Monitoring and control method, circuit, and device for on-board trusted platform
View Patent ↗A monitoring and control method includes: connecting, by a first Multiplexer (MUX), a logic element and a Baseboard Management Controller (BMC) to a BMC serial storage module storing a BMC code, and connecting, by a second MUX, the logic element and a Platform Controller Hub (PCH) to a Basic Input Output System (BIOS) serial storage module storing a BIOS code; when the logic element obtains power-on operation information, and performing a credibility detection on the BMC code and the BIOS code; if the BMC code passes the detection, controlling, by the logic element, the first MUX to connect the BMC to the BMC serial storage module; if the BIOS code passes the detection, controlling, by the logic element, the second MUX to connect the PCH to the BIOS serial storage module; and by the logic element, controlling the PCH to be powered and the BMC to enter a working state.
1. A monitoring and control method for an on-board trusted platform, wherein the method is implemented through a monitoring and control circuit for the on-board trusted platform, and the monitoring and control circuit comprises:
a logic element;
a Baseboard Management Controller (BMC);
a Platform Controller Hub (PCH);
a BMC serial storage module configured to store a BMC code and a first private key;
a Basic Input Output System (BIOS) serial storage module configured to store a BIOS code and a second private key;
a first Multiplexer (MUX), controlled by the logic element, wherein the first MUX is configured to connect the BMC to the BMC serial storage module, or connect the logic element to the BMC serial storage module; and
a second MUX, controlled by the logic element, wherein the second MUX is configured to connect the PCH to the BIOS serial storage module, or connect the logic element to the BIOS serial storage module;
wherein method comprises:
connecting, by means of the first MUX, the logic element and the BMC respectively to the BMC serial storage module that stores the BMC code, and connecting, by means of the second MUX, the logic element and the PCH respectively to the BIOS serial storage module that stores the BIOS code;
in response to the logic element obtaining power-on operation information of a server, obtaining, by the logic element, the BMC code in the BMC serial storage module and the BIOS code in the BIOS serial storage module, and performing, by the logic element, a credibility detection on the BMC code according to the first private key and the BIOS code according to the second private key;
in response to the BMC code passing the credibility detection, controlling, by the logic element, the first MUX to connect a first serial peripheral interface (SPI) of the BMC to the BMC serial storage module;
in response to the BIOS code passing the credibility detection, controlling, by the logic element, the second MUX to connect a second SPI of the PCH to the BIOS serial storage module; and
controlling the PCH to be powered and the BMC to enter a working state by the logic element;
wherein the performing a credibility detection on the BMC code according to the first private key and the BIOS code according to the second private key further comprises:
encrypting a plurality of pieces of preset BMC code information in the BMC code to form a BMC code public key, performing a decryption checking on the BMC code public key by means of the first private key, and in response to the decryption checking being successful, determining that the BMC code passes the credibility detection; and
encrypting a plurality of pieces of preset BIOS code information in the BIOS code to form a BIOS code public key, performing the decryption checking on the BIOS code public key by means of the second private key, and in response to the decryption checking being successful, determining that the BIOS code passes the credibility detection.
2. The monitoring and control method for the on-board trusted platform according to claim 1 , wherein the controlling the PCH to be powered and the BMC to enter a working state by the logic element further comprises:
connecting a RESET pin of the BMC to the logic element, and
controlling, by the logic element, the RESET pin of the BMC to be released to make the BMC enter the working state.
3. The monitoring and control method for the on-board trusted platform according to claim 1 , wherein the controlling the PCH to be powered and the BMC to enter a working state by the logic element further comprises:
connecting a power supply enable pin of a power supply chip that powers the PCH to the logic element, and
controlling, by the logic element, the power supply enable pin to power the PCH.
4. The monitoring and control method for the on-board trusted platform according to claim 1 , further comprising:
in response to the BMC code or the BIOS code not passing the credibility detection, controlling the BMC not to enter the working state and the PCH not to be powered by the logic element, so as to stop a boot operation.
5. The monitoring and control method for the on-board trusted platform according to claim 1 , wherein each of the BMC serial storage module and the BIOS serial storage module comprises a protected area, and the first private key and the second private key are respectively stored in the protected area.
6. A monitoring and control circuit for an on-board trusted platform, comprising:
a logic element;
a Baseboard Management Controller (BMC);
a Platform Controller Hub (PCH);
a BMC serial storage module configured to store a BMC code and a first private key;
a Basic Input Output System (BIOS) serial storage module configured to store a BIOS code and a second private key;
a first Multiplexer (MUX), controlled by the logic element, wherein the first MUX is configured to connect the BMC to the BMC serial storage module, or connect the logic element to the BMC serial storage module; and
a second MUX, controlled by the logic element, wherein the second MUX is configured to connect the PCH to the BIOS serial storage module, or connect the logic element to the BIOS serial storage module;
wherein the logic element is configured to:
in response to obtaining power-on operation information of a server, obtain the BMC code in the BMC serial storage module and the BIOS code in the BIOS serial storage module, and perform a credibility detection on the BMC code according to the first private key and the BIOS code according to the second private key;
in response to the BMC code passing the credibility detection, connect a first serial peripheral interface (SPI) of the BMC to the BMC serial storage module by means of the first MUX;
in response to the BIOS code passing the credibility detection, connect a second SPI of the PCH to the BIOS serial storage module by means of the second MUX; and
control the PCH to be powered and the BMC to enter a working state;
wherein the logic element is further configured to:
encrypt a plurality of pieces of preset BMC code information in the BMC code to form a BMC code public key, perform a decryption checking on the BMC code public key by means of the first private key, and in response to the decryption checking being successful, determine that the BMC code passes the credibility detection; and
encrypt a plurality of pieces of preset BIOS code information in the BIOS code to form a BIOS code public key, perform the decryption checking on the BIOS code public key by means of the second private key, and in response to the decryption checking being successful, determine that the BIOS code passes the credibility detection.
7. The monitoring and control circuit for the on-board trusted platform according to claim 6 , wherein the control the PCH to be powered and the BMC to enter a working state further comprises:
connecting a RESET pin of the BMC to the logic element, and
controlling, by the logic element, the RESET pin of the BMC to be released to make the BMC enter the working state.
8. The monitoring and control circuit for the on-board trusted platform according to claim 6 , wherein the control the PCH to be powered and the BMC to enter a working state further comprises:
connecting a power supply enable pin of a power supply chip that powers the PCH to the logic element, and
controlling, by the logic element, the power supply enable pin to power the PCH.
9. The monitoring and control circuit for the on-board trusted platform according to claim 6 , wherein the logic element is further configured to:
in response to the logic element determining that the BMC code or the BIOS code does not pass the credibility detection, control the BMC not to enter the working state and the PCH not to be powered by the logic element, so as to stop a boot operation.
10. The monitoring and control circuit for the on-board trusted platform according to claim 6 , wherein each of the BMC serial storage module and the BIOS serial storage module comprises a protected area, and the first private key and the second private key are respectively stored in the protected area.
11. A monitoring and control method for an on-board trusted platform, comprising:
connecting, by means of a first Multiplexer (MUX), a logic element and a Baseboard Management Controller (BMC) respectively to a BMC serial storage module that stores a BMC code and a first private key, and connecting, by means of a second MUX, the logic element and a Platform Controller Hub (PCH) respectively to a Basic Input Output System (BIOS) serial storage module that stores a BIOS code and a second private key;
in response to the logic element obtaining power-on operation information of a server, obtaining, by the logic element, the BMC code in the BMC serial storage module and the BIOS code in the BIOS serial storage module, and performing, by the logic element, a credibility detection on the BMC code according the first private key stored in the BMC serial storage module and the credibility detection on the BIOS code according to the second private key stored in the BIOS serial storage module;
in response to the BMC code passing the credibility detection according to the first private key, controlling, by the logic element, the first MUX to connect a first serial peripheral interface (SPI) of the BMC to the BMC serial storage module;
in response to the BIOS code passing the credibility detection according to the second private key, controlling, by the logic element, the second MUX to connect a second SPI of the PCH to the BIOS serial storage module; and
controlling the PCH to be powered and the BMC to enter a working state by the logic element;
wherein the performing, by the logic element, a credibility detection on the BMC code according the first private key stored in the BMC serial storage module and the credibility detection on the BIOS code according to the second private key stored in the BIOS serial storage module further comprises:
encrypting a plurality of pieces of preset BMC code information in the BMC code to form a BMC code public key, performing a decryption checking on the BMC code public key by means of the first private key, and in response to the decryption checking being successful, determining that the BMC code passes the credibility detection; and
encrypting a plurality of pieces of preset BIOS code information in the BIOS code to form a BIOS code public key, performing the decryption checking on the BIOS code public key by means of the second private key, and in response to the decryption checking being successful, determining that the BIOS code passes the credibility detection.
12. The monitoring and control method for the on-board trusted platform according to claim 11 , wherein the controlling the PCH to be powered and the BMC to enter a working state by the logic element further comprises:
connecting a RESET pin of the BMC to the logic element, and
controlling, by the logic element, the RESET pin of the BMC to be released to make the BMC enter the working state.
13. The monitoring and control method for the on-board trusted platform according to claim 11 , wherein the controlling the PCH to be powered and the BMC to enter a working state by the logic element further comprises:
connecting a power supply enable pin of a power supply chip that powers the PCH to the logic element, and
controlling, by the logic element, the power supply enable pin to power the PCH.
14. The monitoring and control method for the on-board trusted platform according to claim 11 , further comprising:
in response to the BMC code or the BIOS code not passing the credibility detection, controlling the BMC not to enter the working state and the PCH not to be powered by the logic element, so as to stop a boot operation.
15. The monitoring and control method for the on-board trusted platform according to claim 11 , wherein each of the BMC serial storage module and the BIOS serial storage module comprises a protected area, and the first private key and the second private key are respectively stored in the protected area.