Measurement methods, devices and systems based on trusted high-speed encryption card
AssigneeAlibaba Group Holding Limited
InventorsYingfang Fu, Peng Xiao
Life of this patent
Estimating the term…
Abstract
Measurement methods, devices and systems based on a trusted high-speed encryption card are disclosed. One of the methods includes: a BIOS actively measuring at least one firmware in a device if an integrity measurement result made by a trusted security chip for the BIOS indicates that the integrity thereof is not corrupted; loading one or more firmware if the integrity of the one or more firmware in the device actively measured by the BIOS is not corrupted; and forbidding a system of the device from being started or controlling the system to enter into a non-secure mode if the integrity of one or more firmware in the device actively measured by the BIOS is corrupted.
Claims20
A method implemented by one or more processors, the method comprising:
- powering on and starting a trusted high-speed encryption card;
- obtaining a platform measurement root of the trusted high-speed encryption card;
- and
- using, by a trusted security chip, the platform measurement root and a key to perform an integrity measurement for a BIOS in a device;
- measuring, by the trusted security chip, the BIOS in the device, to generate an integrity measurement result;
- if the integrity measurement result indicates that the BIOS's integrity is not corrupted, measuring, by the BIOS, at least one firmware in the device;
- if an integrity of the at least one firmware in the device measured by the BIOS is not corrupted, loading, by the trusted security chip, the at least one firmware;
- and
- if the integrity of the at least one firmware in the device measured by the BIOS is corrupted, prohibiting, by the trusted security chip, a system of the device from being started or controlling the system to enter into a non-secure mode.
An apparatus comprising:
- one or more processors;
- and
- memory storing executable instructions that, when executed by the one or more processors, cause the one or more processors to perform acts comprising:
- actively measuring, by a BIOS, an integrity of an option memory firmware of a trusted high-speed encryption card in a device when an integrity measurement result made by a trusted security chip indicates that the integrity of the BIOS is not corrupted;
- and
- triggering the option memory firmware of the trusted high-speed encryption card to measure an integrity of one or more firmware in the device if an integrity of the option memory firmware of the trusted high-speed encryption card that is actively measured by the BIOS is not corrupted, wherein the one or more firmware are loaded when the integrity of the one or more firmware is not corrupted, or otherwise a system of the device is prohibited from booting or the system is controlled to enter into a non-secure mode.
One or more processor-readable media storing executable instructions that, when executed by one or more processors, cause the one or more processors to perform acts comprising:
- powering on and starting a trusted high-speed encryption card;
- obtaining a platform measurement root of the trusted high-speed encryption card;
- using, by a trusted security chip, the platform measurement root and a key to perform an integrity measurement for a BIOS in a device;
- measuring an integrity of the BIOS in the device to obtain a first measurement result, wherein the integrity is used for determining whether the BIOS is tampered with;
- determining that the first measurement result satisfies a first preset condition;
- obtaining a second measurement result, wherein the second measurement result is obtained based on at least one firmware in the device measured by the BIOS;
- determining the second measurement result satisfies a second preset condition;
- and
- loading the at least one firmware.
Dependencies are inferred from the claim text.