DE202022102514U1 - Cryptography-based intelligent system for security management of microcode signatures - Google Patents

Abstract

A cryptography-based intelligent system (10) for security management of microcode signatures, the system comprising:
a certification unit (1), the certification unit (1) being used to certify and validate a load module by analyzing, examining, authenticating and testing the inputs, the certification unit (1) certifying the input load using digital signature authentication;
a secure processing unit (2) used to securely process input by proving a secure environment with digital signature matching and authentication, wherein the secure processing for each element combines the values of each of the elements of the digital signature as an aggregated element and then performs a security using the aggregated items; and
a processing unit (3) comprising at least a processor, a memory (32), an electronic circuit (33) and a communication unit (34), wherein a signature-encrypted microcode file is stored in the memory unit (32) of the processing unit (3), wherein the processor (31) comprises a physical core divided into a virtual secure core and a virtual normal core, and the processor (31) provides a secure execution environment that provides a secure operating system based on the virtual secure core, wherein the performing the signature verification on the signature-encrypted microcode file, loading the file if the signature verification is passed, wherein the processing unit (3) processes a signature cryptography algorithm that provides a private key that is first generated by means of a standard random number generator or a key derivation function wi rd, and uses a secondary signature authentication.

Description

FIELD OF THE INVENTION

The present invention relates to the field of security management for digital signatures.

The present invention relates to the field of cryptography-based security management for digital signatures.

In particular, the present invention relates to a cryptography-based intelligent system for security management of microcode signatures.

BACKGROUND OF THE INVENTION

The subject matter discussed in the background section should not be assumed to constitute prior art merely by virtue of its mention in the background section. Likewise, it should not be assumed that any problem mentioned in the background section or associated with the subject matter of the background section has already been recognized in the prior art. The subject matter of the background section merely presents various approaches, which in themselves may also be inventions.

US20210359861 MICROCODE SIGNATURE SECURITY MANAGEMENT SYSTEM BASED ON TRUST ZONE TECHNOLOGY AND METHODS A microcode signature security management system based on Trust Zone technology comprises the following steps: starting a normal operating system; the normal operating system acquiring the signature-encrypted microcode file and issuing the signature-encrypted microcode file and a switching signal; the microprocessor receiving the switch signal and starting the monitor mode to start a secure operating system; receiving the signature-encrypted microcode file, performing signature verification on the signature-encrypted microcode file, loading the file if the signature verification is successful, otherwise outputting microcode error information if the signature verification by the secure operating system fails. The security of the microcode is guaranteed based on a secure security environment of the operating system, to which a system layer has no access. The security, integrity and correctness of the loaded microcode is guaranteed by a cryptographic tool and the risk of destroying, altering or replacing an existing microcode management mechanism is reduced.

WO/2019/062577 MICROCODE SIGNATURE SECURITY MANAGEMENT SYSTEM AND METHODS BASED ON TRUST ZONE TECHNOLOGY The present invention relates to the field of secure data storage and provides a microcode signature security management system based on Trust Zone technology. The method includes: starting a common operating system after a hardware device has started; the common operating system receives a signature-encrypted microcode file and outputs the signature-encrypted microcode file and a switching signal; a microprocessor receives the switch signal and starts a monitor mode to start a secure operating system; the secure operating system receives the signature-encrypted microcode file, performs signature verification on the signature-encrypted microcode file, loads the file if the signature verification succeeds, and returns microcode error information if the signature verification fails. With the aid of the present invention, the security of the microcode is ensured on the basis of a security environment of a secure operating system (secure so) to which a system layer has no access. A cryptographic tool measure is adopted so that the security, integrity and correctness of the loaded microcode is ensured and the risk of breaking, modifying and replacing an existing microcode management mechanism is reduced.

CN109886011 SECURITY PROTECTION METHOD AND DEVICE The invention discloses a security protection method and device related to the field of information security and aimed at solving the problems that when a wave or similar wave detection and interception technology is used in the state of the art, effective combination with services is difficult and logical rules of the services are difficult to define; and that when a specific coding protection mode is employed, the protection is incomplete and unified management is impractical. The method includes the steps of: when a client needs to send a service request, using the client to obtain a security component signature through a preloaded security component; using the client to send a service request to a pre-connected service server, the service request including a security component signature; Intercepting the service request by a default filter component of the service server and invoking a secure micro-server for processing; using the security microserver to perform a legality assessment according to the security component signature and return an assessment result to the filter component; and if the judgment result is legal, using the filter component to forward the service request to a corresponding service API interface of the service server to perform subsequent service processing.

WO/2016/122656 SYSTEMS AND METHODS FOR OBTAINING AN ELECTRONIC SIGNATURE BY A WORD PROCESSING APPLICATION Techniques for obtaining electronic signatures by word processing applications are described. One approach uses a code module, also known as a "markup engine," that runs within a word processing application and facilitates the preparation of a document for electronic signature. A user can operate the word processing application along with the markup module to add signature marks to the document and provide recipient information about the intended signers, such as names and email addresses. Once the document is prepared, the code engine transmits the document (including the added signature marks) and recipient information to a digital transaction service. The digital transaction service then manages the signing of the document, e.g. B. notifies the recipient, takes the signature of the recipient and securely stores the signature in connection with the document.

CN106155663 METHOD AND APPARATUS FOR LOADING CODE SIGNATURES INTO APPLICATIONS The invention discloses a method for loading a code signature into an application. The method includes the steps of receiving a code signing request sent by a requester, the code signing request including identity information of the requester and the application to be signed; the requester's identity information is verified; after the requestor's identity information passes verification, a signing private key authenticated by a certification mechanism loads the code signature into the application; the application received after the signature and the signature information of the application are saved in a backup data set. The invention further discloses an apparatus for loading the code signature into the application. The private key authenticated by the certification mechanism is stored in a server, code signatures are loaded into applications that require signatures in a native mode through the server, the situation that the code signatures are maliciously tampered with or stolen by illegal users avoided, the private key leakage is avoided, the unified management of the code signatures is promoted, the security of the signatures is further improved, and the security dissemination and use of the applications are guaranteed.

US20150082 SECURITY CERTIFICATIONS FOR SYSTEM-ON-CHIP SECURITY A system-on-chip (SoC) comprises multiple hardware modules implemented on a substrate. The hardware modules contain a variety of hardware and software security features, and the SoC provides one or more external interfaces to access the security features. A validation module that B. implemented in the boot code of the SoC, manages security certificates to control access to the multiple security features. Each security certificate includes one or more unique identifiers that correspond to one or more hardware modules in the SoC and access control settings for one or more security features of the one or more hardware modules. The security certificate also contains a certificate signature signed with a secure key.

CN112532649 METHOD FOR MANAGING NETWORK ACCESS OF SECURITY SITUATION MANAGEMENT PLATFORMS AND RELATED DEVICES The invention discloses a method for managing network access of security devices on a security situation management platform. The method includes the following steps: connecting security equipment to a network and sending equipment information; when a registration notification is received, packaging the received deployment position information, the equipment serial number and a certificate application file into registration application information, adding signature information and sending the registration application information to a security management node; performing signature processing according to the certificate number and a download code and requesting a certificate from the security management node; and importing a visa certificate, the security management node certificate and the security equipment certificate to realize network access registration. Equipment information verification is first performed by a security management node, then the registration application information of the security equipment is verified, and if the verification is passed, the certificate signature processing is performed, so that unified network access registration of the security equipment is realized. The invention further discloses security equipment, a server and a computer-readable storage medium that have the advantageous effects mentioned above.

CN113452527 ROBUST STATE SYNCHRONIZATION FOR STATEFUL HASH-BASED SIGNATURES The subject matter described herein relates generally to the field of computer security and more particularly to a code signing facility for hash-based signatures for post-quantum cryptographic security, including but not limited to a Extended Merkle Signature Scheme (XMSS) and a hash-based signature and verification algorithm based on a Leighton/Micali Signature (LMS). In one example, an apparatus includes computer-readable memory, a signature facility that includes a plurality of hardware security modules, and a state synchronization manager that includes processing circuitry to select from the plurality of hardware security modules a set of hardware security modules to be associated with a digital signature process, wherein the The set of hardware security modules comprises at least a first hardware security module and a second hardware module, and in order to assign a set of unique state synchronization counter sequences to the respective set of hardware security modules, the set of state synchronization counter sequences comprising at least a first state synchronization counter sequence and a second state synchronization counter sequence. Other examples can be described.

KR1020180046593 FIRMWARE UPDATE SYSTEM OF AN INTERNET OF THINGS DEVICE FOR FIRMWARE SIGNATURE VERIFICATION AND SECURITY KEY MANAGEMENT Access to the security key is impossible and allows verification with the security key using hash data for an electronic signature, ensuring security against external access and attack. The firmware update system of an IoT device includes: an update server; and an IoT device. COPYRIGHT KIPO 2018

US20170249477 SECURING REMOTE DELEGATED MANAGEMENT WITH DIGITAL SIGNATURE A system and method for executing a script includes receiving, by a service user account module, a user script from a first user account. The method includes outputting execution data containing the user script and validation parameters from a management system. The method includes the management system signing the execution data with a private key. In response to the execution data being signed, the execution data also includes a digital signature. The method further includes authorizing communication with a remote execution tool by the management system, the authorization requiring the digital signature. The method further includes sending the execution data including the digital signature to the remote execution tool. The method further includes confirming, by the remote execution tool, the validation parameters. The method further includes, in response to confirming the validation parameters, executing, by the remote execution tool, the user script on a remote system for the first user account.

US20200320193 BASEBOARD MANAGEMENT CONTROLLER TO PERFORM SECURITY MEASURES BASED ON COMPARISON OF DIGITAL SIGNATURES IN RESPONSE TO A TRIGGER The examples disclosed herein relate to taking security measures based on a comparison of digital signatures. An intrusion detection mode is initiated by a baseboard management controller. A first digital signature of hardware devices is calculated during activation of the intrusion detection mode. The first digital signature is saved. When a trigger is detected, a second digital signature is calculated for the current hardware devices. The digital signatures are compared with each other. A security measure is performed based on the comparison.

KR1020090040655 SYSTEM AND METHOD FOR ADMINISTRATION AND DISTRIBUTION OF AN ENTERPRISE SIGNATURE FOR NETWORK ATTACKS, IN PARTICULAR FOR DISTRIBUTION OF AN ANALYZED SIGNATURE TO A SECURITY MANAGEMENT SYSTEM IN OTHER NETWORKS A system and method for administration and distribution of an enterprise signature for network attacks are provided to enable any complicated security management system to be consistently based on a signature manage generated by a security system is used to generate signatures. CONSTITUTION: A signature collector (100) classifies signatures generated by each security system that generates signatures according to the information each signature contains. In addition, the signature collector collects the signatures in the form of an internal structure that can be evaluated. To increase reliability, a signature analyzer analyzes the collected signatures. A signature distribution unit (400) distributes the analyzed signature to a security management system in other networks via a signature distribution protocol (600).

As used in the present specification and the following claims, the meaning of "a", "an" and "the" includes the plural unless the context clearly dictates otherwise. As used in the present specification, the meaning of "in" also includes "in" and "am" unless the context clearly dictates otherwise.

The enumeration of value ranges serves only as a short name for each individual value that falls within the range. Unless otherwise noted here, each individual value is included in the specification as if it were individually listed here.

The use of examples or exemplary language (e.g. "such as") with respect to particular embodiments is intended solely to better illustrate the invention and should not be construed as limiting the scope of the otherwise claimed invention. No language in the specification should be construed as an indication of a non-claimed element essential for the implementation of the invention.

The information disclosed in this Background section is only for enhancement of understanding of the background of the invention and therefore it may contain information that does not form the prior art and that is already known in this country to a person skilled in the art.

SUMMARY

Before describing the present systems and methods, it should be noted that this application is not limited to the systems and methods described, as there may be several possible embodiments that are not expressly illustrated in the present disclosure. It is also to be understood that the terminology used in the specification is for the purpose of describing particular versions or embodiments only and is not intended to limit the scope of the present application.

The present invention mainly heals and solves the technical problems of the prior art. In response to these problems, the present invention discloses a cryptography-based intelligent system for security management of microcode signatures.

One aspect of the present invention is to provide a cryptography-based intelligent system for microcode signature security management, the system comprising: a certification engine, the certification engine being used to certify a load module by analyzing, probing, authenticating, and testing the inputs certify and validate, the certification entity certifying the input load using digital signature authentication; A secure processing unit used to securely process the inputs by demonstrating a secure environment with digital signature matching and authentication, where the secure processing for each element combines the values of each of the digital signature elements as an aggregated element and then performs a security using the aggregated items; and a processing unit comprising at least a processor, memory, electronic circuitry and a communication unit, wherein a signature-encrypted microcode file is stored in the storage unit of the processing unit, the processor comprising a physical core divided into a virtual secure core and a virtual normal Core is divided, and the processor provides a secure execution environment that provides a secure operating system based on the virtual secure core, performing a signature verification on the signature-encrypted microcode file, loading the file if the signature verification is passed, the processing unit a signature cryptography algorithm processed, which provides a private key, which is first generated using a standard random number generator or a key derivation function, and a secondary signature authentication used.

character list

In order to clarify various aspects of some embodiments of the present invention, a more detailed description of the invention will be given by reference to certain embodiments illustrated in the attached figure. It is understood that this figure only shows illustrated embodiments of the invention and therefore should not be considered as limiting its scope. The invention is provided with additional specificity and detail by the Described and explained using the attached figure.

• 1 das Blockdiagramm eines auf intelligenter Kryptographie basierenden intelligenten Systems (10) für das Sicherheitsmanagement von Mikrocodesignaturen zeigt.

In order that the advantages of the present invention may be readily understood, a detailed description of the invention is discussed below in connection with the attached figure, which should not, however, be construed as limiting the scope of the invention to the attached figure, in which:

• 1 shows the block diagram of an intelligent system (10) based on intelligent cryptography for the security management of microcode signatures.

DETAILED DESCRIPTION

The present invention relates to a cryptography-based intelligent system for security management of microcode signatures.

1 shows a detailed block diagram of the intelligent cryptography-based system (10) for the security management of microcode signatures.

Although the present disclosure has been described in terms of a cryptography-based intelligent system for security management of microcode signatures, it should be understood that this is only for the purpose of exemplifying the invention and any other purpose or purpose to highlight other functions for which the discussed structures or configurations could be used that fall within the scope of the present disclosure.

The cryptographic-based intelligent system (10) for microcode signature security management is disclosed.

The cryptography-based intelligent system (10) for microcode signature security management comprises a certification unit (1), a secure processing unit (2) and a processing unit (3).

The certification unit (1) serves to certify and validate a load module by analyzing, checking, authenticating and testing the inputs.

The certification unit (1) authenticates the load entered with the help of a digital signature authentication.

A secure processing unit (2) is used to process inputs securely by providing a secure environment with digital signature matching and authentication.

For each item, the secure processing combines the values of each item of the digital signature into an aggregate item and then performs a backup using the aggregate items.

The processing unit (3) comprises at least one processor, a memory (32), an electronic circuit (33) and a communication unit (34).

A signature-encrypted microcode file is stored in the storage unit (32) of the processing unit (3).

The processor (31) includes a physical core divided into a virtual secure core and a virtual normal core.

The processor (31) provides a secure execution environment that provides a secure operating system based on the virtual secure core.

Performing signature verification on the signature-encrypted microcode file and loading the file if the signature verification is successful.

The processing unit (3) processes a signature cryptography algorithm that provides a private key that is first generated using a standard random number generator or key derivation function and uses secondary signature authentication.

The storage unit (32) is a computer-readable memory.

The certification unit (1) includes a large number of hardware security modules that are assigned to digital signature processing.

The system is computer implemented.

The figure and the preceding description show examples of embodiments. Those skilled in the art will understand that one or more of the elements described may well be combined into a single functional element. Alternatively, certain elements can be broken down into multiple functional elements. Elements from one embodiment may be added to another embodiment. For example, the order of the processes described herein may be changed and is not limited to the manner described herein. About that In addition, the actions of a block diagram do not have to be performed in the order shown, nor do all actions necessarily have to be performed. Also, those actions that are not dependent on other actions can be performed in parallel with the other actions. The scope of the embodiments is in no way limited by these specific examples.

Although embodiments of the invention have been described in language specific to structural features and/or methods, the appended claims are not necessarily limited to the specific features or methods described. Rather, the specific features and methods are disclosed as examples of embodiments of the invention.

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• US20210359861 [0005]
• WO 2019/062577 [0006]
• CN109886011 [0007]
• WO 2016/122656 [0008]
• CN 106155663 [0009]
• US20150082 [0010]
• CN112532649 [0011]
• CN113452527 [0012]
• KR 1020180046593 [0013]
• US20170249477 [0014]
• US20200320193 [0015]
• KR 1020090040655 [0016]

Claims (4)

A cryptography-based intelligent system (10) for security management of microcode signatures, the system comprising: a certification unit (1), the certification unit (1) being used to certify and validate a load module by analyzing, examining, authenticating and testing the inputs, the certification unit (1) certifying the input load using digital signature authentication; a secure processing unit (2) used to securely process input by proving a secure environment with digital signature matching and authentication, wherein the secure processing for each element combines the values of each of the elements of the digital signature as an aggregated element and then performs a security using the aggregated items; and a processing unit (3) comprising at least a processor, a memory (32), an electronic circuit (33) and a communication unit (34), wherein a signature-encrypted microcode file is stored in the memory unit (32) of the processing unit (3), wherein the processor (31) comprises a physical core divided into a virtual secure core and a virtual normal core, and the processor (31) provides a secure execution environment that provides a secure operating system based on the virtual secure core, wherein the performing the signature verification on the signature-encrypted microcode file, loading the file if the signature verification is passed, wherein the processing unit (3) processes a signature cryptography algorithm that provides a private key that is first generated by means of a standard random number generator or a key derivation function wi rd, and uses a secondary signature authentication. The cryptography-based intelligent system (10) for security management of microcode signatures claim 1 , wherein the storage unit (32) is a computer-readable memory. The cryptography-based intelligent system (10) for security management of microcode signatures claim 1 , wherein the certification unit (1) comprises a plurality of hardware security modules that are associated with the digital signature processing. The cryptography-based intelligent system (10) for security management of microcode signatures claim 1 , the system being computer-implemented.

Images