file of the management device is loaded into the trusted domain memory by the boot firmware before the image file of the target TEE instance.

[0057] In some possible implementations, the time when the image file of the target TEE instance is loaded into the trusted domain memory is earlier than the time when the image file of the untrusted domain OS is loaded into the untrusted domain memory; the acquisition module is also used to obtain a second measurement value, which is the measurement value of the untrusted domain OS; the first sending module is also used to send the second measurement value to the target TEE instance; the receiving module is also used to receive the second measurement result for the second measurement value returned by the target TEE instance.

[0058] In some possible implementations, the time when the image file of the target TEE instance is loaded into the trusted domain memory is earlier than the time when the image file of the boot program is loaded into the untrusted domain memory, and the boot program is used to load the image file of the untrusted domain OS into the untrusted domain memory; the acquisition module is also used to obtain a third measurement value, which is the measurement value of the boot program; the first sending module is also used to send the third measurement value to the target TEE instance; the receiving module is also used to receive the third measurement result for the third measurement value returned by the target TEE instance.

[0059] In some possible implementations, the privilege level of the target TEE instance is lower than the privilege level of the fTPM manager.

[0060] In some possible implementations, the target TEE instance and the management device run on a processor, the target TEE instance corresponds to a first SP of the processor, and the management device corresponds to an SPM of a first security partition.

[0061] In a fifth aspect, the present application provides a computing device cluster, wherein the computing device includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory; the at least one memory is used to store instructions, and the at least one processor executes the instructions stored in the at least one memory, so that the computing device cluster executes the security service calling method in the above-mentioned second aspect or any possible implementation of the second aspect, or executes the fTPM management method in the above-mentioned third aspect or any possible implementation of the third aspect. It should be noted that the memory can be integrated into the processor or can be independent of the processor. The at least one computing device may also include a bus. The processor is connected to the memory via a bus. The memory may include a readable memory and a random access memory.

[0062] In a sixth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is executed on at least one computing device, the at least one computing device executes the security service calling method in the above-mentioned second aspect or any possible implementation of the second aspect, or executes the fTPM management method in the above-mentioned third aspect or any possible implementation of the third aspect.

[0063] In the seventh aspect, the present application provides a computer program product comprising instructions, which, when executed on at least one computing device, enables the at least one computing device to execute the security service calling method in the above-mentioned second aspect or any possible implementation of the second aspect, or to execute the fTPM management method in the above-mentioned third aspect or any possible implementation of the third aspect.

[0064] Based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0066] FIG1a is a schematic diagram of a structure of a computing device provided in an embodiment of the present application;

[0067] FIG1b is another schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0068] FIG2 is a flow chart of a method for invoking a security service according to an embodiment of the present application;

[0069] FIG3 is an interactive diagram of a method for running a first untrusted program provided in an embodiment of the present application;

[0070] FIG4 is a schematic diagram of a scenario provided by an embodiment of the present application;

[0071] FIG5 is a schematic structural diagram of an object pushing device provided in an embodiment of the present application;

[0072] FIG6 is a schematic diagram of a structure of a computing device provided in an embodiment of the present application;

[0073] FIG7 is a schematic diagram of a structure of a computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0074] The following will describe the solutions in the embodiments provided in this application in conjunction with the drawings in this application.

[0075] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate and are merely used to describe the manner in which objects with the same attributes are described in the embodiments of this application.

[0076] First, some of the nouns involved in the embodiments of this application are introduced.

[0077] TPM: The TPM is the foundation for trusted computing in computing devices. Trusted computing relies on a trusted TPM. If the TPM is untrustworthy, trusted computing is also untrustworthy. Therefore, to ensure the trustworthiness of trusted computing, TPM security must be designed. The TPM provides security services such as key storage services, device identity task services, measurement reporting services, and remote attestation services. The measurement reporting service records the measurement values ​​of the measured application. These values ​​can be hashed.

[0078] fTPM: Firmware-based TPM.

[0079] TEE: Trusted Execution Environment (TEE). A TEE is a secure area within a processor. A TEE is an isolated execution environment. The execution environment corresponding to a TEE is an untrusted execution environment. For example, an untrusted execution environment can include a rich execution environment (REE). A TEE can also be referred to as a trusted domain, and an untrusted execution environment can also be referred to as an untrusted domain.

[0080] TEE TA: TEE Trusted Application (TA), also referred to as TA, refers to an application running on TEE.

[0081] TEE OS: TEE Operating System (TEE OS) refers to the operating system running on the TEE. In the embodiment of the present application, in order to distinguish the operating system running on the TEE from the operating system running on the non-TEE, the operating system running on the non-TEE is referred to as the untrusted domain operating system or untrusted domain OS 1121. The operating system running on the untrusted domain can be, for example, a general-purpose operating system.

[0082] Boot firmware: Boot firmware is used to start applications on a computing device. After the computing device boots up, the boot firmware is activated. Boot firmware loads image files from a storage module into memory, allowing the processor to execute the image files in memory. Optionally, the boot firmware may include, for example, the Basic Input Output System (BIOS).

[0083] Bootloader: A bootloader is a computer program that loads the operating system or other system programs after the computer completes the power-on self-test. A bootloader can be used to load the OS into untrusted memory. Optionally, the bootloader may include, for example, the Unified Extensible Firmware Interface (UEFI).

[0084] TCB: Trusted Computing Base (TCB). A trusted computing base, also known as a trusted foundation, refers to the collection of security mechanisms used to protect a computer system. These mechanisms can take the form of hardware, firmware, and software. If a component of the trusted computing base contains a program error or security vulnerability, the security of the entire system is compromised. To improve security, the size of the trusted foundation can be reduced.

[0085] In an fTPM implementation, the fTPM can be run in a trusted domain of a computing device. Specifically, the processor system environment can be divided into a trusted domain and an untrusted domain. The fTPM running in the trusted domain can provide an fTPM interface to the untrusted domain. When operating systems and applications running in the untrusted domain require trusted computing, they can communicate with the fTPM through the fTPM interface to invoke the security services provided by the fTPM.

[0086] In some implementations, the fTPM can be implemented based on a TEE TA. The TA used to implement the fTPM can be referred to as an fTPM TA. Before the computing device is started, the image file of the fTPM TA can be stored in a storage module, such as a hard disk or flash memory. After the computing device is started, the image file of the fTPM TA can be loaded into the trusted domain memory. After the image file of the fTPM TA in the trusted domain memory is executed, the fTPM TA is in operation and can provide security services.

[0087] Optionally, loading the fTPM TA image file can rely on the trusted domain's operating system. The trusted domain's operating system can, for example, include: That is, after the computing device boots up, the Boot Firmware can first load the TEE OS into the trusted domain memory to run the TEE OS. The TEE OS can then load the fTPM TA image file into the trusted domain memory.

[0088] In the above implementation, since the fTPM TA image file is stored in the storage module in the untrusted domain, loading the fTPM TA image file requires the assistance of a program in the untrusted domain. For example, in some possible implementations, the fTPM TA can be loaded by the operating system in the untrusted domain. For example, the TEE driver in the OS can load the fTPM TA image file into the trusted domain memory.

[0089] In some implementations, multiple TEE TAs may exist. Consequently, the storage device may store multiple TEE TA image files. Accordingly, before loading the fTPM TA, the TEE TA image file that needs to be loaded into the trusted domain memory can be determined. Specifically, the fTPM TA can be determined using tee-supplicant. tee-supplicant is an application running in the untrusted domain that can provide services for the TEE OS.

[0090] That is, after the computing device boots up, the boot firmware can first load the TEE OS into the trusted domain memory and the bootloader into the untrusted domain memory. The bootloader can then load the untrusted domain OS 1121 into the untrusted domain memory. After the untrusted domain OS 1121 enters the running state, it can load the tee-supplicant into the untrusted domain memory. The TEE OS can use the tee-supplicant and the TEE driver in the OS to load the fTPM TA image file into the trusted domain memory. Optionally, the TEE OS can also verify the fTPM TA's signature to ensure its integrity.

[0091] After the fTPM TA image file is loaded into memory, if the untrusted domain OS 1121 subsequently needs to load data such as applications, modules, and components into memory, it can use the fTPM TA's measurement reporting service to extend the measurement values ​​of the above data into the fTPM TA so that the fTPM TA can provide measurement reporting services to verify the integrity of the above data.

[0092] In the above implementation, although the fTPM function is realized through TEE TA, there are still security risks. Specifically, there are at least the following two security risks.

[0093] First, loading the fTPM TA image file relies on the TEE OS. Management of the fTPM TA also relies on the TEE OS. However, the TEE OS manages the TA running within the TEE. Therefore, the TEE OS also contains data such as libraries and driver modules unrelated to the fTPM TA. This makes the TEE OS more vulnerable to attacks. If the TEE OS is attacked, the trustworthiness of the fTPM TA cannot be guaranteed. In other words, the TEE OS is the trusted base for the fTPM TA. However, the TEE OS is large and does not meet the requirements for a small trusted base.

[0094] Secondly, loading the fTPM TA image file also relies on untrusted domain applications, such as the bootloader, untrusted domain OS 1121, and tee-supplicant. Therefore, before running the fTPM TA, the bootloader, untrusted domain OS, and tee-supplicant must be running first. Because the fTPM TA is not running before the bootloader, untrusted domain OS 1121, and tee-supplicant run, their execution cannot be protected by the fTPM TA. In other words, the fTPM's integrity protection may not include the bootloader, untrusted domain OS 1121, and tee-supplicant. This limits the scope of protection provided by the fTPM TA.

[0095] Based on this, an embodiment of the present application provides a computing device, a method for starting an fTPM, and a method for calling a security service. The computing device includes a processor, and the processor includes a trusted execution environment and an untrusted execution environment. When the computing device is running, an fTPM manager and a target TEE instance run in the trusted execution environment. The fTPM manager is used to manage the target TEE instance, and the target TEE instance is used to implement the functions of the fTPM and provide security services for programs running in the untrusted execution environment. In the above implementation, the fTPM is implemented based on the target TEE instance. The target TEE instance is managed by the fTPM manager. The fTPM manager can be used only to manage the target TEE instance. In this way, since only the target TEE instance needs to be managed, the size of the fTPM manager can be smaller. In this way, the fTPM TEE instance is implemented through lightweight application management, which reduces the trusted base of the fTPM, reduces the attack surface of the fTPM, and improves the security of the fTPM.

[0096] That is, if there are multiple TEE instances running in the trusted execution environment, the fTPM manager can be used only to manage the target TEE instance. In this way, because the fTPM manager can only be used to manage a single TEE instance, the fTPM manager has fewer functions, a simpler structure, and is less likely to be attacked. This reduces the trusted base of the fTPM (i.e., the target TEE instance), reduces the attack surface, and improves the security of the computing device 100.

[0097] The computing device also includes a boot firmware. The method of starting the fTPM can be implemented by the boot firmware. Specifically, after the computing device is started, the boot firmware can first load the fTPM manager into the trusted domain memory. Then, the boot firmware can load the target TEE instance into the trusted domain memory. Then, the fTPM manager can start the target TEE instance to provide security services. In this way, since the loading of the fTPM does not depend on the untrusted domain OS1121 and other programs running in the untrusted domain, the target TEE instance can be loaded before loading the untrusted domain OS1121. In this way, the target TEE instance can also provide security services for the untrusted domain OS1121 and other programs running in the untrusted domain, thereby improving the security of the computing device.

[0098] After the target TEE instance is started, the program running in the untrusted execution environment can call the security service provided by the target TEE instance through the fTPM manager. Specifically, the fTPM manager can obtain the security service call request sent by the untrusted domain OS1121 and send a security service call task to the target TEE instance. Among them, the security service call request can be used to request the call of the security service provided by the target TEE instance, and the security service can be for the application running in the untrusted execution environment. After obtaining the security service call task, the target TEE instance can provide security services according to the security service call task and return the security service processing result to the fTPM manager. After obtaining the security service processing result sent by the target TEE instance, the security service processing result can be sent to the untrusted domain OS1121.

[0099] For example, in the application scenario shown in Figure 1a, computing device 100 includes processor 110, memory 120, boot firmware 130, and storage module 140. Processor 110 includes trusted execution environment 111 and untrusted execution environment 112. Trusted execution environment 111 can run an fTPM manager 1111 and a target TEE instance 1112. Untrusted execution environment 112 can run an untrusted domain OS 1121 and may also run at least one untrusted program. Memory 120 includes trusted domain memory and untrusted domain memory. The trusted domain memory corresponds to trusted execution environment 111, and the untrusted domain memory corresponds to untrusted execution environment 112. Storage module 140 stores the image file of target TEE instance 1112 and the image file of fTPM manager 1111.

[0100] After the computing device 100 is booted, the boot firmware 130 is activated. The fTPM boot device 131 first loads the image file of the fTPM manager 1111 from the storage module 140 into the trusted domain memory. Next, the fTPM boot device 131 loads the image file of the target TEE instance 1112 from the storage module 140 into the trusted domain memory. After being loaded into the trusted domain memory, the fTPM manager 1111 enters the running state, boots the target TEE instance 1112 according to the image file of the target TEE instance 1112 in the trusted domain memory, and manages the target TEE instance 1112.

[0101] After the target TEE instance 1112 is started, security services can be provided for the untrusted domain OS 1121 and untrusted programs.

[0102] In the embodiments of the present application, the computing device 100 may be a device with data processing capabilities. For example, it may be a terminal device or a server. Optionally, the processor may be a central processing unit (CPU) for implementing the data processing functions of the computing device 100.

[0103] In some possible implementations, the processor may be an ARM (Advanced Reduced Instruction Set Computer Machine) architecture processor. Accordingly, the target TEE instance 1112 may correspond to a secure partition (SP) in the processor 110, and the fTPM manager 1111 may correspond to a secure partition manager (SPM) in the processor 110. Alternatively, the processor may be a central processing unit (CPU).

[0104] If the processor is an ARM architecture-based processor, the computing device 100 may be as shown in FIG1b . In the implementation shown in FIG1b , the processor and the fTPM Manager and the fTPM SP are running in the trusted execution environment. The fTPM Manager corresponds to the above-mentioned SPM and is used to implement the functions of the fTPM manager in the embodiment of the present application. The fTPM SP is used to implement the functions of the fTPM in the embodiment of the present application, corresponding to the target instance described below. In addition, the fTPM Manager may include an untrusted domain-SP communication module, an SP lifecycle management module, and an fTPM Manager API. Among them, the untrusted domain-SP communication module is used to implement information exchange between the fTPM and the untrusted domain, which is equivalent to the communication unit in the fTPM manager in the embodiment of the present application. The SP lifecycle management module is used to manage the lifecycle of the fTPM SP, which is equivalent to the management unit in the fTPM manager in the embodiment of the present application. The fTPM Manager API is used to implement information exchange between the fTPM Manager and the fTPM SP.

[0105] Next, various non-limiting specific implementations of the process of providing security services to the target TEE instance are described in detail.

[0106] Refer to Figure 2, which is a flow chart of a method for invoking a security service in accordance with an embodiment of the present application. This method can be applied to the application scenarios shown in Figures 1a and 1b above, or to other applicable application scenarios. The following description will use the application scenario shown in Figure 1a as an example.

[0107] The method shown in FIG2 may specifically include:

[0108] S201 : The fTPM manager 1111 obtains a security service call request sent by the untrusted domain OS 1121 .

[0109] In an embodiment of the present application, the target TEE instance 1112 can provide security services for programs in an untrusted execution environment. Accordingly, when it is necessary to call the security services provided by the fTPM, the untrusted domain OS 1121 can generate a security service call request and send the security service call request to the fTPM manager 1111. Optionally, when the target TEE instance provides multiple types of security services, the security service call request can include the type of security service called by the untrusted domain OS 1121.

[0110] Optionally, the security services provided by target TEE instance 1112 may include measurement reporting services. Optionally, the security service call request sent by untrusted domain OS 1121 to fTPM manager 1111 may include a measurement value. The measurement value may be, for example, a hash value of an application. In other words, if a program running in an untrusted execution environment needs to be measured, untrusted domain OS 1121 may send the measurement value corresponding to the program to the fTPM manager.

[0111] The first untrusted program is used as an example for description, wherein the first untrusted program is an application program running in an untrusted execution environment, and the measurement value of the first untrusted program can be referred to as a first measurement value.

[0112] Specifically, before starting the first untrusted program, the data corresponding to the first untrusted program (e.g., the code of the first untrusted program) is stored in the storage module 140. After obtaining the instruction to start the first untrusted program, the untrusted domain OS 1121 can load the data corresponding to the first untrusted program into the untrusted memory. The untrusted domain OS 1121 can also obtain the measurement value of the first untrusted program and send the measurement value of the first untrusted program to the fTPM manager. In this embodiment of the present application, the measurement value of the first untrusted program can, for example, include a hash value of the first untrusted program.

[0113] Optionally, the untrusted domain OS 1121 can send a security service call request to the fTPM manager 1111 via the TEE driver. Accordingly, the fTPM manager 1111 can receive data sent by the TEE driver. Furthermore, the fTPM manager can also send data to the TEE driver to provide security services for programs running in the untrusted execution environment.

[0114] In some possible implementations, security services may be provided to the untrusted domain OS 1121 and / or the boot program, for example, a metric reporting service may be provided to the untrusted domain OS 1121 and / or the boot program. For an introduction to this aspect, please refer to FIG3 and will not be repeated here.

[0115] S202 : The fTPM manager 1111 sends a security service call task to the target TEE instance 1112 .

[0116] After receiving the security service call request, the fTPM manager 1111 may generate a security service call task based on the security service call request and send the security service call task to the target TEE instance 1112. The security service call task is used to instruct the target TEE instance 1112 to provide security services. When the target TEE instance provides multiple types of security services, the security service call request may include the type of security service called by the untrusted domain OS 1121.

[0117] Optionally, the fTPM manager 1111 may include an application programming interface (API). The fTPM manager 1111 may send a security service call task to the target TEE instance 1112 via the fTPM management API.

[0118] S203 : The fTPM manager 1111 receives the security service processing result of the security service call task sent by the target TEE instance 1112 .

[0119] After receiving the security service call task, the target TEE instance 1112 can provide security services according to the security service call task. For example, if the untrusted domain OS 1121 requests to call the measurement reporting service, the target TEE instance 1112 can record the measurement value sent by the untrusted domain OS 1121. After completing the security service call task, the target TEE instance 1112 can send the security service processing results to the fTPM manager 1111.

[0120] S204 : The fTPM manager 1111 sends the security service processing result to the untrusted domain OS 1121 .

[0121] After obtaining the security service processing result sent by the target TEE instance 1112, the fTPM manager 1111 can send the security service processing result to the untrusted domain OS 1121 so that the untrusted domain OS 1121 can perform corresponding operations according to the security service processing result.

[0122] For example, if the security service call request is used to request the provision of a metric reporting service for a first untrusted program, the security service processing result can be used to indicate the trustworthiness of the first untrusted program. For example, the security service processing result can be used to indicate whether the first untrusted program has passed verification. If the first untrusted program has passed verification, the untrusted domain OS 1121 can continue to run the first untrusted program. If the first untrusted program has failed verification, the untrusted domain OS 1121 can refuse to run the first untrusted program or run the first untrusted program through other means.

[0123] 1a, taking an actual application scenario as an example, the process from starting the computing device 100 to running the first untrusted program is introduced.

[0124] Refer to Figure 3, which is a flow chart illustrating a method for running a first untrusted program according to an embodiment of the present application. This method can be applied to the application scenario shown in Figure 1a above, or it can also be applied to other applicable application scenarios. The following description uses the application scenario shown in Figure 1a as an example. The functions of each module are described in detail in the following embodiments.

[0125] The method shown in FIG3 may specifically include:

[0126] S301: The boot firmware 130 is booted.

[0127] Before the computing device 100 is started, all programs running on the computing device 100 may be closed. The processor 110 is closed and no application is running. To run an application on the computing device 100, the computing device 100 may first be started. After the computing device 100 is started, the startup firmware 130 is started.

[0128] Alternatively, the computing device 100 may enter the startup state based on a startup operation. The startup operation may include, for example, obtaining a startup instruction or triggering an operation to power on the computing device 100. For example, a user may turn on the computing device 100 by pressing a power button. Accordingly, the startup operation may include the user pressing a power button. After entering the startup state, the various modules or devices in the computing device 100 may sequentially enter the startup state to complete the startup of the computing device 100.

[0129] S302: The startup firmware 130 loads the image file of the fTPM manager 1111 from the storage module 140 to the trusted domain memory.

[0130] After the boot firmware 130 is started, the boot firmware 130 can load the image file from the storage module 140 to the memory. In the embodiment of the present application, the boot firmware 130 can load the image file of the fTPM manager 1111 from the storage module 140 to the trusted domain memory.

[0131] In an embodiment of the present application, the boot firmware 130 can be used to load a variety of image files into the trusted domain memory. For example, the boot firmware 130 can be used to load the runtime firmware (Runtime Firmware) into the trusted domain memory. For another example, the boot firmware 130 can be used to load the image file of the TEE instance into the trusted domain memory. For another example, the boot firmware 130 can be used to load the boot program into the untrusted domain memory. Optionally, before loading the image file of the fTPM manager 1111 into the trusted domain memory, the boot firmware 130 can first load the runtime firmware into the trusted domain memory.

[0132] After the image file is loaded into the trusted domain memory, the processor 110 may run the fTPM manager 111 in the trusted execution environment according to the image file in the trusted memory.

[0133] S303: The startup firmware 130 loads the image file of the target TEE instance 1112 from the storage module 140 to the trusted domain memory.

[0134] After loading the image file of the fTPM manager 1111 from the storage module 140 to the trusted domain memory, the boot firmware 130 can load the image file of the target TEE instance 1112 from the storage module 140 to the trusted domain memory so that the fTPM manager 1111 can start the target TEE instance 1112.

[0135] In an embodiment of the present application, multiple TEE instances may be running in a trusted execution environment. Accordingly, the storage module 140 may store image files of multiple TEE instances. When loading an image file, the startup firmware 130 can load the image file of a specific TEE instance into the trusted domain memory. This specific TEE instance is the above-mentioned target TEE instance, which is used to implement the functions of the fTPM. Accordingly, if there are multiple TEE instances running in a trusted execution environment, the fTPM manager can be used only to manage the target TEE instance. In this way, since the fTPM manager can be used only to manage a unique TEE instance, the fTPM manager has fewer functions, a simpler structure, and is less likely to be attacked. In this way, the security of the fTPM (i.e., the target TEE instance) of the computing device 100 is improved.

[0136] S304 : The fTPM manager 1111 starts the target TEE instance 1112 .

[0137] After the boot firmware 130 loads the image file of the target TEE instance 1112 from the storage device 140 to the trusted domain memory, the fTPM manager can start the target TEE instance 1112. Starting the target TEE instance 1112 means running the target TEE instance 1112 in the trusted execution environment of the processor 110 and providing security services through the target TEE instance 1112.

[0138] In an embodiment of the present application, the fTPM manager 1111 can be used to manage the target TEE instance 1112, and can also be used to implement information interaction between the target TEE instance 1112 and the program running in the untrusted execution environment. Accordingly, in some possible implementations, the fTPM manager 1111 may include a communication unit and a management unit. Among them, the communication unit is used to implement information interaction between the target TEE instance 1112 and the program running in the untrusted execution environment. The management unit is used to manage the target TEE instance 1112. Optionally, the management unit can be responsible for operations such as initialization, startup, shutdown and destruction of the target TEE instance. Then, after the image file of the target TEE instance 1112 is loaded into the trusted domain memory, the management unit can start the target TEE instance.

[0139] In some possible implementations, a processor may have multiple privilege levels. Different program components may run at different privilege levels. Programs running at higher privilege levels can manage programs running at lower privilege levels. For example, the privilege level of an OS may be higher than the privilege level of a program running on the OS. Accordingly, in an embodiment of the present application, in order to manage the target TEE instance 1112, the priority of the fTPM manager 1111 may be higher than the priority of the target TEE instance 1112.

[0140] For example, in some implementations, processor 110 may include four priority levels: PL0, PL1, PL2, and PL3. Priority level PL3 has a higher priority than priority level PL2, which in turn has a higher priority than priority level PL1, which in turn has a higher priority than priority level PL0. Target TEE instance 1112 may then run at priority level PL0, and fTPM manager 1111 may run at priority level PL3. Thus, the priority of fTPM manager 1111 is higher than that of target TEE instance 1112, and fTPM manager 1111 is able to manage target TEE instance 1112.

[0141] In the embodiment of the present application, target TEE instance 1112 is started by fTPM manager 1111. Both the image file of fTPM manager 1111 and the image file of target TEE instance 1112 are loaded from storage device 140 to trusted domain memory by boot firmware 130. Therefore, to ensure that fTPM manager 1111 can start target TEE instance 1112, boot firmware 130 can first load the image file of fTPM manager 1111. After the image file of fTPM manager 1111 is loaded, the image file of target TEE instance 1112 is loaded.

[0142] After the target TEE instance 1112 is started, the target TEE instance 1112 can provide security services for programs running in the untrusted execution environment to implement the functions of the fTPM. Optionally, the target TEE instance 1112 can provide security services for applications running in the untrusted execution environment (such as the first untrusted program mentioned above), provide security services for the untrusted domain OS 1121, and provide security services for the boot program. The following takes the target TEE instance 1112 providing measurement reporting services as an example for introduction.

[0143] After completing step S304, the target TEE instance 1112 is started. The target TEE instance 1112 can function as an fTPM, providing a secure server for programs running on the processor. In the above process, the transfer method of the target TEE instance 1112 and the fTPM manager 1111 in the storage and memory can be shown in Figure 4.

[0144] Referring to Figure 4, Figure 4 is a schematic diagram of a scenario provided by an embodiment of the present application. As shown in Figure 4, before the computing device 100 is started, the image file of the fTPM manager 1111 and the image file of the target instance 1112 can be stored in the storage module 140. After the computing device 100 is started, the program of the fTPM manager 1111 and the program of the target instance 1112 can be loaded into the trusted domain memory based on the image file. During the operation of the computing device 100, the instructions of the fTPM manager 1111 and the instructions of the target instance 1112 can be loaded into the processor 110, so that the processor 110 executes the instructions of the fTPM manager 1111 and the instructions of the target instance 1112 to implement the functions of the fTPM manager 1111 and the target instance 1112.

[0145] S305: The startup firmware 130 loads the boot program into the untrusted domain memory.

[0146] After the boot firmware 130 is started, the boot firmware 130 may also start the boot program of the computing device 100 so that the boot program starts the untrusted domain OS 1121. Specifically, the boot firmware 130 may load the boot program into the untrusted domain memory so as to run the boot program in the untrusted execution environment of the processor 110.

[0147] In order for the target TEE instance 1112 to provide metric reporting services for the bootloader, in some possible implementations, the time when the bootloader is loaded into the untrusted domain memory by the boot firmware 130 may be later than the time when the fTPM manager 1111 starts the target TEE instance 1112. In other words, step S305 may be executed after step S304. It is understood that in some other possible implementations, if the target TEE instance 1112 does not provide metric reporting services for the bootloader, then step S305 may also be executed before step S304.

[0148] S306 : The boot firmware 130 sends the boot program's measurement value to the target TEE instance 1112 via the fTPM manager 1111 .

[0149] To provide measurement reporting services for the bootloader, the target TEE instance 1112 can obtain the bootloader's measurement values. Specifically, the bootloader firmware 130 can obtain the bootloader's measurement values ​​and then send the bootloader's measurement values ​​to the target TEE instance 1112 via the fTPM manager 1111. The fTPM manager 1111 can obtain the bootloader's measurement values ​​sent by the bootloader firmware 130 and send the bootloader's measurement values ​​to the target TEE instance 1112 via the fTPM management API, so that the target TEE instance 1112 can perform measurement reporting based on the bootloader's measurement values.

[0150] S307: The boot program loads the untrusted domain OS 1121 into the untrusted domain memory.

[0151] After the processor 110 runs the boot program in the untrusted execution environment, the boot program may start the untrusted domain OS 1121 to run the untrusted application program in the untrusted domain OS 1121. First, the boot program may load the untrusted domain OS 1121 into the untrusted domain memory.

[0152] In order for the target TEE instance 1112 to provide metric reporting services for the untrusted domain OS 1121, in some possible implementations, the time when the boot firmware 130 loads the untrusted domain OS 1121 into the untrusted domain memory can be later than the time when the fTPM manager 1111 starts the target TEE instance 1112. In other words, step S307 can be executed after step S304. It is understood that in some other possible implementations, if the target TEE instance 1112 does not provide metric reporting services for the bootloader and untrusted domain OS 1121, then step S307 can also be executed before step S304.

[0153] S308 : The boot program sends the measurement value of the untrusted domain OS 1121 to the target TEE instance 1112 through the fTPM manager 1111 .

[0154] To provide measurement reporting services for the untrusted domain OS 1121, the target TEE instance 1112 can obtain the measurement values ​​of the untrusted domain OS 1121. Specifically, the bootloader can obtain the measurement values ​​of the untrusted domain OS 1121 and then send the measurement values ​​of the untrusted domain OS 1121 to the target TEE instance 1112 via the fTPM manager 1111. The fTPM manager 1111 can obtain the measurement values ​​of the untrusted domain OS 1121 sent by the bootloader and send the measurement values ​​of the untrusted domain OS 1121 to the target TEE instance 1112 via the fTPM management API, so that the target TEE instance 1112 can perform measurement reporting based on the measurement values ​​of the untrusted domain OS 1121.

[0155] S309: The untrusted domain OS 1121 loads the first untrusted program into the untrusted domain memory.

[0156] After the processor 110 runs the untrusted domain OS 1121 in the untrusted execution environment, it can run one or more untrusted applications based on the untrusted domain OS 1121. Before running the untrusted applications, metrics can be reported through the target TEE instance 1112. For example, before running the first untrusted program, the untrusted domain OS 1121 can load the first untrusted program into the untrusted domain memory.

[0157] S310 : The untrusted domain OS 1121 sends the measurement value of the first untrusted program to the target TEE instance 1112 through the fTPM manager 1111 .

[0158] In order to provide measurement reporting services for the first untrusted program, the target TEE instance 1112 can obtain the measurement value of the first untrusted program. Specifically, the untrusted domain OS 1121 can obtain the measurement value of the first untrusted program and then send the measurement value of the first untrusted program to the target TEE instance 1112 through the fTPM manager 1111. The fTPM manager 1111 can obtain the measurement value of the first untrusted program sent by the untrusted domain OS 1121 and send the measurement value of the first untrusted program to the target TEE instance 1112 through the fTPM management API, so that the target TEE instance 1112 performs measurement reporting based on the measurement value of the first untrusted program.

[0159] As can be seen from the above description, since the target TEE instance 1112 implementing the fTPM is launched by the boot firmware 130 and the fTPM manager 1111, and the launch of the boot firmware 130 and the fTPM manager 1111 does not depend on the program running in the untrusted execution environment, the target TEE instance 1112 can be launched before the program running in the untrusted execution environment. In this way, launching the target TEE instance 1112 can only provide security services for the program running in the untrusted execution environment. This improves the coverage of security services and enhances the security of the computing device 100.

[0160] The present application also provides a secure service invocation device, wherein the secure service invocation device can be applied to the fTPM manager in the implementation shown in FIG1a to implement the functions of the fTPM manager in the implementation shown in FIG2 or FIG3. Specifically, as shown in FIG5, the secure service invocation device 500 includes:

[0161] An acquisition module 510 is configured to acquire a security service call request sent by an untrusted domain operating system OS;

[0162] A first sending module 520 is configured to send a security service call task to a target trusted execution environment (TEE) instance, wherein the target TEE instance is configured to implement the functions of the fTPM, and the management device is a management program of the target TEE instance;

[0163] A receiving module 530 is configured to receive a security service processing result of the security service call task sent by the target TEE instance;

[0164] The second sending module 540 is configured to send the security service processing result to the untrusted domain OS 1121 .

[0165] The acquisition module 510, first sending module 520, receiving module 530, and second sending module 540 can all be implemented in software or hardware. For example, the implementation of the acquisition module 510 will be described below using the acquisition module 510 as an example. Similarly, the implementation of the first sending module 520, receiving module 530, and second sending module 540 can be implemented in the same manner as the acquisition module 510.

[0166] As an example of a software functional unit, the acquisition module 510 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the acquisition module 510 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0167] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0168] As an example of a hardware functional unit, the acquisition module 510 may include at least one computing device, such as a server. Alternatively, the acquisition module 510 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0169] The multiple computing devices included in acquisition module 510 can be distributed in the same region or in different regions. The multiple computing devices included in acquisition module 510 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in acquisition module 510 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, GALs, and other computing devices.

[0170] It should be noted that, in other embodiments, the acquisition module 510 can be used to execute any step in the security service calling method, the first sending module 520 can be used to execute any step in the security service calling method, the receiving module 530 can be used to execute any step in the security service calling method, and the second sending module 540 can be used to execute any step in the security service calling method. The steps that the acquisition module 510, the first sending module 520, the receiving module 530 and the second sending module 540 are responsible for implementing can be specified as needed. The full functions of the security service calling device are realized by respectively implementing different steps in the security service calling method through the acquisition module 510, the first sending module 520, the receiving module 530 and the second sending module 540.

[0171] This application also provides a computing device 100. As shown in FIG6 , computing device 100 includes a bus 102, a processor 104, a memory 106, and a communication interface 108. Processor 104, memory 106, and communication interface 108 communicate with each other via bus 102. Computing device 100 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 100.

[0172] Bus 102 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG6 shows only one bus line, but this does not imply a single bus or type of bus. Bus 102 may include a path for transmitting information between various components of computing device 100 (e.g., memory 106, processor 104, and communication interface 108).

[0173] The processor 104 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0174] The memory 106 may include volatile memory, such as random access memory (RAM). The processor 104 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0175] Memory 106 stores executable program code. Processor 104 executes this executable program code to implement the functions of the aforementioned acquisition module 510, first sending module 520, receiving module 530, and second sending module 540, thereby implementing the security service invocation method and the fTPM management method. In other words, memory 106 stores instructions for executing this stored method.

[0176] The communication interface 108 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 100 and other devices or a communication network.

[0177] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0178] As shown in Figure 7, the computing device cluster includes at least one computing device 100. The memory 106 in one or more computing devices 100 in the computing device cluster may store the same instructions for executing the security service calling method and the fTPM management method.

[0179] In some possible implementations, the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing the secure service invocation method and the fTPM management method. In other words, the combination of one or more computing devices 100 can jointly execute the instructions for executing the secure service invocation method and the fTPM management method.

[0180] It should be noted that the memory 106 in different computing devices 100 in the computing device cluster can store different instructions, each for executing a portion of the functions of the object storage service layer. In other words, the instructions stored in the memory 106 in different computing devices 100 can implement the functions of one or more of the acquisition module 510, the first sending module 520, the receiving module 530, and the second sending module 540.

[0181] The present application also provides another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similar to the connection method of the computing device cluster described in FIG7 . However, the memory 106 in one or more computing devices 100 in this computing device cluster can store the same instructions for executing the security service invocation method and the fTPM management method.

[0182] In some possible implementations, the memory of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing the secure service invocation method and the fTPM management method. In other words, the combination of one or more computing devices can jointly execute the instructions for executing the secure service invocation method and the fTPM management method.

[0183] Embodiments of the present application also provide a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored on any available medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to execute a security service invocation method and an fTPM management method.

[0184] The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute a security service invocation method and an fTPM management method, or instruct the computing device to execute a security service invocation method and an fTPM management method.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A computing device, characterized in that The computing device includes a processor, the processor including a trusted execution environment and an untrusted execution environment; The trusted execution environment runs a firmware trusted platform module fTPM manager and a target trusted execution environment TEE instance, the fTPM manager is used to manage the target TEE instance, and the target TEE instance is used to provide security services for programs running in the untrusted execution environment.

2. The computing device according to claim 1, wherein: The untrusted execution environment runs an untrusted domain operating system OS, the security service includes a metric reporting service, and the program running in the untrusted execution environment includes a first untrusted program; The fTPM manager is specifically used to obtain a first measurement value sent by the untrusted domain OS, and send the first measurement value to the target TEE instance, where the first measurement value is a measurement value of the first untrusted program; The target TEE instance is used to determine a first measurement result according to the first measurement value.

3. The computing device according to claim 2, characterized in that The program running in the untrusted execution environment includes the untrusted domain OS. Before running the untrusted domain OS, The fTPM manager is further configured to obtain a measurement value of the untrusted domain OS and send the measurement value of the untrusted domain OS to the target TEE instance; The target TEE instance is further used to determine a second measurement result according to the second measurement value of the untrusted domain OS.

4. The computing device according to claim 3, characterized in that The untrusted execution environment also runs a boot program, which is used to start the untrusted domain OS. The program running in the untrusted execution environment includes the boot program. Before running the boot program, The fTPM manager is further configured to obtain a measurement value of the boot program and send the measurement value of the boot program to the target TEE instance; The target TEE instance is further used to determine a third measurement result according to the measurement value of the boot program.

5. The computing device according to any one of claims 1 to 4, characterized in that: The fTPM manager includes a communication unit and a management unit. The communication unit is used to communicate with the program in the untrusted execution environment; The management unit is used to implement any one or more of the initialization, startup, shutdown and destruction of the target TEE instance.

6. The computing device according to claim 5, characterized in that The fTPM manager also includes an fTPM management application programming interface API; The fTPM management API is used to interact with the target TEE instance.

7. The computing device according to any one of claims 1 to 6, characterized in that: The computing device also includes a memory, a storage module and a startup firmware. The memory includes a trusted domain memory; The storage module is used to store the image file of the fTPM manager and the image file of the target TEE instance; The startup firmware is used to load the image file of the fTPM manager and the image file of the target TEE instance from the storage module to the trusted domain memory when the computing device is started.

8. The computing device according to claim 2, wherein: The fTPM manager is used to start the target TEE instance according to the image file of the target TEE instance after the image file of the target TEE instance is loaded into the trusted domain memory.

9. A method for invoking a security service, characterized in that: The method is applied to a firmware trusted platform module fTPM manager, the fTPM manager includes a function of managing the fTPM, and the method includes: Obtain the security service call request sent by the untrusted domain operating system OS; Sending a security service call task to a target trusted execution environment TEE instance, wherein the target TEE instance is used to implement the function of the fTPM, and the management device is a management program of the target TEE instance; Receive the security service processing result of the security service call task sent by the target TEE instance; The security service processing result is sent to the untrusted domain OS.

10. The method according to claim 9, characterized in that The security service invocation request is used to request the invocation of the metric reporting service; The obtaining of the security service call request sent by the untrusted domain operating system OS comprises: Acquire a first metric value sent by the untrusted domain OS, where the first metric value is a metric value of a first untrusted program, and the first untrusted program is an application program running in an untrusted execution environment; The task of sending a security service call to the target trusted execution environment TEE instance includes: Sending the first metric value to a target trusted execution environment TEE instance, where the target TEE instance is used to implement the function of the fTPM, and the management device is a management program of the target TEE instance; The receiving of the security service processing result sent by the target TEE instance includes: Receiving a first measurement result for the first measurement value returned by the target TEE instance; The sending the security service processing result to the untrusted domain OS includes: The first measurement result is sent to the untrusted domain OS.

11. The method according to claim 9, characterized in that Before obtaining the first metric value, the method further includes: In response to the image text arriving at the target TEE instance being loaded into the trusted domain memory, the target TEE instance is started through the image file.

12. The method according to claim 11, characterized in that The image file of the target TEE instance is loaded into the trusted domain memory by the startup firmware.

13. The method according to claim 12, characterized in that The image file of the management device is loaded into the trusted domain memory by the boot firmware before the image file of the target TEE instance.

14. The method according to claim 12 or 13, characterized in that The time when the image file of the target TEE instance is loaded into the trusted domain memory is earlier than the time when the image file of the untrusted domain OS is loaded into the untrusted domain memory; Before obtaining the first metric value, the method further includes: Acquire a second metric value, where the second metric value is a metric value of the untrusted domain OS; Sending the second metric value to the target TEE instance; Receive a second measurement result for the second measurement value returned by the target TEE instance.

15. The method according to claim 14, characterized in that The time when the image file of the target TEE instance is loaded into the trusted domain memory is earlier than the time when the image file of the boot program is loaded into the untrusted domain memory, and the boot program is used to load the image file of the untrusted domain OS into the untrusted domain memory; Before obtaining the second metric value, the method further includes: Acquire a third measurement value, where the third measurement value is a measurement value of the boot program; Sending the third metric value to the target TEE instance; Receive a third measurement result for the third measurement value returned by the target TEE instance.

16. The method according to any one of claims 9 to 15, characterized in that The privilege level of the target TEE instance is lower than the privilege level of the fTPM manager.

17. The method according to any one of claims 9 to 16, characterized in that: The target TEE instance and the management device run on a processor, the target TEE instance corresponds to a first security partition SP of the processor, and the management device corresponds to a security partition manager SPM of the first security partition.

18. A method for starting a firmware trusted platform module fTPM, characterized in that: The method comprises: The boot firmware loads the fTPM manager into the trusted domain memory; The boot firmware loads a target trusted execution environment TEE instance into the trusted domain memory, and the target TEE instance is used to implement the fTPM; The fTPM manager starts the target TEE instance.

19. The method according to claim 18, characterized in that After loading the target TEE instance into the trusted domain memory, the method further includes: The startup firmware performs digital signature verification on the target TEE instance.

20. A security service calling device, characterized in that: The device is applied to a firmware trusted platform module fTPM manager, the fTPM manager includes a function of managing the fTPM, and the device includes: An acquisition module is used to acquire a security service call request sent by an untrusted domain operating system OS; A first sending module is used to send a security service call task to a target trusted execution environment TEE instance, wherein the target TEE instance is used to implement the function of the fTPM, and the management device is a management program of the target TEE instance; A receiving module, used to receive the security service processing result of the security service call task sent by the target TEE instance; The second sending module is used to send the security service processing result to the untrusted domain OS.

21. The device according to claim 20, characterized in that The security service invocation request is used to request the invocation of the metric reporting service; The acquisition module is specifically used to acquire a first metric value sent by the untrusted domain OS, where the first metric value is a metric value of a first untrusted program, and the first untrusted program is an application program running in an untrusted execution environment; The first sending module is specifically used to send the first measurement value to a target trusted execution environment TEE instance, the target TEE instance is used to implement the function of the fTPM, and the management device is a management program of the target TEE instance; The receiving module is specifically configured to receive a first measurement result for the first measurement value returned by the target TEE instance; The second sending module is specifically configured to send the first measurement result to the untrusted domain OS.

22. The device according to claim 21, characterized in that The device also includes a startup module, which is used to start the target TEE instance through the image file in response to the image text reaching the target TEE instance being loaded into the trusted domain memory.

23. The device according to claim 21, characterized in that The image file of the target TEE instance is loaded into the trusted domain memory by the startup firmware.

24. The device according to claim 23, characterized in that The image file of the management device is loaded into the trusted domain memory by the boot firmware before the image file of the target TEE instance.

25. The device according to claim 23 or 24, characterized in that The time when the image file of the target TEE instance is loaded into the trusted domain memory is earlier than the time when the image file of the untrusted domain OS is loaded into the untrusted domain memory; The acquisition module is further used to acquire a second metric value, where the second metric value is a metric value of the untrusted domain OS; The first sending module is further used to send the second metric value to the target TEE instance; The receiving module is also used to receive a second measurement result for the second measurement value returned by the target TEE instance.

26. The device according to claim 25, characterized in that The time when the image file of the target TEE instance is loaded into the trusted domain memory is earlier than the time when the image file of the boot program is loaded into the untrusted domain memory, and the boot program is used to load the image file of the untrusted domain OS into the untrusted domain memory; The acquisition module is further used to acquire a third measurement value, where the third measurement value is a measurement value of the boot startup program; The first sending module is further used to send the third metric value to the target TEE instance; The receiving module is also used to receive a third measurement result for the third measurement value returned by the target TEE instance.

27. The device according to any one of claims 20 to 26, characterized in that The privilege level of the target TEE instance is lower than the privilege level of the fTPM manager.

28. The device according to any one of claims 20 to 27, characterized in that The target TEE instance and the management device run on a processor, the target TEE instance corresponds to a first security partition SP of the processor, and the management device corresponds to a security partition manager SPM of the first security partition.

29. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, which, when executed on a computing device, enable the computing device to execute the method according to any one of claims 9 to 19.

30. A computer program product comprising instructions which, when executed on a computing device, cause the computing device to perform the method according to any one of claims 9 to 19.

Images