基于TPCM可信根的双体系可信终端计算架构  

Dual system trusted terminal computing architecture based on TPCM RoT

作　　者：黄坚会 张江江 沈昌祥[1,2] 张建标 HUANG Jianhui;ZHANG Jiangjiang;SHEN Changxiang;ZHANG Jianbiao(School of Computer Science,Beijing University of Technology,Beijing 100124,China;Beijing Key Laboratory of Trusted Computing,Beijing 100124,China;Shanghai Suanshi Technology Co.,Ltd.,Shanghai 201203,China;School of Computer and Information Technology,Shanxi University,Taiyuan 030006,China)

机构地区：[1]北京工业大学计算机学院,北京100124 [2]可信计算北京市重点实验室,北京100124 [3]上海算石科技有限公司,上海201203 [4]山西大学计算机与信息技术学院,山西太原030006

出　　处：《通信学报》2025年第4期1-14,共14页Journal on Communications

基　　金：北京市自然科学基金资助项目(No.M21039)。

摘　　要：冯诺依曼计算机体系由于时代局限性未能考虑到现代的安全环境,计算结构中缺少基于硬件可信根的独立防护部件。基于国家标准GB/T 40650-2021可信平台控制模块(TPCM)可信根的可信终端架构被提出。该架构采用双体系结构实现了基于可信根的渐进式并行可信执行环境架构,从硬件可信根芯片和底层基础软件角度出发解决终端设备源头、平台执行环境及终端设备可信管理的问题。该方法确保终端设备的TPCM可信根芯片和被测基础部件首先上电,完成对CPU执行环境可信度量,并控制CPU电源及设备初始化配置,逐步在计算机启动过程中进行可信扩散。该方法可以在保证设备本体安全可信的基础上实现可靠可信的网络应用,实现设备数据的隐私、安全保障及网络安全。Due to the limitations of the times,the von Neumann computer system failed to consider the modern security environment,and the computing structure lacked independent protective components based on hardware trusted roots.A trusted terminal architecture based on the Chinese national standard GB/T 40650-2021 trusted platform control module(TPCM)trusted root was proposed.A dual architecture was adopted to implement a progressive parallel trusted execution environment architecture based on trusted roots,solving the problems of terminal device source,platform execution environment,and terminal device trusted management from the perspectives of hardware trusted root chips and underlying basic software.The method ensured that the TPCM trusted root chip of the terminal device and the tested basic components were powered on first,completing the trusted measurement of the CPU execution environment,and controlling the CPU power and device initialization configuration,gradually performing trusted diffusion during the computer startup process.It can achieve reliable and trustworthy network applications while ensuring the security and trustworthiness of the device itself,realizing the privacy,security protection,and network security of device data.

关 键 词：国标GB/T 40650-2021 可信根 可信平台控制模块 态度量 可信执行环境 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]