RU2574347C2 - Method for secure extension of functions of information security hardware - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: method for the secure extension of functions of information security equipment, the hardware components of which are the self-contained functionally sufficient devices which are embedded in secure computer equipment, the said devices consisting of at least nonvolatile memory which stores program modules corresponding to at least one function from the set of security functions supported by the information security equipment, and a controller through which the nonvolatile memory is accessed via trusted loading of new program modules, under control of which the required extension of security functions is provided, wherein the new program modules are stored signed by electronic signatures of the providers thereof, obtained using signature keys in storages which are external relative to the nonvolatile memory of the information security equipment; the nonvolatile memory of the information security equipment stores the database of verification keys for signatures of providers of the new program modules, and before a loading session, the loaded program modules are authenticated through a signature verification procedure.

EFFECT: providing trusted loading of new program modules.

4 cl

Description

The invention relates to the field of computer technology and information technology.

In this field of technology, there has long been a problem of protecting information stored in computer facilities (SVT), in particular in personal computers, from unauthorized access (unauthorized access), the simplest and historically first solution of which was to create and use software that implements these or those protective functions. However, the experience of previous developments and theoretical analysis of the problem clearly demonstrated the limitations of this approach and led to the need to use hardware-software systems (hardware) to protect information from NSD-TSZI. At present, there is no need to justify the preference for the application of the TSSI in relation to purely software methods of information protection, since the former, in fact, acquired the status of a standard in this area.

The composition of such TSZI includes, along with software, hardware components, in particular, hardware trusted boot modules (AMDZ), which are built-in self-contained, functionally sufficient devices consisting of at least non-volatile memory (EPR) embedded in protected SVT, which stores program modules (PM) corresponding to at least one function from the set of protective functions supported by the TSZI on the hardware platform of the AMDZ, and the controller through which access to the electronic converter is performed [1].

Despite the fact that the AMDZ concept has not changed for many years, the continuous development of both CBT and information security hardware requires constant modernization and the addition of their capabilities (expansion of functions). Making updates regarding the software components of the TSSI is not, from the point of view of information security, a simple procedure, but is accompanied by serious difficulties. Moreover, due to the fact that it is necessary to expand the capabilities of the existing product, and not to create a new one, the hardware components of the TSZI - in particular, AMDZ - must remain unchanged.

Closest to the claimed method is a method for safely expanding the functions of the TSZI, the hardware components of which are built-in autonomous functionally sufficient devices that are built into the protected CBT, consisting of at least an EPR, in which the PMs corresponding to at least one function from the set are stored the protective functions supported by the TSSI, and the controller through which access to the electronic converter is performed by trusted loading of new PMs, under the control of which the required extension of the protection set is provided functions [2].

In this method, maintaining autonomy and functional sufficiency of the TSJI is achieved by the fact that in the EPP AMDZ completely replace the old software with new, including, along with the old ones, new PM.

The main disadvantage of this method is predetermined by the limited internal resources of the memory storage device (relatively small, compared with the SVT memory, the volume of the electronic data converter built in, in particular, in the automatic digital data storage device) and consists in limiting its functionality by the fact that the trusted download of sufficiently large new PMs in the electronic data storage device , without changing the hardware components (replacing on the AMDZ boards with an old ENP with a new, larger volume), it often becomes physically impossible.

The objective of the invention is to expand the functionality of this method. The technical result achieved in connection with the solution of this problem is to remove restrictions on the volume of new PM, which allows for any required modernization of TSZI, saving time and money due to the absence of the need to replace (process) their material parts - hardware components.

The problem is solved in that in a method for safely expanding the functions of the TSZI, the hardware components of which are built-in autonomous functionally sufficient devices that are built into the protected SVT, consisting of at least an EPR, in which the PMs corresponding to at least one function of the set of protective functions supported by the ISIS, and the controller through which access to the electronic converter is performed by trusted loading of new PMs, under the control of which the required extension of the set of protective functions is provided The following main difference is introduced.

New PMs are stored by signed electronic signatures of their suppliers, obtained with the help of signature keys, in external drives (storage devices) (with respect to the ESP TSZI), and in the ESP TSZI they store the database (certificates) of keys for verifying the signatures of the PM expansion providers, and before the session downloads verify the authenticity of downloaded PMs through a signature verification procedure.

Thus, the problem of the invention is solved, since the consequence of this difference is the possibility of safely expanding the functions of the data storage device due to new PM stored not in its internal EDS, but in external storage devices that have no real memory size limitations (in relation to this class of programs) . The non-triviality of this solution lies in the fact that in such drives, in principle, unsafe due to their external location, the new PMs are stored in a form that allows checking their authenticity (first of all, integrity) before downloading, namely, by signed electronic signatures of their suppliers . At the same time, it is not required to store in the EDS TSZI images of new PMs, but only the database (certificates) of signature verification keys, which is incommensurably smaller than the new PMs in volume, and therefore, in the vast majority of cases, it is recorded in the EDS without problems. It is the conduction before each download of new PM of the cryptographic procedure for verifying the signatures with which they are signed that makes their download trusted, which is required by security conditions.

It is advisable to store new PMs in storage devices that are part of the protected SVT, for example, in its built-in hard disk drives corresponding to the standard SVT configuration. This version of the method is the most simple and versatile in capabilities.

In addition, new PMs can, in principle, be stored in specially allocated storage devices that are alienated from protected secure storage devices (removable), for example, USB-flash drives protected from unauthorized access, which support, in particular, the authentication function of portable storage devices from removable drive. At the same time, it is necessary to purchase such devices specifically for the storage of new PM, however, due to their alienation (the ability to connect to the SVT only for the duration of the work session), the possibility of unauthorized external impact of new PM is virtually eliminated. An additional measure to increase security is the use of special (protected) types of USB-flash drives that support the CBT authentication function on its part.

For safety, it is advisable, before shutting down the protected CBT, to upload new PMs to the storage devices allocated for them (in particular, if they are alienable).

INFORMATION SOURCES

1. Konyavsky V.A. Information security management on the basis of SZI NSD "Accord". - M .: Radio and communications, 1999 - 325 p.

2. Konyavsky V.A. The trusted boot hardware module (Accord-AMDZ) // Banking in Moscow, 1998, No. 4 (40).

Claims (4)

1. A method for safely expanding the functions of technical information protection means (TSZI), the hardware components of which are autonomous functionally sufficient devices built into the protected computer equipment (SVT), consisting of at least non-volatile memory (EPR), in which software modules (PM) corresponding to at least one function from the set of protective functions supported by the TSSI, and the controller through which access to the EEC is carried out by trusted loading of new PMs, under the control of which the required extension of the set of protective functions is provided, characterized in that new PMs are stored in it by signed electronic signatures of their suppliers, obtained with the help of signature keys, in external (in relation to the electronic data storage devices) storage devices (storage devices), in the electronic data storage devices they store the base (certificates) of signature verification keys of suppliers of new PMs, and before the download session, verify the authenticity of downloaded PMs by means of the signature verification procedure. 2. The method according to p. 1, characterized in that new PMs are stored in it in storage devices included in the protected SVT, for example, in its built-in hard disk drives corresponding to the standard SVT configuration. 3. The method according to p. 1, characterized in that new PMs are stored in it in specially allocated storage devices that are alienated from the protected SVT (removable), for example, in USB-flash drives protected from unauthorized access, supporting, in particular, the function CBT authentication from removable storage. 4. The method according to p. 1, characterized in that in it before completing the work of the protected CBT, new PMs are unloaded to the storage devices allocated for them.