CN201498001U

CN201498001U - Credible calculation platform based on symmetrical key codes

Info

Publication number: CN201498001U
Application number: CN2009202278961U
Authority: CN
Inventors: 刘毅; 余发江; 韩勇桥; 张大鹏; 胡晓
Original assignee: JETWAY INFORMATION SECURITY INDUSTRY Co Ltd
Current assignee: JETWAY INFORMATION SECURITY INDUSTRY Co Ltd
Priority date: 2009-09-04
Filing date: 2009-09-04
Publication date: 2010-06-02
Anticipated expiration: 2019-09-04

Abstract

The utility model relates to a credible calculation platform based on symmetrical key codes, which belongs to the technical field of computer information safety. The platform comprises CPUs which are connected in turn, a north bridge which belongs to a pattern and storage centralized controller and a south bridge which belongs to an integrated centralized controller of periphery devices, a display and a memory are respectively connected with the north bridge, and a keyboard, a hard disc, a BIOSROM and a credible code module are respectively connected with the south bridge. The credible calculation platform has the advantages of leading the key to have fast storage and protection speed and high reliability, not only saving limited internal resources of platforms, but also preventing a sensitive key from being exposed outside the credible platform.

Description

A kind of credible calculating platform based on symmetric key cipher

Technical field

The utility model relates to a kind of credible calculating platform based on symmetric key cipher, belongs to the computer information safety technique field.

Background technology

Credible calculating platform has embedded an independent security module on common computing platform, platform proof of identification and integrity data can be provided to the visitor of this platform.This independent security module is referred to as credible password module, and former common computing platform is referred to as the credible calculating platform main frame.Credible password module has separate processor and storer, can provide functions such as encryption and decryption and secret data storage to support.For credible password module, the user of the driver on the credible calculating platform main frame, operating system or application program and operating system or application program etc. is referred to as external entity.Key under the credible calculating platform environment is the core data of encryption and decryption and authorization identifying, can the implementation platform authentication, exchanges data between completeness of platform report, platform, guarantee the functions such as confidentiality, integrality and non-repudiation of data, so key management is the important component part of credible calculating platform.Wherein, the storage of key is most important, if improper measures causes key to leak, platform can become " insincere " from " credible ".

Credible calculating platform provides a more broad security context for the network user, and it handles safety problem from the angle of security system, guarantees user's secure execution environments, breaks through Passive Defence patch installing mode.

In order to solve the safe storage problem of key, Trusted Computing tissue (TCG) adopts following safety practice:

Adopt public-key cryptosystem to reinforce the various keys that need protection: with the public-key cryptography of primary storage key partly to key to be protected encrypt encKey=AsymEnc (Key, pubSMK), the ciphertext after a storage key is encrypted; When needs use corresponding key, again with the private cipher key of primary storage key part to ciphertext be decrypted obtain key plain Key=UAsymEnc (encKey, priSMK).

The system that uses public-key is encrypted various keys and storage, because public key algorithm, algorithm speed is slow, is difficult to satisfy the encryption/decryption speed requirement of the many keys of large-scale credible calculating platform; Because private cipher key is privately owned by PKI holder individual fully, do not meet the cryptography-policy that uses the secret key encryption sensitive information, be unfavorable for realizing that the third party supervises.

Summary of the invention

The purpose of this utility model is, overcomes the shortcoming of prior art, and a kind of credible calculating platform based on symmetric key cipher is provided; make key memory protection speed fast; the reliability height had both been saved limited platform internal resource, had avoided responsive key to be exposed to outside the credible platform again.

The technical solution of the utility model is: a kind of credible calculating platform based on symmetric key cipher comprises successively the CPU that connects, belongs to the north bridge of figure and saveset middle controller and belongs to the south bridge of the integrated Centralized Controller of peripheral equipment; Display and internal memory are connected with north bridge respectively; Keyboard, hard disk, BIOS ROM and credible password module are connected with south bridge respectively.

Described credible password module comprises I/O I/O interface, processor, storer, random number generator and password coprocessor.

Described credible password module is a nonvolatile memory, and its storage inside has the key that needs storage, comprises storage master key SMK, identity key PIK, encryption key PEK.

Between described storage master key SMK and identity key PIK and encryption key PEK, the user key UK the double-deck cipher key management structure of root key to lower floor's key.

Described identity key PIK and encryption key PEK be with stored in clear physical protection zone in credible password module, or encrypt the back with storage master key SMK and be stored in the credible password module external entity with ciphertext; User key UK encrypts the back with storage master key SMK and is stored in the credible password module outside with ciphertext.

Technique effect of the present utility model is: utilize symmetric key cipher to carry out the key memory protection, speed is fast, and the reliability height had both been saved limited platform internal resource, had avoided responsive key to be exposed to outside the credible platform again; When the High Security Level key select stored in clear in credible password module the physical protection zone or encrypt when being stored in external entity safety flexibly; Adopt symmetric cryptography to realize encrypting storage, meet relevant password Regulation Policy.

Description of drawings

Fig. 1 is the credible calculating platform structural representation;

Fig. 2 is the credible password module structural representation.

Fig. 3 is a credible calculating platform key management structure synoptic diagram.

Embodiment

It is as follows that the utility model is described in further detail in conjunction with the accompanying drawings and embodiments:

As shown in Figure 1, 2, 3, a kind of credible calculating platform based on symmetric key cipher, it is made up of the CPU 200 that connects successively, the south bridge 225 that belongs to the north bridge 210 of figure and saveset middle controller and belong to the integrated Centralized Controller of peripheral equipment; Display 205 and internal memory 215 are connected with north bridge 210 respectively; Keyboard 220, hard disk 240, BIOS ROM 230 and credible password module 235 are connected with south bridge 225 respectively.Credible password module 235 includes I/O I/O interface 300, processor 305, comprises volatibility and non-volatile storer 310, random number generator 330 and password coprocessor 335.The described credible password module 235 of present embodiment is a nonvolatile memory, and its storage inside has the key that needs storage, comprises storage master key SMK 315, identity key PIK 320, encryption key PEK 325.Between storage master key SMK 315 and identity key PIK320 and encryption key PEK 325, the user key UK 326 is the double-deck cipher key management structure of root key to lower floor's key.Identity key PIK 320 and encryption key PEK 325 also can encrypt the back with storage master key SMK 315 and be stored in credible password module 235 external entities with ciphertext with stored in clear physical protection zone in credible password module 235; User key UK 326 usefulness storage master key SMK 315 encrypts the back and is stored in credible password module 235 outsides with ciphertext.

Using a kind of credible calculating platform based on symmetric key cipher of the utility model carries out the key storing step and is: A, credible password module 235 is written into the private key PRIEK of crypto module key EK, and to the credible password module initialization; B, the verifying bench owner authorize; C, checking storage master key SMK 315 authorize; D, identity key PIK 320 authorization datas are set; E, carry out the ECC key schedules by credible password module 235, it is right to generate identity key PIK 320 keys, and described key is to storing and stored in clear for ciphertext; F, use identity key PIK 320; The storage of described ciphertext is to derive together with crypto identity key PIK 320 private keys of storing master key SMK 315 and authorization data thereof and identity key PIK 320 PKIs to store external entity into, send private key and the authorization data of encrypting to crypto module then, by the ciphertext of this module with storage master key SMK 315 decryption identity key PIK 320 and private key and authorization data thereof.Described stored in clear be identity key PIK 320 with stored in clear non-volatile physical protection zone in credible password module 235, and directly be in identity key PIK 320 user modes and directly use.Described storage master key SMK 315 is with stored in clear non-volatile physical protection zone in credible password module 235.

Claims

1. the credible calculating platform based on symmetric key cipher is characterized in that, this platform comprises successively the CPU (200) that connects, belong to the north bridge (210) of figure and saveset middle controller and belong to the south bridge (225) of the integrated Centralized Controller of peripheral equipment; Display (205) and internal memory (215) are connected with north bridge (210) respectively; Keyboard (220), hard disk (240), BIOS ROM (230) and credible password module (235) are connected with south bridge (225) respectively.

2. according to the described credible calculating platform of claim 1 based on symmetric key cipher, it is characterized in that described credible password module (235) comprises I/O I/O interface (300), processor (305), storer (310), random number generator (330) and password coprocessor (335).

3. according to the described credible calculating platform of claim 2 based on symmetric key cipher, it is characterized in that, described credible password module (235) is a nonvolatile memory, its storage inside has the key that needs storage, comprises storage master key SMK (315), identity key PIK (320), encryption key PEK (325).

4. according to the described credible calculating platform of claim 2 based on symmetric key cipher, it is characterized in that, be the double-deck cipher key management structure of root key to lower floor's key between described storage master key SMK (315) and identity key PIK (320) and encryption key PEK (325), the user key UK (326).

5. according to claim 3 or 4 described credible calculating platforms based on symmetric key cipher, it is characterized in that, described identity key PIK (320) and encryption key PEK (325) be with stored in clear physical protection zone in credible password module (235), or encrypt the back with storage master key SMK (315) and be stored in credible password module (235) external entity with ciphertext; User key UK (326) encrypts the back with storage master key SMK (315) and is stored in credible password module (235) outside with ciphertext.