CN101727551A

CN101727551A - Method for computer to safely transfer secret key and private key

Info

Publication number: CN101727551A
Application number: CN200810228010A
Authority: CN
Inventors: 李玲
Original assignee: Individual
Current assignee: Individual
Priority date: 2008-10-10
Filing date: 2008-10-10
Publication date: 2010-06-09

Abstract

The invention provides a method for a computer to safely transfer a secret key and a private key, relates to computer safety, in particular relating to that computer equipment safely transfers a secret key and a private key. The invention provides a platform sending request; the platform provides an intrinsic message and responses to the request; the platform provides a message requested by the equipment which is manufactured by one or a group of equipment manufacturers and is freely chosen by verification needed by the first requested platform. The invention has the technical scheme that the platform shows that the cipher message generated by the equipment manufacturer is owned thereby, and the platform extracts a reliable plain module TPM in a replied mode. The TPM is the cipher equipment manufactured by the equipment manufacturer and is sealed in the processor of small amounts of packaged on-chip-memories to be configured to the platform; the processor can be a microprocessor, a digital signal processor and a microcontroller.

Description

The method of computer to safely transfer secret key and private key

Technical field

The present invention relates to computer security, relates in particular to computer equipment and transmits cryptographic key safely.

Background technology

Some disposal system architecture of present computer security features requires special protection, software module can create with disposal system in the certified encrypted communication session of special protection hardware device.A kind of common method that is used for marking equipment and sets up encrypted communication session simultaneously, in this course, to devices allocation unique publicly-owned/privately owned because this verification process uses RSA or ECC key, therefore equipment has unique and evincible identity, and this may cause privacy concerns.Under worst case, these problems can cause lacking the support that structure is provided the credible equipment of this security.Their encrypted communication session own and foundation and trusted software module of protected/credible equipment authentication that Internet Key Exchange Protocol allows have been avoided creating any unique identity information in disposal system, and avoid introducing privacy concerns thus.Yet directly embedding in the equipment on production line directly has than the more protected non-volatile memories of other method on the proof private key requirement equipment, thereby has increased equipment cost.Be installed in method in the equipment by equipment itself, realize that minimizing to the amount of the required non-volatile memories of the key change based on direct proof of equipment can cause the more wide in range employing to this technology.The example of various types of communication links includes but not limited to or does not retrain torch line, optical fiber, cable, total line tracking or wireless signaling technology.

Summary of the invention:

For achieving the above object, the invention provides this a kind of platform and send request, platform provides the information about itself, in response to request, institute's information requested of the equipment of equipment manufacturers that platform provides that first platform of asking need verify to come freely to select or one group of equipment manufacturers' manufacturing of selection.

If according to above-mentioned described, technical scheme of the present invention is that platform has the encrypted message that is generated by equipment manufacturers so that it to be shown, platform is by carrying credible flat compound module TPM with the form of replying, TPM is the encryption device of being made by equipment manufacturers, be sealed in the processor of small amount of on-chip memory in the encapsulation and be configured to platform, processor is microprocessor, digital signal processor, microcontroller.

Beneficial effect of the present invention:

The configuration of computer system of the present invention is depended on such as numerous factors such as price constraints, performance requirement, other environment of technological improvement and different between each is realized." credible " software module of the special protection be stored in the primary memory mass-memory unit and carried out by processor is used in the computer system support; even also to carry out specific activities under the situation that in system, has other Malware; some need in these trusted software module certain not only to other platform; and to the one or more equipment in the identical platform, such as the protected access of equal " credible " of graphics controller.Generally speaking, ability or specific identity that this visiting demand trusted software module can marking equipment, set up then with the encryption session of this equipment to allow exchange and can not be monitored or the data of swindle by other software in the system.PKI can be delivered to software module together with certificate of certification.In the DH key exchange process, equipment uses its private key to sign message, and software module can use corresponding public key to verify this private key.

Description of drawings:

Fig. 1 is a system flowchart of the present invention;

Fig. 2 is the FB(flow block) of key of the present invention.

Embodiment:

Of the present invention on production line during production equipment, equipment manufacturers only are stored into pseudo random number in this equipment, use distribution CD to encrypt and transmit simultaneously, this process guarantees to have only appointed equipment could decipher and use the key of its signature, can be by transmitting the data structure that is called " key block " by the group record of equipment manufacturers' signature.And only just begin to handle the key block that is extracted after whole record is carried out grammatical analysis, the assailant just can't infer and selected key block based on regularly attacking.The protected system of device fabrication is included in the disposal system of using in the manufacturing setting up procedure before of equipment.Protected system can be by equipment manufacturers or other physical operation, so that the protected attack that is not subjected to from the hacker outside the device fabrication side of protected system.Manufacture system can use in the manufacturing of equipment.Key block comprises at least three data item, if to encrypt using stream cipher, then uses at the known method that stream cipher uses being used for.If use block encryption, then will make that thus each example of encrypting all is different as the part of the message that will encrypt to encrypting.

Take over what combination,, can use any suitable movable storage medium herein although CD is described to storage medium.Expectation use direct identification protocol carry out with system in the client computer system of the authentication of communication session of the equipment that comprises and key change can after in case CD is inserted in the CDROM drive of client computer system, promptly read selected group record the keyblob database from CD.Cipher key block data can obtain from group record, and is used to generate the localized keyblob that is used to realize direct identification protocol by equipment.Device driver software carries out initialization and opertaing device by client computer system.Equipment manufacturers can generate the Device keys of the number of appointment then.When being one group of equipment when having created the whole data set of key block, signing the keyblob database of this group at least and it is burnt on the common distribution CD, with each equipment distribution.Thus, group record is created by equipment manufacturers.Can be with the close silver bullion database that adds to through the group record of signature on the distribution CD.

Claims

1. the method for computer to safely transfer secret key and private key, it has the encrypted message that is generated by equipment manufacturers to it is characterized in that platform, platform is by providing credible flat compound module TPM with the form of replying, TPM is the encryption device of being made by equipment manufacturers, is sealed in the processor that encapsulates interior small amount of on-chip memory and is configured to platform; Processor is microprocessor, digital signal processor, microcontroller.