CN111264044A - 芯片、生成私钥的方法和可信证明的方法 - Google Patents

芯片、生成私钥的方法和可信证明的方法 Download PDF

Info

Publication number
CN111264044A
CN111264044A CN201880064343.0A CN201880064343A CN111264044A CN 111264044 A CN111264044 A CN 111264044A CN 201880064343 A CN201880064343 A CN 201880064343A CN 111264044 A CN111264044 A CN 111264044A
Authority
CN
China
Prior art keywords
layer1
secure
firmware
chip
memory
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201880064343.0A
Other languages
English (en)
Other versions
CN111264044B (zh
Inventor
蔡恒
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Publication of CN111264044A publication Critical patent/CN111264044A/zh
Application granted granted Critical
Publication of CN111264044B publication Critical patent/CN111264044B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3265—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate chains, trees or paths; Hierarchical trust model
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Power Engineering (AREA)
  • Storage Device Security (AREA)

Abstract

一种芯片(700)、生成私钥的方法和可信证明的方法，该芯片(700)包括安全核模块(710)，该安全核模块(710)包括：安全核(711)和存储器(712)，其中，该安全核模块(710)对于该芯片(700)的除该安全核模块(710)外的外部模块访问隔离，且该安全核模块(710)对于该芯片(700)以外的外部设备访问隔离；该存储器(712)，用于保存第一根公钥哈希和该芯片(700)的唯一设备秘密UDS；该安全核(711)，用于根据该第一根公钥哈希和该UDS生成层1公钥和层1私钥；该存储器(712)，用于保存该层1私钥。本方案可以减少攻击者获取到层1私钥，并利用层1私钥对篡改后的固件或信息进行可信证明的可能性。

Description

PCT国内申请，说明书已公开。

Claims (17)

  1. PCT国内申请，权利要求书已公开。
CN201880064343.0A 2018-10-09 2018-10-09 芯片、生成私钥的方法和可信证明的方法 Active CN111264044B (zh)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/109537 WO2020073206A1 (zh) 2018-10-09 2018-10-09 芯片、生成私钥的方法和可信证明的方法

Publications (2)

Publication Number Publication Date
CN111264044A true CN111264044A (zh) 2020-06-09
CN111264044B CN111264044B (zh) 2021-11-19

Family

ID=70164436

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201880064343.0A Active CN111264044B (zh) 2018-10-09 2018-10-09 芯片、生成私钥的方法和可信证明的方法

Country Status (4)

Country Link
US (2) US11722300B2 (zh)
EP (1) EP3809625A4 (zh)
CN (1) CN111264044B (zh)
WO (1) WO2020073206A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111917756A (zh) * 2020-07-27 2020-11-10 杭州叙简科技股份有限公司 一种执法记录仪基于公钥路由的加密系统及加密方法
CN112367165A (zh) * 2020-10-19 2021-02-12 珠海格力电器股份有限公司 串口通信方法、装置、电子设备和计算机可读介质
CN114095172A (zh) * 2020-07-02 2022-02-25 中国移动通信集团设计院有限公司 无线接口前传数据校验方法及装置
CN116567624A (zh) * 2023-07-10 2023-08-08 南京邮电大学 一种5g馈线终端通信安全防护方法、装置及存储介质
WO2023160166A1 (zh) * 2022-02-28 2023-08-31 华为技术有限公司 一种可信计算方法、芯片以及服务器

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3656577A1 (en) * 2018-11-21 2020-05-27 Thales Dis France SA In-the-field patching of an operating system using a digital certificate extension
CN112417422B (zh) * 2020-11-23 2024-06-18 深圳市中易通安全芯科技有限公司 安全芯片升级方法及计算机可读存储介质
US20220222348A1 (en) * 2021-01-13 2022-07-14 Microsoft Technology Licensing, Llc Attesting update of a firmware layer
US11522723B2 (en) * 2021-03-01 2022-12-06 Hewlett Packard Enterprise Development Lp Secure provisiong of baseboard management controller identity of a platform
US20240143769A1 (en) * 2022-10-26 2024-05-02 Dell Products L.P. Identity-based verification of software code layers
CN118133326B (zh) * 2024-05-07 2024-07-05 沐曦科技(北京)有限公司 一种基于芯片的数据加密传输系统

Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1421000A (zh) * 2000-03-31 2003-05-28 英特尔公司 生成用在隔离执行环境中的密钥层组
CN1553349A (zh) * 2003-05-29 2004-12-08 联想(北京)有限公司 一种安全芯片及基于该芯片的信息安全处理设备和方法
CN101430747A (zh) * 2008-09-26 2009-05-13 武汉大学 基于可信嵌入式平台的移动设备及其安全存储方法
CN102123031A (zh) * 2009-12-23 2011-07-13 英特尔公司 硬件认证技术
US20140010371A1 (en) * 2012-07-09 2014-01-09 Roger I. Khazan Cryptography and key management device and architecture
CN103514414A (zh) * 2012-06-26 2014-01-15 上海盛轩网络科技有限公司 一种基于ARM TrustZone的加密方法及加密系统
US9037875B1 (en) * 2007-05-22 2015-05-19 Marvell International Ltd. Key generation techniques
US20160301671A1 (en) * 2015-04-09 2016-10-13 Web Sensing, Llc System-on-chip data security appliance and methods of operating the same
CN107908574A (zh) * 2017-11-22 2018-04-13 深圳华中科技大学研究院 固态盘数据存储的安全保护方法
CN108429719A (zh) * 2017-02-14 2018-08-21 华为技术有限公司 密钥保护方法及装置
CN108460282A (zh) * 2017-02-22 2018-08-28 北京大学 一种基于异构多核芯片的计算机安全启动方法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPWO2008117556A1 (ja) * 2007-03-28 2010-07-15 日本電気株式会社 ログ取得システム、ログ収集端末、ログ取得端末、それらを用いたログ取得方法及びプログラム
JP6175603B2 (ja) * 2012-03-19 2017-08-09 ロイヤルティ ペイズ ホールディングス コーポレイション 資産記憶と移送システムにおける外部ログ記憶
GB2520489A (en) * 2013-11-20 2015-05-27 Ibm Deletion of content in digital storage systems
US20170277898A1 (en) * 2016-03-25 2017-09-28 Advanced Micro Devices, Inc. Key management for secure memory address spaces
US20180198620A1 (en) * 2017-01-11 2018-07-12 Raptor Engineering, LLC Systems and methods for assuring data on leased computing resources
CN110546939B (zh) * 2017-04-26 2022-07-26 维萨国际服务协会 用于记录表示多个交互的数据的系统和方法
DE102018208066A1 (de) * 2018-05-23 2019-11-28 Robert Bosch Gmbh Datenverarbeitungseinrichtung und Betriebsverfahren hierfür

Patent Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1421000A (zh) * 2000-03-31 2003-05-28 英特尔公司 生成用在隔离执行环境中的密钥层组
CN1553349A (zh) * 2003-05-29 2004-12-08 联想(北京)有限公司 一种安全芯片及基于该芯片的信息安全处理设备和方法
US9037875B1 (en) * 2007-05-22 2015-05-19 Marvell International Ltd. Key generation techniques
CN101430747A (zh) * 2008-09-26 2009-05-13 武汉大学 基于可信嵌入式平台的移动设备及其安全存储方法
CN102123031A (zh) * 2009-12-23 2011-07-13 英特尔公司 硬件认证技术
CN103514414A (zh) * 2012-06-26 2014-01-15 上海盛轩网络科技有限公司 一种基于ARM TrustZone的加密方法及加密系统
US20140010371A1 (en) * 2012-07-09 2014-01-09 Roger I. Khazan Cryptography and key management device and architecture
US20160301671A1 (en) * 2015-04-09 2016-10-13 Web Sensing, Llc System-on-chip data security appliance and methods of operating the same
CN108429719A (zh) * 2017-02-14 2018-08-21 华为技术有限公司 密钥保护方法及装置
CN108460282A (zh) * 2017-02-22 2018-08-28 北京大学 一种基于异构多核芯片的计算机安全启动方法
CN107908574A (zh) * 2017-11-22 2018-04-13 深圳华中科技大学研究院 固态盘数据存储的安全保护方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
高东飞: "PCI密码卡的设计与实现", 《中国优秀硕士学位论文全文数据库》 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114095172A (zh) * 2020-07-02 2022-02-25 中国移动通信集团设计院有限公司 无线接口前传数据校验方法及装置
CN111917756A (zh) * 2020-07-27 2020-11-10 杭州叙简科技股份有限公司 一种执法记录仪基于公钥路由的加密系统及加密方法
CN112367165A (zh) * 2020-10-19 2021-02-12 珠海格力电器股份有限公司 串口通信方法、装置、电子设备和计算机可读介质
WO2023160166A1 (zh) * 2022-02-28 2023-08-31 华为技术有限公司 一种可信计算方法、芯片以及服务器
CN116567624A (zh) * 2023-07-10 2023-08-08 南京邮电大学 一种5g馈线终端通信安全防护方法、装置及存储介质
CN116567624B (zh) * 2023-07-10 2023-09-29 南京邮电大学 一种5g馈线终端通信安全防护方法、装置及存储介质

Also Published As

Publication number Publication date
EP3809625A1 (en) 2021-04-21
EP3809625A4 (en) 2021-09-08
US20210176056A1 (en) 2021-06-10
WO2020073206A1 (zh) 2020-04-16
CN111264044B (zh) 2021-11-19
US20230403151A1 (en) 2023-12-14
US11722300B2 (en) 2023-08-08

Similar Documents

Publication Publication Date Title
CN111264044B (zh) 芯片、生成私钥的方法和可信证明的方法
JP7416775B2 (ja) 周辺デバイス
EP3458999B1 (en) Self-contained cryptographic boot policy validation
US10885197B2 (en) Merging multiple compute nodes with trusted platform modules utilizing authentication protocol with active trusted platform module provisioning
US10771264B2 (en) Securing firmware
Anati et al. Innovative technology for CPU based attestation and sealing
US9405912B2 (en) Hardware rooted attestation
JP2022527757A (ja) 物理複製困難関数を使用したコンピューティングデバイスのｉｄの生成
CN109492352B (zh) 一种设备标识组合引擎的实现方法及装置
KR20210132216A (ko) 동작 동안 긴급 차량의 아이덴티티 검증
US10878101B2 (en) Trusted booting by hardware root of trust (HRoT) device
US20230351056A1 (en) Sram physically unclonable function (puf) memory for generating keys based on device owner
US20230273977A1 (en) Managing ownership of an electronic device
US11734460B2 (en) Connectionless trusted computing base recovery
US20240073033A1 (en) Method of updating device certificate and device for driving the method
WO2022170973A1 (zh) 密钥灌装方法、系统、装置、设备以及存储介质
CN118591803A (zh) 使用经授权子密钥进行安全启动的装置和方法
JP2024507531A (ja) デジタルデバイスのためのトラステッドコンピューティング
EP4264466B1 (en) Attesting update of a firmware layer
US20240111853A1 (en) Certificate update method and certificate update system of device driving the same
US20240152620A1 (en) Owner revocation emulation container
US20240296226A1 (en) Systems and methods for identifying firmware versions using spdm alias certificates
CN118551386A (zh) 一种云平台的安全启动方法及片上系统
CN110059489A (zh) 安全电子设备
Malipatlolla Sustainable Trusted Computing: A Novel Approach for a Flexible and Secure Update of Cryptographic Engines on a Trusted Platform Module

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant