CN101477602A - Remote proving method in trusted computation environment - Google Patents

Abstract

The invention provides a method for remote certification in a trusted computing environment, which uses a session encryption key to encrypt the integrity measurement value and measurement log of the verified trusted platform, and digitally signs the encrypted result. The method is based on a security chip TPM /TCM, the remote attestation architecture adopted is composed of three parts: integrity measurement mechanism, reporting mechanism and verification mechanism, which are respectively completed by integrity measurement agent, reporting agent and verification requester, wherein the measurement agent, reporting agent and security chip are installed in In the verified trusted platform, the method can guarantee the authenticity of the integrity measurement value and the measurement log of the verified trusted platform and the privacy of the platform, and effectively prevent replay attacks, impersonation attacks and man-in-the-middle attacks, and can be used for Prove to the verification requester that the platform operating environment is credible or used for self-testing of the platform operating environment, and can be used to prove to the verification requester that the platform operating environment is credible and can be used for self-testing of the platform operating environment. Suitable for a fair and open network environment.

Description

A Method of Remote Attestation in Trusted Computing Environment

technical field

The invention relates to a remote attestation method in a trusted computing environment, which belongs to the field of computer information security trusted computing.

Background technique

Distributed applications have higher and higher security requirements for computing platforms in an open system environment. Distributed applications include many interests and security conflicting parties. Therefore, establishing mutual trust between platforms and proving that the computing environment is credible has become the current information A major imperative for security. On the other hand, computing platforms running malicious program codes exhibit arbitrary attack behaviors, such as Byzantine attacks, which make it impossible to maintain long-term static trust between platforms. At present, the general idea is to use remote attestation to identify the software configuration and status of remote platforms, so as to calculate the environment status, detect damaged participating platforms, and ensure normal communication between platforms in trusted operating environments. The trusted computing organization TCG (Trusted Computing Group) has formulated a series of related specifications such as trusted computing platforms, trusted storage, and trusted network connections. The method is to install a dedicated security chip TPM on the host platform, mobile platform, and embedded platform. (TrustedPlatform Module, Trusted Platform Module), which is used as the root of trust of the system to solve the problem of establishing and proving the trust of the trusted computing platform. my country has also formulated the relevant standards of TCM (Trusted Cryptography Module) with independent intellectual property rights, and domestic IT manufacturers have successively developed security chips that support the TCM standard. Similar to TPM specifications and chips, TCM standards and chips also support the certification of trusted computing platform computing environments. Here, the security function of the TPM/TCM for proving the trusted state of the platform is collectively referred to as Remote Attestation (Remote Attestation, RA).

Remote attestation RA is the process of verifying and confirming the identity of the remote platform and the configuration information of the platform status by the party that sends the verification request, that is, the verification requester. RA is based on integrity measurement, storage and reporting, wherein, integrity measurement and storage refers to the measurement value of the calculation component, records the event to the measurement log, and records the measurement value into the platform configuration register PCR; integrity report Refers to the process by which a trusted computing platform provides platform or part integrity metrics to a verification requester. When reporting integrity metrics, the platform identity key shall digitally sign the integrity metrics. The verification requester judges the credibility of the platform by verifying the validity of the signature and verifying the integrity measurement value.

Remote attestation is one of the important research issues in the field of trusted computing. The remote attestation scheme under the TCG framework has received extensive attention from many scholars and research institutions at home and abroad. Among the many research results, the integrity measurement framework IMA (Integrity Measurement Architecture) proposed by IBM Research is more typical. Existing remote attestation schemes are issued by the verification requester. The measurement and proof lack consistency and scalability, cannot guarantee the authenticity of the integrity measurement value and the privacy of the platform, and lack protection against replay attacks and impersonation attacks. and protection against man-in-the-middle attacks.

Contents of the invention

The purpose of the present invention is to improve the remote attestation mechanism proposed by Trusted Computing Group TCG in the Trusted Platform Module TPM specification, and propose a new method for remote attestation in a trusted computing environment, which uses a session encryption key Encrypt the integrity measurement value and measurement log of the verified trusted platform, and digitally sign the encrypted result to ensure the authenticity of the integrity measurement value and measurement log of the verified trusted platform and the privacy of the platform, which can effectively prevent duplication Release attacks, impersonation attacks and man-in-the-middle attacks can be used to prove to the verification requester that the platform operating environment is credible, and can also be used for self-detection of the platform operating environment.

This method is based on the security chip TPM/TCM, and the adopted remote attestation architecture consists of three parts: integrity measurement mechanism, reporting mechanism and verification mechanism, which are respectively completed by integrity measurement agent, reporting agent and verification requester, wherein measurement agent, report Agents and security chips are installed in verified and trusted platforms. There is a valid identity certificate in the verified trusted platform, which binds the identity key PIK _pub of the verified trusted platform. in,

(1) Measurement agent: determine the object of measurement, measurement time and how to maintain the measurement value safely. Its main function is to calculate the measurement value of the component, record the measurement event into the measurement log, and record the measurement value into the corresponding platform configuration register PCR in the security chip. The recording method is: new PCR value=cipher hash algorithm (original PCR value||metric value). The measurement log at least includes but is not limited to: measurer information, measureee information, original PCR value, measurement value, new PCR value, and completion time. The measurement log represents the integrity measurement history of the verified trusted platform.

(2) Reporting agent: Provide the integrity measurement value of the platform or some components to the verification requester, generate the session encryption key according to the established key generation algorithm (such as the DH algorithm), and the specified PCR value and the relevant measurement of the specified PCR The log information is encrypted, and the encrypted result is digitally signed using the private key PIK _prv corresponding to the platform identity key PIK _pub , and the signed result is sent to the verification requester.

(3) Verification requester: Send a verification request to the verified trusted platform, use the platform identity key PIK _pub to verify the signature of the PCR value and the measurement log and decrypt the received response result. Through the measurement log, reconstruct the entire integrity measurement process and calculate the hash value, and compare the final PCR value with the decrypted PCR value. If the two are the same, the credibility of the verified trusted platform can be confirmed; if the two are different, it can be concluded that the status of the verified trusted platform has changed, and its credibility cannot be confirmed.

The specific remote attestation process is:

给被验证可信平台A；(1) The verification requester C generates an unpredictable timestamp N _C , digitally signs C and N _C , and then sends verification request messages C, N _C ,

To the verified trusted platform A;

(2) After receiving C's verification request message, A requests a trusted third-party CA to verify the validity and legitimacy of C's certificate;

(3) After the certificate verification is passed, the CA sends C's public key certificate to A;

中的C和N_C是否与消息中未签名的C和N_C分别相同。若相同，则生成不可预期的时间戳N_A，和N_C根据既定的密钥生成算法(如DH算法)生成会话加密密钥SK。(4) A uses C's public key PUB _C to verify the signature

Are the C and N _C in the message the same as the unsigned C and N _C in the message, respectively. If they are the same, an unpredictable time stamp N _A is generated, and N _C generates a session encryption key SK according to a predetermined key generation algorithm (such as a DH algorithm).

A obtains the value of the specified PCR and the relevant measurement log ML of the specified PCR from the security chip TPM/TCM, and encrypts the PCR value and the measurement log ML with the session encryption key SK to obtain the encrypted result enc{PCR, ML} _SK , and uses The private key PIK _prv corresponding to the platform identity key PIK _pub digitally signs the identity A, the unpredictable timestamp N _A , N _C +1 and the encryption result enc{PCR, ML} _SK , and sends the following message to C:

$\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; A</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; sig</span>}{<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; A</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; C</span>}}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; enc</span>}{<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; PCR</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; ML</span>}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; SK</span>}}<span\; class="notranslate">\; \}</span>}_{{\mathrm{<span\; class="notranslate">\; PIK</span>}}_{\mathrm{<span\; class="notranslate">\; prv</span>}}}$

(5) After receiving A's response message, C verifies the validity and legitimacy of A's platform identity certificate through CA;

(6) After the certificate verification is passed, C uses the A platform identity key PIK _{pub to} verify whether the A and N _A in the signature are the same as the unsigned A and N _A in the message, and check that the N _C in it is the same as the sent N Whether _C matches.

If N _C matches, C uses N _A and N _C to generate session encryption key SK according to a predetermined key generation algorithm (such as DH algorithm), decrypts enc{PCR, ML} _SK , and obtains PCR value and measurement log ML.

C reconstructs the entire integrity measurement process according to the measurement log ML, calculates the final PCR value, and compares it with the decrypted PCR value. If the two are the same, it can be confirmed that the verified trusted platform is trusted; otherwise, it is considered that the verified trusted platform is not trusted.

The beneficial effect of the invention is: in order to solve the defects in the remote certification mechanism of the trusted platform based on integrity verification that cannot effectively prevent replay attacks, counterfeit attacks and man-in-the-middle attacks, the patent of the present invention proposes a new remote certification method, Use the session encryption key to encrypt the integrity measurement value and measurement log of the verified trusted platform, and digitally sign the encrypted result to ensure the authenticity of the integrity measurement value and measurement log of the verified trusted platform and the privacy of the platform , not only can effectively prevent the above attack methods, but also can be used to prove to the verification requester that the platform operating environment is credible, and can be used for self-testing of the platform operating environment, which is more suitable for a fair and open network environment.

Description of drawings

Figure 1 is a system composition diagram,

Figure 2 is a diagram of the remote attestation process.

Explanation of reference symbols:

Verify the requester: C: Identity

N _C : Unexpected timestamp generated by C

PUB _C , PRV _C : the public-private key pair held by C

Verified and trusted platform: A: Identity

N _A : Unexpected timestamp generated by A

PIK _pub , PIK _prv : the public-private key pair held by A

PCR: Platform configuration register, which holds integrity metrics

ML: Integrity Metrics Log

Trusted third party: CA

Session key: SK, according to the established key generation algorithm (such as DH algorithm) to generate operations:

Digital signature: sig

Encryption: enc, encrypted using a symmetric encryption algorithm.

Detailed ways

The present invention will be described in detail below through specific embodiments and accompanying drawings.

The present invention is a method for remote certification in a trusted computing environment. It uses a security chip TPM/TCM to generate a session encryption key by using the unanticipated time stamp generated by the verified trusted platform and the verification requester. The integrity measurement value and measurement log of the trusted platform are encrypted, and the identity, unpredictable time stamp, and encryption result are digitally signed to ensure the authenticity of the integrity measurement value and measurement log of the verified trusted platform and the privacy of the platform Through the measurement log, the verification requester reconstructs the integrity measurement process of the verified trusted platform, calculates and compares the integrity measurement value, and realizes the remote proof of the verified trusted platform.

The method of the present invention includes a verified trusted platform A and a verified requester C, wherein the verified trusted platform A is equipped with a security chip TPM/TCM, a measurement agent and a report agent, wherein:

给被验证可信平台A；(1) Verification request: C generates a 160-bit or 256-bit unpredictable time stamp N _C , digitally signs C and N _C , and then sends a verification request message

To the verified trusted platform A;

(2) Certificate check: After receiving C's verification request message, A requests a trusted third-party CA to verify the validity and legitimacy of C's certificate;

(3) Certificate sending: After the certificate verification is passed, the CA sends C's public key certificate to A;

中的C和N_C是否与消息中未签名的C和N_C分别相同。若相同，则生成160位或256位的不可预期时间戳N_A，和N_C根据既定的密钥生成算法(如DH算法)生成160位或256位的会话加密密钥SK。(4) Measurement report: A uses C's public key PUB _C to verify the signature

Are the C and N _C in the message the same as the unsigned C and N _C in the message, respectively. If they are the same, a 160-bit or 256-bit unpredictable time stamp N _A is generated, and N _C generates a 160-bit or 256-bit session encryption key SK according to a predetermined key generation algorithm (eg, DH algorithm).

A obtains the value of the specified PCR and the relevant measurement log ML of the specified PCR from the security chip TPM/TCM, and encrypts the PCR value and the measurement log ML with the session encryption key SK to obtain the encrypted result enc{PCR, ML} _SK , and uses The private key PIK _prv corresponding to the platform identity key PIK _pub digitally signs the identity A, the unpredictable timestamp N _A , N _C +1 and the encryption result enc{PCR, ML} _SK , and sends the following message to C:

$\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; A</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; sig</span>}{<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; A</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; C</span>}}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; enc</span>}{<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; PCR</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; ML</span>}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; SK</span>}}<span\; class="notranslate">\; \}</span>}_{{\mathrm{<span\; class="notranslate">\; PIK</span>}}_{\mathrm{<span\; class="notranslate">\; prv</span>}}}$

(5) Certificate check: After receiving A's response message, C verifies the validity and legitimacy of A's platform identity certificate through CA;

(6) Remote proof: After the certificate verification is passed, C uses the A platform identity key PIK _{pub to} verify whether the A and N _A in the signature are the same as the unsigned A and N _A in the message, and check that the N _C in it is the same as the one sent Whether the N _C matches.

If N _C matches, C uses N _A and N _C to generate session encryption key SK according to a predetermined key generation algorithm (such as DH algorithm), decrypts enc{PCR, ML} _SK , and obtains PCR value and measurement log ML.

C reconstructs the entire integrity measurement process according to the measurement log ML, calculates the final PCR value, and compares it with the decrypted PCR value. If the two are the same, it can be confirmed that the verified trusted platform is trusted; otherwise, it is considered that the verified trusted platform is not trusted.

11) The verification requester C reconstructs the entire integrity measurement process according to the measurement log ML, calculates the final PCR value, compares it with the decrypted PCR value, and if the two are the same, it confirms that the verified trusted platform is credible; Otherwise, the verified trusted platform is considered untrustworthy.

Claims (4)

1. A method for remote attestation in a trusted computing environment, characterized in that the integrity measurement value and the measurement log of the verified trusted platform are encrypted using a session encryption key, and the encrypted result is digitally signed to ensure that the verified The authenticity of the integrity measurement value of the trust platform and the measurement log and the privacy of the platform, and the effective prevention of replay attacks, counterfeit attacks and man-in-the-middle attacks can be used to prove to the verification requester that the platform operating environment is credible or used for Self-detection of the platform operating environment. This method is based on the security chip TPM/TCM. The remote attestation architecture adopted consists of three parts: integrity measurement mechanism, reporting mechanism and verification mechanism, which are respectively composed of integrity measurement agent, reporting agent and verification requester. Complete, where the measurement agent, reporting agent, and security chip are installed in the verified trusted platform, and there is a valid identity certificate in the verified trusted platform, which binds the identity key PIK _pub of the verified trusted platform ,in, (1) Measurement agent: determine the measurement object, measurement time and how to safely maintain the measurement value. Its function is to calculate the measurement value of the component, record the measurement event into the measurement log, and record the measurement value into the corresponding In the platform configuration register PCR, the recording method is: new PCR value = cryptographic hash algorithm, and the measurement log includes at least but not limited to: measurer information, measureee information, original PCR value, measurement value, new PCR value, completion time , the measurement log represents the integrity measurement history of the verified trusted platform; (2) Reporting agent: Provide the integrity measurement value of the platform or some components to the verification requester, generate a session encryption key according to the established key generation algorithm, encrypt the specified PCR value and the relevant measurement log information of the specified PCR, and Use the private key PIK _prv corresponding to the platform identity key PIK _pub to digitally sign the encrypted result, and send the signed result to the verification requester; (3) Verification requester: Send a verification request to the verified trusted platform, use the platform identity key PIK _pub to verify the signature of the PCR value and the measurement log and decrypt the received response result, and reconstruct the entire integrity through the measurement log Measure the process and calculate the hash value, compare the final PCR value with the decrypted PCR value, if the two are the same, then confirm the credibility of the verified trusted platform; if the two are different, obtain the status of the verified trusted platform has been changed and its credibility cannot be confirmed; The specific remote attestation steps are: (1) The verification requester C generates an unpredictable timestamp N _C , digitally signs C and N _C , and then sends verification request messages C, N _C ,

To the verified trusted platform A; (2) After receiving C's verification request message, A requests a trusted third-party CA to verify the validity and legitimacy of C's certificate; (3) After the certificate verification is passed, the CA sends C's public key certificate to A; (4) A uses C's public key PUB _C to verify the signature Whether the C and _NC in the message are the same as the unsigned C and _NC in the message, and if they are the same, an unpredictable timestamp N _A will be generated, and _NC will generate a session according to the established key generation algorithm (such as the DH algorithm) encryption key SK; A obtains the value of the specified PCR and the relevant measurement log ML of the specified PCR from the security chip TPM/TCM, and encrypts the PCR value and the measurement log ML with the session encryption key SK to obtain the encrypted result enc{PCR, ML} _SK , and uses The private key PIK _prv corresponding to the platform identity key PIK _pub digitally signs the identity A, the unpredictable timestamp N _A , N _C +1 and the encryption result enc{PCR, ML} _SK , and sends the following message to C: $\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; A</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; sig</span>}{<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; A</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; N</span>}}_{\mathrm{<span\; class="notranslate">\; C</span>}}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; enc</span>}{<span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; PCR</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; ML</span>}<span\; class="notranslate">\; \}</span>}_{\mathrm{<span\; class="notranslate">\; SK</span>}}<span\; class="notranslate">\; \}</span>}_{{\mathrm{<span\; class="notranslate">\; PIK</span>}}_{\mathrm{<span\; class="notranslate">\; prv</span>}}}<span\; class="notranslate">\; ;</span>$ (5) After receiving A's response message, C verifies the validity and legitimacy of A's platform identity certificate through CA; (6) After the certificate verification is passed, C uses the A platform identity key PIK _{pub to} verify whether the A and N _A in the signature are the same as the unsigned A and N _A in the message, and check that the N _C in it is the same as the sent N Whether _C matches; If N _C matches, C uses N _A and N _C to generate a session encryption key SK according to a predetermined key generation algorithm, and decrypts enc{PCR, ML} _SK to obtain the PCR value and the measurement log ML; C reconstructs the entire integrity measurement process according to the measurement log ML, calculates the final PCR value, and compares it with the decrypted PCR value. If the two are the same, it is confirmed that the verified trusted platform is trusted; otherwise, the verified trusted platform is considered to be untrusted. 2. The method according to claim 1, characterized in that the integrity measurement process of the verified trusted platform includes an integrity measurement mechanism, a reporting mechanism and a verification mechanism, and the integrity measurement agent, the reporting agent and the verification request or completed, wherein the measurement agent, the reporting agent and the security chip TPM/TCM are installed in the verified trusted platform. 3. The method according to claim 1, characterized in that the measurement agent determines the measurement object, measurement time and how to maintain the measurement value safely, its main function is to calculate the measurement value of the component, and record the measurement event into the measurement log , and record the measurement value into the corresponding platform configuration register PCR in the security chip TPM/TCM. 4. The method according to claim 1, wherein the measurement log includes, but is not limited to, measurer information, measureee information, original PCR value, measurement value, new PCR value, and completion time.

Images