JP2019092134A - Encryption key generation method - Google Patents

Abstract

To provide a technology that avoids bypassing of a core root of trust for measurement (CRTM) code that includes a measurement function that is the greatest risk when a secure boot (preventing code tampering) is performed using a secure element (SE) such as a trusted platform module (TPM) by a generic MCU that does not ensure tamper resistance.SOLUTION: A one-way function 102 included in logic operation means 100 of an MCU uses key information [α] 202 included in an object code 201 or data and a code measurement result 308 generated in code measurement means 300 to generate an encryption key 101 for common key encryption.EFFECT: The encryption key 101 is generated by the same process in an external device connected to such a system and used for mutual encryption communication, and therefore, it becomes possible to detect object code tampering due to mutual authentication abnormality or the like.SELECTED DRAWING: Figure 2

Description

Targets authentication for general-purpose MCUs for which tamper resistance is not secured, and encryption of transmission / reception data.

An object of the present invention is to provide an anti-malware measure that has recently attracted attention in the field of IT security.

Originally, as a measure against malware, the basic measure is to prevent the intrusion of malware itself, but a network camera made by Xiongmai etc. [SOURCE: http://www.itmedia.co.jp/enterprise/articles/1610/25/ Looking at the recent DDoS case in [news059.html], there are cases where defense technology can not keep up with the progress of attack technology.

An object of the present invention is to provide a function that enables a host device to detect a system abnormality in an authentication process at the time of opening of a malware in a peer-to-peer (Peer to Peer) or master-slave connection environment.

In recent years, Secure Boot technology has been adopted that uses TPM (Trusted Platform Module) to perform integrity verification of object code as a final measure of anti-malware measures. For example, software is deployed on RAM In the case, as shown in the attack tree of FIG. 1, the following risks potentially exist.
Risk _1: Directly rewrite the code developed on the external RAM after startup by probing Risk _2: Bypass the CRTM [Core Root of Trust for Measurement], which is the starting point of the integrity proof

For Risk_1, there is Run Time Detection technology developed by US Red Balloon Security, but for Risk_2, a standard document Trusted Platform Module Library published by TCG [Trusted Computer Group] which is a standardization body of TPM. It is specified as follows in 34.1 Introduction of Part 1: Architecture (Family “2.0”, Level 00 Revision 01.38, September 29, 2016), and bypass is not taken into consideration.

A computer system reset puts the processor and chipset into a known state, and the processor (beginning of the root for trust) begins executing code provided by the platform manufacturer.
This initial code is the core root of trust for measurement (CRTM). It is a code that must be trusted as there is no way to tell what that code is for other than really on the manufacturer.
Translation: Computer system reset puts the processor and chipset in a known state, and the processor (RTM 301) starts executing code provided by the platform manufacturer.
This initial code is CRTM.
It has to be a code to trust, as there is no way but to trust the manufacturer.

The CRTM is software executed at boot time as defined in the same standard, and in a system where the boot area can be changed, bypassing the CRTM at Risk_2 is the largest risk.

The configuration of the present invention is shown in FIG.

The system comprises a logic operation unit 100 configured by a CPU or an FPGA, a non-volatile storage unit 200 such as a FLASH memory, and a code measurement unit 300 configured by software implementation or a device such as a TPM.
Here, the configuration will be described below using the TPM as the code measurement means 300 as an example, but the code measurement means 300 may be a gate array that is directly connected to the FLASH or RAM interface and performs measurement simultaneously with transfer. it can.

The reason for using the TPM for the code measurement means 300 is 500 in the cryptographic boundary defined in FIPS 140-2 standardized by NIST (National Institute of Standards and Technology) of the measurement results. It can be safely managed.
Further, in the TPM, RTM 301 [Root of Trust for Measurement] measures the code by hash function 304, and the measurement result (step S306) is included by PCR expansion function 305 in RTS 302 [Root of Trust for Storage] PCR 308 [Platform Configuration Register ] (Step S307), and the RTR 303 [Root of Trust for Reporting] outputs the measurement result (step S309).

As in normal secure boot, the logic operation unit 100 transfers the object code 201 stored in the non-volatile storage unit 200 to the code measurement unit 300 (step S203), and the logic operation unit 100 acquires the measurement result from the PCR 308 ( Step S309) The key information [α] 202 included in the non-volatile storage unit 200 is obtained (step S204) and input to the one-way function Fdiv () 102 to generate the encryption key 101 (step S103).
Note that since the encryption key 101 exists outside the encryption boundary 400, when considering security, the encryption key 101 and the Fdiv () 102 are internal to the CPU of the logic operation means 100 in which the debugging interface such as JTAG is invalidated. Store in RAM.

As the one-way function Fdiv () 102, it is also possible to use an encryption function such as AES [Advanced Encryption Standard] in NIST, but in consideration of the amount of calculation here, SHA having a security strength [128 bit] equivalent to AES. Let H.sub.MAC be used according to the following equation.
Fdiv (key information [α] 202, measurement result S 309) = HASH (key information [α] 202 || measurement result S 309)
However, the HASH (): SHA-256 function

However, since the key information [α] 202 is stored in the non-volatile storage means 200 out of the encryption boundary 400 and the possibility of exposure can not be denied, diversification is performed to minimize the influence on other systems at the time of exposure. FIG. 3) may be implemented.

It is possible to share the encryption key 101 by performing the same process as in the present invention even with an external device connected to this system, and when the object code of this system is falsified, mutual encryption / decryption results Inconsistencies occur, and it is possible to detect code tampering due to, for example, mutual authentication error.

Further, when authentication is performed by the logic operation unit 100, the non-volatile storage unit 200, and the code measurement unit 300, the code measurement unit 300 and the code measurement unit 300 are configured by setting the generated encryption key 101 in the code measurement unit 300. It is possible to invalidate other encryption means provided.

It is a figure which shows an example of the attack tree with respect to secure boot. It is a figure which shows an example of the whole image of this invention. It is a figure which shows an example of the whole image of the diversification method of this invention. It is a figure which shows an example of the key information storage of the diversification method of this invention. It is a figure which shows an example of key information generation of the diversification method of this invention.

Hereinafter, diversification (entire view) of key information in FIG. 3 will be described using FIG. 4 (key information storage) and FIG. 5 (key information generation).

The logical operation means 100 of FIG. 4 secures a random number array area 106 composed of n (number of arrays) key length [here, 256 bits] size entries on the RAM, and fills it with a random number sequence.

Note that the entry is described as Entry_m (the suffix m indicates the entry number (0, 1, 2,...)).

Next, the logical operation means 100 generates two array entries (x, y) to be used by the array element number generation function Fsel () 105 which generates an array element number from unmodifiable unique values 104 such as device information stored in the logical operation means 100. 3) select [Entry_1 and Entry_n-2].

The processing of Fsel () 105 for selecting two entries [Entry_x and Entry_y] may be, for example, the following expression.
x = unique value mod n [where unique value 104 is unique_ID or user defined value]
y = (x + z) mod n [where z is a fixed value calculated from the unique value by an arbitrary algorithm, 1 z z n n-1]

Next, the logic operation means 100 reads out the entry of the number x 107 (β) (step S108), and the result of exclusive ORing with the key information [α] 202 stored in the non-volatile storage means 200 (γ) After storing (step S108a) in the yth entry 107a (step S108b), the random number array area 106 is copied to the non-volatile storage unit 200 (copy random number array area 106a) (step S109). It is erased from the logic operation means 100.

When the logical operation means 100 reproduces the key information [α] 202 from the copy random number array area 106a stored in the non-volatile storage means 200, the logical operation means 100 of FIG. The stored unique value 104 is converted to the entry number (x, y) by Fsel () 105, and the copy random number array area 106a stored in the non-volatile storage unit 200 is copied to the logic operation unit 100 (recopy random number After the array area 106b (step S109a), the entry (β) of the x-th 107 and the entry (γ) of the y-th 107a are read out (steps S110 to S110a), and their exclusive OR is taken (step S110b). ) The generated key information [α] 202 a which is the same key information [α] as the key information [α] 202 in the non-volatile storage means 200 is reproduced to the logical operation means 100.

If security is taken into consideration, diversification of key information in FIG. 3 is stored in the internal RAM of the CPU of the logic operation means 100 as in the case of the encryption key 101.

By adopting this process, even if an attacker intercepts a signal between the logic operation means 100 and the non-volatile storage means 200, a random number sequence of key length x n unique to the copy random number area 106a is measured for each system. As the key information [α] 202 does not appear on the signal only by (step S111), it is possible to secure the resistance against the man-in-the-middle attack.

Further, since the unique value 104 is used for generation, even if the key information [α] 202 is illegally acquired from the CPU internal RAM of the logic operation means 100, it is stored in the non-volatile storage means 200 of other devices. It is difficult to feed back to the copy random number array area 106a.

100 logical operation means 101 encryption key 102 one-way function Fdiv ()
104 unique value 105 array number generation function Fsel ()
106 Random number array area 106a of logical operation means Copy from random operation means to nonvolatile storage means Random number array area 106b from nonvolatile storage means to logical operation means Copy random number array area 107 select_Entry_x
107a select_Entry_y
200 non-volatile storage means 201 object code 202 key information [α]
202a generated key information [α]
300 Code Generation Means 301 RTM [Core Root of Trust for Measurement]
302 RTS [Root of Trust for Storage]
303 RTR [Root of Trust for Reporting]
304 hash function 305 PCR extension function 400 outside the cryptographic boundary 500 within the cryptographic boundary

Claims (2)

In a system comprising a nonvolatile storage means 200 including at least an object code 201 and data, a code measuring means 300 for performing measurement on the object code 201, and a logic operation means 100 for executing the object code 201, A system characterized in that a one-way function included 102 generates an encryption key for common key encryption from key information [α] 202 included in object code 201 or data and code measurement result 308. A system characterized in that the system unique value is included as an input of the one-way function 102 according to the first paragraph.

Images