CN107766724A - A kind of construction method of trusted computer platform software stack function structure - Google Patents

Abstract

The present invention discloses a method for constructing a trusted computer platform software stack functional architecture. The trusted computer platform software stack includes, from top to bottom: TSS service provider, TSS core service, TCG device driver library and TPM device driver, and the construction method Including: key management, cryptographic services, secure storage, integrity verification, authorization protocol and certificate management. The multi-level security model of the power service terminal based on the security chip constructed by the construction method of the present invention establishes a trusted software stack at the software layer to provide the system with a tool for measuring application programs, and the system can call the trusted chip through the trusted software stack to realize Measurement of applications; the trusted software stack implements a single entry point that supports the application of trusted platform module functions, provides synchronous access to trusted platform modules, and provides appropriate interfaces for upper-layer applications to hide trusted platform module instructions Stream and manage Trusted Platform Module resources.

Description

A method for constructing the functional architecture of a trusted computer platform software stack

technical field

The invention relates to the technical field of information statistics security, in particular to a method for constructing a functional framework of a trusted computer platform software stack.

Background technique

Trusted computing is proposed in view of the fact that the current computing system cannot fundamentally solve the security problem. By integrating special hardware modules in the computing system to establish a source of trust, using a cryptographic mechanism to establish a chain of trust, and building a reliable computing environment, it provides a platform for computer platforms. The system provides the security foundation.

The trusted computing platform is a support system built in the computing system and used to realize trusted computing functions. It is the source of the trust chain. Only by solving the security problems at the source can the trust chain be established, thereby ensuring the overall security and credibility. The trusted platform module is an important part of the trusted computing platform. The trusted platform module includes cryptographic algorithms, key management, certificate management, cryptographic protocols, and cryptographic services. Attestation and data security storage provide cryptographic support. The Trusted Computing Organization proposes a trusted software stack, and specifies its functional requirements, hierarchical structure, and functional interfaces between layers. TSS is the supporting software of TPM. The TPM chip is a secure hardware module that provides the basic functions of trusted computing. However, due to limited chip resources, it only provides the interface of basic functions externally. Therefore, TSS should be used as the expansion and support system of the TPM chip. , realize the functions of the upper-layer actual application program, and provide the function interface for accessing the TPM function; TSS is the bridge between the TPM and the upper-layer application, which not only enables the functions provided by the TPM to be fully applied, but also enables the upper-layer application to be used conveniently and safely TPM function.

TSS consists of four modules, which are from top to bottom: TSS Service Provider (TSP), TSS Core Service (TCS), TCG Device Driver Library (TDDL), and TPM Device Driver (TDD). Among them, the TSP at the top of the system provides an interface to the user's application program. It packs the parameters from the application program to the TCS module, and the TCS module provides specific functions (such as key management). The parameters of the TSP module are analyzed and manipulated and written into a byte stream that can be recognized by the TPM, which is transmitted to the TPM through TDDL. After receiving the byte stream, the TPM performs corresponding operations and returns the result in the form of a byte stream through TDDL. Go to TCS, after analyzing the byte stream, pass the result to TSP, and TSP returns the formal result to the application program. TDD is a kernel-mode component that receives byte streams from TDDL, sends them to the TPM, and finally returns a response to TDDL.

By calling the interface function provided by the service provider in the trusted software stack, the upper-layer application can use the function, so that trusted computing can be applied to various fields. These areas include security risk management, e-commerce, digital rights management, network authentication and authorization, virtual private network, network intrusion detection, malicious code detection and prevention, etc.

Contents of the invention

Purpose of the invention: In order to overcome the deficiencies of the prior art, the present invention aims to provide a method for constructing the functional architecture of the trusted computer platform software stack.

Technical solution: In order to solve the above technical problems, the present invention provides the following technical solutions:

A method for building a functional architecture of a trusted computer platform software stack, the method for building a functional architecture of a trusted computer platform software stack includes:

(1) Key management: The user calls the TCM_CreateWrapKey command of the hardware module of the trusted computing platform, and the TCM generates a symmetric encryption key or an ECC key pair, which is encrypted and stored with the upper-level key; when creating a key, set the password and migration Password, use the password to authorize the use of encryption and decryption operations, but do not allow the migration password to find the actual password value to authorize the user to migrate the key under a specific public key; when the user needs to use the key, call TCM_LoadWrapKey Command, TCM decrypts with the parent key and loads it into a free area, returns the keyhandle for the user to use;

(2) Cryptography services: The cryptographic algorithms equipped on trusted computer platforms include random number generation algorithms, hash algorithms, message authentication code algorithms, symmetric cryptographic algorithms, and asymmetric cryptographic algorithms;

(3) Secure storage: TCM provides a secure storage function for keys and other sensitive data, ensuring that keys and sensitive information stored in it will not be destroyed, changed, leaked, or used without authorization;

(4) Integrity verification: Integrity verification of trusted computer platforms includes three aspects: integrity measurement, storage and reporting; integrity measurement refers to calculating the measurement value, recording the event to the event log, and recording the measurement value into the corresponding platform In the configuration register PCR; the integrity report means that the TCM provides the verifier with the integrity measurement value of the platform or some components in its protected area, the measurement events in the log and related certificates, and the verifier can judge the platform through the integrity report status; the verifier can judge whether the PCR value comes from the correct measurement process by analyzing the integrity measurement event log information; the trusted computer platform provides the function of reporting the integrity measurement value to the external entity, and the reported measurement value is used as a judgment platform credible sexual grounds;

(5) Authorization protocol: Any entity can submit TCM commands, and a secure communication channel is formed between the entity and the TCM platform, through which TCM commands are submitted and results are returned; the communication channel follows the request for completing session-oriented information exchange- Response semantics, the protocol implements authorization authentication between external entities and TCM, information integrity verification and confidentiality protection of sensitive data;

(6) Certificate management: Digital certificates adopt a public key system, that is, use a pair of matching keys for encryption and decryption; each user sets a specific private key known only to himself. Key, use it to decrypt and sign, and set a public key public key and make it public for encryption and signature verification.

The hardware module TCM of the above-mentioned trusted computing platform provides a cryptographic operation function for the trusted computing platform, and has a protected storage space;

The above-mentioned platform configuration register PCR is located inside the TPM and is only used to load the measurement value of the module, with a size of 160 bits;

The above integrity measurement is introduced to ensure the credibility of the trusted computing platform, which means that any entity that wants to obtain control of the platform must be measured before obtaining control;

The above-mentioned digital certificate is also called "digital ID card" and "digital ID". It is issued by the certification center and digitally signed by the certification center. The true identity of the digital certificate holder;

The above entities are processes, threads or controllers.

Further, the (1) key management reduces key management levels by introducing symmetric algorithms and the concept of "user entity", simplifies key storage protection, and adopts a three-level key management model:

A. The cryptographic module key, storage master key, and authorized data of the platform owner are directly stored inside the trusted cryptographic module and protected by physical security measures of the trusted cryptographic module;

B. Entity encryption key, entity authentication key, entity authority data and other information constitute the entity identity data block, which is encrypted and protected by the storage root key and stored outside the TCM; various application keys, P instruments, etc. owned by the entity The encryption key is encrypted and protected and stored outside the TCM. The platform controls the user's access to the key by setting the entity's permission data;

C. One of the functions of TCM is to create SMI symmetric key and ECC asymmetric key pair. The details of these keys will be stored in TCM after creation, but due to the limited space of TCM, they will be encrypted if necessary. The form is placed in the external storage area. When the key is to be used, it is loaded into the TCM according to the loading steps in the previous section before use.

Further, in (1) key management, key migration must occur in a controlled environment, ensuring that the key is only transferred from one hardware-protected environment to another hardware-protected environment.

Data mobility is an important topic in key management. When data stored on one platform needs to be backed up to another platform, the keys associated with the data must also be migrated to make the data available.

Further, the random number generation algorithm in the (2) cryptographic service is a one-way hash function that turns an unpredictable input into a random number with a byte length;

The symmetric encryption algorithm is to introduce a symmetric encryption algorithm, use the symmetric encryption algorithm to generate an encryption key, and perform encryption and decryption operations inside the TCM;

Asymmetric cryptography algorithms include public key cryptography and key cryptography. The public key cryptography algorithm is the ECC cipher algorithm, and the key bit length is m. The ECC cryptography algorithm includes key pair generation, signature/verification algorithm, encryption and decryption algorithm, and key agreement. etc., the key pair is generated as an ECC key pair, including the private key d and the public key Q, where d is a random positive integer less than n-1, Q is a non-infinity point on the elliptic curve E and Satisfy Q=dG, G is a base point in the curve;

The hash algorithm is SMZ. For a given message with a length of k, the hash algorithm generates a hash value after padding, iterative compression, and selection. The length of the preprocessed message group is bits, and the length of the hash value is bits. The hash function will The message is compressed into unique digital information to ensure the legitimacy and security of the original message. SMZ is a one-way encryption function, and a hash value of the same length will be generated for a message of any length after processing, making it easier to compare the original message Convenience, only the hash value needs to be saved for confidential information. On the one hand, the stored hash value cannot be deciphered so that the original information is fully protected, and there is no need to worry about the hash value being maliciously intercepted even during transmission. On the other hand, the comparison Information is more convenient and secure;

The message authentication code algorithm HMAC requires an encryption hash function and a key.

After the processing of the hash algorithm, even if the original information only changes one letter, the corresponding compressed information will become completely different, which ensures the uniqueness of the processed information; at the same time, SMZ is not encrypted, it is impossible to decrypt the hash value back to the original message.

The above signature and verification algorithm: calculating the digital signature requires the use of a hash algorithm to compress the message to be signed, the input message of the signature algorithm is a summary of the bit length of the message to be signed after being compressed by the hash algorithm, and the verification of the digital signature requires the use of the hash algorithm to treat the signature The message is compressed, and the input message of the verification algorithm is the m-bit digest of the message to be signed after being compressed by the hash algorithm.

The above encryption and decryption algorithm: the ECC encryption algorithm in the platform is used to encrypt sensitive information such as symmetric keys and random numbers, and the byte length of the plaintext information encrypted by ECC is variable. The decryption algorithm outputs plaintext information. When the encrypted information is invalid, the decryption algorithm does not output any plaintext information.

The above-mentioned key negotiation: assume that the two parties of the key negotiation are A and B, and their key pairs are (dA, QA) and (dB, QB) respectively, and the bit length of the key data that both parties need to obtain is klen. The key agreement algorithm is divided into two stages;

The first stage: generate a temporary key pair, user A invokes the key pair generation algorithm to generate a pair of temporary key pair (rA, RA), sends RA to B, user B invokes the key pair generation algorithm to generate a pair of temporary key pair Key pair (rB, RB), send RB to B;

Phase 2: Calculate the shared key data.

Security analysis of the above message authentication code algorithm HMAC:

The message authentication code algorithm HMAC is more like an encryption algorithm. It introduces a key, and its security is not completely dependent on the HASH algorithm used. The security is mainly guaranteed by the following points:

A. The key used is agreed in advance by both parties, and it is impossible for a third party to know. As a third party who illegally intercepts information, the only information that can be obtained is the random number as a "challenge" and the result of a "response". The key is deduced from the data, and a consistent response cannot be forged because the key is not known;

B. The important difference between the message authentication code algorithm HMAC and general encryption is that it is "instantaneous", that is, the authentication is only valid at that time, and after the encryption algorithm is cracked, the previous encryption result may be decrypted.

Further, the safe storage in (3) safe storage includes the following methods:

A. Binding: use the public key to encrypt a message, and the receiver uses the private key to decrypt it. It is a traditional encryption method. If a key is a non-migratable key, it is bound to a specific The non-migratable key in TCM is mainly used for signature;

B. Signature assistance: use the private key to generate a signature to protect the integrity of a message; the signature key is generated and managed by TCM and used to sign the information. Through it and a certain signature algorithm, you can get the platform identity The ciphertext is usually non-migratable; some of the keys are defined as signature keys, and the keys can only be used for signing, but not for encryption operations;

C. Sealing: Add platform status information, that is, certain PCR values, when encrypting messages. When the receiving party decrypts the message, it needs to judge that the platform status of the decrypting party is the same as the PCR value at the time of encryption, otherwise it cannot be decrypted.

D. Sealed signature: When signing, it is associated with certain PCR values to indicate that the platform has reached a certain state requirement when signing.

Further, the (5) authorization agreement also includes:

A. Authorization data: The keys, sensitive data and other data that need to be stored and protected inside the platform are called objects. Each object must have corresponding authorization data. One authorization data can correspond to multiple objects, and must pass the verification of authorization data to access object. The authorization data of the object is input by the user from the platform, and stored after length normalization processing by the hash algorithm; the authentication code of the SMK of the TCM owner is held by the TCM itself, and the authentication code of each entity is obtained by the entity Possessed by itself, the TCM uses the authentication code as full proof that it can verify the identity of the entity. There is no need for other checks. Knowing the authorization data of the object means that you have the right to use the TCM object. Any entity of the requester needs additional protection and requests where it saves the authorization data, but TCM does not;

B. Authorized session: Any entity may have a dialogue with TCM, in order to provide a secure channel for the dialogue between the entity and the TCM platform, through which the secure transmission of interactive data and results can be guaranteed, due to the existence of this requirement , the authentication session is introduced. The purpose of session establishment is to ensure that the access to the TCM object is authenticated. It uses the protocol mechanism of random numbers in turns to prevent replay attacks;

C. Protocol flow: The purpose of the authorization protocol and mechanism is to prove to the TCM that the requester has the right to execute commands and use some objects.

The above-mentioned requester refers to the entity that wishes to execute commands on the TCM or use a special entity.

Further, the protocol of the protocol process meets the following requirements:

1) The AP session is initiated with the TCM_AP_CREATE command and ends with TCM_AP_TERMINATE;

2) The protocol provides an authentication mechanism that uses AuthData as the shared secret to generate a session key, and generates a verification value based on the session key to determine whether the caller has the authority to a certain entity;

3) The protocol provides an integrity protection mechanism. Integrity protection of the data packets in the function call phase with the session key shared by both parties;

4) The calculation in the TCMAPCREATE command is optional;

5) The protocol provides an optional confidentiality protection mechanism. According to the needs, the data packets in the function call phase are encrypted and protected with the session key shared by both parties. IfEncrypted is a sign of whether to encrypt the communication data packets. In special cases, the communication data It has already been encrypted, such as key migration, you can choose not to encrypt the communication data, and the description in the table is the situation where the data packet is encrypted;

6) The protocol provides an anti-replay mechanism. seqNonce is an anti-replay sequence number, which is generated by the TCM and shared between the external caller and the TCM. Both parties maintain the sequence number, and the sequence number is incremented by 1 each time a data packet is sent to prevent replay attacks. .

Further, in (6) certificate management, when sending a confidential document, the sender uses the receiver’s public key to encrypt the data, and the receiver uses its own private key to decrypt, so that the information can be safely and correctly Reach the destination; by using digital certificates, users can get the following guarantees: the information will not be stolen by others except the sender and the receiver, and the information will not be tampered with during transmission. The sender can confirm the identity of the receiver through the digital certificate. The party cannot deny that the information has not been modified since it was digitally signed until it was received, and the issued document is a real document.

Furthermore, the digital certificate adopts the public key mechanism. The program provided by the certificate authority generates a pair of keys for the user. One is a public public key, which will be published in the user's digital certificate and stored in the digital certificate certification center. One is the private private key, which will be stored on the user's computer.

Further, the digital certificate needs to carry out authentication communication and confidential communication. For authentication communication, the sender uses its own private key to encrypt the plaintext, and the receiver uses the sender’s public key to decrypt the ciphertext; for confidential communication, the sender uses The recipient's public key encrypts the plaintext, and the recipient uses its own private key to decrypt the ciphertext.

In the above-mentioned authentication communication, the receiver uses the sender's public key to decrypt, so it can be sure that the information is encrypted by the sender, and the identity of the sender can be identified; The information decryption, so that secure communication can be realized.

Beneficial effects: the construction method of the trusted software stack functional framework of the present invention, the constructed multi-level security model of the power service terminal based on the security chip, establishes a trusted software stack at the software layer, and provides the system with tools for measuring application programs, and the system can The trusted chip is called by the trusted software stack to realize the measurement of the application program; the trusted software stack implements a single entry point that supports the application of the trusted platform module function, provides synchronous access to the trusted platform module, and provides upper-layer applications with Appropriate interfaces to hide the instruction flow of the TPM and manage TPM resources.

Description of drawings

Fig. 1 is a functional architecture diagram of the trusted computer platform software stack of the present invention;

Fig. 2 is a flow chart of platform integrity verification in the trusted computer platform software stack of the present invention;

Fig. 3 is a process diagram of key generation and loading in the present invention.

Detailed ways

Example 1

As shown in Figure 1-3, a method for constructing the functional architecture of the trusted computer platform software stack, the method for constructing the functional architecture of the trusted computer platform software stack includes:

(1) Key management: The user calls the TCM_CreateWrapKey command of the hardware module of the trusted computing platform, and the TCM generates a symmetric encryption key or an ECC key pair, which is encrypted and stored with the upper-level key; when creating a key, set the password and migration Password, use the password to authorize the use of encryption and decryption operations, but do not allow the migration password to find the actual password value to authorize the user to migrate the key under a specific public key; when the user needs to use the key, call TCM_LoadWrapKey command, TCM decrypts with the parent key and loads it into a free area, and returns the keyhandle for the user; by introducing the symmetric algorithm and the concept of "user entity", the key management level is reduced, the key storage protection is simplified, and the key storage protection is adopted Three-level key management mode:

A. The cryptographic module key, storage master key, and authorized data of the platform owner are directly stored inside the trusted cryptographic module and protected by physical security measures of the trusted cryptographic module;

B. Entity encryption key, entity authentication key, entity authority data and other information constitute the entity identity data block, which is encrypted and protected by the storage root key and stored outside the TCM; various application keys, P instruments, etc. owned by the entity The encryption key is encrypted and protected and stored outside the TCM. The platform controls the user's access to the key by setting the entity's permission data;

C. One of the functions of TCM is to create SMI symmetric key and ECC asymmetric key pair. The details of these keys will be stored in TCM after creation, but due to the limited space of TCM, they will be encrypted if necessary. The form is placed in the external storage area. When the key is to be used, it is loaded into the TCM according to the loading steps in the previous section before use;

Data mobility is an important topic in key management. When data stored on one platform needs to be backed up to another platform, the keys related to the data must also be migrated to make the data available; migration keys This must occur in a controlled environment, ensuring that keys are only transferred from one hardware-protected environment to another.

(2) Cryptography services: The cryptographic algorithms equipped on trusted computer platforms include random number generation algorithms, hash algorithms, message authentication code algorithms, symmetric cryptographic algorithms, and asymmetric cryptographic algorithms;

A. Random number generation algorithm: a one-way hash function turns an unpredictable input into a random number with a byte length;

B. Symmetric encryption algorithm: introduce a symmetric encryption algorithm, use the symmetric encryption algorithm to generate an encryption key, and perform encryption and decryption operations inside the TCM;

C. Asymmetric cryptographic algorithm: The public key cryptographic algorithm is ECC cryptographic algorithm, and the key bit length is m. ECC cryptographic algorithm includes key pair generation, signature/verification algorithm, encryption and decryption algorithm, and key negotiation.

Key pair generation: ECC key pair includes private key d and public key Q, where d is a random positive integer less than n-1, Q is a non-infinity point on the elliptic curve E and satisfies Q=dG , G is a base point in the curve;

Signature and Verification Algorithm: To calculate a digital signature, a hash algorithm is required to compress the message to be signed. The input message of the signature algorithm is a summary of the bit length of the message to be signed after being compressed by the hash algorithm. To verify a digital signature, a hash algorithm is required to treat the signed message Compression, the input message of the verification algorithm is a summary of the length of m bits after the message to be signed is compressed by the hash algorithm;

Encryption and decryption algorithm: The ECC encryption algorithm in the platform is used to encrypt sensitive information such as symmetric keys and random numbers, and the byte length of the plaintext information encrypted by ECC is variable. The decryption algorithm outputs plaintext information. When the encrypted information is invalid, the decryption algorithm does not output any plaintext information;

Key negotiation: Let A and B be the two parties in the key negotiation, and their key pairs are (dA, QA) and (dB, QB) respectively, and the bit length of the key data that both parties need to obtain is klen. The key agreement algorithm is divided into two stages;

The first stage: generate a temporary key pair, user A invokes the key pair generation algorithm to generate a pair of temporary key pair (rA, RA), sends RA to B, user B invokes the key pair generation algorithm to generate a pair of temporary key pair Key pair (rB, RB), send RB to B;

The second stage: calculate the shared key data;

D. Hash algorithm: The hash algorithm is SMZ. For a given message with a length of k, the hash algorithm generates a hash value through padding, iterative compression, and selection. The length of the preprocessed message group is bits, and the length of the hash value is Bit, the hash function compresses the message into unique digital information to ensure the legitimacy and security of the original message. After the hash algorithm is processed, even if the original information is only changed by one letter, the corresponding compressed information will become completely different. This ensures the uniqueness of the processed information; at the same time, SMZ is not encrypted, it is impossible to decrypt the hash value back to the original message; SMZ is a one-way encryption function, and will generate the same length for any length of message after processing The hash value makes it more convenient to compare the original message. For confidential information, only the hash value needs to be saved. On the one hand, the stored hash value cannot be deciphered so that the original information is fully protected, and there is no need to worry about the hash value being destroyed even during transmission. Malicious interception, on the other hand, is more convenient and safer than information manipulation;

E. Message authentication code algorithm: The message authentication code algorithm HMAC requires an encryption hash function and a key.

Security analysis of message authentication code algorithm HMAC:

The message authentication code algorithm HMAC is more like an encryption algorithm. It introduces a key, and its security is not completely dependent on the HASH algorithm used. The security is mainly guaranteed by the following points:

A. The key used is agreed in advance by both parties, and it is impossible for a third party to know. As a third party who illegally intercepts information, the only information that can be obtained is the random number as a "challenge" and the result of a "response". The key is deduced from the data, and a consistent response cannot be forged because the key is not known;

B. The important difference between the message authentication code algorithm HMAC and general encryption is that it is "instantaneous", that is, the authentication is only valid at that time, and after the encryption algorithm is cracked, the previous encryption result may be decrypted.

(3) Secure storage: TCM provides secure storage functions for keys and other sensitive data, ensuring that the stored keys and sensitive information will not be destroyed, changed, leaked, or used without authorization; secure storage includes: The following ways:

A. Binding: use the public key to encrypt a message, and the receiver uses the private key to decrypt it. It is a traditional encryption method. If a key is a non-migratable key, it is bound to a specific The non-migratable key in TCM is mainly used for signature;

B. Signature assistance: use the private key to generate a signature to protect the integrity of a message; the signature key is generated and managed by TCM and used to sign the information. Through it and a certain signature algorithm, you can get the platform identity The ciphertext is usually non-migratable; some of the keys are defined as signature keys, and the keys can only be used for signing, but not for encryption operations;

C. Sealing: Add platform status information, that is, certain PCR values, when encrypting messages. When the receiving party decrypts the message, it needs to judge that the platform status of the decrypting party is the same as the PCR value at the time of encryption, otherwise it cannot be decrypted.

D. Sealed signature: When signing, it is associated with certain PCR values to indicate that the platform has reached a certain state requirement when signing.

(4) Integrity verification: Integrity verification of trusted computer platforms includes three aspects: integrity measurement, storage and reporting; integrity measurement refers to calculating the measurement value, recording the event to the event log, and recording the measurement value into the corresponding platform In the configuration register PCR; Integrity measurement is introduced to ensure the credibility of the trusted computing platform, which means that any entity that wants to gain control of the platform must be measured before obtaining control; The verifier provides the integrity measurement value of the platform or some components in its protected area, the measurement events in the log and related certificates, and the verifier can judge the status of the platform through the integrity report; the verifier can analyze the integrity measurement event log The information judges whether the PCR value comes from the correct measurement process; the trusted computer platform provides the function of reporting the integrity measurement value to the external entity, and the reported measurement value is used as the basis for judging the credibility of the platform.

(5) Authorization protocol: any entity (process, thread or controller) can submit a TCM command, and a secure communication channel is formed between the entity and the TCM platform, through which the TCM command is submitted and the result is returned; the communication channel is completed Session-oriented information exchange follows request-response semantics, and the protocol implements authorization authentication between external entities and TCM, information integrity verification, and confidentiality protection of sensitive data:

A. Authorization data: The keys, sensitive data and other data that need to be stored and protected inside the platform are called objects. Each object must have corresponding authorization data. One authorization data can correspond to multiple objects, and must pass the verification of authorization data to access object. The authorization data of the object is input by the user from the platform, and stored after length normalization processing by the hash algorithm; the authentication code of the SMK of the TCM owner is held by the TCM itself, and the authentication code of each entity is obtained by the entity Possessed by itself, the TCM uses the authentication code as full proof that it can verify the identity of the entity. No further checks are needed, knowing the authorizationdata of an object indicates the right to use the TCM object, any entity that is requesting (wishing to execute commands on the TCM or use a special entity) needs additional protection where it stores authorization data and requests, while TCM does not;

B. Authorized session: Any entity may have a dialogue with TCM, in order to provide a secure channel for the dialogue between the entity and the TCM platform, through which the secure transmission of interactive data and results can be guaranteed, due to the existence of this requirement , the authentication session is introduced. The purpose of session establishment is to ensure that the access to the TCM object is authenticated. It uses the protocol mechanism of random numbers in turns to prevent replay attacks;

C. Protocol flow: The purpose of the authorization protocol and mechanism is to prove to the TCM that the requester has the right to execute commands and use some objects. The protocol meets the following requirements:

1) The AP session is initiated with the TCM_AP_CREATE command and ends with TCM_AP_TERMINATE;

2) The protocol provides an authentication mechanism that uses AuthData as the shared secret to generate a session key, and generates a verification value based on the session key to determine whether the caller has the authority to a certain entity;

3) The protocol provides an integrity protection mechanism. Integrity protection of the data packets in the function call phase with the session key shared by both parties;

4) The calculation in the TCMAPCREATE command is optional;

5) The protocol provides an optional confidentiality protection mechanism. According to the needs, the data packets in the function call phase are encrypted and protected with the session key shared by both parties. IfEncrypted is a sign of whether to encrypt the communication data packets. In special cases, the communication data It has already been encrypted, such as key migration, you can choose not to encrypt the communication data, and the description in the table is the situation where the data packet is encrypted;

6) The protocol provides an anti-replay mechanism. seqNonce is an anti-replay sequence number, which is generated by the TCM and shared between the external caller and the TCM. Both parties maintain the sequence number, and the sequence number is incremented by 1 each time a data packet is sent to prevent replay attacks. .

(6) Certificate management: Digital certificates are also called "digital ID cards" and "digital IDs". They are issued by the certification center and digitally signed by the certification center. documents, used to prove the true identity of the holder of the digital certificate; the digital certificate adopts the public key system, that is, a pair of matching keys is used for encryption and decryption; each user sets a specific Known private key private key, use it to decrypt and sign at the same time set a public key public key and make it public for encryption and signature verification; when sending a confidential document, the sender uses the receiving The party's public key encrypts the data, and the receiver uses its own private key to decrypt, so that the information can reach the destination safely and without error; by using digital certificates, the user can obtain the following guarantees: The information will not be stolen by others. The information will not be tampered with during transmission. The sender can confirm the identity of the receiver through digital certificate. The files are real files.

The digital certificate adopts the public key mechanism. The program provided by the certificate authority generates a pair of keys for the user. One is the public public key, which will be published in the user's digital certificate and stored in the digital certificate certification center, and the other is the public key. The private private key, which will be stored on the user's computer.

Digital certificates need to carry out authentication communication and confidential communication. In authentication communication, the sender uses its own private key to encrypt the plaintext, and the receiver uses the sender’s public key to decrypt the ciphertext. It can be sure that the information is encrypted by the sender, and The identity of the sender can be identified; the confidential communication is that the sender uses the receiver's public key to encrypt the plaintext, and the receiver uses its own private key to decrypt the ciphertext; since only the receiver can encrypt the plaintext encrypted by its own public key The information decryption, so that secure communication can be realized.

The trusted computer platform will provide at least the following three basic attribute functions:

(1) Protect storage

It is an instruction set that enables exclusive access to protected areas. The protected area is an area where sensitive data can be safely operated. TPM uses protected storage and platform integrity measurement reports to achieve protection capabilities. Protected storage is a trusted way to perform computations and protect stored data. TPM provides a secure storage function for keys and other sensitive data, ensuring that the keys and sensitive information stored in it will not be destroyed, changed, leaked, and used without authorization to protect the implementation of storage.

(2) Integrity measurement, storage and reporting of the platform

It is mainly used for credible description of platform configuration information. It is a process of obtaining platform indicators that affect the integrity of the platform, storing these indicators and storing the summary information of these indicators in the platform configuration register. The starting point for measurement is called the root of trust for measurement. A static measurement root of trust is derived from a startup state such as power-on self-test. A measured dynamic root of trust results from a transition from an untrusted state to a trusted state. Sitting between integrity measurement and integrity reporting is integrity storage. Integrity storage stores integrity metrics in log files and a summary of those metrics in platform configuration registers. Integrity reporting is the process of proving the integrity of stored content. The methods of integrity measurement, storage and reporting require that the platform can enter any possible state including undesired and unsafe states, but the platform is not allowed to report its state fraudulently.

(3) Identity certificate

Proof is a process to ensure the accuracy of information, and it is a platform's proof of platform attributes that affect the integrity of the platform. All forms of proof require trustworthy evidence of the entity to be proved. In essence, this means that a trusted platform should be able to protect against attacks, have the ability to prove the integrity of its platform code and data, implement protection for code execution, and maintain the confidentiality of sensitive information. To ensure trustworthiness, a trusted platform can reliably measure any attribute index about itself and prove it. Some useful attribute indicators include platform loaded software and any hardware devices. Users will have to review whether these attribute indicators are consistent with the trustworthy values obtained separately to decide whether the platform is trustworthy.

Therefore, a trusted computing software stack must include cryptographic algorithms, key management, certificate management, cryptographic protocols, and cryptographic services to provide cryptographic support for the platform's own integrity, identity credibility, and data security.

Platform integrity verification includes three aspects: integrity measurement, storage and reporting. Integrity measurement refers to calculating the measurement value, recording the event to the event log, and recording the measurement value into the corresponding PCR. Integrity measurement is introduced to ensure the credibility of the trusted computing platform. It means that any entity that wants to gain control of the platform must be measured before gaining control. Integrity report means that TCM provides the verifier with the measured value of the integrity of the platform or some components in its protected area, the measured events in the log and related certificates, and the verifier can judge the status of the platform through the integrity report. The verifier can judge whether the PCR value comes from the correct measurement process by analyzing the integrity measurement event log information. The platform provides the function of integrity measurement report to external entities, and the reported measurement value is used as the basis for judging the credibility of the platform. The specific process is as follows:

①An external entity that wants to gain control of the platform requests the platform to send an integrity measurement report;

②The trusted computing platform based on autonomous cryptography receives the request sent by the entity;

③ The trusted cryptographic module in the trusted platform collects the PCR value;

④ PIK (signature key) signs the PCR value and returns it to the external entity;

⑤ The external entity verifies the PIK certificate and PCR signature;

⑥ The external entity compares the PCR value with the platform integrity benchmark value to determine whether the current platform status is credible.

By calling the TCM_Create_WrapKey command, the TCM generates a symmetric encryption key or key pair, and stores them encrypted with the upper-level key. Two passwords can be set when creating a key: a usage password and a migration password. Use a password for authorization of use for encryption and decryption operations, but does not allow discovery of the actual password value. Migration ciphers authorize users to migrate a key under a specific public key.

When the user needs to use the key, call the TCM_LoadKey command, decrypt it with the parent key and load it into a free area, and return the keyhandle for the user to use.

The technologies not mentioned in the present invention are all prior art.

Claims (10)

1. A method for building a trusted computer platform software stack functional architecture, characterized in that: the method for building a trusted computer platform software stack functional architecture includes: (1) Key management: The user calls the TCM_CreateWrapKey command of the hardware module of the trusted computing platform, and the TCM generates a symmetric encryption key or an ECC key pair, which is encrypted and stored with the upper-level key; when creating a key, set the password and migration Password, use the password to authorize the use of encryption and decryption operations, but do not allow the migration password to find the actual password value to authorize the user to migrate the key under a specific public key; when the user needs to use the key, call TCM_LoadWrapKey Command, TCM decrypts with the parent key and loads it into a free area, returns the keyhandle for the user to use; (2) Cryptography services: The cryptographic algorithms equipped on trusted computer platforms include random number generation algorithms, hash algorithms, message authentication code algorithms, symmetric cryptographic algorithms, and asymmetric cryptographic algorithms; (3) Secure storage: TCM provides a secure storage function for keys and other sensitive data, ensuring that keys and sensitive information stored in it will not be destroyed, changed, leaked, or used without authorization; (4) Integrity verification: Integrity verification of trusted computer platforms includes three aspects: integrity measurement, storage and reporting; integrity measurement refers to calculating the measurement value, recording the event to the event log, and recording the measurement value into the corresponding platform In the configuration register PCR; the integrity report means that the TCM provides the verifier with the integrity measurement value of the platform or some components in its protected area, the measurement events in the log and related certificates, and the verifier can judge the platform through the integrity report status; the verifier can judge whether the PCR value comes from the correct measurement process by analyzing the integrity measurement event log information; the trusted computer platform provides the function of reporting the integrity measurement value to the external entity, and the reported measurement value is used as a judgment platform credible sexual grounds; (5) Authorization protocol: Any entity can submit TCM commands, and a secure communication channel is formed between the entity and the TCM platform, through which TCM commands are submitted and results are returned; the communication channel follows the request for completing session-oriented information exchange- Response semantics, the protocol implements authorization authentication between external entities and TCM, information integrity verification and confidentiality protection of sensitive data; (6) Certificate management: Digital certificates adopt a public key system, that is, use a pair of matching keys for encryption and decryption; each user sets a specific private key known only to himself. Key, use it to decrypt and sign, and set a public key public key and make it public for encryption and signature verification. 2. The construction method of the trusted computer platform software stack functional architecture according to claim 1, characterized in that: in the (1) key management, the level of key management is reduced by introducing symmetric algorithms and the concept of "user entity" , simplify key storage protection, and adopt a three-level key management model: A. The cryptographic module key, storage master key, and authorized data of the platform owner are directly stored inside the trusted cryptographic module and protected by physical security measures of the trusted cryptographic module; B. Entity encryption key, entity authentication key, entity authority data and other information constitute the entity identity data block, which is encrypted and protected by the storage root key, and stored outside the TCM; various application keys and P instruments owned by the entity are controlled by the entity The encryption key is encrypted and protected and stored outside the TCM. The platform controls the user's access to the key by setting the entity's permission data; C. One of the functions of TCM is to create SMI symmetric key and ECC asymmetric key pair. The details of these keys will be stored in TCM after creation, but due to the limited space of TCM, they will be encrypted if necessary. The form is placed in the external storage area. When the key is to be used, it is loaded into the TCM according to the loading steps in the previous section before use. 3. the construction method of trusted computer platform software stack functional architecture according to claim 1, is characterized in that: in described (1) key management, migration key must take place in the controlled environment, guarantee key Only move from one hardware-protected environment to another. 4. the construction method of trusted computer platform software stack functional framework according to claim 1, it is characterized in that: in described (2) cryptography service, random number generation algorithm is a one-way hash function will an unpredictable The input becomes a random number with a byte length; The symmetric encryption algorithm is to introduce a symmetric encryption algorithm, use the symmetric encryption algorithm to generate an encryption key, and perform encryption and decryption operations inside the TCM; Asymmetric cryptography algorithms include public key cryptography and key cryptography. The public key cryptography algorithm is the ECC cipher algorithm, and the key bit length is m. The ECC cryptography algorithm includes key pair generation, signature/verification algorithm, encryption and decryption algorithm, and key agreement. etc., the key pair is generated as an ECC key pair, including the private key d and the public key Q, where d is a random positive integer less than n-1, and Q is a non-infinity point on the elliptic curve E, And satisfy Q=dG, G is a base point in the curve; The hash algorithm is SMZ. For a given message with a length of k, the hash algorithm generates a hash value after padding, iterative compression, and selection. The length of the preprocessed message group is bits, and the length of the hash value is bits. The hash function will The message is compressed into unique digital information to ensure the legitimacy and security of the original message. SMZ is a one-way encryption function, and a hash value of the same length will be generated for a message of any length after processing, making it easier to compare the original message Convenience, only the hash value needs to be saved for confidential information. On the one hand, the stored hash value cannot be deciphered so that the original information is fully protected, and there is no need to worry about the hash value being maliciously intercepted even during transmission. On the other hand, the comparison Information is more convenient and secure; The message authentication code algorithm HMAC requires an encryption hash function and a key. 5. the building method of trusted computer platform software stack functional architecture according to claim 4, is characterized in that: safe storage in described (3) safe storage comprises the following several modes: A. Binding: use the public key to encrypt a message, and the receiver uses the private key to decrypt it. It is a traditional encryption method. If a key is a non-migratable key, it is bound to a specific The non-migratable key in TCM is mainly used for signature; B. Signature assistance: use the private key to generate a signature to protect the integrity of a message; the signature key is generated and managed by TCM and used to sign the information. Through it and a certain signature algorithm, you can get the platform identity The ciphertext is usually non-migratable; some of the keys are defined as signature keys, and the keys can only be used for signing, but not for encryption operations; C. Sealing: Add platform status information, that is, certain PCR values, when encrypting messages. When the receiving party decrypts the message, it needs to judge that the platform status of the decrypting party is the same as the PCR value at the time of encryption, otherwise it cannot be decrypted. D. Sealed signature: When signing, it is associated with certain PCR values to indicate that the platform has reached a certain state requirement when signing. 6. according to the construction method of the trusted computer platform software stack functional framework described in any one of claim 1-5, it is characterized in that: described (5) authorization agreement also comprises: A. Authorization data: The keys, sensitive data and other data that need to be stored and protected inside the platform are called objects. Each object must have corresponding authorization data. One authorization data can correspond to multiple objects, and must pass the verification of authorization data to access object. The authorization data of the object is input by the user from the platform and stored after length normalization processing by the hash algorithm; the authentication code of the SMK of the TCM owner is held by the TCM itself, and the authentication code of each entity is obtained by the entity Possessed by itself, the TCM uses the authentication code as full proof that it can verify the identity of the entity. There is no need for other checks. Knowing the authorization data of the object means that you have the right to use the TCM object. Any entity of the requester needs additional protection and requests where it saves the authorization data, but TCM does not; B. Authorized session: Any entity may have a dialogue with TCM, in order to provide a secure channel for the dialogue between the entity and the TCM platform, through which the secure transmission of interactive data and results can be guaranteed, due to the existence of this requirement , the authentication session is introduced. The purpose of session establishment is to ensure that the access to the TCM object is authenticated. It uses the protocol mechanism of random numbers in turns to prevent replay attacks; C. Protocol flow: The purpose of the authorization protocol and mechanism is to prove to the TCM that the requester has the right to execute commands and use some objects. 7. The construction method of the trusted computer platform software stack functional framework according to claim 6, characterized in that: the protocol of the protocol flow meets the following requirements: 1) The AP session is initiated with the TCM_AP_CREATE command and ends with TCM_AP_TERMINATE; 2) The protocol provides an authentication mechanism that uses AuthData as the shared secret to generate a session key, and generates a verification value based on the session key to determine whether the caller has the authority to a certain entity; 3) The protocol provides an integrity protection mechanism. Integrity protection of the data packets in the function call phase with the session key shared by both parties; 4) The calculation in the TCMAPCREATE command is optional; 5) The protocol provides an optional confidentiality protection mechanism. According to the needs, the data packets in the function call phase are encrypted and protected with the session key shared by both parties. IfEncrypted is a sign of whether to encrypt the communication data packets. In special cases, the communication data It has already been encrypted, such as key migration, you can choose not to encrypt the communication data, and the description in the table is the situation where the data packet is encrypted; 6) The protocol provides an anti-replay mechanism. seqNonce is an anti-replay sequence number, which is generated by the TCM and shared between the external caller and the TCM. Both parties maintain the sequence number, and the sequence number is incremented by 1 each time a data packet is sent to prevent replay attacks. . 8. According to the construction method of the trusted computer platform software stack functional framework described in any one of claims 1-5, it is characterized in that: in the (6) certificate management, when sending a confidential file, the sender uses The recipient's public key encrypts the data, and the recipient uses its own private key to decrypt it, so that the information can reach the destination safely and without error; by using digital certificates, the user can obtain the following guarantees: the information is separated from the sender and the recipient The information will not be stolen by others, and the information will not be tampered with during transmission. The sender can confirm the identity of the receiver through the digital certificate. Documents issued are authentic documents. 9. The construction method of the trusted computer platform software stack functional architecture according to claim 8, characterized in that: the digital certificate adopts a public key mechanism, and the program provided by the certificate authority generates a pair of keys for the user, one of which is public The public key, which will be published in the user's digital certificate and stored in the digital certificate certification authority, and the other is the private private key, which will be stored on the user's computer. 10. The construction method of the trusted computer platform software stack functional framework according to claim 9, wherein: the digital certificate will carry out authentication communication and confidential communication, and the authentication communication is that the sender uses his own private key to carry out plaintext In encryption, the receiver uses the sender's public key to decrypt the ciphertext; in confidential communication, the sender uses the receiver's public key to encrypt the plaintext, and the receiver uses its own private key to decrypt the ciphertext.