KR20070103590A - Method of managing authorization session safely in the tpm software stack - Google Patents

Abstract

A method for managing a safe authorization session of a TSS is provided to reduce time required for a command to be stored at a TPM and executed by a request of an application. A method for managing a safe authorization session of a TSS includes a step of starting a TCS and initiating an AM list, by calling an application(201); a step of calling a TPM command by a TSP(TSS service provider)(202) and generating an AM object; a step of judging a shortage of a memory(210) shortage of the TPM(211) by the TCS; and a step of keeping the authorization session generated from the TSP, at the TPM by selecting at least one of the authorization session loaded at the TPM when the memory space of the TPM is not available. The AM object is formed by an AM linked list formed by connecting at least one AM list.

Description

Method of managing Authorization Session safely in the TPM Software Stack}

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.

1 is a block diagram showing a relationship between a conventional TPM and a TSS.

2 is a block diagram showing a relationship between a TPM and a TSS according to the present invention.

3 is a diagram illustrating a relationship between a TCS context manager and an automation manager (AM) according to the present invention.

4 is a flowchart illustrating a method for managing an automation session according to the present invention.

* Description of the symbols for the main parts of the drawings *

11: Application

12: TSP Service Provider

13: TCS Core Service

14: TSM Software Stack

15: Trustec platform Module

201: Application

202: TSP service provider

203: TCS Information Manager (gstTCS Service)

204: TCS Context Manager (TCS CM-TCS Context Manager)

205: Automation Manager (AM)

206: each TCS memory storage

207: TCS memory

208: TCS Core Service

209: TSM Software Stack

210: each TPM memory storage

211: Trustec platform Module

301: TCS Context Manager (TCS CM-TCS Context Manager)

302: Automation Manager (AM)

The present invention relates to a method for managing a secure authentication session in a TPM-TPM Software Stack for using a TPM-rusted Platform Module.

The Trusted Platform Module (TPM) is a System on Chip (SoC) to provide secure key management and platform integrity standardized by the Trusted Computing Group (TCC). TSS is a standard application programming interface for applications to use TPM. Therefore, in order to use the Trusted Platform Module (TPM), an application programming interface (API-Application Programming Interface) requiring an application must be called using the TPM software stack (TSS).

TPM software stack (TSS) is largely divided into TSS Service Provider (TSP) and TSS Core Service (TCS). The TSP is provided to the application in the form of a dynamic linking library, and the TCS is provided to the TSP as a system service on Windows or as a daemon on Unix or Linux.

1 is a block diagram illustrating a process for a conventional application to use a TPM.

1, the application 11 calls the API of the TSP 12 in order to use the functions of the TPM 15, the TSP 12 calls the API of the TCS 13, and finally the TCS 13 Calls the API of the TPM 15.

In the above conventional structure, the TSS must provide a service that allows multiple applications to use the TPM at the same time. However, the TPM is a system on chip that provides very limited memory storage to the hardware devices of individual user servers. In this case, the TSS has a limitation in that the number of orthodontic sessions created by the application should be limited to the memory storage space provided by the TPM. Therefore, there is a problem in that the time until the command is executed is stored in the TPM according to the request of the application is long.

The technical problem to be achieved by the present invention is a method for managing a secure authorization session in a TPM software stack (TSS-TPM Software Stack), the automation function block (AM- automation) Manager to create an automation session at any time, reducing the time required for instructions to be stored in the TPM and executed at the request of the application. To provide. Another object of the present invention is to provide a TCS system that can reduce the time until the instruction is stored in the TPM and executed at the request of the application using AM.

An orthodontic management method according to an embodiment of the present invention includes a secure orthodontic session management method in a TSS, comprising: calling an application to initialize an AM list at the start of operation of the TCS; A TSP calling a TPM command, and the TCS generating an AM information unit (AM Object); Determining, by the TCS, whether the memory storage space of the TPM is insufficient; And when there is no memory storage space of the TPM, the TCS selects one or more of an orthodontic session loaded in the TPM and stores it in the TCS, and then stores the orthodontic session created in the TSP in the TPM. And storing in the.

Accordingly, in the method for managing an automation session according to the present invention, the AM may be configured in the TCS so that the TSP may generate the automation session at any time. Therefore, according to the request of the application, there is an advantage of reducing the time until the instruction is stored in the TPM and executed.

DETAILED DESCRIPTION In order to fully understand the operational advantages of the present invention and the objects achieved by the practice of the present invention, reference should be made to the accompanying drawings which illustrate preferred embodiments of the present invention and the contents set forth in the drawings.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

2 is a block diagram showing the relationship between the TPM 211 and the TSS 209 according to the present invention.

Referring to Fig. 2, the TCS 208 includes an automation manager (AM) 205, a TCS information manager (gstTCS service) 203, a TCS Contwxt Manager 204, and a TCS memory. 207 is provided. The AM 205 is composed of an AM list.

The orthodontic management method of the present invention according to the drawings, in the secure orthodontic session management method in the TSS, the step of calling the application, the AM list (AM list) is initialized at the start of the TCS operation; A TSP calling a TPM command, and the TCS generating an AM information unit (AM Object); Determining, by the TCS, whether the memory storage space of the TPM is insufficient; And when there is no storage space of the TPM memory, the TCS selects one or more of the automation sessions loaded in the TPM and stores the same in the TPM after storing the initialization session created in the TSP. Characterized in that the step of storing.

In the initializing of the AM list, the time point when the AM list is initialized is the time point at which the TCS is activated. As the TCS starts up, AM retrieves a list of the automation sessions currently loaded into the TPM. If there is a load, remove all loaded automation sessions in order to synchronize the automation session with the TPM and TCS. The AM list unit is initialized through the information of the list and the removed automation session.

In the TPM command call step, when the TSP calls the TPM commands (TPM_OIAP, TPM_OSAP), an AM information unit (AM Object) is generated in the AM of the TCS. When the TSP creates an automation session in response to the TPM commands (TPM_OIAP and TPM_OSAP), it sets the AM related values (AuthHandle and random number) obtained from the TPM to the AM information and stores them in the AM list. The AM Auth Handle is the information that the TSP obtains from the TPM through the TPM command, and the random number is a random number obtained from the TPM through the TPM command. It is a newly generated random value, that is, the haute hand and random random number are information in the AM object generated due to the creation of the automation, and identify the automation session. However, the Auth Handle does not change every time an orthodontic session is created, but for TPMs that only support three orthodontic sessions, only three AM-related values are needed. In other words, since the method of assigning AM related values to AM information is different depending on the manufacturer of the TPM, the AM related values cannot be identified only to identify the automation session. To solve this problem, random random numbers returned from the TPM command should be used.

When the AM information part is deleted from the AM list, the TPM responds to the TPM command (TPM_OIAP, TPM_OSAP) not to create an orthodontic session, and the TSP no longer internalizes the TPM. This is when the session will not be created. Then, the AM information unit is found in the AM list (AM list or AM linked list), and the same AM information unit as the AM related value and random random number is deleted and the AM information unit is deleted.

If the execution of the TPM command fails using the automation session, the manufacturer of the TPM does not remove the automation session. Therefore, in such a case, if an error occurs in the execution of the TPM command while using the automation session, the TCS automatically sends the removal of the automation session command to remove the automation session. That is, since the TCS takes care of all of these points, the TSP does not need to issue a separate command to delete the automation session.

In the step of storing the automation session in the TCS due to the lack of storage space of the TPM, the oldest automation session is deleted from the memory storage space of the TPM and stored in the host memory of the TCS in which the TCS operates. If an automation session stored in the TCS is used, it can be recovered and reloaded into the TPM for reuse.

In the step of storing the automation session in the TCS due to the lack of storage space of the TPM, when the TSP calls the TPM command, if the TPM responds that there is no space to create the automation session, the storage stored in the TPM Send the command to load the oldest session in the TCS. Accordingly, the oldest one of the automation sessions currently loaded in the TPM is selected, and the encryption value and random random number of the selected automation session are obtained and set in the AM information unit. Thereafter, the automation session is removed from the TPM internal memory, and the removed automation session is stored in the TCS memory. Here, whether the TPM has a space for creating an automation session is determined depending on whether the TPM command returns due to an error after transmitting the TPM command. When the TPM command returns due to an error, it is determined that there is no space for storing an automation session in the TPM.

The way to find the oldest automation session in the AM list is to create an Aging list in the AM information section so that the lowest number is the oldest. These save time values will be reinitialized when saving the automation session.

In the storing of the automation session in the TPM, after loading and storing the oldest automation session from the TPM to the TCS, the TSP requests the automation session created by the TSP. Thus, the automation session is stored in the TPM, so that the command requested by the application is executed.

After the storing step, when the TPM command requiring an automation session is executed through the TCS, the present invention selects the oldest of the automation sessions of the TPM and stores it again in the TCS, and is loaded and stored in the TCS. The method may further include the step of returning the oldest of the automated sessions to the TPM memory area.

In the step of returning the automation session to the TPM, a method of distinguishing whether the automation session of the AM information unit is loaded in the TPM is not loaded in the TPM if the encryption value rgbAuth is not NULL (empty space). It means that it is temporarily stored in the TCS. Therefore, the AM information unit is found and the automation session is restored to the TPM.

3 is a diagram showing the relationship between the TCS situation unit (TCS CM) and the automation manager (AM) according to the present invention.

The AM information unit (AM Object) is composed of an AM list. That is, various kinds of information included in the AM list constitute the AM information unit. The AM may be made of the AM information unit itself, or may have other portions.

The AM list may be generated in a form in which one or more AM lists are connected. One or more AM lists are linked to each other. This is called a linked AM list. By configuring the linked AM list, when loading orthodontic sessions stored in the TPM into the TCS, one TCS situation unit manages by connecting each AM information unit for the orthodontic sessions. It becomes possible. Therefore, at any time, the AM information unit for the automation session loaded into the TCS can be generated in the TCS and can be temporarily stored in the TCS, thereby eliminating the limitation due to the lack of TPM memory storage space.

The TCS information manager (gstTCS Service) manages various types of information managed in the TCS and also manages an AM list. The AM object should point to the TCS context that it belongs to when it is created. When the TCS command to close the situation list is called, the AM should delete the AM information remaining without being deleted. The AM related value (AuthHandle) is identification information of an automation session obtained by the TSP from the TPM through the TPM command. The randomEven is a random number obtained from the TPM through the TPM command. The randomEven value is always a new random value generated every time an automation session is created. Aging determines when the AM information section is used. The smaller the value, the older the AM information section. The encryption value (rgbAuth) is an encrypted value of the automation session. That is, the encryption value is an encryption value of the automation session obtained from the TCS by instructing the TPM to move and store the storage session in the TCS, and in response to the response of the TPM, the encryption session is the host of the TCS. Mandatory value required for storing in the area. The TCS context part address (Pint TCS Context) is address information for pointing to a TCS context part (TCS CM-TCS Context Manager) for creating and using an automation session.

Therefore, the AM list in the AM information section inside the TCS includes the AM related value, random random number, storage time, encryption value, and information of the TCS situation part address. Therefore, the AM list provides the information necessary for the automation session to be moved from the TPM to the TCS, stored, and restored to the TPM.

As described above, optimal embodiments have been disclosed in the drawings and the specification. Although specific terms have been used herein, these terms are only used for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, in the method for managing an automation session according to the present invention, the AM may be configured in the TCS so that the TSP may generate the automation session at any time. Therefore, there is an advantage in that it is possible to reduce the time until the instruction is stored in the TPM and executed at the request of the application.

Claims (12)

In the secure automation session management method in TSS, Calling by the application, starting up the TCS and initializing an AM list; The TSP calling a TPM command, and the TCS generating an AM information unit (AM Object); Determining, by the TCS, whether the memory storage space of the TPM is insufficient; And When there is no memory storage space of the TPM, the TCS selects one or more of the automation sessions loaded in the TPM and stores the same in the TCS. Orthodontic session management method comprising the step of storing (storing step). The method according to claim 1, wherein in the AM information generating step, The generation of the AM information unit is a automation session management method, characterized in that the generation of one or more AM list linked AM list (AM linked list) form. The method according to claim 2, The linked AM list is generated including information of AM related value, random occurrence random number, aging time, TCS status address, and automation session encryption value. Session management method. The method of claim 3, And recovering at least one of the orthodontic sessions stored in the TCS in the TPM (recovery step). The method of claim 4, wherein storing the orthodontic session in a TPM comprises: Selecting the oldest one of the automation sessions loaded in the TPM and storing in the TCS, and the automation session management method, characterized in that for storing the automation generated in the TSP in the TPM. The method of claim 5, wherein the storing of the automation session in the TPM comprises: Method for managing an automation session, wherein the oldest automation session is obtained using the AM related value and the random number of the AM list. The method of claim 5, wherein the determining whether the TPM is short of memory storage space, And if the TSP sends a TPM command and the TPM command is returned, determining that the TPM memory storage space is insufficient. The method of claim 5, wherein the storing of the automation session in the TPM, An automation session management method comprising selecting an oldest automation session loaded in the TPM, and storing the oldest one in the host memory of the TCS. The method of claim 5, wherein recovering an orthodontic session stored in the TCS to a TPM comprises: And retrieving the automation session in the TPM by finding an AM information unit whose non-nullation session encryption value in the AM list is not null. A system relating to a TCS of a TPM software stack (TSS) for using a TPM, The TSP manages the creation of an authority session at any time, and is composed of an AM information unit and includes an automation manager (AM-Authorization manager) pointing to the TCS situation unit (TCS CM); A TCS situation unit (TCS CM) for managing an internal situation of the TCS; A TCS memory for temporarily storing an automation session transferred from the TPM to a storage space inside the TCS; And And a TCS information manager for managing various types of information managed by the TCS. The method of claim 10, The AM information unit (AM Object) is a TCS system, characterized in that composed of a linked AM list (AM linked list) in the form of one or more AM list (AM list) is connected.       The method of claim 10, The linked AM list of the AM information unit includes an information list of an AM related value, a random occurrence random number, a storage time, a TCS context address, and an automation session encryption value.

Images