WO2024036832A1 - 基于tpm的智能密码钥匙密码应用接口的实现方法 - Google Patents

基于tpm的智能密码钥匙密码应用接口的实现方法 Download PDF

Info

Publication number
WO2024036832A1
WO2024036832A1 PCT/CN2022/137642 CN2022137642W WO2024036832A1 WO 2024036832 A1 WO2024036832 A1 WO 2024036832A1 CN 2022137642 W CN2022137642 W CN 2022137642W WO 2024036832 A1 WO2024036832 A1 WO 2024036832A1
Authority
WO
WIPO (PCT)
Prior art keywords
skf
tpm
interface
application
operating system
Prior art date
Application number
PCT/CN2022/137642
Other languages
English (en)
French (fr)
Inventor
岳佳圆
宋俊涛
边秀宁
于珊珊
李蕾
杨诏钧
孔金珠
Original Assignee
麒麟软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 麒麟软件有限公司 filed Critical 麒麟软件有限公司
Publication of WO2024036832A1 publication Critical patent/WO2024036832A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices

Definitions

  • the present invention relates to the technical field of security of terminal cryptographic equipment, and in particular, to a method for implementing a TPM-based intelligent cryptographic key cryptographic application interface.
  • Smart IC cards and smart cryptographic keys are terminal cryptographic devices with cryptographic operations and key management capabilities that can provide cryptographic services. Their main function is to store user secret information (such as private keys, digital certificates), complete data encryption and decryption, and Data integrity verification, digital signature, access control and other functions generally use the USB interface form, so it is also called USB Token or USB Key, UKey.
  • the smart IC card and smart password key password application interface (SKF interface for short) is the C language application development interface standard for smart password keys in the national secret standard. It is located between the application and the device (i.e. smart IC card or smart password key) ( As shown in Figure 1), these interfaces provide functions such as storing user secret information (such as keys, digital certificates) on the USB Key, and completing data encryption and decryption, data integrity verification, digital signatures, and access control.
  • SKF interface development kits for their products. Developers can develop cryptographic applications through a unified SKF interface and access different forms of cryptographic devices such as USB Keys, TF cards, and smart cards from different device vendors without having to bind to a specific device vendor's proprietary device or interface.
  • SKF interfaces in standard specifications: device management, access control, application management, file management, container management, and password services.
  • a device that follows the SKF interface specification can contain one or more applications (Application) ( Figure 2). Each application is independent of each other. Each application has an administrator PIN and a user PIN, and can contain one or more containers and one or more files. Each container can store two key pairs for encryption and signature, as well as two corresponding certificates or certificate chains. Each container can only be of one type, ECC or RSA, and ECC keys and RSA keys cannot be mixed in one container ( Figure 3).
  • USB Key As the physical carrier for cryptographic algorithm functions and key and other data storage.
  • domestic CPU manufacturers that have launched technologies that provide cryptographic algorithm functions based on their domestic CPU chips.
  • these technologies mainly focus on meeting the needs of users.
  • the various requirements put forward in the SKF interface standard specification have not yet paid attention to the protective measures for SKF interface calls and the use of sensitive data when the integrity of the operating system of the cryptographic device is threatened.
  • the purpose of the present invention is to provide a method for implementing an intelligent cryptographic key cryptographic application interface based on TPM to solve the problem of SKF interface calls and the use of sensitive data when the integrity of the operating system of existing intelligent cryptographic devices is threatened. Problems that cannot be prevented.
  • the present invention is implemented as follows:
  • An implementation method of a TPM-based smart password key password application interface including the following steps:
  • the underlying hardware of smart IC cards or smart password keys uses TPM security chips.
  • the smart IC cards or smart password keys whose underlying hardware uses TPM security chips are TPM devices.
  • the kernel of the operating system of each TPM device includes a TPM device driver.
  • the operating system interacts with the TPM security chip through the TPM device driver of the kernel;
  • the TSS trusted software stack provides software interface support for user-mode programs in the operating system to access related functions of the TPM security chip;
  • the specific form of the SKF interface service layer is a service process running in the operating system. It accepts requests from upper-layer applications, maintains various runtime handles in the SKF interface calling process, and communicates with the TPM through the TSS trusted software stack. security chip to interact;
  • the SKF interface providing layer provides an SKF interface for upper-layer applications to call SKF functions.
  • the SKF interface includes an SKF device management interface, an SKF access control interface, an SKF application management interface, an SKF file management interface, and an SKF container management interface. interface and SKF cryptographic service class interface;
  • the SKF application metadata occupies an NV index in the non-volatile storage area, saving the total number of created applications and information about the attributes of each application;
  • Each SKF container data occupies an NV index, which stores the container name, the creation status of each key in the container, the length and key value of each key, and the data information of the NV index of the certificate in the container;
  • Each SKF file data occupies one NV index.
  • the authorized access mechanism is created based on the access of the NV index, and adopts a password authorization mechanism.
  • the SKF cryptographic service interface reads the SKF application metadata, the key and certificate data in the SKF container data through the NV related commands of the TPM, and calls the TPM cryptographic algorithm related commands to implement various cryptographic algorithm functions.
  • the SKF device management interface involves querying and obtaining information about TPM device nodes in the operating system, and calling the TPM get attribute command to obtain the manufacturer, firmware, version number, supported algorithm, mode identification, and algorithm of the TPM device. Information about property values and storage space size.
  • the SKF access control interface involves operating SKF application metadata through NV related commands of TPM;
  • the SKF application management interface involves operating SKF application metadata through NV related commands of TPM;
  • the SKF file management interface involves The SKF application metadata and SKF file data are operated through the NV related commands of the TPM;
  • the SKF container management class interface involves operating the SKF application metadata and SKF container data through the NV related commands of the TPM.
  • step d The method of checking the SKF interface availability in step d is:
  • the integrity of each level in the trust chain of the operating system software and hardware equipped with a TPM device is measured by the TPM, and its integrity measurement value is stored in the PCR register of the TPM;
  • the metadata of applications and containers in the SKF interface, as well as sensitive data such as keys and certificates in the container are all stored in the non-volatile storage of the TPM and are protected by the authorized access mechanism provided by the TPM. Accessed by outsiders through other means.
  • the random number generation, key generation, symmetric encryption and decryption algorithms, asymmetric encryption and decryption algorithms and other functions in the SKF interface are also provided by the TPM security chip.
  • the availability of the SKF interface of the present invention is combined with the integrity measurement results of the operating system. If the system integrity measured by the TPM fails, it means that the current system is facing security risks. At this time, the SKF interface logic will control that the upper-layer application cannot use SKF normally. Interface to deal with the risk of illegal use of sensitive data such as keys and certificates until the system integrity measurement results return to normal.
  • the underlying hardware of the smart password key scale of the present invention all adopts TPM security chip, which combines the availability of smart IC cards and smart password key password application interfaces with the system integrity measured by TPM, and provides TPM as the core for the availability of SKF interfaces. Hardware-level system integrity security and trustworthy protection mechanism.
  • Figure 1 is a position diagram of the application hierarchy relationship of the SKF interface in the prior art
  • Figure 2 shows the logical structure of SKF equipment in the prior art
  • Figure 3 is a logical structure diagram of the application and container of equipment that complies with the SKF interface specification in the prior art
  • FIG. 4 is a software and hardware architecture diagram of the present invention.
  • Figure 5 shows the relationship between various SKF interfaces and TPM of the present invention
  • Figure 6 is a flow chart of the SKF interface availability check according to the present invention, taking a specific SKF interface that generates random numbers as an example.
  • TPM device 1. TPM device; 2. TPM device driver; 3. TSS trusted software stack; 4. SKF interface service layer; 5. SKF interface providing layer; 6. Application program; 51. SKF device management interface; 52. SKF access Control interface; 53. SKF application management interface; 54. SKF file management interface; 55. SKF container management interface; 56. SKF password service interface.
  • the invention is a method for realizing the SKF interface of smart password key cryptography based on TPM trusted security chip. It expands the underlying hardware platform of smart IC cards and smart password keys to trusted security hardware (ie, TPM security chip), and further Combine the availability of SKF interfaces with the trusted ability to measure system integrity provided by TPM. In the existing technology, the availability of the SKF interface is not associated with the integrity of the operating system.
  • the present invention proposes to use TPM software and hardware to measure the integrity of the operating system. When the system integrity is damaged or has potential risks, the SKF interface will no longer become available, providing a safer and more reliable guarantee for the SKF interface. .
  • a method for implementing a TPM-based smart password key password application interface of the present invention includes the following steps:
  • the underlying hardware of smart IC cards or smart password keys uses TPM security chips.
  • the smart IC cards or smart password keys whose underlying hardware uses TPM security chips are TPM devices 1, and the operating systems of each TPM device 1
  • the kernel includes TPM device driver 2, user space deployment application 6 of the operating system of each TPM device 1, SKF interface provider layer 5, SKF interface service layer 4 and TSS trusted software stack 3.
  • the operating system interacts with the TPM security chip through the TPM device driver 2 of the kernel; the TSS trusted software stack 3 provides software interface support for user-mode programs in the operating system to access TPM security chip-related functions.
  • the specific form of the SKF interface service layer 4 is a service process running in the operating system. It accepts requests from upper-layer applications 6, maintains various runtime handles in the SKF interface calling process, and communicates with the SKF interface through the TSS trusted software stack 3. TPM security chip to interact with. Specifically, the SKF interface service layer 4 waits for monitoring requests from the upper application program 6, and creates several types of handle objects of the SKF interface service layer 4 in the application program 6, thereby maintaining various runtime handles during the SKF interface call process.
  • the specific processing logic of each SKF interface is implemented, and each SKF interface logic interacts with the TPM chip through the TSS trusted software stack 3, using its various physical-level cryptographic functions and NV storage operations.
  • steps a and b are the design of the software and hardware architecture of the present invention.
  • the SKF interface providing layer 5 provides the SKF interface for the upper-layer application 6 to call SKF functions, which is generally integrated and called in the form of a dynamic library or a static library.
  • SKF interfaces include SKF device management interface 51, SKF access control interface 52, SKF application management interface 53, SKF file management interface 54, SKF container management interface 55 and SKF password service interface 56.
  • TPM security chip refers to a security chip that complies with TPM (Trusted Platform Module) standard: Trusted Platform Module TPM is a security co-processor with encryption and decryption capabilities, with non-volatile storage (NV storage) and platform
  • the configuration register (PCR) can provide basic functions such as physical random number generator, symmetric/asymmetric/hash and other encryption and decryption algorithms, key generation and management, etc., which can provide integrity measurement, identity authentication, and data sealing of the system. Protection and other trusted security capabilities, which can then be used as a hardware security anchor point for computers and the basis for building a secure trust chain.
  • domestic TPM chip products generally have national encryption and decryption algorithms.
  • TSS Trusted Software Stack 3 mainly has the following core functions: providing a single access entrance to TPM functions; allowing synchronous access to TPM; building the underlying implementation of TPM command flow for applications; and managing TPM resources. Some specific implementations of TSS Trusted Software Stack 3 also support the ability to provide interfaces remotely across machines.
  • c. Store the device's SKF application metadata, SKF container data, and SKF file data in the non-volatile storage area provided by the TPM security chip, and create an authorized access mechanism.
  • NV Storage non-volatile storage area
  • the application's metadata area occupies an NV index and stores information such as the total number of created applications and the attributes of each application.
  • the storage structure definition of the application metadata area in TPM NV is shown in Table 1:
  • NV index created in TPM a corresponding authorization access mechanism can be created for it: when trying to access the NV index, the data stored in the NV index can only be read and written after successfully obtaining its authorization, otherwise you will not have the right to operate.
  • TPM provides a variety of authorization mechanisms.
  • the password authorization mechanism is used for the NV index. Compared with other authorization mechanisms, the password authorization mechanism is clear and simple, and the password authorization information is stored inside the TPM. When encountering the operating system or TPM security When the chip needs to be restarted, there is no need to perform additional export and import operations on the authorization data, which is more suitable for the scenario in the present invention.
  • NV index which stores the container name, the creation status of each key in the container, the length and key value of each key, and the NV index of the certificate in the container (Note: Because a single NV index in the TPM cannot There is an upper limit on the storage space, so the certificates in the container use independent NV indexes to store data such as).
  • Table 2 The structure definition of container body data stored in TPM NV is shown in Table 2:
  • Container name 64 bytes Encryption public key length 1 byte
  • the certificate in the container is stored using an independent NV index, so only the NV index of the certificate is stored in the container body data above.
  • the length of the certificate is not fixed, there is an upper limit on the storage space of a single NV index in the TPM, and the upper limit is generally determined by the TPM manufacturer. Therefore, each certificate may need to be stored in two or more NV indexes. (At this time, each NV index saves part of the certificate), it needs to be adjusted according to the actual situation.
  • One or more files can be created in an SKF application. Each file occupies an NV index, and its storage structure is shown in Table 3:
  • SKF application metadata occupies an NV index in the non-volatile storage area, saving the total number of created applications and information about the attributes of each application;
  • Each SKF container data occupies an NV index, which stores the container name, the creation status of each key in the container, the length and key value of each key, and the data information of the NV index of the certificate in the container;
  • Each SKF file data occupies one NV index.
  • the authorized access mechanism is created based on the access of the NV index, which uses a password authorization mechanism.
  • the SKF cryptographic service interface 56 reads the SKF application metadata, the key and certificate data in the SKF container data through the NV related commands of the TPM, and calls the TPM cryptographic algorithm related commands to implement various cryptographic algorithm functions.
  • TPM cryptographic algorithm related commands include random number generation, key generation, hash hashing, symmetric encryption and decryption, asymmetric encryption and decryption/signature verification, and message authentication code.
  • the SKF device management interface involves querying and obtaining information about the TPM device 1 node in the operating system, and calling the TPM get attribute command to obtain the manufacturer, firmware, version number, supported algorithm and mode identifier, and algorithm characteristic value of the TPM device 1 , storage space size information.
  • the SKF access control interface involves operating SKF application metadata through TPM's NV-related commands; the SKF application management interface involves operating SKF application metadata through TPM's NV-related commands; the SKF file management interface involves operating SKF through TPM's NV-related commands.
  • Application metadata and SKF file data; the SKF container management class interface involves operating SKF application metadata and SKF container data through the NV-related commands of the TPM.
  • step d The method of SKF interface availability check in step d is:
  • the integrity of each level in the trust chain of the operating system software and hardware with TPM device 1 is measured by the TPM, and its integrity measurement value is stored in the PCR register of the TPM;
  • Step d above is equivalent to adding a layer of hardware-level system integrity protection provided by TPM as the core to the use of SKF interfaces.
  • the integrity of the operating system is generally measured by measuring the system in the initial state of the operating system (such as when the system has just been installed).
  • Figure 6 shows the position of the SKF interface availability check in the entire interface logic, taking a specific SKF interface that generates random numbers as an example:
  • the present invention uses the TPM security chip and the TSS trusted software stack 3 as the basis.
  • the TPM security chip provides various cryptographic algorithm functions at the underlying physical level, and designs storage applications, containers, files, etc. on the non-volatile storage of the TPM.
  • the hierarchical structure of objects such as keys and certificates is a set of methods used to realize the application interface functions of smart IC cards and smart password keys.
  • the present invention combines the availability of smart IC cards and smart password key cryptography application interfaces with the system integrity measured by TPM, and provides the former with a hardware-level system integrity safe and trustworthy protection mechanism with TPM as the core.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Automation & Control Theory (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开一种基于TPM的智能密码钥匙密码应用接口的实现方法，包括：a、智能IC卡或智能密码钥匙的底层硬件均采用TPM安全芯片，为TPM设备，各TPM设备的操作系统的内核包括TPM设备驱动，各TPM设备的操作系统的用户空间部署应用程序、SKF接口提供层、SKF接口服务层和TSS可信软件栈；b、操作系统通过TPM设备驱动与TPM安全芯片交互；c、将设备的SKF应用元数据、SKF容器数据、SKF文件数据存储在由TPM安全芯片提供的非易失性存储区，创建授权访问机制；d、在调用SKF接口时先执行SKF接口可用性检查。本发明为SKF接口的可用性提供了由TPM作为核心的硬件级系统完整性安全可信防护机制。

Description

基于TPM的智能密码钥匙密码应用接口的实现方法 技术领域
本发明涉及终端密码设备的安全技术领域，尤指一种基于TPM的智能密码钥匙密码应用接口的实现方法。
背景技术
智能IC卡及智能密码钥匙是一种具备密码运算、密钥管理能力、可提供密码服务的终端密码设备，其主要作用是存储用户秘密信息(如私钥、数字证书)，完成数据加解密、数据完整性校验、数字签名、访问控制等功能，一般使用USB接口形态，因此也被称作USB Token或者USB Key、UKey。
智能IC卡及智能密码钥匙密码应用接口(简称为SKF接口)是国密标准中智能密码钥匙的C语言应用开发接口标准，位于应用程序与设备(即智能IC卡或智能密码钥匙)之间(如图1所示)，这些接口提供了在USB Key上进行存储用户秘密信息(如密钥、数字证书)，完成数据加解密、数据完整性校验、数字签名、访问控制等功能。
目前很多国内密码设备厂商都为其产品提供了SKF接口的开发包。开发者可以通过统一的SKF接口开发密码应用，访问来自不同设备供应商的USB Key、TF卡、智能卡等不同形态的密码设备，而无需与某一个设备供应商的专属设备或专属接口绑定。
另外，现有技术在标准规范中定义了以下几个大类的SKF接口：设备管理、访问控制、应用管理、文件管理、容器管理、密码服务。根据标准规范，在一个遵循SKF接口规范的设备中可以包含一个或多个应用(Application)(如图2)。每个应用之间彼此相互独立。每个应用具有管理员PIN和用户PIN，并可以包含一个或多个容器(Container)、一个或多个文件。每个容器中可以存放两对分别用于加密和签名的密钥对，以及两个相应的证书或证书链。每一个容器只能为ECC或RSA中的一种类型，一个容器中不能混用ECC 密钥和RSA密钥(如图3)。
现有技术中，绝大多数采用USB Key作为密码算法功能及密钥等数据存储的物理载体，也有国产CPU厂商推出了基于其国产CPU芯片提供密码算法功能的技术，但是这些技术主要侧重于满足SKF接口标准规范中提出的各项要求，尚未关注到当密码设备的操作系统的完整性遭受威胁时对于SKF接口调用及其敏感数据使用方面的防护措施。
发明内容
本发明的目的，在于提供一种基于TPM的智能密码钥匙密码应用接口的实现方法，以解决现有的智能密码设备存在的其操作系统的完整性遭受威胁时对于SKF接口调用及其敏感数据使用方面无法防护的问题。
为解决上述技术问题，本发明是这样实现的：
一种基于TPM的智能密码钥匙密码应用接口的实现方法，包括以下步骤：
a、智能IC卡或智能密码钥匙的底层硬件均采用TPM安全芯片，底层硬件采用TPM安全芯片的智能IC卡或智能密码钥匙为TPM设备，各TPM设备的操作系统的内核包括TPM设备驱动，各TPM设备的操作系统的用户空间部署应用程序、SKF接口提供层、SKF接口服务层和TSS可信软件栈；
b、所述操作系统通过内核的TPM设备驱动与TPM安全芯片进行交互；所述TSS可信软件栈为操作系统中的用户态程序提供访问TPM安全芯片相关功能的软件接口支持；
所述SKF接口服务层的具体形态为运行于操作系统中的一个服务进程，其接受来自上层的应用程序的请求，维护SKF接口调用过程中各类运行时句柄，通过TSS可信软件栈与TPM安全芯片进行交互；
所述SKF接口提供层提供上层应用程序调用SKF功能的SKF接口，所述SKF接口包括SKF设备管理类接口、SKF访问控制类接口、SKF应用管理类接口、SKF文件管理类接口、SKF容器管理类接口和SKF密码服务类接口；
c、将设备的SKF应用元数据、SKF容器数据、SKF文件数据存储在由TPM安全芯片提供的非易失性存储区，并创建授权访问机制；
d、在调用SKF接口时先执行SKF接口可用性检查。
其中，所述SKF应用元数据在非易失性存储区中占用一个NV索引，保存创建的应用总数、以及每个应用的属性的信息；
每个SKF容器数据占用一个NV索引，保存容器名称、容器中各密钥的创建情况、各密钥的长度与密钥值、容器中证书的NV索引的数据信息；
每个SKF文件数据占用一个NV索引。
其中，所述授权访问机制基于NV索引的访问创建的，其采用口令授权机制。
其中，所述SKF密码服务类接口通过TPM的NV相关命令读取SKF应用元数据、SKF容器数据中的密钥及证书的数据，并调用TPM密码算法相关命令实现各类密码算法功能。
其中，所述SKF设备管理类接口涉及查询并获取操作系统中TPM设备节点的信息，调用TPM的获取属性命令以获得关于TPM设备的厂商、固件、版本号、所支持的算法及模式标识、算法特性值、存储空间大小的信息。
其中，所述SKF访问控制类接口涉及通过TPM的NV相关命令操作SKF应用元数据；所述SKF应用管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据；所述SKF文件管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据和SKF文件数据；所述SKF容器管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据和SKF容器数据。
其中步骤d的SKF接口可用性检查的方法为：
计算机启动后，具备TPM设备的操作系统软硬件信任链上各个级别的完整性由TPM度量，其完整性度量值保存于TPM的PCR寄存器中；
在SKF接口中，首先开启操作系统的可用性检查，读取PCR的当前值与完整性基准值，并进行比较：
(1)若两者不一致，说明当前操作系统可能存在安全风险，此时SKF接口不可用；
(2)若两者一致，说明系统完整性度量正常，SKF接口可正常使用。
本发明的有益效果是：
本发明中的SKF接口中应用、容器的元数据与容器中的密钥及证书等敏感数据均保存在TPM的非易失性存储中，并由TPM所提供的授权访问机制所保护，无法通过其它途径被外界访问。并且SKF接口中的随机数生成、密钥生成、对称加解密算法、非对称加解密算法等功能也均由TPM安全芯片提供。
本发明的SKF接口的可用性与所在操作系统的完整性度量结果相结合，若由TPM度量的系统完整性失败，说明当前系统面临安全风险，此时SKF接口逻辑将控制上层应用程序无法正常使用SKF接口，以应对密钥及证书等敏感数据存在被非法使用的风险，直至系统完整性度量结果恢复正常。
本发明的智能密码钥匙称的底层硬件均采用TPM安全芯片，将智能IC卡及智能密码钥匙密码应用接口的可用性与TPM度量的系统完整性相结合，为SKF接口的可用性提供了由TPM作为核心的硬件级系统完整性安全可信防护机制。
附图说明
下面结合附图和具体实施方式对本发明作进一步详细的说明。
图1为现有技术中SKF接口在应用层次关系的位置图；
图2为现有技术SKF设备的逻辑结构；
图3为现有技术符合SKF接口规范的设备的应用与容器的逻辑结构图；
图4为本发明的软硬件架构图；
图5为本发明的SKF各类接口与TPM之间的关系；
图6为本发明以生成随机数的具体SKF接口为例的SKF接口可用性检查流程图。
附图标记说明
1、TPM设备；2、TPM设备驱动；3、TSS可信软件栈；4、SKF接口服务层；5、SKF接口提供层；6、应用程序；51、SKF设备管理类接口；52、SKF访问控制类接口；53、SKF应用管理类接口；54、SKF文件管理类接口；55、SKF容器管理类接口；56、SKF密码服务类接口。
具体实施方式
下面结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述。在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是本发明还可以采用其他不同于在此描述的其它方式来实施，本领域技术人员可以在不违背本发明内涵的情况下做类似推广，因此本发明不受下面公开的具体实施例的限制。
本发明为一种基于TPM可信安全芯片实现智能密码钥匙密码应用SKF接口的方法，其将智能IC卡及智能密码钥匙的底层硬件平台拓展到了可信安全硬件(即TPM安全芯片)，并进一步将SKF接口的可用性与TPM所提供的系统完整性度量这一可信能力结合起来。现有技术中，SKF接口的可用性并未与操作系统的完整性相关联。本发明提出了借助TPM软硬件实现对操作系统的完整性进行度量，当系统完整性遭受破坏或存在潜在风险时，SKF接口将不再变得可用，为SKF接口提供了更为安全可靠的保障。
本发明的一种基于TPM的智能密码钥匙密码应用接口的实现方法，包括以下步骤：
a、如图4所示，智能IC卡或智能密码钥匙的底层硬件均采用TPM安全芯片，底层硬件采用TPM安全芯片的智能IC卡或智能密码钥匙为TPM设备1，各TPM设备1的操作系统的内核包括TPM设备驱动2，各TPM设备1的操作系统的用户空间部署应用程序6、SKF接口提供层5、SKF接口服务层4和TSS可信软件栈3。
b、如图4所示，操作系统通过内核的TPM设备驱动2与TPM安全芯片进行交互；TSS可信软件栈3为操作系统中的用户态程序提供访问TPM安全芯片相关 功能的软件接口支持。
SKF接口服务层4的具体形态为运行于操作系统中的一个服务进程，其接受来自上层的应用程序6的请求，维护SKF接口调用过程中各类运行时句柄，通过TSS可信软件栈3与TPM安全芯片进行交互。具体而言，SKF接口服务层4等待监听来自上层应用程序6的请求，在应用程序6中创建SKF接口服务层4的几类句柄对象，以此维护SKF接口调用过程中各类运行时句柄，实现了各个SKF接口的具体处理逻辑，并在各SKF接口逻辑中通过TSS可信软件栈3与TPM芯片进行交互，使用其各种物理级的密码功能与NV存储操作。
以上步骤a、b为本发明的软硬件架构的设计。
SKF接口提供层5提供上层应用程序6调用SKF功能的SKF接口，其一般以动态库或静态库的形式被集成与调用。SKF接口包括SKF设备管理类接口51、SKF访问控制类接口52、SKF应用管理类接口53、SKF文件管理类接口54、SKF容器管理类接口55和SKF密码服务类接口56。
其中，TPM安全芯片是指符合TPM(可信赖平台模块)标准的安全芯片：可信平台模块TPM是一种具备加解密能力的安全协处理器，拥有非易失性存储(NV storage)和平台配置寄存器(PCR)，可提供物理随机数发生器、对称/非对称/杂凑等加解密算法、密钥生成与管理等基础功能，由此可提供对系统进行完整性度量、身份认证、数据密封保护等可信安全能力，进而可作为计算机的一个硬件安全锚点，作为构建安全信任链的基础。另外，国产的TPM芯片产品一般都具备国密的加解密算法。上层应用程序6一般通过可信软件栈(Trusted Software Stack,TSS)来访问和使用TPM的各种能力。它提供访问TPM功能的接口函数，是TPM与上层应用之间的桥梁。一般而言，TSS可信软件栈3主要具备以下核心功能：提供对TPM功能的单一访问入口；允许对TPM的同步访问；对应用程序构建TPM命令流的底层实现；管理TPM的资源。有些TSS可信软件栈3的具体实现还支持远程跨机提供接口的能力。
c、将设备的SKF应用元数据、SKF容器数据、SKF文件数据存储在由TPM安全芯片提供的非易失性存储区，并创建授权访问机制。
在本发明的方案中，与SKF接口相关且需持久化的数据被存储于TPM内部的非易失性存储区(NV Storage)中。其中：
(1)SKF应用元数据存储
在一个SKF设备中可以存在多个应用。应用的元数据区占用一个NV索引，保存创建的应用总数、每个应用的属性等信息。应用元数据区在TPM NV中的存储结构定义如表1所示：
表1应用元数据的存储结构
Figure PCTCN2022137642-appb-000001
Figure PCTCN2022137642-appb-000002
另外，对于TPM中创建的NV索引，可为其创建对应的授权访问机制：在尝试访问NV索引时，只有成功获取其授权后才能读写该NV索引所存储的数据，否则无权进行操作。
TPM提供了多种授权机制，在本发明中对于NV索引采用口令授权机制，相较于其它授权机制，口令授权机制清晰简单，且口令授权信息保存在TPM内部，当遇到操作系统或TPM安全芯片需要重启的情况时，无需对授权数据进行额外的导出导入操作，更适合本发明中的场景。
(2)SKF容器数据
在一个SKF应用中可以存在多个容器。容器的主体数据区占用一个NV索引，保存容器名称、容器中各密钥的创建情况、各密钥的长度与密钥值、容器中证书的NV索引(注：因TPM中单个NV索引所能存储的空间存在上限，故容器中的证书使用独立的NV索引进存储)等数据。容器主体数据存储在TPM NV中的结构定义如表2所示：
表2容器的存储结构
容器名称长度 1字节
容器名称 64字节
加密公钥长度 1字节
加密公钥 128字节
加密私钥的TPM句柄(注*) 4字节
签名公钥长度 1字节
签名公钥 128字节
签名私钥的TPM句柄(注*) 4字节
加密证书的NV索引 4字节
签名证书的NV索引 4字节
已创建的会话密钥数量 1字节
已创建的第1个会话密钥长度 1字节
已创建的第1个会话密钥 8字节
已创建的第2个会话密钥长度 1字节
已创建的第2个会话密钥 8字节
…… ……
(注：实际参与加解密的密钥对是由TPM生成，其私钥保存于TPM内，只能通过TPM句柄访问，故此处保存私钥的TPM句柄)。
容器中证书采用独立的NV索引进行存储，故在上面的容器主体数据中只存放证书的NV索引。此外，由于证书的长度并不固定，TPM中单个NV索引所能存储的空间存在上限，而且该上限值一般由TPM厂商决定，因此可能存在每个证书需要存储于两个或多个NV索引中的情况(此时每个NV索引保存证书的一部分内容)，需根据实际情况进行调整。
(3)SKF文件数据的存储
在一个SKF应用中可以创建一个或多个文件。每个文件占用一个NV索引，其存储结构如表3所示：
表3文件的存储结构
文件名称长度 1字节
文件名称 32字节
文件内容的实际长度 1字节
文件内容 可变
。
d、在调用SKF接口时先执行SKF接口可用性检查。
SKF应用元数据在非易失性存储区中占用一个NV索引，保存创建的应用总数、以及每个应用的属性的信息；
每个SKF容器数据占用一个NV索引，保存容器名称、容器中各密钥的创建情况、各密钥的长度与密钥值、容器中证书的NV索引的数据信息；
每个SKF文件数据占用一个NV索引。
授权访问机制基于NV索引的访问创建的，其采用口令授权机制。
如图5所示，SKF密码服务类接口56通过TPM的NV相关命令读取SKF应用元数据、SKF容器数据中的密钥及证书的数据，并调用TPM密码算法相关命令实现各类密码算法功能。TPM密码算法相关命令包括随机数生成、密钥生成、哈希杂凑、对称加解密、非对称加解密/签名验证、消息鉴别码。
SKF设备管理类接口涉及查询并获取操作系统中TPM设备1节点的信息，调用TPM的获取属性命令以获得关于TPM设备1的厂商、固件、版本号、所支持的算法及模式标识、算法特性值、存储空间大小的信息。
SKF访问控制类接口涉及通过TPM的NV相关命令操作SKF应用元数据；SKF应用管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据；SKF文件管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据和SKF文件数据；SKF容器管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据和SKF容器数据。
步骤d的SKF接口可用性检查的方法为：
计算机启动后，具备TPM设备1的操作系统软硬件信任链上各个级别的完整性由TPM度量，其完整性度量值保存于TPM的PCR寄存器中；
在SKF接口中，首先开启操作系统的可用性检查，读取PCR的当前值与完整性基准值，并进行比较：
(1)若两者不一致，说明当前操作系统可能存在安全风险，此时SKF接口不 可用；
(2)若两者一致，说明系统完整性度量正常，SKF接口可正常使用。
上述步骤d相当于给SKF接口的使用增加了一层由TPM为核心提供的硬件级系统完整性防护。另外，操作系统的完整性一般在操作系统初始状态(比如刚安装完系统时)对系统进行度量得出。
图6展示了以生成随机数的具体SKF接口为例，SKF接口可用性检查在整个接口逻辑中的位置：
首先开启操作系统的SKF接口可用性检查，然后读取PCR的当前值与完整性基准值，并进行比较：
(1)若两者不一致，SKF接口不可用，说明当前操作系统可能存在安全风险。
(2)若两者一致，调用TSS软件栈接口，生成TPM物理随机数，SKF接口可正常使用。
本发明采用TPM安全芯片及TSS可信软件栈3作为基础，由TPM安全芯片提供底层物理级的各类密码算法功能，并在TPM的非易失性存储上设计了存储应用、容器、文件、密钥及证书等对象的层次化结构，用以实现智能IC卡及智能密码钥匙密码应用接口功能的一整套方法。另外，本发明将智能IC卡及智能密码钥匙密码应用接口的可用性与TPM度量的系统完整性相结合，为前者提供了由TPM作为核心的硬件级系统完整性安全可信防护机制。

Claims (5)

  1. 一种基于TPM的智能密码钥匙密码应用接口的实现方法，其特征在于，包括以下步骤：
    a、智能IC卡或智能密码钥匙的底层硬件均采用TPM安全芯片，底层硬件采用TPM安全芯片的智能IC卡或智能密码钥匙为TPM设备，各TPM设备的操作系统的内核包括TPM设备驱动，各TPM设备的操作系统的用户空间部署应用程序、SKF接口提供层、SKF接口服务层和TSS可信软件栈；
    b、所述操作系统通过内核的TPM设备驱动与TPM安全芯片进行交互；所述TSS可信软件栈为操作系统中的用户态程序提供访问TPM安全芯片相关功能的软件接口支持；
    所述SKF接口服务层的具体形态为运行于操作系统中的一个服务进程，其接受来自上层的应用程序的请求，维护SKF接口调用过程中各类运行时句柄，通过TSS可信软件栈与TPM安全芯片进行交互；
    所述SKF接口提供层提供上层应用程序调用SKF功能的SKF接口，所述SKF接口包括SKF设备管理类接口、SKF访问控制类接口、SKF应用管理类接口、SKF文件管理类接口、SKF容器管理类接口和SKF密码服务类接口；
    c、将设备的SKF应用元数据、SKF容器数据、SKF文件数据存储在由TPM安全芯片提供的非易失性存储区，并创建授权访问机制；所述SKF应用元数据在非易失性存储区中占用一个NV索引，保存创建的应用总数、以及每个应用的属性的信息；每个SKF容器数据占用一个NV索引，保存容器名称、容器中各密钥的创建情况、各密钥的长度与密钥值、容器中证书的NV索引的数据信息；每个SKF文件数据占用一个NV索引；
    d、在调用SKF接口时先执行SKF接口可用性检查；步骤d的SKF接口可用性检查的方法为：
    计算机启动后，具备TPM设备的操作系统软硬件信任链上各个级别的完整性由TPM度量，其完整性度量值保存于TPM的PCR寄存器中；
    在SKF接口中，首先开启操作系统的可用性检查，读取PCR的当前值与完整性基准值，并进行比较：
    (1)若两者不一致，说明当前操作系统存在安全风险，此时SKF接口不可用；
    (2)若两者一致，说明系统完整性度量正常，SKF接口可正常使用。
  2. 根据权利要求1所述的基于TPM的智能密码钥匙密码应用接口的实现方法，其特征在于，所述授权访问机制基于NV索引的访问创建的，其采用口令授权机制。
  3. 根据权利要求2所述的基于TPM的智能密码钥匙密码应用接口的实现方法，其特征在于，所述SKF密码服务类接口通过TPM的NV相关命令读取SKF应用元数据、SKF容器数据中的密钥及证书的数据，并调用TPM密码算法相关命令实现各类密码算法功能。
  4. 根据权利要求2所述的基于TPM的智能密码钥匙密码应用接口的实现方法，其特征在于，所述SKF设备管理类接口涉及查询并获取操作系统中TPM设备节点的信息，调用TPM的获取属性命令以获得关于TPM设备的厂商、固件、版本号、所支持的算法及模式标识、算法特性值、存储空间大小的信息。
  5. 根据权利要求2所述的基于TPM的智能密码钥匙密码应用接口的实现方法，其特征在于，所述SKF访问控制类接口涉及通过TPM的NV相关命令操作SKF应用元数据；所述SKF应用管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据；所述SKF文件管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据和SKF文件数据；所述SKF容器管理类接口涉及通过TPM的NV相关命令操作SKF应用元数据和SKF容器数据。
PCT/CN2022/137642 2022-08-18 2022-12-08 基于tpm的智能密码钥匙密码应用接口的实现方法 WO2024036832A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210989534.6 2022-08-18
CN202210989534.6A CN115062330B (zh) 2022-08-18 2022-08-18 基于tpm的智能密码钥匙密码应用接口的实现方法

Publications (1)

Publication Number Publication Date
WO2024036832A1 true WO2024036832A1 (zh) 2024-02-22

Family

ID=83207838

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/137642 WO2024036832A1 (zh) 2022-08-18 2022-12-08 基于tpm的智能密码钥匙密码应用接口的实现方法

Country Status (2)

Country Link
CN (1) CN115062330B (zh)
WO (1) WO2024036832A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115062330B (zh) * 2022-08-18 2022-11-11 麒麟软件有限公司 基于tpm的智能密码钥匙密码应用接口的实现方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050138393A1 (en) * 2003-12-22 2005-06-23 Challener David C. Determining user security level using trusted hardware device
CN1755572A (zh) * 2004-09-30 2006-04-05 联想(北京)有限公司 计算机安全启动的方法
US20210365529A1 (en) * 2018-03-12 2021-11-25 Hewlett-Packard Development Company, L.P. Hardware security
CN114115836A (zh) * 2022-01-28 2022-03-01 麒麟软件有限公司 一种基于Linux操作系统的可信TCM软件栈的设计方法及系统
CN115062330A (zh) * 2022-08-18 2022-09-16 麒麟软件有限公司 基于tpm的智能密码钥匙密码应用接口的实现方法

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106775716B (zh) * 2016-12-15 2020-04-17 中国科学院沈阳自动化研究所 一种基于度量机制的可信plc启动方法
CN109412795A (zh) * 2018-09-17 2019-03-01 江苏敏行信息技术有限公司 一种虚拟智能密码钥匙
CN110263524B (zh) * 2019-08-05 2020-11-06 厦门亿力吉奥信息科技有限公司 一种移动设备加密u盾
CN110866240A (zh) * 2019-11-12 2020-03-06 北京握奇智能科技有限公司 智能密码钥匙调用方法和系统
CN111555881A (zh) * 2020-03-23 2020-08-18 中安云科科技发展(山东)有限公司 使用sdf、skf实现国密ssl协议的方法及系统
CN111800260B (zh) * 2020-06-19 2022-12-09 深圳证券通信有限公司 兼容rsa及国产商用密码算法的智能密匙签名方法
CN112464203A (zh) * 2020-11-16 2021-03-09 航天信息股份有限公司 基于智能密码钥匙应用接口数据格式检测方法及电子设备
CN112560058B (zh) * 2020-12-17 2022-12-30 山东华芯半导体有限公司 基于智能密码钥匙的ssd分区加密存储系统及其实现方法
CN114422261A (zh) * 2022-02-15 2022-04-29 北京无字天书科技有限公司 管理方法、管理系统、计算机设备和计算机可读存储介质
CN114567470B (zh) * 2022-02-21 2024-01-30 北京创原天地科技有限公司 一种基于sdk的多系统下密钥拆分验证系统及方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050138393A1 (en) * 2003-12-22 2005-06-23 Challener David C. Determining user security level using trusted hardware device
CN1755572A (zh) * 2004-09-30 2006-04-05 联想(北京)有限公司 计算机安全启动的方法
US20210365529A1 (en) * 2018-03-12 2021-11-25 Hewlett-Packard Development Company, L.P. Hardware security
CN114115836A (zh) * 2022-01-28 2022-03-01 麒麟软件有限公司 一种基于Linux操作系统的可信TCM软件栈的设计方法及系统
CN115062330A (zh) * 2022-08-18 2022-09-16 麒麟软件有限公司 基于tpm的智能密码钥匙密码应用接口的实现方法

Also Published As

Publication number Publication date
CN115062330B (zh) 2022-11-11
CN115062330A (zh) 2022-09-16

Similar Documents

Publication Publication Date Title
US6609199B1 (en) Method and apparatus for authenticating an open system application to a portable IC device
US7139915B2 (en) Method and apparatus for authenticating an open system application to a portable IC device
KR100996784B1 (ko) 공개 키 암호화에 기초한 데이터의 저장 및 검색을 위한, 컴퓨팅 장치에서 구현되는 방법, 시스템 및 복수의 명령어를 저장하는 하나 이상의 컴퓨터 판독가능 매체
JP4818542B2 (ja) コンピューティングプラットフォームにおけるサービスの実行
Sarmenta et al. Virtual monotonic counters and count-limited objects using a TPM without a trusted OS
KR101067399B1 (ko) 대칭 키 암호화에 기초한 데이터의 저장 및 검색을 위한, 컴퓨팅 장치에서 구현되는 방법, 시스템 및 복수의 명령어를 저장하는 하나 이상의 컴퓨터 판독가능 매체
US8745386B2 (en) Single-use authentication methods for accessing encrypted data
WO2020192406A1 (zh) 数据存储、验证方法及装置
CN103038745B (zh) 扩展完整性测量
US7073059B2 (en) Secure machine platform that interfaces to operating systems and customized control programs
US6557104B2 (en) Method and apparatus for secure processing of cryptographic keys
US20050060561A1 (en) Protection of data
KR20170095161A (ko) 시큐어 시스템 온 칩
US20050060568A1 (en) Controlling access to data
US20100115625A1 (en) Policy enforcement in trusted platforms
CN102208000A (zh) 为虚拟机镜像提供安全机制的方法和系统
JPH1124919A (ja) 安全な記憶領域でアプリケーション・データを保護する方法及び装置
US7631348B2 (en) Secure authentication using a low pin count based smart card reader
US11586710B2 (en) System and method for protecting software licensing information via a trusted platform module
KR20220090537A (ko) 정책 적용을 위한 가상 환경 유형 검증
WO2024036832A1 (zh) 基于tpm的智能密码钥匙密码应用接口的实现方法
CN108345804B (zh) 一种可信计算环境中的存储方法和装置
Toll et al. The Caernarvon secure embedded operating system
CN110601846B (zh) 一种校验虚拟可信根的系统及方法
Wang Towards a General Purpose Trusted Computing Platform for All Vendors and Applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22955601

Country of ref document: EP

Kind code of ref document: A1