WO2023179745A1 - Trusted verification method and apparatus - Google Patents

Abstract

The present application provides a trusted verification method and apparatus. The method is applied to a trusted verification system. The trusted verification system comprises a trusted platform control module (TPCM) and a trusted cryptography module (TCM). The TPCM comprises a main control module. The method comprises executing, by means of a main control module, the following operations: invoking a TCM to calculate a first metric value of a first measured object, the first measured object comprising one or more objects in software and firmware in a device where a trusted verification system is located; reading a reference metric value of the first measured object from a non-volatile memory of the TCM; and performing policy control on the first measured object on the basis of a matching result of the first metric value and the reference metric value. The present application can realize the active measurement of the software and/or the firmware in the device on the basis of the TPCM, and improve the security protection of data.

Description

Trusted verification method and device

This application claims priority to the Chinese patent application filed with the China Patent Office on March 24, 2022, with the application number 202210297166.9 and the invention title "Trusted Verification Method and Device". The entire content of the patent application is incorporated by reference in in this application.

Technical field

The present invention relates to the field of information security technology, and in particular to a trustworthy verification method and device.

Background technique

The trusted platform control module (TPCM) is a protective component integrated in the device and consists of hardware, software and firmware. TPCM is connected in parallel with the hardware, software and firmware of the device's computing system and is a basic core module used to establish and ensure the source of trust. And TPCM provides active measurement, active control, trusted verification, encryption protection, trusted reporting, password calling and other functions for the software and firmware in the device.

The standard for TPCM has been officially released in GB/T40650-2021 Information Security Technology Trusted Computing Specification. In addition, the law stipulates that network security level protection assessment and other assessments include trusted computing into assessment items, and all manufacturers will gradually launch products that support TPCM. However, how to implement active measurement of software and/or firmware in devices based on TPCM and further improve data security protection is a technical issue that urgently needs to be solved.

Contents of the invention

This application discloses a trusted verification method and related devices, which can realize active measurement of software and/or firmware in the device based on TPCM, and improve the security protection of data.

In the first aspect, this application provides a trusted verification method, which is applied to a trusted verification system. The trusted verification system includes a trusted platform control module TPCM and a trusted cryptographic module TCM. The aforementioned TPCM includes a main control module. module;

The aforementioned method includes performing the following operations through the aforementioned main control module:

Call the aforementioned TCM to calculate the first measurement value of the first measured object; the aforementioned first measured object includes one or more objects in the software and firmware in the device where the aforementioned trusted verification system is located;

Read the reference measurement value of the aforementioned first measured object from the non-volatile memory of the aforementioned TCM;

Policy control is performed on the first measured object based on the matching result between the first metric value and the reference metric value.

The embodiment of the present application provides a trusted verification solution that actively measures the integrity of the software and/or firmware in the device based on TPCM. In addition, in this application, the benchmark measurement value of the measured object is stored in the non-volatile memory of the TCM. Since the non-volatile memory of the TCM is a protected storage area and can only be accessed after authorization, it can improve the accuracy of the benchmark. Security protection of metric values. This ensures the reliability of integrity measurement, reduces the risk of tampering of measured objects, and improves the security protection of system data.

In a possible implementation, before calling the TCM to calculate the first measurement value of the first measured object, the method further includes:

Call the aforementioned TCM to calculate the second measurement value of the aforementioned first measured object;

Reading the first identification corresponding to the aforementioned first measured object in the one-time programmable memory, the aforementioned first identification indicating that the reference measurement value of the aforementioned first measured object is not stored in the non-volatile memory of the aforementioned TCM;

The second measurement value is written into the non-volatile memory of the TCM as the reference measurement value of the first measured object based on the first identification.

This solution combines a one-time programmable memory to quickly determine whether the benchmark measurement value of the first measured object has been stored. Compared with the existing solution that requires one-by-one comparison in the memory to determine, this solution can improve the reliability Measure efficiency. In addition, for measurement objects that do not have a baseline value stored, the current measurement value is stored as the baseline value, which solves the problem of writing the baseline value offline when there is no baseline value.

In a possible implementation, before writing the second measurement value as the reference measurement value of the first measured object to the non-volatile memory of the TCM based on the first identification, the method further includes:

Complete identity authentication in the aforementioned TCM through the aforementioned main control module, and obtain authorization to access the non-volatile memory of the aforementioned TCM.

In this solution, the memory in the TCM can only be accessed after authorization, ensuring that the protected storage area in the TCM will not be maliciously tampered with, and improving the security protection of the baseline value.

In a possible implementation, after writing the second measurement value as the reference measurement value of the first measured object into the non-volatile memory of the TCM based on the first identification, the method further includes:

The aforementioned first identification corresponding to the aforementioned first measured object in the aforementioned one-time programmable memory is changed to a second identification, and the aforementioned second identification indicates that the reference measurement value of the aforementioned first measured object has been stored in the non-transitory part of the aforementioned TCM Loss of memory.

In this solution, after the benchmark value of the first measured object is stored in the non-volatile memory, the corresponding identifier in the one-time programmable memory can be changed, so that it can be quickly learned that the corresponding one-time programmable memory has been stored based on the changed identifier. Reference value.

In a possible implementation, the aforementioned method further includes: reading, through the aforementioned main control module, the second identification corresponding to the aforementioned first measured object in the aforementioned one-time programmable memory;

The aforementioned reading of the aforementioned reference measurement value of the aforementioned first measured object from the aforementioned non-volatile memory of the TCM includes:

The reference measurement value of the first measured object is read from the non-volatile memory of the TCM based on the second identification.

In this solution, the corresponding benchmark value can be quickly read from the non-volatile storage based on the identifier in the one-time programmable memory corresponding to the first measured object, without further comparison to determine whether the benchmark value has been stored, improving credibility. Measure efficiency.

In a possible implementation, the foregoing method further includes performing the following operations through the foregoing main control module:

Receive the baseline measurement value of the second measured object from the remote trusted management center, where the aforementioned second measured object is an updated object of the aforementioned first measured object;

The reference measurement value of the first measured object in the non-volatile memory of the TCM is updated to the reference measurement value of the second measured object.

This solution interacts with the remote trusted management center to obtain the baseline metric value of the updated software/firmware and updates the local baseline value, which solves the problem that the baseline value needs to be re-programmed offline after the software/firmware is updated, otherwise it cannot be started.

In a possible implementation, the policy control module of the aforementioned TPCM includes configuration information of the control policy of the measured object;

The aforementioned method also includes performing the following operations through the aforementioned main control module:

Receive the target control policy of the first measured object from the remote trusted management center, where the target control policy is an updated policy of the control policy of the first measured object;

The configuration information of the control policy of the first measured object in the policy control module of the TPCM is updated to the configuration information of the target control policy.

This solution can achieve timely control policy updates by interacting with the remote trusted management center, and avoids the problem of abnormal policy control of the measured object during the trusted verification process.

In a possible implementation, the foregoing method further includes performing the following operations through the foregoing main control module:

Generate an event log based on the process of credible verification of the aforementioned first measured object;

Store one or more of the baseline measurement value of the first measured object, the matching result and the event log in the platform configuration memory of the TCM.

This solution stores this information in the platform configuration memory so that it can be used for remote certification later.

In a possible implementation, the aforementioned trusted verification system is a management system implemented based on a baseboard management controller (BMC).

In the second aspect, this application provides a trusted verification device, which includes a trusted verification system. The trusted verification system includes a trusted platform control module TPCM and a trusted cryptographic module TCM. The aforementioned TPCM includes a main control module. ;

The aforementioned main control module is used for:

Call the aforementioned TCM to calculate the first measurement value of the first measured object; the aforementioned first measured object includes one or more objects in the software and firmware in the device where the aforementioned trusted verification system is located;

Read the reference measurement value of the aforementioned first measured object from the non-volatile memory of the aforementioned TCM;

Policy control is performed on the first measured object based on the matching result between the first metric value and the reference metric value.

In a possible implementation, the aforementioned main control module is also used for:

Before the aforementioned calling the aforementioned TCM to calculate the first measurement value of the first measured object, calling the aforementioned TCM to calculate the aforementioned second measurement value of the aforementioned first measured object;

Reading the first identification corresponding to the aforementioned first measured object in the one-time programmable memory, the aforementioned first identification indicating that the reference measurement value of the aforementioned first measured object is not stored in the non-volatile memory of the aforementioned TCM;

The second measurement value is written into the non-volatile memory of the TCM as the reference measurement value of the first measured object based on the first identification.

In a possible implementation, the aforementioned main control module is also used for:

Before writing the second measurement value as the baseline measurement value of the first measured object into the non-volatile memory of the TCM based on the first identification, identity authentication is completed in the TCM through the main control module, and Obtain authorization to access the non-volatile memory of the aforementioned TCM.

In a possible implementation, the aforementioned main control module is also used for:

After the aforementioned second measurement value is written into the aforementioned non-volatile memory of the aforementioned TCM as the aforementioned reference measurement value of the aforementioned first measured object based on the aforementioned first identification, the aforementioned first measured object in the aforementioned one-time programmable memory is written into the non-volatile memory of the aforementioned TCM. The corresponding first identification is changed to a second identification, and the second identification indicates that the reference measurement value of the first measured object has been stored in the non-volatile memory of the TCM.

In a possible implementation, the main control module is further configured to: read the second identification corresponding to the first measured object in the one-time programmable memory;

The aforementioned reading of the aforementioned reference measurement value of the aforementioned first measured object from the aforementioned non-volatile memory of the TCM includes:

The reference measurement value of the first measured object is read from the non-volatile memory of the TCM based on the second identification.

In a possible implementation, the aforementioned main control module is also used for:

Receive the baseline measurement value of the second measured object from the remote trusted management center, where the aforementioned second measured object is an updated object of the aforementioned first measured object;

The reference measurement value of the first measured object in the non-volatile memory of the TCM is updated to the reference measurement value of the second measured object.

In a possible implementation, the policy control module of the TPCM includes configuration information of the control strategy of the measured object; the main control module is also used to:

Receive the target control policy of the first measured object from the remote trusted management center, where the target control policy is an updated policy of the control policy of the first measured object;

The configuration information of the control policy of the first measured object in the policy control module of the TPCM is updated to the configuration information of the target control policy.

In a possible implementation, the aforementioned main control module is also used for:

Generate an event log based on the process of credible verification of the aforementioned first measured object;

Store one or more of the baseline measurement value of the first measured object, the matching result and the event log in the platform configuration memory of the TCM.

In a possible implementation, the aforementioned trusted verification system is a management system implemented based on a baseboard management controller (BMC).

In a third aspect, this application provides a trusted verification device, including a processor and a memory, for implementing the method described in the above first aspect and its possible implementations. The memory is coupled to a processor. When the processor executes a computer program stored in the memory (the computer program can be the main control module of the TPCM in the above-mentioned trusted verification system), the device can realize the above-mentioned first aspect or any of the first aspects. One possible implementation is the method described.

The device may also include a communication interface for the device to communicate with other devices. For example, the communication interface may be a transceiver, a circuit, a bus, a module or other types of communication interfaces. The communication interface includes a receiving interface and a sending interface. The receiving interface is used for receiving messages, and the sending interface is used for sending messages.

In one possible implementation, the device may include:

Memory, used to store the main control module of TPCM in the above-mentioned trusted verification system;

Processor, used to perform the following operations through the main control module:

Call the TCM to calculate the first measurement value of the first measured object; the first measured object includes one or more objects in the software and firmware in the device where the trusted verification system is located;

Read the baseline measurement value of the first measured object from the non-volatile memory of the TCM;

Policy control is performed on the first measured object based on a matching result between the first metric value and the base metric value.

It should be noted that in this application, the computer program in the memory can be stored in advance or can be downloaded from the Internet and stored when using the device. This application does not specifically limit the source of the computer program in the memory. The coupling in the embodiment of this application is an indirect coupling or connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information interaction between devices, units or modules.

In a fourth aspect, the present application provides a computer-readable storage medium that stores a computer program. When the computer program is executed by a processor, any one of the above-mentioned first aspect and its possible implementations is implemented. the method described.

In a fifth aspect, the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the computer performs the method described in any one of the above first aspects.

It can be understood that the devices described in the second and third aspects, the computer storage medium described in the fourth aspect, and the computer program product described in the fifth aspect provided above are all used to execute any one of the first aspects. methods provided. Therefore, the beneficial effects it can achieve can be referred to the beneficial effects in the corresponding methods, and will not be described again here.

Description of the drawings

The drawings needed to be used in the embodiments of this application will be introduced below.

Figure 1 shows a schematic diagram of the system architecture provided by an embodiment of the present application;

Figure 2 shows a schematic flow chart of the trustworthy verification method provided by the embodiment of the present application;

Figure 3 shows a schematic structural diagram of a device provided by an embodiment of the present application;

Figure 4 shows another structural schematic diagram of the device provided by the embodiment of the present application.

Detailed ways

The drawings needed to be used in the embodiments of this application will be introduced below.

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

First, some terms used in this application are explained to facilitate understanding by those skilled in the art.

1. Trusted platform control module (TPCM).

TPCM is a protective component component integrated in the equipment, consisting of hardware, software and firmware. TPCM is connected in parallel with the hardware, software and firmware of the device's computing system and is a basic core module used to establish and ensure the source of trust. And TPCM provides active measurement, active control, trusted verification, encryption protection, trusted reporting, password calling and other functions for the software and firmware in the device.

2. Trusted crypto module (TCM).

TCM is a module that has functions such as cryptographic operations required for trusted computing and provides protected storage space.

According to national standards and regulations, TCM needs to provide a protected storage space inside it during design and manufacturing. This storage space has non-volatile characteristics, that is, the data will not be lost even if the power is turned off. In addition, the storage space in TCM is protected and cannot be accessed by the outside world at will. Access requires specific authorization operations through the TCM interface.

For example, TCM is a collection of hardware and firmware that builds a secure computing environment. Its core functional system is the function of building trusted computing based on independent cryptographic algorithms from three dimensions. The three dimensions include: integrity measurement and verification, which can Identification and authentication, and data protection.

3. Non-volatile memory (NVM).

Non-volatile memory refers to memory that does not lose data when the computer is turned off or shut down suddenly or unexpectedly.

4. Base-board management controller (BMC).

BMC is an out-of-band management subsystem widely used in server computer processors. Its functions include virtual keyboard, mouse, monitor, power management control and remote operation and maintenance, etc. It also includes power supply voltage, temperature, fan status of servers and other computers. , monitoring of logistics information such as chassis status. Its hardware is the first power-on component of the motherboard and the out-of-band management system.

5. Root of trust (RoT).

The scope of the trusted root includes the root of trust for measurement (RTM), the root of trust for storage (RTS), and the root of trust for reporting (RTR). The root of trust is the source of trust in trustworthiness and is a component that must be trusted.

6. Core root of trust for measurement (CRTM).

In this application, CRTM is the first piece of code or the first piece of computer program executed after the computer is powered on and started, and is the core program code for establishing a root of trust.

7. Basic input output system (BIOS).

BIOS is a set of programs that are solidified on a memory chip on the motherboard. It stores the computer's most important basic input and output programs, post-boot self-test programs, and system self-startup programs. It can be obtained from complementary metal oxide semiconductors. Read and write detailed information about system settings in complementary metal oxide semiconductor (CMOS).

8. Firmware.

Firmware can be a kind of software that is written into the chip, so it is "hardened". The firmware code itself can be stored in read-only memory (ROM). It can also be stored in memory such as programmable read-only memory (PROM) or electrically erasable programmable read-only memory (EEPROM).

9. Trustworthy verification.

Trusted verification refers to the process of active integrity measurement and verification of measured objects. It can also include the process of implementing policy control on measured objects based on the results of measurement and verification.

10. Image file.

Mirroring is a form of file storage. Files are produced and stored in a certain format. A file is exactly the same as its own mirror file, except that the storage location is different. It can also be said that the mirror file is the original file. backup or copy.

In order to better understand the trusted verification method provided by the embodiment of the present application, the following is an exemplary description of the applicable scenarios of the embodiment of the present application. Refer to Figure 1, which is a schematic diagram of a system architecture provided by an embodiment of the present application.

As shown in Figure 1, the trusted verification system 11 includes a trusted platform control module 110 and a trusted cryptographic module 112. The trusted platform control module 110 and the trusted cryptographic module 112 can communicate with each other.

The above-mentioned trusted platform control module 110 includes a main control module 1101, a policy control module 1102, a one-time programmable memory 1103 and an update interface 1104.

The above-mentioned main control module 1101 is the core of the entire trusted verification system 11 and is also the trusted root of trust CRTM of the trusted platform control module 110 . The main control module 1101 is the first module to be started and executed after the device where it is located is powered on. The main control module 1101 is responsible for obtaining the measured object 12 and performing active measurement and trustworthy verification on the measured object 12 .

For example, the measured object 12 is one or more objects in the software and/or firmware in the device where the trusted verification system 11 is located. For example, the measured object may include the logical configuration file of the complex programmable logic device (CPLD), the boot program image file of the BMC, the BIOS configuration file, the binary image file of the BIOS segmented function code, and the BIOS driver. The binary image file of the module, the binary image file of the BIOS peripheral function module, the binary image file of the computer's operating system boot loader (operation system loader, OS loader), the binary image file of the computer's operating system, the binary image file of the BMC operating system One or more of the following: image files and binary image files of BMC application software. These measured objects can be directly or indirectly accessed and obtained by the trusted platform control module 110 .

In a possible implementation, the above main control module 1101 may also be called a TPCM engine. For example, the main control module 1101 may be deployed in the device in the form of software or firmware, and called and executed by the processor in the device. This processor also belongs to the above-mentioned trusted verification system 11 and is not shown in Figure 1 .

The above-mentioned policy control module 1102 mainly contains configuration information of policy control corresponding to each measured object. For example, it includes the configuration information of the policy to be executed after each measured object successfully passes the integrity measurement, and the configuration information of the policy to be executed after each measured object fails to measure the integrity, and so on. For example, the policy control module 1102 may be deployed in the device in the form of software or firmware.

The one-time programmable memory 1103 can store multiple bits of data. For example, the initial value of multiple bits of data in the one-time programmable memory 1103 may be "1". Taking one bit among the plurality of bits as an example, the data in the one bit can change the stored value to "0" through one-time programming. This programming can be accomplished by fusing the one This is achieved by using the fuse corresponding to the bit. Because the fusing operation is irreversible, this bit has one and only one opportunity to program, so it is a one-time programming. The same applies to other bits in the plurality of bits, so it is called a one-time programmable memory.

For example, the one-time programmable memory 1103 mentioned above may be a memory implemented based on efuse.

In the embodiment of the present application, the determination of whether the benchmark measurement value of the measured object already exists can be implemented through the one-time programmable memory 1103, which will be introduced later and will not be described in detail here.

The above-mentioned update interface 1104 is mainly responsible for communicating with the remote trusted management center 13 and is used to import updated information into the trusted platform control module 110 .

The remote trusted management center 13 includes a baseline and policy management module. In the specific implementation, the measured object is often updated or the corresponding control strategy is often updated after the measured object is measured. Then, the benchmark and policy management module can measure the updated measured object to obtain a new benchmark metric value, and then send the new benchmark metric value to the trusted platform control module 110 through the update interface 1104 . In addition, the baseline and policy management module can also send the updated control policy to the trusted platform control module 110 through the update interface 1104. This allows the trusted platform control module 110 to update the corresponding baseline metric values and control strategies in a timely manner.

In addition, for example, the remote trusted management center 13 can also complete remote trustworthy certification of trustworthy verification results, etc. This application does not limit the specific functions of the remote trusted management center 13.

The above-mentioned trusted cryptographic module 112 includes an algorithm module 1121, a non-volatile memory 1122 and a platform configuration register (platform configuration registers, PCR) 1123.

The above algorithm module 1121 can implement a cryptographic hash function algorithm. In this embodiment of the present application, the algorithm module 1121 can calculate the integrity measurement value of the measured object through a cryptographic hash function algorithm. For example, the cryptographic hash function algorithm can be, for example, the SM3 cryptographic hash algorithm issued by the State Cryptozoology Administration, or the like. This application does not place any restrictions on the specific cryptographic hash function algorithm used.

The above-mentioned non-volatile memory 1122 may be used to store the baseline measurement value of the measured object.

The above-mentioned platform configuration register 1123 can be used to further save the baseline measurement value of the measured object and the measurement value obtained by each measurement of the measured object. The information saved in the platform configuration register 1123 can be used to provide trustworthy proof for the remote trusted management center 13 .

In a possible implementation, the main control module 1101, the policy control module 1102 and the update interface 1104 in the trusted platform control module 110 may be deployed in the device in the form of software or firmware and controlled by the processor in the device. Call executions to implement their respective corresponding functions. The above-mentioned trusted cryptographic module 112 may be implemented in the form of hardware to provide underlying hardware basic guarantee for trusted verification. The trusted cryptographic module 112 is the trusted root of the above-mentioned trusted verification system 11 .

In a possible implementation, the above-mentioned trusted platform control module 110 and trusted cryptographic module 112 can be deployed in the BMC management system of the device. The processor in the BMC management system calls the trusted platform control module 110 to implement trusted verification.

By way of example, the devices on which the above-mentioned trusted verification system 11 resides may include, but are not limited to, servers, workstations, high-performance computers, personal home computers, portable computers, and any electronic product based on an intelligent operating system.

It should be noted that the above system architecture shown in Figure 1 is only an example. The system architecture provided by the embodiments of this application is not limited to the above description. As long as it is applied to the scenario of the trusted verification method provided by the embodiments of this application, This is the applicable scenario for the embodiments of this application and will not be described again here.

In order to implement active measurement of software and/or firmware in the device based on TPCM, embodiments of the present application provide a trusted verification method. Illustratively, this method can be applied to the trusted verification system shown in Figure 1 above. This method can be implemented through the main control module of TPCM in the trusted verification system. Referring to Figure 2, the method may include but is not limited to the following step:

S201. The main control module of the TPCM in the trusted verification system calls the TCM in the trusted verification system to calculate the first measurement value of the first measured object; the first measured object includes the location where the trusted verification system is located. One or more objects in the software and firmware in a device.

In a specific implementation, after the device where the above-mentioned trusted verification system is located is powered on, the TPCM in the trusted verification system is first powered on and started to run. The integrity measurement of the software and/or firmware in the device is completed through the main control module of TPCM. That is, the main control module is the first program module to be run after the device where it is located is powered on.

After the above-mentioned TPCM is powered on and started, the TPCM completes self-test on the internally solidified read-only memory (ROM) and verifies the external secure boot code (ESBC) firmware, thereby completing its own secure boot. After the TPCM securely starts, the above-mentioned main control module is first started and run, and the integrity measurement of the software and/or firmware in the device is implemented through the main control module.

Specifically, the above-mentioned first measured object can be read directly or indirectly through the main control module. The first measured object includes one or more objects in the software and firmware in the device. For example, regarding the first measured object, reference may be made to the relevant description of the measured object 12 shown in FIG. 1 , which will not be described again here.

In a possible implementation, the above-mentioned first measured object can be directly read through the hardware physical bus. For example, if the first measured object is a BIOS binary image file, it can be read directly through the serial peripheral interface (SPI) bus.

In another possible implementation, the above-mentioned first measured object can be obtained indirectly through a measurement agent. The measurement agent can access and obtain the first measured object, and then send the obtained first measured object to the above-mentioned main control module for integrity measurement. For example, if the first measured object is a binary image file of the computer operating system in the device, it can be obtained indirectly through the measurement agent.

After acquiring the first measured object, the main control module may send the first measured object to the TCM. The TCM calls a cryptographic hash function algorithm to calculate the metric value of the first measured object (ie, the above-mentioned first metric value). For example, the measurement value of the first measured object can be calculated through an algorithm module in the TCM. Regarding the algorithm module in the TCM, you can rationally refer to the relevant description of the algorithm module 1121 shown in Figure 1, and will not be described again here.

After calculating the measurement value of the first measured object, the TCM sends the calculated measurement value to the above-mentioned main control module.

S202: Read the reference measurement value of the first measured object from the non-volatile memory of the TCM through the above-mentioned main control module.

In a specific implementation, the above-mentioned reference measurement value of the first measured object is stored in the non-volatile memory in the TCM. This non-volatile memory is protected so that only authorized parties can access it.

In a possible implementation, the reference measurement value of the first measured object may be a non-volatile memory written into the TCM through the main control module. Then, the main control module can complete identity authentication in the TCM before writing to obtain authorization to access the non-volatile memory in the TCM.

For example, the main control module can send a preconfigured secret key to the TCM, and the TCM matches the received secret key with its own preset secret key. If the match is successful, the identity authentication of the main control module is passed. Then, the TCM can send an indication that the identity authentication is passed to the main control module, thereby authorizing the main control module to access the non-volatile memory in the TCM. After the main control module obtains the authorization to access the non-volatile memory in the TCM, it can write the above-mentioned baseline measurement value of the first measured object into the non-volatile memory of the TCM. This description of the process in which the main control module performs identity authentication in TCM to obtain access authorization is only an example and does not constitute a limitation on the embodiments of the present application. In addition, the main control module obtains the first The process of measuring the baseline metric value of an object can be found in the later description and will not be described in detail here.

Based on the above description, the main control module has been authorized to access the non-volatile memory in the TCM. In order to improve the efficiency of trusted verification, the main control module can access the non-volatile memory in the TCM without performing identity authentication again. memory, and read the baseline measurement value of the above-mentioned first measured object from it.

Or, for example, in order to strengthen the security protection of the baseline measurement value of the measured object, even if the above main control module has obtained authorization to access the non-volatile memory in the TCM, before subsequent access to the non-volatile memory in the TCM , it is still necessary to perform identity authentication and obtain access authorization again before the baseline measurement value of the first measured object can be read from it.

In another possible implementation, the above-mentioned reference measurement value of the first measured object may be obtained through other control modules or may be written into a non-volatile memory in the TCM by a user. In this case, before accessing the non-volatile memory in the TCM, the above-mentioned main control module first performs identity authentication and obtains access authorization, and then can read the baseline measurement value of the above-mentioned first measured object from it.

S203: Use the main control module to perform policy control on the first measured object based on the matching result between the first metric value and the benchmark metric value.

After the main control module obtains the reference measurement value of the first measured object, the reference measurement value can be compared with the calculated first measurement value.

If the first metric value is the same as the reference metric value, it indicates that the integrity metric of the first measured object passes, that is, it indicates that the first measured object has not been tampered with and is safe. Then, based on the comparison result, the main control module can control the first measured object to start running.

If the first metric value is different from the baseline metric value, it indicates that the integrity metric of the object to be measured fails, which indicates that the first object to be measured may have been tampered with, and there is a security threat. Then, based on the comparison result, the main control module can perform abnormal control on the first measured object. For example, the first measured object may be prevented from starting to run, or the version of the first measured object may be rolled back or restored, and so on. This application does not limit this specific policy control.

For example, the main control module may find the corresponding control policy in the policy control module based on the comparison result to control the first measured object. The description of the policy control module can be exemplarily referred to the corresponding description in Figure 1 above, and will not be described again here.

Optionally, the optional main control module can store the first measurement value of the first measured object in the platform configuration register of the TCM to provide data for subsequent remote certification. In addition, the above-mentioned main control module may generate a corresponding event log based on the above-mentioned trusted verification operation on the first measured object. For example, the event log may record information such as the trustworthy verification of the first measured object. Then, the main control module can store one or more of the event log and the above matching results into the platform configuration register of the TCM. Alternatively, the main control module can store one or more of the event log and the matching results in other memories in the trusted verification system. This application does not limit the specific storage memory.

In summary, embodiments of the present application provide a trusted verification solution that actively measures the integrity of software and/or firmware in a device based on TPCM. In addition, in the embodiment of the present application, the baseline measurement value of the measured object is stored in the non-volatile memory of the TCM. Since the non-volatile memory of the TCM belongs to a protected storage area and can only be accessed after authorization, it can improve Securing baseline metric values.

In a possible implementation, the process of writing the above-mentioned benchmark measurement value of the first measured object into the non-volatile memory in the TCM through the above-mentioned main control module is as follows:

In specific implementation, before the main control module of the TPCM in the trusted verification system calls the TCM in the trusted verification system to calculate the first measurement value of the first measured object, the main control module will first calculate the first measurement value. The benchmark of the object being measured measurement value and writes it to the non-volatile memory in the TCM mentioned above.

Specifically, after the main control module starts running, the first measured object is obtained. Similarly, the first measured object is sent to the TCM to calculate the measurement value of the first measured object, and the measurement value may be referred to as the second measurement value for short. Then, the main control module reads the bit-stored identifier corresponding to the first measured object from the one-time programmable memory. And based on the read identification, it is determined whether the reference measurement value of the first measured object is stored in the non-volatile memory of the TCM.

Based on the previous description, it can be known that the one-time programmable memory can be set in the TPCM. And the one-time programmable memory can store multiple bits of data. Then, in the embodiment of the present application, each measured object can be configured to uniquely correspond to one of the plurality of bits, and the reference metric of each measured object is indicated by the identifier in the corresponding bit. Whether the value is already stored in the TCM's non-volatile memory. For example, since the initial value stored in multiple bits in the one-time programmable memory is "1", when the bit is programmed once (that is, the fuse corresponding to the bit is blown), the bit is stored The value becomes "0". Since this one-time programming is irreversible, when a bit is programmed once, the value stored in that bit will always be "0" and cannot be changed. Then, for the bit corresponding to the above-mentioned first measured object, when the value stored in the bit is "1", the flag "1" can be used to indicate that the first measured object is not stored in the non-volatile memory of the TCM. The base measurement value of the measured object. After the reference measurement value of the first measured object is stored in the non-volatile memory of the TCM, the bit can be programmed once so that its stored value becomes "0". That is, the flag "0" can be used to indicate that the reference measurement value of the first measured object has been stored in the non-volatile memory of the TCM.

Based on the above description, after the above-mentioned main control module reads the identifier stored in the bit corresponding to the first measured object from the above-mentioned one-time programmable memory, if the identifier indicates that the non-volatile memory of the TCM does not store the identifier, If the base measurement value of the first measured object is the first measured object, then the main control module can write the second measured value calculated above into the non-volatile memory of the TCM as the base measured value of the first measured object. Specifically, the main control module can complete identity authentication in the TCM and obtain the authorization to access the non-volatile memory of the TCM before writing the second measurement value as the baseline measurement value of the first measured object. TCM non-volatile memory. The specific implementation of this identity authentication can be found in the previous description and will not be repeated here.

After the above-mentioned main control module writes the benchmark measurement value of the first measured object into the non-volatile memory of the TCM, it can blow the fuse of the bit corresponding to the first measured object in the one-time memory to complete the bit A one-time programming of a bit changes the value stored in that bit to "0". That is, the first identifier originally stored in the bit is changed to the second identifier. The first flag is, for example, "1", indicating that the reference measurement value of the first measured object is not stored in the non-volatile memory of the TCM. The second identification is, for example, "0", which indicates that the reference measurement value of the first measured object has been stored in the non-volatile memory of the TCM.

Then, the main control module can store the event log and the baseline measurement value of the first measured object into the platform configuration register of the TCM to provide data for subsequent remote certification.

Optionally, the optional main control module can store the baseline measurement value of the first measured object in the platform configuration register of the TCM to provide data for subsequent remote certification. In addition, optionally, after the above-mentioned main control module writes the baseline measurement value of the first measured object into the non-volatile memory of the TCM, it can also generate a corresponding event log. For example, the event log may record information such as writing the baseline measurement value of the first measured object into the non-volatile memory of the TCM. Then, the main control module can store the event log into the platform configuration register of the TCM. Alternatively, the main control module can store the event log in other memories in the above-mentioned trusted verification system. This application does not limit the specific storage memory.

In a possible implementation, based on the above description, before the main control module reads the reference measurement value of the first measured object from the non-volatile memory of the TCM in step S202, the main control module Also from the above time The identifier stored in the bit corresponding to the first measured object is read from the programmable memory. The read identification indicates that the baseline measurement value of the first measured object has been stored in the non-volatile memory of the TCM. Then, the main control module can read the reference measurement value of the first measured object from the non-volatile memory of the TCM based on the read identification.

In the above embodiment, a one-time programmable memory is combined to quickly determine whether the benchmark measurement value of the first measured object has been stored. Compared with the existing solution that requires one-to-one comparison in the memory to determine, this solution can improve the reliability. The efficiency of confidence measurement. In addition, for measurement objects that do not have a baseline value stored, the current measurement value is stored as the baseline value, which solves the problem of writing the baseline value offline when there is no baseline value.

In a possible implementation, the measured object is often upgraded and updated, and the baseline measurement value of the measured object after the upgrade and update will also change accordingly, so the baseline measurement value stored in the non-volatile memory of the TCM will also change accordingly. Update, otherwise the integrity measurement of the measured object will not pass successfully, causing the measured object to fail to start and run normally. The following takes the above-mentioned first measured object as an example to introduce the process of updating the baseline measurement value stored in the non-volatile memory of the TCM.

When the first measured object is upgraded and updated, the remote trusted management center can sense the upgraded update of the first measured object. Then, the remote trusted management center obtains the upgraded and updated first measured object (referred to as the second measured object for short), and calls the benchmark and policy management module in the remote trusted management center to calculate the second measured object. The object's measure. The algorithm for calculating metric values is the same as the algorithm for calculating metric values in TCM.

The above-mentioned TPCM establishes communication with the remote trusted management center through the update interface. See Figure 1 for an example. Then, after obtaining the measurement value of the second measured object, the remote trusted management center sends the measurement value of the second measured object to the TPCM through the update interface. Then, the main control module of the TPCM receives the measurement value of the second measured object through the update interface. And access the non-volatile memory of the TCM, and update the original benchmark measurement value of the first measured object in the non-volatile memory to the measurement value of the second measured object. Optionally, the main control module can complete identity authentication in the TCM and obtain the authorization to access the non-volatile memory of the TCM before writing the measurement value of the second measured object into the non-volatile memory of the TCM. memory. The specific implementation of this identity authentication can be found in the previous description and will not be repeated here.

This solution interacts with the remote trusted management center to obtain the updated baseline measurement value of the measured object and updates the local baseline value, which solves the problem that after the measured object is updated, the baseline value needs to be re-programmed offline or it cannot be started. At the same time, it also avoids the problem that the integrity measurement of the measured object cannot pass successfully, causing the measured object to fail to start and run normally.

In one possible implementation, the control policy of the measured object is often upgraded and updated, so the configuration in the policy control module of TPCM must also be updated accordingly, otherwise the policy control of the measured object will be abnormal. The following takes the above-mentioned first measured object as an example to introduce the process of updating the policy configuration in the policy control module of TPCM.

Specifically, the remote trusted management center can sense the update of the control policy of the first measured object. Then, the benchmark and policy management module of the remote trusted management center obtains the updated control policy of the first measured object. Similarly, the above-mentioned TPCM establishes communication with the remote trusted management center through the update interface. See Figure 1 for example. Then, after obtaining the updated control policy of the first measured object, the remote trusted management center sends the updated control policy of the first measured object to the TPCM through the update interface. Then, the main control module of the TPCM receives the updated control policy of the first measured object through the update interface. Then, the main control module updates the policy configuration of the first measured object in the policy control module based on the received control policy.

Optionally, the control policy can also be upgraded and updated for the updated first measured object, that is, the above-mentioned second measured object. For the specific upgrade and update process, please refer to the above description and will not be repeated here.

This solution can achieve timely control policy updates by interacting with the remote trusted management center, avoiding the need for trusted verification. The problem of abnormal policy control of the measured object during the process.

The above has introduced the trustworthy verification method provided by the embodiment of the present application. It can be understood that, in order to implement the corresponding functions mentioned above, each device includes a corresponding hardware structure and/or software module to perform each function. In conjunction with the units and steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving the hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each specific application, but such implementations should not be considered beyond the scope of this application.

Embodiments of the present application can divide the device into functional modules according to the above method examples. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software function modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. In actual implementation, there may be other division methods.

In the case where each functional module is divided according to each function, FIG. 3 shows a specific logical structure diagram of the device, which may be the device where the above-mentioned trusted verification system is located. The device 300 includes a trusted platform control module 301 and a trusted cryptographic module 302. The trusted platform control module 301 includes a main control module 3011. in:

The main control module 3011 is used for:

Call the trusted cryptographic module 302 to calculate the first metric value of the first measured object; the first measured object includes one or more objects in the software and firmware in the device where the trusted verification system is located;

Read the baseline measurement value of the first measured object from the non-volatile memory of the trusted cryptographic module 302;

Policy control is performed on the first measured object based on a matching result between the first metric value and the base metric value.

In a possible implementation, the main control module 3011 is also used to:

Before calling the trusted cryptographic module 302 to calculate the first metric value of the first measured object, call the trusted cryptographic module 302 to calculate the second metric value of the first measured object;

Read the first identification corresponding to the first measured object in the one-time programmable memory. The first identification indicates that the non-volatile memory of the trusted cryptographic module 302 does not store the reference measurement of the first measured object. value;

Based on the first identification, the second metric value is written into the non-volatile memory of the trusted cryptographic module 302 as the reference metric value of the first measured object.

In a possible implementation, the main control module 3011 is also used to:

Before writing the second metric value as the baseline metric value of the first measured object into the non-volatile memory of the trusted cryptographic module 302 based on the first identification, the main control module 3011 Identity authentication is completed in the cryptographic module 302 and authorization to access the non-volatile memory of the trusted cryptographic module 302 is obtained.

In a possible implementation, the main control module 3011 is also used to:

After the second metric value is written into the non-volatile memory of the trusted cryptographic module 302 based on the first identification as the baseline metric value of the first measured object, the third metric value in the one-time programmable memory is written. The first identification corresponding to a measured object is changed to a second identification, and the second identification indicates that the reference measurement value of the first measured object has been stored in the non-volatile memory of the trusted cryptographic module 302 .

In a possible implementation, the main control module 3011 is also configured to: read the second identification corresponding to the first measured object in the one-time programmable memory;

Reading the reference measurement value of the first measured object from the non-volatile memory of the trusted cryptographic module 302 includes:

The reference measurement value of the first measured object is read from the non-volatile memory of the trusted cryptographic module 302 based on the second identification.

In a possible implementation, the main control module 3011 is also used to:

Receive the baseline metric value of the second measured object from the remote trusted management center, where the second measured object is an updated object of the first measured object;

The reference metric value of the first measured object in the non-volatile memory of the trusted cryptographic module 302 is updated to the reference metric value of the second measured object.

In a possible implementation, the policy control module of the trusted platform control module 301 includes configuration information of the control policy of the measured object; the main control module 3011 is also used to:

Receive the target control policy of the first measured object from the remote trusted management center, where the target control policy is an updated policy of the control policy of the first measured object;

The configuration information of the control policy of the first measured object in the policy control module of the trusted platform control module 301 is updated to the configuration information of the target control policy.

In a possible implementation, the main control module 3011 is also used to:

Generate an event log based on a process of trusted verification of the first measured object;

Store one or more of the baseline metric value of the first measured object, the matching result, and the event log in the platform configuration memory of the trusted cryptographic module 302 .

In a possible implementation, the trusted verification system is a management system implemented based on a baseboard management controller (BMC).

For the specific operations and beneficial effects of each unit in the device 300 shown in Figure 3, please refer to the corresponding descriptions in Figure 2 and its specific method embodiments, and will not be described again here.

Figure 4 shows a specific hardware structure schematic diagram of the device provided by this application. The device may be the device where the trusted verification system described in the above embodiment is located. The device 400 includes: a processor 401, a memory 402 and a communication interface 403. The processor 401, the communication interface 403, and the memory 402 may be connected to each other or to each other via a bus 404.

Exemplarily, the memory 402 is used to store computer programs and data of the device 400. The memory 402 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), Erasable programmable read only memory (EPROM) or portable read-only memory (compact disc read-only memory, CD-ROM), etc. For example, the memory 402 can be used to store computer programs for one or more of the main control module, the policy control module and the update interface in the above-mentioned trusted verification system.

The communication interface 403 includes a sending interface and a receiving interface. The number of the communication interface 403 may be multiple, and is used to support the device 400 to communicate, such as receiving or sending data or messages.

For example, the processor 401 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on. The processor 401 can be used to read the program stored in the memory 402, so that the device 400 executes the trusted verification method as described in the above-mentioned Figure 2 and its specific embodiments.

In a specific implementation, the processor 401 can be used to read the program stored in the memory 402 and perform the following operations: call the TCM to calculate the first measurement value of the first measured object; Including one or more objects in the software and firmware in the device where the trusted verification system is located; reading the baseline measurement value of the first measured object from the non-volatile memory of the TCM; based on the first degree The result of matching the measure value to the base measure value is the A measured object is subject to policy control.

For the specific operations and beneficial effects of each unit in the device 400 shown in Figure 4, please refer to the corresponding descriptions in Figure 2 and its specific method embodiments, and will not be described again here.

Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program. The computer program is executed by a processor to implement any one of the above-mentioned Figure 2 and its specific method embodiments. method described.

An embodiment of the present application also provides a computer program product. When the computer program product is read and executed by a computer, the method described in any one of the above-mentioned Figure 2 and its specific method embodiments can be performed.

In summary, embodiments of the present application provide a trusted verification solution that actively measures the integrity of software and/or firmware in a device based on TPCM. In addition, in this application, the benchmark measurement value of the measured object is stored in the non-volatile memory of the TCM. Since the non-volatile memory of the TCM is a protected storage area and can only be accessed after authorization, it can improve the accuracy of the benchmark. Security protection of metric values. This ensures the reliability of integrity measurement, reduces the risk of tampering of measured objects, and improves system security.

In this application, the terms "first", "second" and other words are used to distinguish the same or similar items with basically the same functions and functions. It should be understood that the terms "first", "second" and "nth" There is no logical or sequential dependency, and there is no limit on the number or execution order. It should also be understood that, although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.

It should also be understood that in each embodiment of the present application, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not be determined by the execution order of the embodiments of the present application. The implementation process constitutes no limitation.

It will also be understood that the term "includes" (also "includes," "including," "comprises," and/or "comprising") when used in this specification specifies the presence of stated features, integers, steps, operations, elements , and/or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groupings thereof.

It should also be understood that references throughout this specification to "one embodiment," "an embodiment," and "a possible implementation" mean that specific features, structures, or characteristics related to the embodiment or implementation are included herein. In at least one embodiment of the application. Therefore, “in one embodiment” or “in an embodiment” or “a possible implementation” appearing in various places throughout this specification do not necessarily refer to the same embodiment. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner in one or more embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present application, but not to limit it; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions described in the foregoing embodiments can still be modified, or some or all of the technical features can be equivalently replaced; and these modifications or substitutions do not deviate from the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present application. scope.

Claims (20)

A trusted verification method, characterized in that the method is applied to a trusted verification system, the trusted verification system includes a trusted platform control module TPCM and a trusted cryptographic module TCM, and the TPCM includes a main control module ; The method includes performing the following operations through the main control module: Call the TCM to calculate the first measurement value of the first measured object; the first measured object includes one or more objects in the software and firmware in the device where the trusted verification system is located; Read the baseline measurement value of the first measured object from the non-volatile memory of the TCM; Policy control is performed on the first measured object based on a matching result between the first metric value and the baseline metric value. The method according to claim 1, characterized in that before calling the TCM to calculate the first measurement value of the first measured object, it further includes: Call the TCM to calculate the second measurement value of the first measured object; Reading the first identification corresponding to the first measured object in the one-time programmable memory, the first identification indicating that the reference measurement of the first measured object is not stored in the non-volatile memory of the TCM value; The second metric value is written into the non-volatile memory of the TCM as the base metric value of the first measured object based on the first identification. The method according to claim 2, characterized in that, based on the first identification, the second metric value is written into the non-volatile memory of the TCM as the baseline metric value of the first measured object. Before memory, also includes: Complete identity authentication in the TCM through the main control module, and obtain authorization to access the non-volatile memory of the TCM. The method according to claim 2 or 3, characterized in that, based on the first identification, the second metric value is written into the non-transformable TCM as the baseline metric value of the first measured object. After lossy memory, there are also: The first identification corresponding to the first measured object in the one-time programmable memory is changed to a second identification, the second identification indicating that the baseline measurement value of the first measured object has been stored in The TCM's non-volatile memory. The method according to claim 4, characterized in that the method further includes: reading the second identification corresponding to the first measured object in the one-time programmable memory through the main control module; Reading the baseline measurement value of the first measured object from the non-volatile memory of the TCM includes: The reference measurement value of the first measured object is read from the non-volatile memory of the TCM based on the second identification. The method according to any one of claims 1-5, characterized in that the method further includes performing the following operations through the main control module: Receive the baseline measurement value of the second measured object from the remote trusted management center, where the second measured object is an updated object of the first measured object; Update the baseline measurement value of the first measured object in the non-volatile memory of the TCM to the baseline measurement value of the second measured object. The method according to any one of claims 1 to 6, characterized in that the policy control module of the TPCM includes configuration information of the control policy of the measured object; The method also includes performing the following operations through the main control module: Receive the target control policy of the first measured object from a remote trusted management center, where the target control policy is an updated policy of the control policy of the first measured object; Update the configuration information of the control policy of the first measured object in the policy control module of the TPCM to the configuration information of the target control policy. The method according to any one of claims 1-7, characterized in that the method further includes performing the following operations through the main control module: Generate an event log based on a process of trusted verification of the first measured object; Store one or more of the baseline measurement value of the first measured object, the matching result and the event log in the platform configuration memory of the TCM. The method according to any one of claims 1 to 8, characterized in that the trusted verification system is a management system implemented based on a baseboard management controller (BMC). A trusted verification device, characterized in that the device includes a trusted verification system, the trusted verification system includes a trusted platform control module TPCM and a trusted cryptographic module TCM, and the TPCM includes a main control module; The main control module is used for: Call the TCM to calculate the first measurement value of the first measured object; the first measured object includes one or more objects in the software and firmware in the device where the trusted verification system is located; Read the baseline measurement value of the first measured object from the non-volatile memory of the TCM; Policy control is performed on the first measured object based on a matching result between the first metric value and the baseline metric value. The device according to claim 10, characterized in that the main control module is also used for: Before calling the TCM to calculate the first measurement value of the first measured object, calling the TCM to calculate the second measurement value of the first measured object; Reading the first identification corresponding to the first measured object in the one-time programmable memory, the first identification indicating that the reference measurement of the first measured object is not stored in the non-volatile memory of the TCM value; The second metric value is written into the non-volatile memory of the TCM as the base metric value of the first measured object based on the first identification. The device according to claim 11, characterized in that the main control module is also used for: Before writing the second metric value as the baseline metric value of the first measured object into the non-volatile memory of the TCM based on the first identification, the main control module Complete identity authentication in the TCM and obtain authorization to access the TCM's non-volatile memory. The device according to claim 11 or 12, characterized in that the main control module is also used for: After writing the second metric value as the baseline metric value of the first measured object into the non-volatile memory of the TCM based on the first identification, write the one-time programmable memory into the non-volatile memory of the TCM. The first identification corresponding to the first measured object is changed to a second identification, and the second identification indicates that the baseline measurement value of the first measured object has been stored in the non-volatile memory of the TCM . The device according to claim 13, wherein the main control module is further configured to: read the second identification corresponding to the first measured object in the one-time programmable memory; Reading the baseline measurement value of the first measured object from the non-volatile memory of the TCM includes: The reference measurement value of the first measured object is read from the non-volatile memory of the TCM based on the second identification. The device according to any one of claims 10-14, characterized in that the main control module is also used for: Receive the baseline measurement value of the second measured object from the remote trusted management center, where the second measured object is an updated object of the first measured object; Update the baseline measurement value of the first measured object in the non-volatile memory of the TCM to the baseline measurement value of the second measured object. The device according to any one of claims 10 to 15, characterized in that the policy control module of the TPCM includes configuration information of the control policy of the measured object; the main control module is also used to: Receive the target control policy of the first measured object from a remote trusted management center, where the target control policy is an updated policy of the control policy of the first measured object; Update the configuration information of the control policy of the first measured object in the policy control module of the TPCM to the configuration information of the target control policy. The device according to any one of claims 10-16, characterized in that the main control module is also used for: Generate an event log based on a process of trusted verification of the first measured object; Store one or more of the baseline measurement value of the first measured object, the matching result and the event log in the platform configuration memory of the TCM. The device according to any one of claims 10 to 17, characterized in that the trusted verification system is a management system implemented based on a baseboard management controller (BMC). A trusted verification device, characterized in that the device includes a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the device The method according to any one of claims 1 to 9 is carried out. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method described in any one of claims 1 to 9.