CN106161024A - A kind of USB device authentic authentication method of USB control chip level and system thereof - Google Patents

Abstract

A kind of USB device authentic authentication method of USB control chip level and system thereof, relate to field of information security technology.USB device authentic authentication system of the present invention is generated management system, USB main control chip safety management system and USB device authentic authentication system by Third Party Authentication authentication management system, USB main control chip device certificate and forms.Compared with the existing technology, integrated use asymmetric cryptographic technique of the present invention and authentic authentication technology, the master controller of usb host and the main control chip of USB device are carried out safety and strengthens transformation, and by third party testing agency, USB main control chip is authenticated empowerment management, realize the usb host authentic authentication to USB device, reach to stop the purpose of all assault patterns attempted with USB control chip firmware as intermediary, thus build computer system and the trust computing of USB device system and communication environment.

Description

A trusted authentication method and system for USB device at USB control chip level

technical field

The invention relates to the technical field of information security, in particular to a trusted authentication method and system for a USB device at the USB control chip level.

Background technique

USB (Universal Serial Bus) is a bus used to connect computers and peripheral devices. Its plug-and-play (Plug and Play) function enables it to connect, configure, and use and removal. Due to the flexibility and ease of use of USB, the number of peripheral devices supporting USB, including mice, keyboards, speakers, modems, and scanners, has increased year by year. Today, the USB interface has become the most successful peripheral connection interface on computers since the COM port (serial port), and related products have also entered the market with an annual growth rate of more than 30%.

As the most widely used USB device, mobile storage media (U disk for short) has the characteristics of small size, large capacity, and easy portability, and is a convenient medium for information exchange. In order to facilitate production and after-sales maintenance, the U disk master chip provides mass production tools to partners, which are used to define product functions and technical parameters, and to fix problems that occur after sales of products through software. However, the firmware of the U disk main control chip itself is a secret of the chip manufacturer and is not open. Similar methods are also adopted in other USB peripheral products.

Through the principle analysis and reverse engineering of the firmware of the USB main control chip, the hacker organization discovered a security flaw called "BADUSB", which allows the computer to modify the firmware of the main control chip of the U disk by itself, so that it can be inserted through the main control chip. The main control chip firmware can also actively attack the computer system, making it a chain of attack propagation, forming an exponential spread infection model of "computer -> multiple U disks -> more computers", thus It triggers the thinking on how to carry out security management on mobile storage media.

In the prior art, due to the design flaws of the computer, operating system system and USB protocol, it is currently impossible to defend the above-mentioned attack methods through software means, which constitutes a serious threat to the global computer system, including the automatic control system of industry and national infrastructure. An imminent and serious threat.

Contents of the invention

Aiming at the above-mentioned problems in the prior art, the object of the present invention is to provide a trusted authentication method and system for a USB device at the USB control chip level. It comprehensively uses asymmetric cryptography technology and trusted authentication technology to enhance the security of the main controller of the USB host and the main control chip of the USB device, and conduct authentication and authorization management on the USB main control chip through a third-party testing agency to realize The trusted authentication of the USB device by the USB host achieves the purpose of preventing all hacker attack modes that try to use the USB control chip firmware as an intermediary, thereby constructing a trusted computing and communication environment for the computer system and the USB device system.

In order to achieve the above-mentioned purpose of the invention, the technical solution of the present invention is realized in the following manner:

A trusted authentication method for USB devices at the USB control chip level, which consists of a third-party authentication and authorization management system, a USB main control chip device certificate generation management system, a USB main control chip security management system, and a USB device trusted authentication system trusted authentication system. Among them, the third-party certification and authorization management system used by the third-party chip testing agency consists of an authorization manager, an authorization cryptographic algorithm module, and a USB master chip device certificate issuance manager. The authorized cryptographic algorithm module includes hash algorithms, digital signature algorithms and digital signature algorithms. Signature verification algorithm. The USB master chip device certificate generation management system used by the USB master chip manufacturer is composed of a system cryptographic algorithm module and a chip device certificate generator. The system cryptographic algorithm module includes a hash algorithm and a digital signature algorithm. The USB main control chip security management system built into the USB main control chip of the USB device consists of a chip security storage unit, a chip cryptographic algorithm hardware module, a security self-test ROM boot program, and a security verification management firmware program. The chip cryptographic algorithm hardware module includes a hash Algorithms and digital signature verification algorithms. The USB device trusted authentication system on the USB host side is composed of a USB main control chip authentication manager, a key security storage unit and an authentication cryptographic algorithm module, and the authentication cryptographic algorithm module includes a digital signature verification algorithm. Its main implementation steps are:

1 ) system authorization:

① The authorization manager in the third-party authentication and authorization management system provides the third-party authentication public key for the USB device trusted authentication system, and stores and solidifies it into the key security storage unit of the USB device trusted authentication system.

② The authorization manager in the third-party authentication and authorization management system provides the third-party authentication public key for the USB main control chip security management system, and stores and solidifies it in the chip security storage unit of the USB main control chip security management system.

) USB Master chip device certificate generation, issuance and storage curing:

①USB main control chip device certificate generation The chip device certificate generator of the management system uses the hash algorithm in the system password algorithm module to hash all or part of the data of the USB main control chip firmware in the USB main control chip to generate a USB main control chip. Chip firmware digital digest, and use the chip device private key and the digital signature algorithm in the system cryptographic algorithm module to generate a digital signature of the USB master chip firmware digital digest. Package the USB main control chip identification, USB device type description, chip device public key, USB main control chip firmware digital summary, and the digital signature information of the USB main control chip firmware digital summary to generate a chip device certificate body corresponding to the USB main control security chip , the chip device certificate body will be provided to the third-party authentication and authorization management system.

②The USB master chip device certificate issuance manager in the third-party authentication and authorization management system uses the chip device public key in the chip device certificate body and the digital signature verification algorithm in the authorized cryptographic algorithm module to verify the USB master control in the chip device certificate body. The digital signature of the digital digest of the chip firmware confirms the legitimacy and integrity of the digital digest of the USB main control chip firmware; if the digital signature is verified, use the hash algorithm in the authorized cryptographic algorithm module to perform all or part of the data of the USB main control chip firmware Hash processing to generate a digital summary of the USB master chip firmware. Compare the digital digest of the USB main control chip firmware with the digital digest of the USB main control chip firmware in the chip device certificate body. If the data is consistent, use the third-party signature private key and the digital signature algorithm in the authorized cryptographic algorithm module to generate the chip The digital signature of the device certificate body, and package the chip device certificate body and the digital signature of the chip device certificate body to generate a USB master chip device certificate.

③The USB main control chip device certificate will be stored and solidified in the chip security storage unit of the USB main control chip security management system.

) USB Security self-test of the main control chip:

①The USB device is connected to the USB host through the USB bus. After the USB device is powered on, the USB master chip starts to execute the safety self-test ROM boot program of the USB master chip security management system.

②Security self-test ROM boot program uses the third-party authentication public key in the chip security storage unit and the digital signature verification algorithm in the chip cryptographic algorithm hardware module to verify the digital signature of the USB master chip device certificate in the chip security storage unit, and confirm the USB The legitimacy and integrity of the master chip device certificate. If the digital signature is not verified, the USB device will be blocked from communicating with the USB host.

③Security self-test ROM boot program uses the chip device public key in the USB master chip device certificate and the digital signature verification algorithm in the chip cryptographic algorithm hardware module to verify the number of the USB master chip firmware digital digest in the USB master chip device certificate Signature to confirm the legitimacy and integrity of the digital digest of the USB master chip firmware. If the digital signature is not verified, the USB device will prevent communication with the USB host.

④The security self-check ROM boot program uses the hash algorithm in the chip cryptographic algorithm hardware module to perform hash processing on all or part of the data of the USB main control chip firmware, and obtains the digital summary of the USB main control chip firmware. Compare the digital summary with the digital summary of the USB main control chip firmware in the USB main control chip device certificate. If the data is consistent, it is confirmed that the USB main control chip firmware data has not been tampered with. If the data is inconsistent, the USB device will be blocked from communicating with the USB host.

⑤ After the USB device establishes a communication connection with the USB host, the USB main control chip will execute the security verification management firmware program of the USB main control chip security management system, and cooperate with the trusted authentication of the USB device by the USB host.

) USB Trusted certification of the main control chip:

① After the USB host detects the USB device, a communication connection is established, and the USB main control chip authentication manager of the USB device trusted authentication system communicates with the security verification management firmware program of the USB main control chip security management system to obtain the USB main control chip device Certificate, and use the third-party authentication public key in the key security storage unit and the digital signature verification algorithm in the authentication cryptographic algorithm module to verify the digital signature of the USB master chip device certificate, and confirm the legitimacy and integrity of the USB master chip device certificate . If the digital signature verification is not passed, directly disconnect the communication connection between the USB host and the USB device.

②The USB main control chip authentication manager of the USB device trusted authentication system starts the USB device enumeration process, obtains the USB device type declaration from the USB main control chip, and combines the USB device type declaration with the device type description in the USB main control chip device certificate Compare. If the device types are consistent, continue the enumeration process of the USB device; if the types are inconsistent, directly disconnect the communication connection between the USB host and the USB device.

In the above-mentioned trusted authentication method for USB devices at the USB control chip level, the key security storage unit of the USB device trusted authentication system and the chip security storage unit of the USB master chip security management A tamper-proof storage unit protected by a chip after the programming tool writes data once.

In the above-mentioned trusted authentication method for USB devices at the USB control chip level, the third-party authentication public key and the third-party signature private key are managed by the third-party authentication authorization management system A, and are used for the digital signature of the USB master chip device certificate and signature verification; the chip device private key and chip device public key are owned and managed by the USB master chip manufacturer, and are used to digitally sign and verify the USB master chip firmware. One-to-one correspondence.

In the USB device trustworthy authentication method at the USB control chip level above, the USB main control chip identification is an identification formed by the model of the USB main control chip and the firmware version number of the USB main control chip, and is the same as the USB main control chip device certificate. One to one correspondence.

A trusted authentication system for USB devices at the USB control chip level. Authentication system composition. The third-party authentication and authorization management system is composed of an authorization manager, an authorization cryptographic algorithm module and a USB main control chip device certificate issuing manager, and the authorized cryptographic algorithm module includes a hash algorithm, a digital signature algorithm and a digital signature verification algorithm. The USB main control chip device certificate generation management system is composed of a system cryptographic algorithm module and a chip device certificate generator, and the system cryptographic algorithm module includes a hash algorithm and a digital signature algorithm. The USB main control chip security management system is composed of a chip security storage unit, a chip cryptographic algorithm hardware module, a security self-inspection ROM boot program, and a security verification management firmware program. The chip cryptographic algorithm hardware module includes a hash algorithm implemented by hardware and a digital Signature verification algorithm. The USB device trusted authentication system is composed of a USB main control chip authentication manager, a key security storage unit and an authentication cryptographic algorithm module, and the authentication cryptographic algorithm module includes a digital signature verification algorithm. The third-party authentication and authorization management system is a system used by third-party chip testing agencies, and completes the authentication and authorization functions of the USB main control chip security management system and the USB device trusted authentication system. The USB main control chip device certificate generation management system is a system used by USB main control chip manufacturers to complete the generation and management of USB main control chip certificates. The USB main control chip security management system is built in the USB main control chip of the USB device, and completes the main control chip level security self-check and security verification functions of the USB device. The USB device trusted authentication system is built in the USB host controller or implemented by an independent chip, and completes the trusted authentication and safe use verification functions of the USB host to the USB device.

Due to the adoption of the above method and structure, the present invention, on the one hand, carries out chip-level security transformation on the main control chip of the USB device. The chip itself is safe; on the other hand, carry out security transformation on the main controller of the USB host or add an independent chip, and increase the trusted authentication function of the USB host to the USB device before the USB host enumerates the USB device to ensure that the USB device connected to the host It is safe and reliable. At the same time, the trusted authentication management of the USB main control chip is carried out by a third-party testing agency to realize the trusted authentication of the USB host to the USB device, and the USB device that fails the authentication is refused to connect to the host. The invention provides a USB control chip-level trusted authentication technology for USB devices for information and network systems to defend against attacks using USB as a medium, thereby solving the problem of failure to pass software due to design defects in computers, operating system systems, and USB protocols. Means to defend against attacks using USB as the medium. The invention adopts the asymmetric encryption technology to realize the authorization management and trusted authentication of the USB main control chip, and by increasing the security self-check of the USB main control chip, the self-security of the USB device is realized from the chip layer, which is the reliable security of the USB device. Letter certification provides a reliable technical guarantee.

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Description of drawings

Fig. 1 is the schematic structural diagram of the system of the present invention;

Fig. 2 is a schematic diagram of system authorization processing of USB host and USB device in the method of the present invention;

Fig. 3 is a schematic diagram of USB main control chip device certificate generation, issuance and storage solidification processing in the method of the present invention;

Fig. 4 is a flow chart of the system for generating the certificate of the USB master control chip device in Fig. 3;

Fig. 5 is the flow chart of the safety self-inspection processing system of USB main control chip in the method of the present invention;

FIG. 6 is a flow chart of the trusted authentication processing system of the USB host to the USB main control chip in the method of the present invention.

detailed description

Referring to Fig. 1 to Fig. 3, the system realizing the trusted authentication method of USB device at the USB control chip level is composed of a third-party authentication authorization management system A, a USB main control chip device certificate generation management system B, a USB main control chip security management system C and Composition of trusted authentication system D for USB devices.

The third-party authentication and authorization management system A is a system used by third-party chip testing institutions. It is composed of an authorization manager 1, an authorized cryptographic algorithm module 2, and a USB master chip device certificate issuance manager 3. The authorized cryptographic algorithm module 2 includes a Greek algorithm, digital signature algorithm and digital signature verification algorithm to complete the authentication and authorization functions of the USB master chip security management system C and the USB device trusted authentication system D. On the one hand, the third-party authentication and authorization management system A implements the authorization management of the USB host and USB devices through the authorized use of the third-party authentication public key 13; The certificate body 14 is digitally signed to generate a USB main control chip device certificate 15 to realize the issuance of the USB main control chip device certificate 15 .

USB main control chip device certificate generation management system B is a system used by USB main control chip manufacturers. It consists of a system cryptographic algorithm module 4 and a chip device certificate generator 5. The system cryptographic algorithm module 4 includes hash algorithms and digital signatures Algorithm to complete the generation and management of USB master chip device certificates.

The USB main control chip safety management system C is built into the USB main control chip of the USB device, and is composed of a chip safe storage unit 6, a chip password algorithm hardware module 7, a safety self-check ROM boot program 8 and a safety verification management firmware program 9, and the chip password The algorithm hardware module 7 includes a hash algorithm and a digital signature verification algorithm realized by hardware, and completes the safety self-check and safety verification functions of the USB device main control chip.

The USB device trusted authentication system D is built into the USB host controller or realized by an independent chip, and is composed of a USB master chip authentication manager 10, a key security storage unit 11 and an authentication cryptographic algorithm module 12. The authentication cryptographic algorithm module 12 includes The digital signature verification algorithm completes the trusted authentication and safe use verification functions of the USB host to the USB device.

The USB main control chip device certificate 15 of the present invention includes the digital abstract of the firmware of the USB main control chip and its digital signature, which provides important support for realizing the credible authentication of the entire system.

Referring to Fig. 1 to Fig. 6, the step when the inventive method uses is:

1 ) system authorization:

① The authorization manager 1 in the third-party authentication and authorization management system A provides the third-party authentication public key 13 for the USB device trusted authentication system D, and stores and solidifies it into the key security storage unit 11 of the USB device trusted authentication system D, Realize the authentication and authorization of the USB device trusted authentication system D.

② The authorization manager 1 in the third-party authentication and authorization management system A provides the third-party authentication public key 13 for the USB main control chip security management system C, and stores and solidifies it in the chip security storage unit 6 of the USB main control chip security management system C , to implement the authentication and authorization of the USB device.

) USB Master chip device certificate generation, issuance and storage curing:

① USB main control chip device certificate generation The chip device certificate generator 5 of management system B uses the hash algorithm in the system cryptographic algorithm module 4 to perform hash processing on all or part of the data of the USB main control chip firmware in the USB main control chip to generate USB master control chip firmware digital digest, and use the chip device private key and the digital signature algorithm in the system cryptographic algorithm module 4 to generate the digital signature of the USB master control chip firmware digital digest. Pack the USB main control chip identification, USB device type description, chip device public key, USB main control chip firmware digital digest, and digital signature information of the firmware digital digest to generate a chip device certificate body 14 corresponding to the USB main control security chip. The chip device certificate body 14 will be provided to the third-party authentication authorization management system A.

②The USB main control chip device certificate issuance manager 3 in the third-party authentication and authorization management system A uses the chip device public key in the chip device certificate body 14 and the digital signature verification algorithm in the authorized cryptographic algorithm module 2 to verify the chip device certificate body 14 The digital signature of the digital summary of the USB main control chip firmware in the USB main control chip confirms the legitimacy and integrity of the digital summary of the USB main control chip firmware; Perform hash processing on all or part of the firmware data to generate a digital summary of the USB main control chip firmware, compare the digital summary with the digital summary of the USB main control chip firmware in the chip device certificate body 14, and if the data are consistent, use a third-party The signature private key and the digital signature algorithm in the authorized cryptographic algorithm module 2 generate the digital signature of the chip device certificate body 14, and package the chip device certificate body 14 and the digital signature to generate the USB master chip device certificate 15.

③ The USB main control chip device certificate 15 will be stored and solidified in the chip security storage unit 6 of the USB main control chip security management system D.

) USB Security self-test of the main control chip:

①The USB device is connected to the USB host via the USB bus, and after the USB device is powered on, the USB main control chip starts to execute the safety self-test ROM boot program 8 of the USB main control chip safety management system C;

②Security self-inspection ROM boot program 8 uses the third-party authentication public key 13 in the chip security storage unit 6 and the digital signature verification algorithm in the chip cryptographic algorithm hardware module 7 to verify the number of the USB main control chip device certificate 15 in the chip security storage unit 6 Signature to confirm the legitimacy and integrity of the chip device certificate; if it fails to pass the digital signature verification, the USB device will be blocked from communicating with the USB host;

③Security self-check ROM boot program 8 uses the chip device public key in the USB master chip device certificate 15 and the digital signature verification algorithm in the chip cryptographic algorithm hardware module 7 to verify the USB master chip firmware in the USB master chip device certificate 15 The digital signature of the digital digest confirms the legitimacy and integrity of the digital digest of the USB master chip firmware; if it fails to pass the digital signature verification, the USB device will be blocked from communicating with the USB host;

4. The security self-check ROM boot program 8 uses the hash algorithm in the chip cryptographic algorithm hardware module 7 to carry out hash processing to all or part of the data of the USB main control chip firmware to obtain a digital summary of the USB main control chip firmware; combine the digital summary with the USB Compare the digital summary of the USB main control chip firmware in the main control chip device certificate 15. If the data is consistent, it is confirmed that the firmware data of the USB main control chip has not been tampered with; if the data is inconsistent, the USB device will be prevented from communicating with the USB host;

⑤ After the USB device establishes a communication connection with the USB host, the USB main control chip will execute the security verification management firmware program 9 of the USB main control chip security management system C, and cooperate with the trusted authentication of the USB device by the USB host.

) USB Trusted certification of the main control chip:

① After the USB host detects the USB device, a communication connection is established, and the USB main control chip authentication manager 10 of the USB device trusted authentication system D communicates with the security verification management firmware program 9 of the USB main control chip security management system C to obtain the USB Master control chip device certificate 15; and use the third-party authentication public key 13 in the key security storage unit 11 and the digital signature verification algorithm in the authentication cryptographic algorithm module 12 to verify the digital signature of the USB master chip device certificate 15, confirm the chip device The legality and integrity of the certificate 15; if it fails to pass the digital signature verification, directly disconnect the communication connection between the USB host and the USB device.

2. The USB main control chip authentication manager 10 of the USB device trusted authentication system D starts the USB device enumeration process, obtains the USB device type declaration from the USB main control chip, and matches the USB device type declaration with the USB main control chip device certificate 15. Compare the device type descriptions; if the device types are consistent, continue the normal enumeration process of the USB device; if the device types are inconsistent, directly disconnect the communication connection between the USB host and the USB device.

Claims (5)

1. A trusted authentication method for USB devices at the USB control chip level, which uses a third-party authentication and authorization management system (A), a USB master chip device certificate generation management system (B), and a USB master chip security management system (C) and a trusted authentication system for USB devices (D); where the third-party authentication and authorization management system (A) used by the third-party chip testing agency consists of an authorization manager (1), an authorized cryptographic algorithm module ( 2) and the USB main control chip device certificate issuance manager (3), the authorized cryptographic algorithm module (2) includes the hash algorithm, digital signature algorithm and digital signature verification algorithm; the USB main control chip manufacturer used by the USB main control chip The control chip device certificate generation management system (B) is composed of a system cryptographic algorithm module (4) and a chip device certificate generator (5). The system cryptographic algorithm module (4) includes a hash algorithm and a digital signature algorithm; it is built into the USB device The USB main control chip security management system (C) of the USB main control chip consists of a chip security storage unit (6), a chip cryptographic algorithm hardware module (7), a safety self-test ROM boot program (8) and a safety verification management firmware program (9 ), the chip cryptographic algorithm hardware module (7) contains the hash algorithm and digital signature verification algorithm implemented by hardware; the USB device trusted authentication system (D) on the USB host side is composed of the USB master chip authentication manager (10), the key The secure storage unit (11) is composed of an authentication cryptographic algorithm module (12), and the authentication cryptographic algorithm module (12) includes a digital signature verification algorithm; its main implementation steps are: 1 ) system authorization: ① The authorization manager (1) in the third-party authentication and authorization management system (A) provides the third-party authentication public key (13) for the USB device trusted authentication system (D), and stores and solidifies it in the USB device trusted authentication system (D ) in the key security storage unit (11); ② The authorization manager (1) in the third-party authentication and authorization management system (A) provides the third-party authentication public key (13) for the USB main control chip security management system (C), and stores and solidifies it in the USB main control chip security management system (C) in the chip security storage unit (6); 2 ) USB master chip device certificate generation, issuance and storage curing: ①USB main control chip device certificate generation The chip device certificate generator (5) of the management system (B) uses the hash algorithm in the system cryptographic algorithm module (4) to encrypt all or part of the data of the USB main control chip firmware in the USB main control chip Perform hash processing to generate a digital summary of the firmware of the USB main control chip, and use the private key of the chip device and the digital signature algorithm in the system cryptographic algorithm module (4) to generate a digital signature of the digital summary of the firmware of the USB main control chip; Identification, USB device type description, chip device public key, USB main control chip firmware digital summary and digital signature information of the firmware digital summary are packaged to generate a chip device certificate body (14) corresponding to the USB main control chip; chip device certificate body (14 ) will be provided to the third-party authentication authorization management system (A); ②The USB master chip device certificate issuance manager (3) in the third-party authentication and authorization management system (A) uses the chip device public key in the chip device certificate body (14) and the digital authentication in the authorized cryptographic algorithm module (2). The signature algorithm verifies the digital signature of the USB main control chip firmware digital digest in the chip device certificate body (14), and confirms the legitimacy and integrity of the USB main control chip firmware digital digest; if the digital signature verification is passed, use the authorized cryptographic algorithm module ( The hash algorithm in 2) performs hash processing on all or part of the data of the USB main control chip firmware, generates a digital summary of the USB main control chip firmware, and combines the digital summary with the USB main control chip firmware in the chip device certificate body (14) Compare the digital digests, and if the data are consistent, use the third-party signature private key and the digital signature algorithm in the authorized cryptographic algorithm module (2) to generate a digital signature for the chip device certificate body (14), and send the chip device certificate body (14) ) and digital signature packaging to generate a USB master chip device certificate (15); ③The USB main control chip device certificate (15) will be stored and solidified in the chip security storage unit (6) of the USB main control chip security management system (C); 3 )Security self-test of USB main control chip: ①The USB device is connected to the USB host through the USB bus, and after the USB device is powered on, the USB main control chip starts to execute the safety self-test ROM boot program (8) of the USB main control chip safety management system (C); ②The security self-test ROM boot program (8) uses the third-party authentication public key (13) in the chip security storage unit (6) and the digital signature verification algorithm in the chip cryptographic algorithm hardware module (7) to verify the chip security storage unit (6) The digital signature of the USB master chip device certificate (15) confirms the legitimacy and integrity of the chip device certificate; if the digital signature fails to pass the digital signature verification, the USB device will be blocked from communicating with the USB host; ③Security self-test ROM boot program (8) uses the chip device public key in the USB master chip device certificate (15) and the digital signature verification algorithm in the chip cryptographic algorithm hardware module (7) to verify the USB master chip device certificate (15 ) in the digital signature of the USB main control chip firmware digital digest to confirm the legitimacy and integrity of the USB main control chip firmware digital digest; if the digital signature fails to pass the digital signature verification, the USB device will be blocked from communicating with the USB host; ④Security self-check ROM boot program (8) uses the hash algorithm in the chip cryptographic algorithm hardware module (7) to perform hash processing on all or part of the data of the USB main control chip firmware to obtain a digital summary of the USB main control chip firmware; Compare the digital summary with the digital summary of the USB main control chip firmware in the USB main control chip device certificate (15). If the data is consistent, it is confirmed that the firmware data of the USB main control chip has not been tampered with; if the data is inconsistent, the USB device will be blocked. USB host for communication connection; ⑤ After the USB device establishes a communication connection with the USB host, the USB main control chip will execute the security verification management firmware program (9) of the USB main control chip security management system (C), and cooperate with the trusted authentication of the USB device by the USB host; 4 ) Trusted certification of the USB master chip: ① After the USB host detects the USB device, it establishes a communication connection, and the USB main control chip authentication manager (10) of the USB device trusted authentication system (D) and the security verification management firmware program of the USB main control chip security management system (C) ( 9) Conduct session communication, obtain the USB master chip device certificate (15); and use the third-party authentication public key (13) in the key security storage unit (11) and the digital signature verification in the authentication cryptographic algorithm module (12) The algorithm verifies the digital signature of the USB master chip device certificate (15), and confirms the legitimacy and integrity of the chip device certificate (15); if the digital signature verification is not passed, the communication connection between the USB host and the USB device is directly disconnected; ②The USB main control chip authentication manager (10) of the USB device trusted authentication system (D) starts the USB device enumeration process, obtains the USB device type declaration from the USB main control chip, and combines the USB device type declaration with the USB main control chip device Compare the device type description in the certificate (15); if the device type is consistent, continue the normal enumeration process of the USB device; if the device type is inconsistent, directly disconnect the communication connection between the USB host and the USB device. 2. The trusted authentication method for USB devices at the USB control chip level according to claim 1, characterized in that, the secure key storage unit (11) and the USB master of the USB device trusted authentication system (D) The chip security storage unit (6) of the chip security management system (C) refers to a tamper-proof storage unit protected by the chip after data is written once by the chip programming tool in the chip. 3. The trusted authentication method for USB devices at the USB control chip level according to claim 1 or 2, wherein the third-party authentication public key (13) and the third-party signature private key are managed by a third-party authentication authority System (A) management, used for digital signature and verification of the USB main control chip device certificate (15); the chip device private key and chip device public key are owned and managed by the USB main control chip manufacturer, and used for The firmware of the USB main control chip performs digital signature and verification, and there is no one-to-one correspondence with the USB main control chip. 4. the USB device credible authentication method of USB control chip level as claimed in claim 3, it is characterized in that, described USB main control chip identification is made of the model of USB main control chip and the firmware version number of USB main control chip The identification is in one-to-one correspondence with the USB main control chip device certificate (15). 5. A trusted authentication system for USB devices at the USB control chip level, characterized in that it consists of a third-party authentication and authorization management system (A), a USB master chip device certificate generation management system (B), a USB master chip security Composed of a management system (C) and a USB device trusted authentication system (D); the third-party authentication and authorization management system (A) consists of an authorization manager (1), an authorized cryptographic algorithm module (2) and a USB master chip device certificate Issuance manager (3), the authorized cryptographic algorithm module (2) includes hash algorithm, digital signature algorithm and digital signature verification algorithm; the USB main control chip device certificate generation management system (B) consists of the system cryptographic algorithm module ( 4) Composed of a chip device certificate generator (5), the system cryptographic algorithm module (4) includes a hash algorithm and a digital signature algorithm; the USB main control chip security management system (C) consists of a chip security storage unit (6) , chip cryptographic algorithm hardware module (7), security self-check ROM boot program (8) and security verification management firmware program (9), the chip cryptographic algorithm hardware module (7) includes hardware-implemented hash algorithm and digital signature verification algorithm ; The USB device trusted authentication system (D) is composed of a USB main control chip authentication manager (10), a key security storage unit (11) and an authentication cryptographic algorithm module (12), and the authentication cryptographic algorithm module (12) Including the digital signature verification algorithm; the third-party certification and authorization management system (A) is a system used by the third-party chip testing agency, and completes the certification of the USB main control chip security management system (C) and the USB device trusted certification system (D) Authorization function; USB main control chip device certificate generation management system (B) is a system used by USB main control chip manufacturers to complete the generation and management of USB main control chip device certificates (15); USB main control chip security management system ( C) The USB main control chip built into the USB device completes the security self-check and security verification functions of the USB device main control chip; the USB device trusted authentication system (D) is built into the USB host controller or implemented by an independent chip to complete the USB The trusted authentication and safe use verification function of the host to the USB device.