TPCM-based trusted PXE boot method for servers

Guojie LIU; Jianbiao ZHANG

doi:10.11959/j.issn.2096-109x.2020079

您当前的位置：

首页 >

文章列表页 >

TPCM-based trusted PXE boot method for servers

Papers | 更新时间：2024-06-03

- TPCM-based trusted PXE boot method for servers
- Chinese Journal of Network and Information Security Vol. 6, Issue 6, Pages: 105-111(2020)
- 作者机构：
  
  1. 北京工业大学信息学部，北京 100124
  2. 可信计算北京市重点实验室，北京 100124
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020079
  CLC： TP393
- Online First：2020-12，
  
  Published：15 December 2020
- 稿件说明：
移动端阅览
Guojie LIU, Jianbiao ZHANG. TPCM-based trusted PXE boot method for servers[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 105-111.
DOI：

Guojie LIU, Jianbiao ZHANG. TPCM-based trusted PXE boot method for servers[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 105-111. DOI： 10.11959/j.issn.2096-109x.2020079.

摘要

PXE 启动机制通过网络下载操作系统文件并启动操作系统，广泛应用于服务器网络启动。通过可信计算技术保障PXE启动过程的安全可信，防止PXE启动文件被恶意篡改，确保服务器的安全可信运行。网络安全等级保护标准要求基于可信根对服务器设备的系统引导程序、系统程序等进行可信验证。根据等级保护标准要求，提出一种基于TPCM的服务器可信PXE启动方法，保障服务器的BIOS固件、PXE启动文件、Linux系统文件的安全可信。在服务器进行PXE启动时，由TPCM度量BIOS固件，由BIOS启动环境度量PXE启动文件，由PXE启动环境度量Linux系统文件。以TPCM为信任根逐级度量、逐级信任，建立信任链，建立可信的服务器运行环境。所提方法在国产自主可控申威服务器上进行了实验，实验结果表明所提方法是可行的。

Abstract

The PXE startup mechanism downloads operating system files through the network and starts the operating system

which is widely used in server network startup.It is widely used in server network startup.The PXE boot process is secured and trusted through trusted computing technology to prevent the PXE boot file from being tampered with maliciously

ensuring the safe and reliable operation of the server.The cyber security classified protection standard requires that the system boot program and system program of the server device be trusted and verified based on the trusted root.A TPCM-based server trusted PXE boot method based on the requirements of classified protection standard was proposed to ensure the security and trust of the server's BIOS firmware

PXE bootfiles

and Linux system files.When the server performs PXE boot

TPCM measured BIOS firmware

BIOS boot environment measured PXE boot files

and PXE boot environment measured Linux system files.Taking TPCM as the root of trust

one level of measurement

one level of trust

and a chain of trust were established to achieve a trusted server operating environment.The proposed method was tested on a domestically-controlled

self-controllable Shenwei server.The experimental results show that the proposed method is feasible.

关键词

Keywords

references

冯登国 , 秦宇 , 汪丹 , 等 . 可信计算技术研究 [J ] . 计算机研究与发展 , 2011 , 48 ( 8 ): 1332 - 1349 .

FENG D G , QIN Y , WANG D , et al . Research on trusted computing technology [J ] . Journal of Computer Research ＆ Development , 2011 , 48 ( 8 ): 1332 - 1349 .

SHEN C X , ZHANG H G , WANG H M , et al . Research on trusted computing and its development [J ] . Science in China Series F (Information Science) , 2010 , 53 ( 3 ): 405 - 433 .

ZHANG H G , LUO J G , JIN G , et al . Development of trusted computing research [J ] . Wuhan University Journal of Natural Sciences , 2006 , 11 ( 6 ): 1407 - 1413 .

陈广勇 , 祝国邦 , 范春玲 . 《信息安全技术网络安全等级保护测评要求》（GB/T 28448-2019）标准解读 [J ] . 信息网络安全 , 2019 , 19 ( 7 ): 1 - 7 .

CHEN G Y , ZHU G B , FAN C L . Information security technology—evaluation requirement for classified protection of cyber security(GB/T 28448-2019)standard interpretation [J ] . Netinfo Security , 2019 , 19 ( 7 ): 1 - 8 .

何欣枫 , 田俊峰 , 刘凡鸣 . 可信云平台技术综述 [J ] . 通信学报 , 2019 , 40 ( 2 ): 158 - 167 .

HE X F , TIAN J F , LIU F M . Survey on trusted cloud platform technology [J ] . Journal on Communications , 2019 , 40 ( 2 ): 158 - 167 .

刘川意 , 王国峰 , 林杰 , 等 . 可信的云计算运行环境构建和审计 [J ] . 计算机学报 , 2016 , 39 ( 2 ): 339 - 350 .

LIU C Y , WANG G F , LIN J , et al . Practical construction and audit for trusted cloud execution environment [J ] . Chinese Journal of Computers , 2016 , 39 ( 2 ): 339 - 350 .

BAI G , HAO J , WU J , et al . TrustFound:towards a formal foundation for model checking trusted computing platforms [C ] // International Symposium on Formal Methods . 2014 .

VON BOMHARD N , AHLBORN B , MASON C , et al . The trusted server:a secure computational environment for privacy compliant evaluations on plain personal data [J ] . Plos One , 2018 , 13 ( 9 ): 1 - 19 .

吴奇烜 , 马建峰 , 孙聪 . 采用完整性威胁树的信息流完整性度量方法 [J ] . 网络与信息安全学报 , 2019 , 5 ( 2 ): 50 - 57 .

WU Q X , MA J F , SUN C . Information flow integrity measurement method using integrity threat tree [J ] . Chinese Journal of Network and Information Security , 2019 , 5 ( 2 ): 50 - 57 .

胡浩 , 刘玉岭 , 张玉臣 , 等 . 基于攻击图的网络安全度量研究综述 [J ] . 网络与信息安全学报 , 2018 , 4 ( 9 ): 1 - 16 .

HU H , LIU Y L , ZHANG Y C , et al . Survey of attack graph based network security metric [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 9 ): 1 - 16 .

田俊峰 , 常方舒 . 基于 TPM 联盟的可信云平台管理模型 [J ] . 通信学报 , 2016 , 37 ( 2 ): 1 - 10 .

TIAN J F , CHANG F S . Trusted cloud platform management model based on TPM alliance [J ] . Journal on Communications , 2016 , 37 ( 2 ): 1 - 10 .

LI Y H , ZHANG Y D , LI P , et al . An efficient trusted chain model for real-time embedded systems [C ] // International Conference on Computational Intelligence ＆ Security . 2016 .

CONG W N , CAO K . Enabling secure and efficient ranked keyword search over outsourced cloud data [J ] . IEEE Transactions on Parallel and Distributed Systems , 2012 , 23 ( 23 ): 1467 - 1479 .

沈昌祥 , 张大伟 , 刘吉强 , 等 . 可信 3.0 战略:可信计算的革命性演变 [J ] . 中国工程科学 , 2016 , 18 ( 6 ): 53 - 57 .

SHEN C X , ZHANG D Q W , LIU J G , et al . The strategy of TC 3.0:a revolutionary evolution in trusted computing [J ] . Strategic Study of CAE , 2016 , 18 ( 6 ): 53 - 57 .

张兴 , 黄强 , 沈昌祥 . 一种基于无干扰模型的信任链传递分析方法 [J ] . 计算机学报 , 2010 , 33 ( 1 ): 74 - 81 .

ZHANG X , HUANG Q , SHEN C X , et al . A formal method based on noninterference for analyzing trust chain of trusted computing platform [J ] . Chinese Journal of Computers , 2010 , 33 ( 1 ): 74 - 81 .

郭颖 , 毛军捷 , 张翀斌 , 等 . 基于可信平台控制模块的主动度量方法 [J ] . 清华大学学报(自然科学版) , 2012 , 52 ( 10 ): 1465 - 1473 .

GUO Y , MAO J J , ZHANG C B , et al . Active measures based on a trusted platform control module [J ] . Journal of Tsinghua University , 2012 , 52 ( 10 ): 1465 - 1473 .

王勇 , 许荣强 , 任兴田 , 等 . 可信计算中信任链建立的形式化验证 [J ] . 北京工业大学学报 , 2016 , 42 ( 3 ): 387 - 392 .

WANG Y , XU R Q , REN X T , et al . Formal verification of establishment of chain of trust in trusted computing [J ] . Journal of Beijing University of Technology , 2016 , 42 ( 3 ): 387 - 392 .

HUANG G , YANG B . Research and improvement on PXE security of dynamic distributed network of non-fixed disk [J ] . Journal of Computers , 2012 , 7 ( 7 ): 1681 - 1687 .

Views

357

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Reversible data hiding algorithm in encrypted images based on prediction error and bitplane coding

Survey of key management schemes for cluster networks

Public key cryptographic algorithm SM2 optimized implementation on low power embedded platform

Survey on explainable knowledge graph reasoning methods

Application progress of SGX in trusted computing area

Related Author

Mengning JI

Haiyong WANG

Jun LIU

Lin YUAN

Zhishang FENG

Ganqin LIU

Hui LI

Hui ZHU

Related Institution

School of Computer Science, Wuhan University

School of Cyber Science and Engineering, Wuhan University

Beijing Information Science and Technology University

Xidian University, School of Cyber Engineering, Xi′an

School of Marxism, Xidian University, Xi′an

⁰