CN102339368A

CN102339368A - IP (Internet Protocol) core for measuring BIOS (Basic Input Output System) and measurement method

Info

Publication number: CN102339368A
Application number: CN2011101959197A
Authority: CN
Inventors: 沈昌祥; 王斌; 郑志蓉; 郭灵儿; 金刚; 王宏涛; 鄢斌; 李红; 傅子奇; 蔡谊; 唐金艺; 刘毅
Original assignee: 706th Institute Of No2 Research Institute Casic; PEOPLE'S LIBERATION ARMY NAVY COMPUTING TECHNOLOGY INSTITUTE
Current assignee: 706th Institute Of No2 Research Institute Casic; PEOPLE'S LIBERATION ARMY NAVY COMPUTING TECHNOLOGY INSTITUTE
Priority date: 2011-07-13
Filing date: 2011-07-13
Publication date: 2012-02-01
Anticipated expiration: 2031-07-13
Also published as: CN102339368B

Abstract

The invention discloses an IP (Internet Protocol) core for measuring BIOS (Basic Input Output System) and a measurement method. The IP core comprises an LPC (Low Pin Count) interface module, a high-speed asynchronous FIFO (First-In, First-Out) module, a hash operation module, a measurement value comparison module and an Avalon interface module. The iterative time of a hash algorithm adopted for measuring the BIOS in the four-round iteration process is consistent; and the measurement value comparison module is responsible for comparing the hash result obtained by the hash operation module with an expectant hash value and informing the comparison result of a safety chip main processor through the Avalon interface. The measurement method is operated in parallel by two layers, wherein one layer is in input parallel and the other layer is in hash parallel. The BIOS measurement module disclosed by the invention can be used for processing tasks together with the safety chip, thus the multi-task processing capacity of the system is improved; compared with the prior art, the IP core adopts the streamline design, further has stronger data processing capacity and multi-task processing capacity and can be used for greatly reducing the influence on the system caused by BIOS measurement in the start process of the system.

Description

A kind of IP kernel and measure of BIOS tolerance

Technical field

The present invention relates to a kind of IP kernel of BIOS tolerance, particularly a kind of BIOS tolerance IP kernel towards Trusted Computing.

Background technology

On credible platform, trust chain is a unidirectional delivery chain, and any therebetween node goes wrong, and especially trusted root goes wrong, and will cause whole trusted environment to set up failure.In the common credible platform, BIOS becomes the emphasis of attack as credible tolerance root.Many novel attack meanses like kernel BIOS Rootkit, mainly through malicious code being inserted in the expansion module among the BIOS, start along with the operation of BIOS at present, obtain the control of system.Along with the application gradually of the stronger UEFI BIOS of extendability, BIOS Rootkit also will have more variation, be difficult to more detect and take precautions against.These attack methods, mode are very hidden, are difficult to find, if malicious code enters into kernel or BIOS, and obtain the system management authority, can't prevent system is destroyed or steal canned data in the system.

Summary of the invention

The object of the invention is to provide a kind of IP kernel of the BIOS of having metric function, credible tolerance root is put into safety chip inside carry out physical protection, in the start-up course of system, accomplishes the tolerance verification to BIOS, guarantees the complete transmission of system's trust chain.

The present invention adopts following technological means to realize:

A kind of IP kernel with BIOS metric function is made up of LPC interface module, high-speed asynchronous fifo module, hash computing module, metric comparison module, Avalon interface module; The LPC interface is responsible for reading the BIOS data through lpc bus, and accomplishes the data width conversion, is 32 bit wide data with the data-switching of 4 bit widths of input, and the BIOS data that read are write high-speed asynchronous fifo module; High-speed asynchronous fifo module coupling upstream and downstream data reading speed and translation data width; The input data width of high-speed asynchronous fifo module is 32, and the output data width is 512; The hash computing module carries out the hash computing from disposable 512 bit data of reading in of high-speed asynchronous fifo module, when the hash computing is accomplished, the HASHFIN signal is put 1, and deposits the hash computing in the metric comparison module; The time of the iteration of hash algorithm in the four-wheel iterative process that BIOS tolerance adopts is consistent; The hash result that the metric comparison module is responsible for the hash computing module is obtained and the Hash Value of expection compare, and with comparative result through Avalon interface notice safety chip primary processor.

The level Four streamline is adopted in aforesaid hash computing, and every level production line is accomplished one and taken turns interative computation, and deal with data is passed through the level Four streamline successively, utilize between every level production line with the wide register of data as the data temporarily providing room.

A kind of measure with BIOS metric function divides the two-layer parallel work-flow of carrying out, and wherein one deck is parallel for input, and another layer is parallel for hash; May further comprise the steps:

1, to the input parallel work-flow; The bigger characteristics of quantity of message such as the file of measuring to the needs in the credible platform, code, data; After these compartment, calculate the message digest value of multiple messages simultaneously concurrently with a plurality of hash computing modules;

2, carry out the hash parallel work-flow, the message of each input is divided into a plurality of fixed-size message blocks: piece 1, piece 2...... piece M is if last message blocks less than fixed size, then fills it into fixed size; Then these pieces are carried out the hash computing concurrently, can select simultaneously several message blocks to be carried out the hash computing this moment, rather than the entire message piece of this message; Earlier several message blocks are handled, after its eap-message digest storage, remaining message blocks is proceeded to handle, all handle until whole M message blocks;

3, the M that a calculates eap-message digest is combined into a new message, the new information after the combination is carried out the hash computing, the digest value of its digest value as the message of input.

The present invention compared with prior art has following remarkable advantages and beneficial effect:

The 1BIOS metric module can with the safety chip parallel processing task, improve the multitasking ability of system;

2 adopt The pipeline design, can effectively improve BIOS tolerance speed, reduce the influence of BIOS tolerance to system start-up.

Description of drawings

Fig. 1 forms structural drawing for BIOS tolerance IP kernel;

Fig. 2 calculates synoptic diagram for parallel hash.

Embodiment

Below in conjunction with Figure of description specific embodiment of the present invention is explained:

See also shown in Figure 1ly, be that BIOS tolerance IP kernel forms structural drawing.As can be seen from the figure, this BIOS tolerance IP kernel is made up of LPC interface module, high-speed asynchronous fifo module, hash computing module, metric comparison module, Ava lon interface module.

Computer starting, safety chip are grasped the access control power of BIOS, read the total data of BIOS then, accomplish the hash computing, and compare with BIOS integrity measurement desired value.In BIOS completeness check process; Safety chip can't carry out other initialization operation, in order to reduce the influence of BIOS completeness check to system start-up as far as possible, adopts hardware to realize the BIOS metric module; Accelerate the toggle speed of system on the one hand through the verification speed of accelerating BIOS; The BIOS metrics process is accomplished separately by the BIOS metric module fully on the other hand, and safety chip can other task of parallel processing, effectively improves the multitasking ability of safety chip.

LPC interface module: be responsible for reading the BIOS data, and accomplish the data width conversion, be 32 bit wide data with the data-switching of 4 bit widths of input, and the BIOS data that read are write high-speed asynchronous FIFO through lpc bus.

High-speed asynchronous fifo module: mainly be coupling upstream and downstream data reading speed and translation data width.The input data width of high-speed asynchronous FIFO is 32, and the output data width is 512, and once input just in time makes the hash computing module accomplish a hash computing.

Hash computing module: carry out the hash computing from disposable 512 bit data of reading in of high-speed asynchronous FIFO, when the hash computing is accomplished, the HASHFIN signal is put 1, and deposit the hash computing in the metric comparison module.The hash algorithm that BIOS tolerance adopts is SHA-1, takes turns in the iterative process 4, though every function difference of taking turns iterative process, the time of iteration is almost completely consistent.In order to improve BIOS tolerance speed, the design of 4 level production lines is adopted in hash computing wherein, and every level production line is accomplished one and taken turns interative computation, and deal with data is successively through 4 level production lines, utilize between every level production line with the wide register of data as the data temporarily providing room.Though the practical operation of each message block still needs 80 clock period like this, from whole module, handling a message block but only needs 20 clock period.This makes that under the situation that does not change other hardware configurations the throughput of system has improved four times.

The metric comparison module: the hash result who is responsible for the hash computing module is obtained compares with the Hash Value of expection, and notifies the safety chip primary processor with comparative result through the Avalon interface.

In order further to improve the verification speed of BIOS, bring into play the advantage of FPGA parallel processing simultaneously better, under the situation that does not change hash algorithm, shorten the proving time of BIOS through concurrent designing.To be that branch is two-layer carry out parallel processing to the thinking of this degree of parallelism metering method, shown in accompanying drawing 2.

fixes the hash computing of importing length for having among the figure,

for exporting the combination operation of regular length.

Concrete steps are following:

1, to the parallel processing of message of input.The bigger characteristics of quantity of message such as the file of measuring to the needs in the credible platform, code, data after these compartment, are calculated the message digest value of multiple messages simultaneously concurrently with a plurality of hash computing modules;

2, the second layer then is that message with each input is divided into a plurality of fixed-size message blocks: piece 1, piece 2...... piece M is if last message blocks less than fixed size, then fills it into fixed size.Then these pieces are carried out the hash computing concurrently, can select simultaneously several message blocks to be carried out the hash computing this moment, rather than the entire message piece of this message.Earlier several message blocks are handled, after its eap-message digest storage, remaining message blocks is proceeded to handle, all handle until whole M message blocks.

3, the M that a calculates eap-message digest is combined into a new message, and the new information after the combination is carried out the hash computing, with the digest value of its digest value as the message of input.

Claims

1. the IP kernel with BIOS metric function is made up of LPC interface module, high-speed asynchronous fifo module, hash computing module, metric comparison module, Avalon interface module;

Described LPC interface is responsible for reading the BIOS data through lpc bus, and accomplishes the data width conversion, is 32 bit wide data with the data-switching of 4 bit widths of input, and the BIOS data that read are write high-speed asynchronous fifo module;

Described high-speed asynchronous fifo module coupling upstream and downstream data reading speed and translation data width; The input data width of high-speed asynchronous fifo module is 32, and the output data width is 512;

Described hash computing module carries out the hash computing from disposable 512 bit data of reading in of high-speed asynchronous fifo module, when the hash computing is accomplished, the HASHFIN signal is put 1, and deposits the hash computing in the metric comparison module; The time of the iteration of the hash algorithm that BIOS tolerance adopts in many wheel iterative process is consistent;

The hash result that described metric comparison module is responsible for the hash computing module is obtained and the Hash Value of expection compare, and with comparative result through Avalon interface notice safety chip primary processor.

2. a kind of IP kernel with BIOS metric function according to claim 1 is characterized in that: described many wheel iterative process are the four-wheel iteration.

3. a kind of IP kernel according to claim 1 with BIOS metric function; It is characterized in that: the level Four streamline is adopted in described hash computing; Every level production line is accomplished one and is taken turns interative computation; Deal with data is successively through 4 level production lines, utilize between every level production line with the wide register of data as the data temporarily providing room.

4. measure with BIOS metric function, it is characterized in that branch is two-layer carries out parallel work-flow, and wherein one deck is parallel for input, and another layer walks abreast for hash; May further comprise the steps:

4.1, to the input parallel work-flow; The bigger characteristics of quantity of message such as the file of measuring to the needs in the credible platform, code, data; After these compartment, calculate the message digest value of multiple messages simultaneously concurrently with a plurality of hash computing modules;

4.2, carry out the hash parallel work-flow, the message of each input is divided into a plurality of fixed-size message blocks: piece 1, piece 2...... piece M is if last message blocks less than fixed size, then fills it into fixed size; Then these pieces are carried out the hash computing concurrently, can select simultaneously several message blocks to be carried out the hash computing this moment, rather than the entire message piece of this message; Earlier several message blocks are handled, after its eap-message digest storage, remaining message blocks is proceeded to handle, all handle until whole M message blocks;

4.3, the M that a calculates eap-message digest is combined into a new message, the new information after the combination is carried out the hash computing, with the digest value of message of its digest value as input.