HK40095785B - Tpcm in-place detection method, apparatus, server starting method and server - Google Patents

Description

TPCM in-situ detection method, device, server startup method and server

Technical Field

This invention relates to the field of computer security technology, and in particular to a TPCM in-situ detection method, apparatus, server startup method, and server.

Background Technology

Currently, with the development of information technology and computer science, information security and confidentiality have become increasingly important. To ensure that computer firmware is not tampered with, the concept of Trusted Root Certification (TPCM) has been introduced and adopted. This involves using a verified TPCM module to measure the BMC and BIOS, thereby ensuring that the firmware, including the BMC and BIOS, is not altered. In practical use, the TPCM module is installed on the motherboard, connected to the motherboard via the TPCM interface, and secured to the motherboard with screws.

However, existing structural designs rely solely on simple, specially shaped screws to prevent TPCM module replacement, thus creating a structural vulnerability and risk of substitution. Especially with the standardization of TPCM interfaces, pin definitions and procedures are more easily obtained, increasing the chances of hacking and reducing security. Therefore, a method to prevent TPCM replacement or tampering is urgently needed to improve server system security.

Summary of the Invention

To address the aforementioned technical problems, this invention provides a TPCM in-situ detection method, apparatus, server startup method, and server, which can solve problems such as the replacement or tampering of TPCM modules in the prior art and improve the security of the server system.

To achieve the above objectives, in a first aspect, the present invention provides a method for in-situ detection of TPCM, the method comprising:

After the server system is powered on, the first key information from TPCM is obtained;

Determine whether the TPCM is trusted and in place based on the first key information;

If the TPCM is trusted to be in place, then the response is the measurement result from the TPCM;

If the TPCM is not trusted in place, then the startup sequence is stopped.

Furthermore, the first key information is compared with the pre-configured second key information. If the comparison is consistent, the TPCM is determined to be in a trusted position; if the comparison is inconsistent, the TPCM is determined to be in an untrusted position.

Furthermore, before comparing the first key information with the pre-configured second key information, the method further includes:

Obtain the pre-stored key status information, and determine whether the second key information has been configured based on the key status information;

If the key has been configured, then compare the first key information with the second key information;

If the key is not configured, the second key information is configured according to the first key information.

Further, the step of configuring the second key information based on the first key information includes:

The configuration status of the second key information is determined based on the key status information. If the key status information is in an unconfigured state, the first key information is stored as the second key information, and the key status information is set to a configuration state.

If the key status information is in the configuration state, the first key information is compared with the stored second key information. If the comparison matches, the key status information is set to the configuration completed state. If the comparison does not match, the key status information is set to the unconfigured state.

Furthermore, the first key information is a unique key information that is pre-stored in the TPCM.

Furthermore, the measurement result is a data sequence generated by measuring the measurement target according to TPCM, and the data sequence includes measurement target data and measurement status data.

Furthermore, the step of responding to the measurement result from the TPCM if the TPCM is trusted to be in place includes:

Obtain the measurement results from TPCM, and based on the measurement results, obtain the measurement status of the measurement target and execute the corresponding timing control.

Furthermore, the step of obtaining the measurement state of the measurement target and performing corresponding timing control includes:

If the measurement status is in the measurement process, the startup sequence will not be executed until the measurement status is in the measurement completion state.

If the measurement status is a measurement completion status, then determine whether the measurement has passed based on the measurement completion status, and execute the corresponding timing control according to whether the measurement has passed or not.

In a second aspect, the present invention provides a TPCM in-situ detection device, the device comprising:

The key acquisition module is used to acquire the first key information from the TPCM after the server system is powered on.

The trust determination module is used to determine whether the TPCM is trusted in place based on the first key information;

The timing control module is used to respond to the measurement result from the TPCM if the TPCM is trusted and in place, and to stop the startup timing if the TPCM is untrusted and in place.

Furthermore, the trust determination module is also used to compare the first key information with the pre-configured second key information. If the comparison is consistent, the TPCM is determined to be trustworthy and in place. If the comparison is inconsistent, the TPCM is determined to be untrustworthy and in place.

Furthermore, the trust determination module is also used to obtain pre-stored key status information, and determine whether the second key information has been configured successfully based on the key status information; if it has been configured successfully, the first key information is compared with the second key information; if it has not been configured successfully, the second key information is configured based on the first key information.

Furthermore, the trust determination module also includes a key configuration module;

The key configuration module is used to determine the configuration status of the second key information based on the key status information. If the key status information is in an unconfigured state, the first key information is stored as the second key information, and the key status information is set to a configuration state.

If the key status information is in the configuration state, the first key information is compared with the stored second key information. If the comparison matches, the key status information is set to the configuration completed state. If the comparison does not match, the key status information is set to the unconfigured state.

Furthermore, the first key information is a unique key information that is pre-stored in the TPCM.

Furthermore, the measurement result is a data sequence generated by measuring the measurement target according to TPCM, and the data sequence includes measurement target data and measurement status data.

Furthermore, the timing control module is also configured to: if the measurement state is in the measurement process state, not execute the startup timing until the measurement state is in the measurement completion state; if the measurement state is in the measurement completion state, determine whether the measurement has passed based on the measurement completion state, and execute the corresponding timing control based on whether the measurement has passed or not.

Thirdly, the present invention provides a server startup method, which uses the TPCM presence detection method described above to perform trusted presence detection on the TPCM, and starts the server when the detection passes.

Fourthly, the present invention provides a server comprising a TPCM and a CPLD connected unidirectionally via serial communication, wherein the TPCM is pre-configured with first key information, and the CPLD performs trusted presence detection on the TPCM using the TPCM presence detection method as described in any one of claims 1 to 8.

Furthermore, the CPLD is externally connected to an EEPROM, which is used to store the configured second key information.

This invention provides a method, apparatus, server startup method, and server for TPCM presence detection. This invention adds a mechanism for CPLD to actively authenticate the TPCM, enriches the ways in which TPCM status information is transmitted, and avoids defects and risks such as short-circuiting and physical replacement of the TPCM entity through a dual control method, effectively improving the security and stability of the server system.

Attached Figure Description

Figure 1 is a schematic diagram of the interconnection between CPLD and TPCM in the prior art;

Figure 2 is a schematic diagram of the server startup process based on TPCM in the prior art;

Figure 3 is a flowchart illustrating the TPCM in-situ detection method in an embodiment of the present invention;

Figure 4 is a flowchart illustrating the key configuration method in an embodiment of the present invention;

Figure 5 is a schematic diagram of the TPCM in-situ detection device in an embodiment of the present invention;

Figure 6 is a flowchart illustrating the server startup method in an embodiment of the present invention;

Figure 7 is a schematic diagram of the server structure in an embodiment of the present invention.

Detailed Implementation

To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

Before describing the technical solution of this invention, the technical keywords involved in this invention will be explained: TPCM (Trusted Platform Control Module): Trusted Platform Control Module, or Trusted Authentication Boot Process; BIOS (Basic Input Output System): Basic Input Output System; BMC (Baseboard Management Controller): Baseboard Management Controller; CPLD (Complex Programmable Logic Device): Complex Programmable Logic Device; FW (Firmware): Firmware Version; OD (Open Drain): Open Drain Output.

Please refer to Figure 1. In the existing TPCM module's working mechanism, the TPCM is installed on the server motherboard and connected to the motherboard through the TPCM interface on the CPLD. It is fixed to the motherboard with screws. The main signals transmitted between the TPCM and the CPLD include the TPCM_PRESENT_N signal, the BMC_CHECK_PASS_N signal, and the BIOS_CHECK_PASS_N signal. These three signals represent different meanings through high and low levels, and pull-up resistors are set between the three connection lines and the power supply VCC. The TPCM_PRESENT_N signal is used to indicate whether the TPCM is installed, the BMC_CHECK_PASS_N signal is used to indicate whether the TPCM's measurement of the BMC passes, and the BIOS_CHECK_PASS_N signal is used to indicate whether the TPCM's measurement of the BIOS passes.

Referring to the topology shown in Figure 1 and Figure 2, the existing TPCM-based server startup workflow is as follows: Upon system power-up, the CPLD and TPCM on the motherboard start first. The CPLD uses the TPCM_PRESENT_N signal to determine if the TPCM module is installed. If no TPCM module is installed, the TPCM_PRESENT_N signal is high due to the pull-up resistor on the motherboard, indicating that the TPCM is not installed; the CPLD stops the startup sequence, keeps the BMC in a reset state, and the system MAIN domain power is not powered on. If the TPCM is installed, the TPCM_PRESENT_N signal is strongly pulled low by the ground resistor on the TPCM, resulting in a low level. Once the CPLD determines that the TPCM_PRESENT_N signal is low, it proceeds with the predetermined startup process.

According to the predetermined procedure, the TPCM first verifies the firmware in the BMC FLASH. If the BMC firmware verification fails, the TPCM does not process the BMC_CHECK_PASS_N signal, and the BMC_CHECK_PASS_N signal remains high. If the CPLD does not receive the BMC_CHECK_PASS_N signal going low after a certain period of time, it indicates that the BMC firmware measurement has failed. The CPLD stops the startup timing, keeps the BMC in a reset state, and the system MAIN domain power is not powered on. If the BMC measurement passes, the TPCM pulls the BMC_CHECK_PASS_N signal low. After the CPLD determines that the BMC_CHECK_PASS_N signal is low, it starts up according to the predetermined procedure.

Upon receiving the power-on command, the TPCM verifies the firmware in the BIOS FLASH according to the predetermined procedure. If the BIOS firmware verification fails, the TPCM does not process the BIOS_CHECK_PASS_N signal, and BIOS_CHECK_PASS_N remains high. If the CPLD does not receive a low BIOS_CHECK_PASS_N signal after a certain period, it indicates that the BIOS firmware measurement has failed, the CPLD stops the boot sequence, and the system MAIN domain power is not powered on. If the BIOS measurement passes, the TPCM pulls the BIOS_CHECK_PASS_N signal low. After the CPLD receives a high BIOS_CHECK_PASS_N signal, it proceeds with the boot process according to the predetermined procedure. Thus, the traditional TPCM-based boot process is complete.

While traditional methods utilize TPCM to measure BMC and BIOS to improve server system security, some problems still exist. On the one hand, TPCM is not verified, and using an unverified TPCM for measurement cannot completely guarantee the security and accuracy of the measurement results. There is a risk that the TPCM may be replaced or tampered with, leading to untrustworthy systems. For example, if a tampered TPCM is used, regardless of whether the measurement passes or fails, a measurement pass signal will be sent, deceiving the CPLD to bypass TPCM verification and complete system startup.

On the other hand, for the existing structure, TPCM verification can also be bypassed through methods such as shorting. For example, shorting TPCM_PRESENT_N to ground can deceive the CPLD into believing that TPCM is in place. Similarly, shorting BMC_CHECK_PASS_N to ground for a certain period of time can deceive the CPLD into believing that BMC measurement has passed. Or, shorting BIOS_CHECK_PASS_N to ground for a certain period of time can deceive the CPLD into believing that BIOS measurement has passed. Through these simple hardware shorting methods, the CPLD can be tricked into bypassing TPCM verification, thereby completing the system boot. However, system booting through shorting or physical replacement will inevitably lead to the server system becoming untrustworthy.

To address the aforementioned issues with existing TPCM-based startup methods, please refer to Figure 3. The first embodiment of this invention proposes a TPCM in-situ detection method, comprising steps S10 to S20:

Step S10: After the server system is powered on, obtain the first key information from TPCM;

Step S20: Determine whether the TPCM is trusted and in place based on the first key information.

In existing TPCM startup methods, the presence of the TPCM module is detected by traditional GPIO high and low levels, without performing trusted verification of the TPCM. Furthermore, these high and low level signals can be tricked into believing the CPLD is present by shorting them, posing a risk of TPCM replacement or tampering. Therefore, this invention designs a detection method to verify the trustworthiness of the TPCM. In this embodiment, a serial data method is used for presence verification. A key is assigned to the TPCM, serving as its identity verification. By verifying the key information, the TPCM's trustworthiness is determined, thus achieving trusted verification of the TPCM and preventing the CPLD from being tricked into believing the TPCM is present by pin shorting.

In a preferred embodiment, the TPCM's key information can be generated externally using a preset method and pre-stored within the TPCM. This key information, serving as the TPCM's identity information, should be unique and correspond one-to-one with the TPCM. This uniqueness ensures the accuracy of the verification results. Alternatively, the key information can be generated once randomly or according to a preset method by a key generation device built into the TPCM, and this unique key information is stored within the TPCM. Furthermore, this invention provides another preferred embodiment: during the initial installation of the TPCM, the authenticator, such as a CPLD, sends a key information to the TPCM, which is then stored as the TPCM's key information. Subsequent verification of the TPCM can then use this key information as its identity information. This key information can either be generated externally using a preset method and pre-stored within the CPLD, or it can be generated by a key generation device installed within the CPLD. In this embodiment, since the TPCM is unaware of the key information generation method, the security of the key information is also guaranteed.

In existing startup procedures, the CPLD determines whether the TPCM is present. This invention utilizes this characteristic, also employing the CPLD to verify the correctness of the TPCM's key information. Therefore, after system power-on, the TPCM's key information needs to be transmitted to the CPLD for trusted presence verification. Key information transmission can be in plaintext or encrypted form. If plaintext transmission is used, the key information can be directly read and its correctness determined upon receipt, thus quickly confirming the TPCM's trustworthiness. If encrypted transmission is used, encryption/decryption devices need to be configured on both the sender and receiver, which improves transmission security. It should be understood that other key information generation and transmission methods can also be applied to this invention, and will not be elaborated upon here.

After receiving the key information, there are multiple ways to verify it. For example, if the key information is generated according to preset rules, the key information can be verified to be correct by determining whether it conforms to the preset rules. Alternatively, the verification method used in this invention can be adopted, which compares the first key information with the pre-configured second key information. If the comparison is consistent, the TPCM is determined to be trustworthy and in place; if the comparison is inconsistent, the TPCM is determined to be untrustworthy and in place.

The second key information is the same as the first key information. By comparing the two key information, it is possible to verify whether the first key information is correct, thereby confirming that the TPCM is in place and has not been tampered with or replaced. This verification method is not only simple and convenient, but also has extremely high accuracy.

In this embodiment, the second key information is pre-configured key information, which is pre-stored on the CPLD side. Since the second key information needs to be configured in advance in this embodiment, to avoid invalid verification caused by performing key comparison before the second key information is successfully configured, the present invention also provides a preferred embodiment. In this embodiment, before comparing the first key information with the second key information, the following steps need to be performed:

Obtain the pre-stored key status information, and determine whether the second key information has been configured based on the key status information;

If the key has been configured, then compare the first key information with the second key information;

If the key is not configured, the second key information is configured according to the first key information.

In this embodiment, the key status information is used to indicate the configuration status of the second key information, such as configuration incomplete or configuration complete. Only key information with complete configuration can be used to verify the first key information of TPCM. If the configuration is incomplete, the verification result of the first key information is invalid or will not be verified. In this way, the accuracy of the key comparison result can be further ensured, and invalid verification is avoided when the second key information has not been configured. The key status information can be a preset string, and different character data can be set to represent different statuses.

Before performing trusted verification on the TPCM, it is essential to confirm that the second key information has been configured correctly. Verification of the first key information is only valid if the key status information indicates configuration is complete; otherwise, the second key information must be configured first. There are several methods for configuring the second key information. One method is to pre-store the first key information in the CPLD as the second key information while pre-storing it in the TPCM, and then set the key status information to "configuration complete" after the second key information is pre-stored. However, this method requires a one-to-one correspondence between the TPCM and CPLD; incorrect installation will result in the TPCM being unable to verify and the second key information being unmodifiable. Therefore, while this configuration method is simple and doesn't add much extra cost, it has high requirements for production installation and is not conducive to improving production efficiency. Another configuration method involves sending the generated key information simultaneously with the first key information, provided the first key information is generated by the CPLD and sent to the TPCM. The first key information is stored as the second key information, and after the first key information is successfully sent, the key status information is set to the configuration complete state. This method can greatly improve the security of the key information, thereby improving the accuracy of the verification results. However, this method has the problem that a key generation device needs to be set in the CPLD, and in order to ensure the uniqueness of the key, the key generation device only needs to generate the key information once after the motherboard is successfully installed. Therefore, it inevitably increases the production cost and causes a waste of resources. In order to solve the above problems, and to ensure the security and uniqueness of the key without increasing the production cost, and to facilitate the production and installation of the factory assembly line without bringing additional burden to the production process, the present invention provides a preferred embodiment of the configuration method for the second key information, the configuration steps of which are as follows:

The configuration status of the second key information is determined based on the key status information. If the key status information is in an unconfigured state, the first key information is stored as the second key information, and the key status information is set to a configuration state.

If the key status information is in the configuration state, the first key information is compared with the stored second key information. If the comparison matches, the key status information is set to the configuration completed state. If the comparison does not match, the key status information is set to the unconfigured state.

In this embodiment, the second key information is configured based on the first key information. The first key information can be pre-stored in the TPCM or generated internally within the TPCM. While the latter method offers extremely high key security, as mentioned above, it requires an additional key generation device that only needs to generate the key once. Therefore, this invention preferably extracts and stores the first key information in the TPCM. Then, upon successful motherboard installation and first power-on, the first key information is sent to the CPLD as the second key information for storage. To ensure the accuracy of data transmission, please refer to Figure 4. The key configuration process used in this invention is as follows:

After the system powers on, it first receives the first key information from the TPCM, and then determines the key status information. In this embodiment, two bytes are used as the key status bit to determine the key configuration status. The key status bit can be stored in the EEPROM, where 00 indicates an unconfigured state, 01 indicates a configuration in progress state, and 10 indicates a configuration complete state. If the key status information is 00, i.e., an unconfigured state, then the first key information is stored as the second key information, and the key status information is changed from 00 to 01, indicating a configuration in progress state. To ensure accurate configuration results, this embodiment does not directly change the unconfigured state to the configuration completed state. Instead, it sets a configuration in progress state and ensures the accuracy and validity of the configuration result through two configuration comparisons. That is, after the system powers on again and receives the first key information again, if the key status information is in the configuration in progress state (01), it needs to be compared with the stored second key information. If they match, the stored second key information is considered valid, and the key status information can be changed to the configuration completed state (10). If they do not match, it is considered that an error occurred in the first transmission, and the first stored key information is unreliable. In this case, the key status information is changed to 00 (unconfigured state), and the stored second key information is discarded, waiting to be re-recorded on the next startup, until the key configuration is complete, and the key status information is 10 (configuration completed state). After the system powers on again, if the key status information is determined to be in the configuration completed state, it means that the CPLD has completed the configuration of the second key information, and the subsequent startup can proceed according to the predetermined process.

This invention ensures the integrity of the key configuration process and the accuracy of the configuration results through secondary configuration, thereby guaranteeing the validity of the subsequent trusted verification results of the TPCM. The configuration method provided by this invention does not require the addition of additional complex devices such as key generators on the TPCM or CPLD side. It only requires pre-storing a key information in the TPCM and does not require corresponding settings on the CPLD. This key configuration method is not only simple and efficient, but also does not bring any additional burden to production and installation.

This invention records the key information of the TPC upon initial power-on and compares it with the key information of the TPCM upon subsequent power-on. By verifying the trusted presence of the TPCM, it prevents the TPCM from being maliciously replaced later, thereby improving the security of the server system.

Step S30: If the TPCM is trusted and in place, respond with the measurement result from the TPCM; if the TPCM is untrusted and in place, stop the startup sequence.

As can be seen from the above description of the prior art, since the TPCM informs the CPLD of the firmware measurement results of BMC or BIOS by means of high and low level signals, and different measurement results are represented by different pin signals, after the TPCM is removed, the feasible root authentication can be bypassed by shorting the relevant pins, thereby maliciously tampering with the system. In order to solve this problem of the prior art, the present invention replaces the method of using high and low level information to represent the measurement results in the prior art with the method of representing the measurement results by means of data sequence, thereby avoiding the situation where the CPLD is deceived by shorting the connection to pass the measurement.

This invention represents the measurement result, indicated by the high and low level information of different pins, as a data sequence. That is, the value of different bits in the data sequence can represent the measurement result for different devices such as the BMC or BIOS. For example, whether the target of the measurement is the BMC or the BIOS, and whether the measurement result is pass or fail. When the CPLD receives the measurement result, it can know the TPCM's measurement target and result by reading the data sequence, and then execute corresponding timing control based on the read information, such as timing start or stop startup. In this embodiment, since the measurement result is represented by a data sequence, which contains both the measurement result and the measurement target, this data sequence does not need to transmit levels through multiple GPIOs as in existing designs. Instead, only one port is needed for data transmission. Therefore, this invention's design of representing the measurement result through a data sequence not only avoids bypassing feasible root authentication by shorting pins, but also effectively reduces the number of TPCM interfaces.

Furthermore, in the existing design, the CPLD can only determine whether the firmware measurement of the TPCM is complete by reading the corresponding GIPO level information within a certain period of time. Before reading the level information, the CPLD does not know the current state of the TPCM, that is, whether the TPCM is performing firmware measurement. Under this design, it is very easy to deceive the CPLD into thinking that the TPCM measurement has passed by shorting the pins, because the CPLD can only judge the measurement result by high and low levels and cannot obtain information on whether the TPCM is measuring in other ways. This is also a drawback caused by the existing design using level signals to transmit measurement results.

Therefore, this invention provides a preferred embodiment, which, based on using data sequence to transmit measurement results, adds format information to the data sequence and incorporates measurement status information into the data sequence. Whenever the TPCM starts measurement, it writes the measurement status information into the data sequence and continuously transmits it to inform the CPLD of the current status of the TPCM, thus preventing the CPLD from being misled by the measurement results due to a lack of understanding of the TPCM's measurement status. After adding the measurement status information, the CPLD performs the corresponding timing control steps based on the measurement status of the measurement target as follows:

If the measurement status is in the measurement process, the startup sequence will not be executed until the measurement status is in the measurement completion state.

If the measurement status is a measurement completion status, then determine whether the measurement has passed based on the measurement completion status, and execute the corresponding timing control according to whether the measurement has passed or not.

In this embodiment, the CPLD and TPCM communicate using 8-bit instructions. The data format can be set to: MSB_XX_XX_XX_XX_LBS, where the format and definition are shown in Table 1 below:

Table 1 Data transmission format

In the table above, the data that TPCM sends to the BMC measurement command is: 0000_00_00, which will be repeatedly sent throughout the measurement process to notify CPLD of its measurement status.

TPCM sends data that passed the BMC metric as: 0000_00_11, and data that failed the metric as: 0000_00_10. This data sequence will be sent after the BMC metric is completed.

The TPCM sends the data for the commands in the BIOS measurement as: 0000_01_00, and will repeatedly send it throughout the measurement process to notify the CPLD of its measurement status.

TPCM sends the data that the BIOS measurement passed as 0000_01_11 and the data that failed as 0000_01_10. This data sequence will be sent after the BIOS measurement is completed.

Of course, the above is just an example of measurement status. In actual situations, you can also set measurement error information, or set other data formats, etc., which will not be elaborated here.

The TPCM presence detection method proposed in this invention abandons the traditional method of detecting TPCM presence and measurement completion through GPIO high and low levels. Instead, it designs a serial data method for verification and transmission of measurement results. This not only avoids the failure of the root of trust due to TPCM replacement or malicious tampering, but also prevents the system from becoming untrustworthy due to bypassing root of trust authentication by shorting. Furthermore, it reduces the number of GPIOs used and the number of TPCM interfaces, while enriching the update of TPCM status information, thereby effectively improving the security of server system startup and the stability of operation.

Please refer to Figure 5. Based on the same inventive concept, the second embodiment of the present invention proposes a TPCM in-situ detection device, comprising:

The key acquisition module 10 is used to acquire the first key information from the TPCM after the server system is powered on.

Trust determination module 20 is used to determine whether the TPCM is trusted in place based on the first key information;

The timing control module 30 is used to respond to the measurement result from the TPCM if the TPCM is trusted and in place, and to stop the timing startup if the TPCM is untrusted and in place.

In this embodiment, a serial data method is used for in-situ verification. A key is assigned to the TPCM, serving as its identity verification. Verification of this key determines whether the TPCM is truly in-situ, thus achieving reliable TPCM verification and preventing the CPLD TPCM from being deceived into in-situ by pin short-circuiting. In a preferred embodiment, the TPCM key can be generated externally using a preset method and pre-stored within the TPCM. This key, serving as the TPCM's identity information, should be unique and correspond one-to-one with the TPCM. This uniqueness ensures the accuracy of the verification result.

Furthermore, the present invention also provides another preferred embodiment, in which:

The trust determination module is also used to obtain pre-stored key status information, and determine whether the second key information has been configured successfully based on the key status information; if it has been configured successfully, the first key information is compared with the second key information; if it has not been configured successfully, the second key information is configured based on the first key information.

In this embodiment, the second key information is the same as the first key information. By comparing the two key information, it can be verified whether the first key information is correct, thereby confirming that the TPCM is in place and has not been tampered with or replaced. This verification method is not only simple and convenient, but also has extremely high accuracy.

Furthermore, the present invention also provides another preferred embodiment in which the apparatus further includes:

The key configuration module is used to determine the configuration status of the second key information based on the key status information. If the key status information is in an unconfigured state, the first key information is stored as the second key information, and the key status information is set to a configuration state.

If the key status information is in the configuration state, the first key information is compared with the stored second key information. If the comparison matches, the key status information is set to the configuration completed state. If the comparison does not match, the key status information is set to the unconfigured state.

In this embodiment, the key status information is used to indicate the configuration status of the second key information, such as configuration incomplete or configuration complete. Only the key information that has been configured can be used to verify the first key information of TPCM. If the configuration is incomplete, the verification result of the first key information is invalid or will not be verified. In this way, the accuracy of the key comparison result can be further ensured, and invalid verification is avoided when the second key information has not been configured. The key status information can be a preset string, and different character data can be set to represent different statuses.

Furthermore, the present invention also provides another preferred embodiment, in which:

The measurement result is a data sequence generated by measuring the measurement target according to TPCM, and the data sequence includes measurement target data and measurement status data.

This embodiment replaces the existing method of representing measurement results using high and low level information with representing measurement results using a data sequence, thereby avoiding the possibility of deceiving the CPLD to pass the measurement by shorting. In this embodiment, since the measurement result is represented by a data sequence, which contains both the measurement result and the measurement target, the data sequence does not need to transmit levels through multiple GPIOs as in existing designs. Instead, only one port is needed for data transmission. That is, the design of representing measurement results by data sequence in this invention not only avoids bypassing feasible root authentication by shorting pins, but also effectively reduces the number of TPCM interfaces.

Furthermore, the present invention also provides another preferred embodiment, in which:

The timing control module is also used to: if the measurement status is in the measurement process state, not execute the startup timing until the measurement status is in the measurement completion state; if the measurement status is in the measurement completion state, determine whether the measurement has passed based on the measurement completion state, and execute the corresponding timing control based on whether the measurement has passed or not.

This embodiment adds format information to the data sequence based on the use of data sequence to transmit measurement results. The measurement status information is added to the data sequence. As soon as the TPCM starts measurement, it writes the measurement status information into the data sequence and continuously sends the data sequence to inform the CPLD of the current status of the TPCM. This is to avoid the CPLD being deceived by the measurement results because it does not know the measurement status of the TPCM.

The technical features and effects of the TPCM in-situ detection device proposed in this embodiment of the invention are the same as those of the method proposed in this embodiment of the invention, and will not be repeated here. Each module in the above-mentioned TPCM in-situ detection device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in a computer device in hardware form, or it can be stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

The third embodiment of the present invention proposes a server startup method, which uses the TPCM presence detection method described above to perform trusted presence detection on the TPCM, and starts the server when the detection passes.

In existing designs, CPLDs can be tricked by methods such as pin shorting to bypass trusted root authentication, thus rendering the system untrustworthy. To address the problems in existing designs, this invention proposes a TPCM in-situ detection method for trusted TPCM authentication. Furthermore, this invention also provides a server startup method that modifies the existing startup process and methods to improve the security of server system startup, thereby ensuring the security and stability of server system operation.

As shown in Figure 2, the traditional TCPM-based startup process suffers from several drawbacks. First, it relies on high and low voltage levels to assess the presence of the TCPM and transmit its measurement results. Second, it lacks reliable authentication of the TCPM and allows the CPLD to be bypassed through methods like short-circuiting, leading to unreliable system startup. To address these issues, this invention provides a novel server startup method. Referring to Figure 6, the server startup method provided by this invention is as follows:

After the server system is powered on, the CPLD resets the BMC via timing control, a step identical to the traditional startup method. Following this step, the TPCM is authenticated using the key information sent by the TPCM. If the key comparison is successful, the TPCM is considered trustworthy and in place. At this point, the CPLD waits for the TPCM to measure the BMC. After the BMC measurement is completed, a data sequence is generated based on the measurement result and sent to the CPLD. Upon receiving the data sequence for the BMC measurement, the CPLD obtains the measurement result of the BMC through this data sequence. If the measurement passes, the BMC reset state is lifted, and the BMC is started. If the measurement fails, the startup timing is stopped.

After the server system receives the boot command, the TPCM performs firmware measurement on the BIOS and generates a data sequence based on the measurement result. This data sequence is also sent to the CPLD, which determines whether the BIOS measurement has passed based on the data sequence. If the measurement fails, the boot sequence is stopped; if the measurement passes, the BIOS is de-reset and booted, thus completing the trusted boot of the server system. It should be noted that before comparing and verifying the first key information of the TPCM, the configuration of the second key information needs to be completed. The configuration method for the key information can also adopt the configuration method described in the TPCM presence detection method, and the data sequence generation method of its measurement result is also the same as that in the TPCM presence detection method, which will not be elaborated further here.

This invention adds a TPCM authentication process during the server system startup process. The trusted root authentication and measurement result transmission via serial data prevents malicious tampering of the system by bypassing trusted root authentication after the TPCM is removed by shorting relevant pins. It also prevents the trusted root from becoming invalid due to TPCM replacement or malicious tampering, thus preventing system untrustworthiness. Furthermore, it reduces the number of GPIOs and TPCM module interfaces, and enriches the updates of TPCM status information. These multiple aspects ensure the secure and reliable startup of the server system, thereby improving its information security.

Please refer to Figure 7. A server provided in the fourth embodiment of the present invention includes a TPCM and a CPLD connected unidirectionally via serial communication. The TPCM is pre-set with first key information, and the CPLD uses the TPCM presence detection method described above to perform trusted presence detection on the TPCM.

In existing designs, the CPLD evaluates the presence of the TPCM and the firmware measurement results of the TPCM by using the high and low levels of different pins. Therefore, at least three pairs of GPIO ports are required. This design is also susceptible to deceiving the CPLD by shorting pins. This invention provides a method for TPCM authentication and measurement result transmission via serial data. All information in this method is serial data, thus changing the connection between the TPCM and CPLD from the traditional GPIO level operation to serial communication. Specifically, the TPCM and CPLD are connected via the TPCM_CPLD_DATA_TX signal, a unidirectional signal sent by the TPCM and received by the CPLD. The TPCM controls external signals via OD output, facilitating level matching with the motherboard.

By using serial communication, the original connection structure requiring at least three pairs of GPIO ports is changed to one pair of GPIO ports for serial communication. Pull-up resistors are also provided on the GPIO connection lines. This topology design not only avoids deceiving the CPLD through short circuits or replacements, but also effectively reduces the number of GPIO interfaces. Furthermore, by specifying that this signal is transmitted unidirectionally, the TPCM will not have any external data input, further ensuring the security of the TPCM's key information.

Furthermore, since the CPLD in this invention needs to verify the key information of the TPCM, it is necessary to configure and store second key information. If this second key information is stored in the CPLD's built-in Flash, the key information may be affected when the CPLD is upgraded, leading to problems such as key information invalidation. Therefore, this invention provides a preferred embodiment in which an external EEPROM is connected to the CPLD. The location of the EEPROM is not affected by CPLD upgrades. After the system powers on, the CPLD will save the key information sent by the TPCM in the EEPROM, thereby ensuring that the configured key information will not be overwritten, cleared, or tampered with due to unexpected system power outages or CPLD upgrades. The server startup process will be described below with reference to the topology in Figure 7:

During the initial power-up phase of the system, the TPCM sends its key information to the CPLD via the TPCM_CPLD_DATA_TX signal. This key is unique within the TPCM. Upon receiving the key information, the CPLD first checks whether the key information stored within the CPLD has been configured. If configured, it compares and verifies the received key information. If not configured, it configures the key based on the received key information.

During key configuration, the key status information in the EEPROM is first checked. If it is in an unconfigured state, the key information is recorded to the EEPROM, and the key status information in the EEPROM is written as "configuring". If it is in a "configuring" state, it is compared with the key stored in the EEPROM for the first time. If they match, the key status information in the EEPROM is written as "configuration complete". If they do not match, the key status information in the EEPROM is written as "unconfigured". The key is then recorded again on the next startup until the key configuration is complete and the key status information is "configuration complete".

The CPLD verifies the correctness of the key information by comparing the stored key information with the received key information. If the CPLD receives the correct TPCM key information, it can determine that the TPCM is in place and has not been tampered with or replaced, which means it is trusted to be in place. If the correct TPCM key information is not received, it means that the TPCM module has been tampered with or replaced. The CPLD stops the startup timing, keeps the BMC in the reset state, and the system MAIN domain power is not powered on.

According to the predetermined procedure, the TPCM first verifies the firmware in the BMC FLASH. During the measurement process, the TPCM continuously sends a data sequence indicating measurement in progress to the CPLD via the TPCM_CPLD_DATA_TX signal until the measurement is complete. If the CPLD receives a data sequence indicating measurement in progress, it waits until it receives a data sequence indicating measurement completion. If the BMC firmware measurement fails, the TPCM sends a data sequence indicating BMC firmware measurement failure to the CPLD via the TPCM_CPLD_DATA_TX signal, the CPLD stops the startup timing, keeps the BMC in a reset state, and the system MAIN domain power is not powered on. If the BMC firmware measurement succeeds, the TPCM sends a data sequence indicating BMC firmware measurement success to the CPLD via the TPCM_CPLD_DATA_TX signal, and the CPLD starts up according to the predetermined procedure.

When the system receives the power-on command, the TPCM verifies the firmware in the BIOS FLASH. During the verification process, the TPCM continuously sends a data sequence indicating "verification in progress" to the CPLD via the TPCM_CPLD_DATA_TX signal until the verification is complete. If the CPLD receives a data sequence indicating "verification in progress," it waits until it receives a data sequence indicating "verification complete." If the BIOS firmware verification fails, the TPCM sends a data sequence indicating "BIOS firmware verification failure" to the CPLD via the TPCM_CPLD_DATA_TX signal, the CPLD stops the boot process, and the system MAIN domain power is not turned on. If the BIOS firmware verification succeeds, the TPCM sends a data sequence indicating "BIOS firmware verification success" to the CPLD via the TPCM_CPLD_DATA_TX signal, and the CPLD boots according to the predetermined procedure. This completes the TPCM-based boot process.

This invention reduces the number of TPCM interfaces by using a unidirectional signal serial communication method, avoids external data input to the TPCM, and improves the security of internal data in the TPCM from a structural design perspective. Furthermore, by using an external EEPROM for the CPLD, it avoids the impact of CPLD upgrades and other factors on the stored key information. Through improvements to the server topology, this invention enhances the data security of the server system, thereby making the server system operate more securely and stably.

It should be noted that the server topology provided by this invention is only a preferred topology matching the server startup method described above. Based on this preferred embodiment, the server topology can be further improved or replaced. For example, the serial communication between the TPCM and CPLD can be set to bidirectional communication. Under this design, in addition to the key configuration method and key comparison method provided by this invention, various preferred key configuration methods can also be implemented, including the CPLD sending key information representing the TPCM's identity to the TPCM and receiving key information from the TPCM for verification, or the CPLD sending a key signal to the TPCM for configuration, and the CPLD sending information to the TPCM indicating whether the key configuration was successful. Alternatively, serial communication can be added to the existing TPCM and CPLD topology. In this case, key comparison and dual determination of high and low level signals can further ensure that the TPCM has not been replaced or tampered with. Of course, a topology with multiple external EEPROMs can also be used, storing the key information, key status information, and other data stored by the CPLD in different external EEPROMs to improve the security of the data stored by the CPLD. That is, without departing from the technical principles of this invention, several improvements and substitutions can be made to the structure and method, and these improvements and substitutions should also be considered within the scope of protection of this application.

In summary, the TPCM presence detection method, apparatus, server startup method, and server proposed in this invention embodiment obtain first key information from the TPCM after the server system is powered on; determine whether the TPCM is trusted and present based on the first key information; if the TPCM is trusted and present, respond to the measurement result from the TPCM; if the TPCM is untrusted and present, stop the startup sequence. This invention, by adding TPCM authentication actions and transmitting status information via data stream instead of traditional voltage levels, effectively prevents the system from being maliciously tampered with by bypassing the root of trust authentication after the TPCM is removed by shorting relevant pins, and prevents the system from becoming untrusted due to the root of trust failure caused by the replacement or malicious tampering of the TPCM. It also reduces the number of GPIOs used, the number of TPCM module interfaces, and enriches the updates of TPCM status information. This invention, by adding a mechanism for CPLD active authentication of the TPCM module, enriches the way TPCM module status information is transmitted, doubly ensuring that the TPCM entity is not shorted or replaced/tampered with. Through methodological and structural improvements, this invention ensures the information security of the server system.

The various embodiments in this specification are described in a progressive manner. For directly identical or similar parts among the embodiments, refer to each other. Each embodiment focuses on its differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; refer to the description of the method embodiments for relevant details. It should be noted that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

The embodiments described above are merely preferred embodiments of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the technical principles of this invention, and these improvements and substitutions should also be considered within the scope of protection of this application. Therefore, the scope of protection of this patent application should be determined by the scope of the claims.

Claims (11)

1. A method for in-situ detection of TPCM, characterized in that it comprises: After the server system is powered on, the first key information from TPCM is obtained; Based on the first key information, determine whether the TPCM is trusted and in place; specifically: The first key information is compared with the pre-configured second key information. If they match, the TPCM is determined to be in a trusted position. If they do not match, the TPCM is determined to be in an untrusted position. The first key information is a key information that is pre-stored in the TPCM and is unique. If the TPCM is trusted to be in place, the response is the measurement result from the TPCM; specifically: Obtain the measurement results from TPCM, obtain the measurement status of the measurement target based on the measurement results, and execute the corresponding timing control. The measurement results are the data sequence generated by measuring the measurement target according to TPCM, and the data sequence includes measurement target data and measurement status data. If the TPCM is not trusted in place, then the startup sequence is stopped. 2. The TPCM presence detection method according to claim 1, characterized in that, before comparing the first key information with the pre-configured second key information, the method further includes: Obtain the pre-stored key status information, and determine whether the second key information has been configured based on the key status information; If the key has been configured, then compare the first key information with the second key information; If the key is not configured, the second key information is configured according to the first key information. 3. The TPCM presence detection method according to claim 2, wherein the step of configuring the second key information according to the first key information includes: The configuration status of the second key information is determined based on the key status information. If the key status information is in an unconfigured state, the first key information is stored as the second key information, and the key status information is set to a configuration state. If the key status information is in the configuration state, the first key information is compared with the stored second key information. If the comparison matches, the key status information is set to the configuration completed state. If the comparison does not match, the key status information is set to the unconfigured state. 4. The TPCM in-situ detection method according to claim 1, characterized in that the step of acquiring the measurement state of the measurement target and performing corresponding timing control includes: If the measurement status is in the measurement process, the startup sequence will not be executed until the measurement status is in the measurement completion state. If the measurement status is a measurement completion status, then determine whether the measurement has passed based on the measurement completion status, and execute the corresponding timing control according to whether the measurement has passed or not. 5. A TPCM in-situ detection device, characterized in that the device comprises: The key acquisition module is used to acquire the first key information from the TPCM after the server system is powered on. The trust determination module is used to determine whether the TPCM is trusted in place based on the first key information; The trust determination module is further configured to compare the first key information with the pre-configured second key information. If the comparison is consistent, the TPCM is determined to be trustworthy and in place. If the comparison is inconsistent, the TPCM is determined to be untrustworthy and in place. The first key information is key information pre-stored in the TPCM and is unique. The timing control module is used to respond to the measurement result from the TPCM if the TPCM is trusted to be in place; specifically: Obtain the measurement results from TPCM, obtain the measurement status of the measurement target based on the measurement results, and execute the corresponding timing control. The measurement results are the data sequence generated by measuring the measurement target according to TPCM, and the data sequence includes measurement target data and measurement status data. If the TPCM is not trusted in place, then the startup sequence is stopped. 6. The TPCM in-situ detection device according to claim 5, wherein the trust judgment module is further configured to acquire pre-stored key status information, and determine whether the second key information has been configured based on the key status information; if the configuration has been completed, the first key information is compared with the second key information; if the configuration has not been completed, the second key information is configured based on the first key information. 7. The TPCM in-situ detection device according to claim 6, wherein the device further comprises a key configuration module; The key configuration module is used to determine the configuration status of the second key information based on the key status information. If the key status information is in an unconfigured state, the first key information is stored as the second key information, and the key status information is set to a configuration state. If the key status information is in the configuration state, the first key information is compared with the stored second key information. If the comparison matches, the key status information is set to the configuration completed state. If the comparison does not match, the key status information is set to the unconfigured state. 8. The TPCM in-situ detection device according to claim 5, wherein the timing control module is further configured to: if the measurement state is in the measurement process state, not execute the startup timing until the measurement state is in the measurement completion state; if the measurement state is in the measurement completion state, determine whether the measurement has passed based on the measurement completion state, and execute the corresponding timing control based on whether the measurement has passed or not. 9. A server startup method, characterized in that the TPCM presence detection method as described in any one of claims 1 to 4 is used to perform trusted presence detection on the TPCM, and the server is started when the detection passes. 10. A server, characterized in that the server includes a TPCM and a CPLD connected unidirectionally via serial communication, the TPCM having a first key information pre-set, and the CPLD performing trusted presence detection on the TPCM using the TPCM presence detection method as described in any one of claims 1 to 4. 11. The server according to claim 10, wherein the CPLD is externally connected to an EEPROM, and the EEPROM is used to store the configured second key information.