CN102842005B - CSP (chip scale package) module of TSPI (telephony service provider interface) based on TSM (tivoli storage manager) and CSP implementation method - Google Patents

Abstract

The present invention relates to a CSP module based on a TSM-based TSPI interface and a CSP implementation method, mainly including a CSP connection interface created based on a TSM-based TSPI interface, a CSP key generation and exchange interface, a CSP encryption and decryption interface, and a CSP hash and digital signature interface. Among them, the CSP connection interface is used to obtain and clear the CSP key container, set and obtain the container parameters, and release the CSP key container; the CSP key generation and exchange interface is used to perform CSP generation and destruction of key objects, Import and export key objects, load key objects, obtain and set key object parameters, and generate random numbers; the CSP encryption and decryption interface is used for CSP encryption and decryption; the CSP hash and digital signature interface is used for generating and destroying hash hash object, get and set hash object parameters, signature and signature verification. By encapsulating the above interfaces on the TSM interface TSPI, it is convenient for security application developers to quickly develop TCM applications, and at the same time facilitate the rapid porting of traditional applications to TCM.

Description

A CSP module and CSP implementation method of TSPI interface based on TSM

technical field

The present invention relates to the field of trusted computing, in particular to the application of trusted computing technology to implement Microsoft CryptoAPI (an application programming interface provided by Microsoft Corporation, which provides a set of functions that allow applications to protect sensitive private key data of users. A system and method for encrypting or digitally signing data in a flexible manner) encryption standard CSP (Cryptographic Service Provider, encryption service provider).

Background technique

Trusted Cryptography Module (Trusted Cryptography Module, TCM) is an essential key basic component of the trusted computing cryptographic support platform, which provides independent cryptographic algorithm operation functions and supports the establishment of the trusted computing platform functional system.

TCM builds a subsystem with storage protection and execution protection, which establishes the root of trust for the computing platform, and its independent computing resources will establish a strictly limited security protection mechanism. In order to effectively play the role of the TCM functional system, the functions that need to be protected and those that do not need to be protected are separated in the subsystem, and the functions that do not need to be protected are executed by the main processor of the computing platform, and these supporting functions constitute the TCM service module , denoted as TSM (Trusted Services Module, trusted service module).

As the software protocol stack of TCM, TSM provides a standardized function interface, and the application-oriented TCM service call interface TSPI (TSM Service Provider Interface, TSM Service Provider Interface), which is divided into 10 categories and 120 interface functions, can be used for trusted computing Cryptography app development provides guidance and calling. However, since most of the cryptographic service call interfaces currently used by most security applications are CSP, CNG (Cryptography API: Next Generation encryption technology) and PKCS#11 (PKCS#11 is an encryption standard), most application developers Familiar with and get used to CSP, CNG and PKCS#11 interface call mode, and has established a mature product development support system.

When developers of traditional security applications turn to application development based on TCM cryptographic service functions, they need to relearn the TCM Cryptographic Service Invocation Interface System (TSPI). In addition, what’s more, to port traditional security applications to TCM, all Redevelopment brings resource consumption to application manufacturers, which brings great resistance to TCM application promotion.

Contents of the invention

The technical problem to be solved by the present invention is to provide a CSP module based on the TSPI interface of TSM, so as to facilitate the rapid development of TCM applications by security application developers, and facilitate the rapid transplantation of traditional applications to TCM.

The technical scheme that the present invention solves the problems of the technologies described above is as follows:

A CSP module based on the TSPI interface of TSM, comprising:

The TCM chip, the TSM of the TCM chip, the call interface TSPI of the TSM, and the CSP connection interface, CSP key generation and exchange interface, CSP encryption and decryption interface, and CSP hash and digital signature interface created based on the TSPI; in

The CSP connection interface is used to obtain and clear the CSP key container, set and obtain container parameters, and release the CSP key container;

The CSP key generation and exchange interface is used for CSP to generate and destroy key objects, import and export key objects, load key objects, obtain and set key object parameters, and generate random numbers;

The CSP encryption and decryption interface is used for CSP encryption and decryption;

The CSP hash and digital signature interface is used for generating and destroying hash objects, acquiring and setting parameters of hash objects, signing and verifying signatures.

Further, the CSP connection interface includes:

CSP environment acquisition module: used to specify the CSP, return the handle of the CSP key container, obtain the TCM chip SMK (Storage Master Key, storage master key) object and TCM object, and use SMK as the parent key to generate SM2 (a non- Symmetric encryption and decryption algorithm), the SM2 container key is the parent key of all subsequent keys;

Key container release module: used to destroy the CSP key container handle;

CSP attribute setting module: used to set the attributes of CSP;

CSP attribute acquisition module: used to acquire the attributes of CSP.

Further, the key is generated and stored in the hardware of the TCM chip, and combined with the storage and computing resources of the computer, hardware protection is performed for the CSP key.

Further, the CSP key generation and exchange interface includes:

Key generation module: used to generate keys;

Key object generation module: used to generate key objects;

Key destruction module: used to destroy the generated key;

Key derivation module: used to derive the key to generate a copy key;

Key import module: used to import the copy key into the CSP;

Key parameter acquisition module: used to acquire key parameters;

Key parameter setting module: used to set key parameters;

Random number generation module: used to generate random numbers.

Further, the TSPI interface called by the key derivation module includes:

Tspi key data loading interface, used to load the specified key data block into TCM;

Tspi migration ticket provides an interface for providing a migration ticket for the migration process;

Tspi key migration data block creation interface, used to create the migration data block of the current key;

The Tspi key data block unloading interface is used to unload the key data block that has been loaded into the TCM.

Further, the TSPI interface called by the key import module includes:

Tspi key object creation interface, used to create a key object;

Tspi policy object allocation interface, used to bind the key object to the policy object;

Tspi key object data setting interface, used to set the data of the key object;

Tspi data block conversion interface, used to convert migration data blocks into common key data blocks.

Further, the TSPI interface called by the random number generation module includes:

Tspi random number generation interface, used to generate random numbers.

Further, the CSP encryption and decryption interface includes:

Data encryption module: used for data encryption;

Data decryption module: used for data decryption.

Further, the CSP hash and digital signature interface includes:

Hash object generation module: used to generate empty hash objects;

Hash value generating module: for generating a hash value of given data;

Hash object parameter acquisition module: used to obtain the parameters of the hash object;

Hash object parameter setting module: used to set the parameters of the hash object;

Hash object destruction module: used to destroy hash objects;

Hash value generation module: used to generate a hash value for the key object;

Hash object signature module: used to sign the specified hash object;

Signature verification module: used to verify the signature.

Further, the TSPI interface called by the hash object signature module includes:

Tspi hash value update interface, used to update the hash value of the hash object;

Signature key handle acquisition interface, used to obtain the signature key handle;

Tspi key loading interface, used to load the signature key into TCM;

Tspi hash value signature interface, used to sign the hash value of the hash object with the signature key;

Tspi key data block unloading interface, used to unload the key data block loaded into TCM;

Signature key object release interface, used to release the signature key object.

Further, the TSPI interface called by the signature verification module includes:

Tspi signature verification interface, used to verify the signature.

The present invention also provides a CSP implementation method based on the TSPI interface of TSM, comprising:

Acquiring and clearing the CSP key container, setting and obtaining container parameters, and releasing the CSP key container through the CSP connection interface;

Through the CSP key generation and exchange interface, CSP generates and destroys key objects, imports and exports key objects, loads key objects, obtains and sets key object parameters, and generates random numbers;

CSP encryption and decryption through the CSP encryption and decryption interface;

Through the CSP hash and digital signature interface, the generation and destruction of hash objects, the acquisition and setting of hash object parameters, signatures and signature verification are performed.

The beneficial effect of the present invention is that by encapsulating the CSP connection interface, CSP key generation and exchange interface, CSP encryption and decryption interface, and CSP hash and digital signature interface on the TSM interface TSPI, it is convenient for security application developers to quickly develop TCM applications, At the same time, it is convenient for traditional applications to be quickly transplanted to TCM.

Description of drawings

Fig. 1 is the CSP password service architecture diagram based on the TSPI interface of TSM among the present invention;

Fig. 2 is the key hierarchical figure of the CSP cryptographic service system based on the TSPI interface of TSM of the present invention;

Fig. 3 is the flow chart of setting signature key or exchanging key use authorization;

Figure 4 is a flowchart of authorization using a signing key or an exchange key.

Detailed ways

The principles and features of the present invention are described below in conjunction with the accompanying drawings, and the examples given are only used to explain the present invention, and are not intended to limit the scope of the present invention.

As shown in Figure 1, the CSP cryptographic service system based on the TSPI interface of TSM of the present invention, on the basis of the TSM of TCM module, utilizes TCM service call interface TSPI to develop a set of new CSP interface, by this CSP interface, program The application program developed by the developer can directly utilize the CryptoSPI of Microsoft Corporation to use the encryption service of the CSP provided by the present invention. Program developers do not need to re-learn the TCM cryptographic service call interface system (TSPI), and traditional security applications can be directly transplanted to the TCM module without code modification. It saves a lot of program development resources and reduces the resistance to popularization of TCM applications. In the present invention, the key is generated, stored and managed in the TCM chip hardware, and can provide hardware-based protection for the algorithm and the key in combination with the storage and computer resources of the system platform.

The CSP interface in the CSP cryptographic service system based on the TSPI interface of the TSM of the present invention includes the following.

Create a CSP connection interface based on the TSPI interface of the TSM, and the CSP connection interface is used to obtain and clear the CSP key container, set and obtain container parameters, and release the CSP key container.

In this step, when generating the CSP key container, a corresponding container key is generated for each CSP key container. The container key is the SM2 key with SMK as the parent key. The parent key of all keys generated by the key container. The information of the CSP key container and the UUID (Universally Unique Identifiers) information of the CSP container key can be stored in the NV (Non-volatile Storage) storage area of the TCM chip or in the operating system in the registry.

The above CSP connection interface includes the following functions:

CPAcquireContext function: used to specify the CSP, return the handle of the CSP key container, obtain the TCM chip SMK object and TCM object, and use the SMK as the parent key to generate the SM2 container key, which is the key of all subsequent keys The parent key, the hierarchical structure of the key is shown in Figure 2;

CPReleaseContext function: used to destroy the CSP key container handle;

CPSetProvParam function: used to set the properties of CSP;

CPGetProvParam function: used to get the properties of CSP.

Among them, the specific implementation of the CPAcquireContext function is as follows:

Construct the TSP context and global objects, and the TSPI interfaces called include:

Tspi_Context_Create(), used to construct the TSP context;

Tspi_Context_Connect(), used to connect to TCS;

Tspi_Context_GetTCMObject(), used to obtain the TCM chip object;

Tspi_Context_CreateObject(), used to generate SMK object, the default is Policy object;

Tspi_Policy_SetSecret(), used to set authorization data;

Tspi_Policy_AssignToObject(), used to bind policy objects to objects that require authorization;

Manipulate the key set according to the container parameters;

Record the environment configuration and return the container handle.

The specific implementation of the CPReleaseContext function is as follows:

To release resources that cannot be released normally, including key objects and hash objects, the TSPI interfaces to call include:

Tspi_Context_CloseObject(), used to destroy the object associated with the context object handle and release the related resources of the object;

Tspi_Policy_FlushSecret(), used to clear the authorization data of the authorization object;

Tspi_Context_CloseObject(), used to destroy the SMK object, the default is the Policy object;

Tspi_Context_Close(), used to disconnect from TCS and destroy the context object;

Delete the current environment configuration record.

The CPSetProvParam function, as shown in Figure 3 and Figure 4, sets the authorization data or use authorization data of the signature key or exchange key by setting the signature key or exchange key authorization data parameter. At the same time, change the authorization data of the corresponding key by setting the modification signature key or exchange key authorization data parameter.

Create a CSP key generation and exchange interface based on the TSPI interface of TSM. The CSP key generation and exchange interface is used for CSP generation and destruction of key objects, import and export of key objects, loading of key objects, and acquisition and setting of keys. object parameters and generate random numbers.

In this step, the key is generated, stored and managed in the TCM chip hardware, and can combine the storage and computing resources of the computer system platform to provide hardware protection for the algorithm and CSP key. Before generating the signing key or exchanging key, calling the set container signing key password or exchanging key password will generate the corresponding key with the specified authorization, and you need to set the authorization of the key to use the key again later.

The key import and export function is a secure key migration between two trusted platforms. When using the key import and export function, the Owner authorization of the TCM chip will be verified. Only when the Owner authorization is successful can the key import and export be completed. If the Owner authorization is unsuccessful, the import and export of the key cannot be completed. Setting the Owner authorization is done by calling the setting container TCM chip owner authorization parameter.

The above CSP key generation and exchange interface includes the following functions:

CPDeriveKey function: used to generate keys;

CPGenKey function: used to generate a key object;

CPDestroyKey function: used to destroy the generated key;

CPExportKey function: used to export the key to generate a copy key;

CPImportKey function: used to import the copy key into CSP;

CPGetKeyParam function: used to obtain key parameters;

CPSetKeyParam function: used to set key parameters;

CPGenRandom function: used to generate random numbers.

Among them, the specific implementation of the CPDeriveKey function is as follows:

To get the hash value of the hash object, the TSPI interface called includes:

Tspi_Hash_GetHashValue(), used to obtain the hash value of the hash object;

Tspi_Context_CreateObject(), used to create key objects;

Tspi_Policy_AssignToObject(), used to assign a policy object to a key object;

Use the hash value to fill the key data, and the TSPI interface called includes:

Tspi_SetAttribData(), used to set the data content of the key object;

To generate an SMS4 key, the TSPI interface called includes:

Tspi_Key_WrapKey(), used to wrap key objects;

Set key object access permissions;

Record the key object, and return its handle.

The specific implementation of the CPGenKey function is as follows:

To generate a key object, the TSPI interface called includes:

Tspi_Context_CreateObject(), used to create key objects;

Tspi_Policy_AssignToObject(), used to assign a policy object to a key object;

Tspi_Key_CreateKey(), used to create a key pair and wrap it with the parent key;

Set key access permissions;

If the generated asymmetric key is registered in the key database, the TSPI interface called includes:

Tspi_Context_RegisterKey(), used to register the key in the key database;

Record the key, and return its handle.

The specific implementation of the CPDestroyKey function is as follows:

To close the key object, the TSPI interface called includes:

Tspi_Context_CloseObject(), used to destroy the object associated with a key object handle and release the related resources of the object;

Delete the key record.

The TSPI interface and specific implementation of the CPExportKey function call are as follows:

Tspi_Key_LoadKey(), used to load the specified key data block into the TCM;

Tspi_Key_AuthorizeMigrationKey(), used to provide migration tickets for the migration process;

Tspi_Key_CreateMigrationBlob(), used to create the migration data block of the current key;

Tspi_Key_UnLoadKey(), used to unload the key data block that has been loaded into the TCM.

The TSPI interface and specific implementation of the CPImportKey function call are as follows:

Tspi_Context_Create(), used to create a key object;

Tspi_Policy_AssignToObject(), used to bind a policy object to a key object;

Tspi_SetAttribData(), used to set the data of the key object;

Tspi_Key_ConvertMigrationBlob(), used to convert a migration data block into a normal key data block.

The TSPI interface and specific implementation of the CPGenRandom function call are as follows:

Tspi_TCM_GetRandom(), used to generate random numbers.

A CSP encryption and decryption interface is created based on the TSPI interface of the TSM, and the CSP encryption and decryption interface is used for CSP encryption and decryption.

Through the CSP encryption and decryption interface in this step, data encryption and decryption are performed inside the TCM chip, and if authorization is set for the exchange key used, the TCM chip verifies the authorization data of the exchange key.

The above CSP encryption and decryption interfaces include:

CPEncrypt function: used for data encryption;

CPDecrypt function: used for data decryption.

Among them, the specific implementation of the CPEncrypt function is as follows:

To perform hash calculation on plaintext data, the TSPI interface called includes:

Tspi_Hash_UpdateHashValue(), used to update the hash value of the hash object;

To encrypt plaintext data, the TSPI interface called includes:

Tspi_Context_CreateObject(), used to create encrypted objects;

Tspi_Key_LoadKey(), used to load the encryption key into the TCM;

Tspi_Data_Encrypt(), used to encrypt plaintext data;

Tspi_Key_UnLoadKey(), used to unload the key data block that has been loaded into the TCM;

Tspi_GetAttribData(), used to obtain the encrypted data block of the encrypted object;

Tspi_Context_CloseObject(), used to destroy the object associated with an encrypted object handle and release the related resources of the object.

The specific implementation of the CPDecrypt function is as follows:

To decrypt the ciphertext data, the TSPI interface called includes:

Tspi_Context_CreateObject(), used to create encrypted objects;

Tspi_SetAttribData(), used to set the encrypted data block of the encrypted object;

Tspi_Key_LoadKey(), used to load the decryption key into the TCM;

Tspi_Data_Decrypt(), used to decrypt ciphertext data;

Tspi_Key_UnLoadKey(), used to unload the key data block that has been loaded into the TCM;

Tspi_Context_CloseObject(), used to destroy the object associated with an encrypted object handle and release the related resources of the object;

If the hash object exists, the hash calculation is performed on the decrypted plaintext data, and the TSPI interface called includes:

Tspi_Hash_UpdateHashValue(), used to update the hash value of the hash object.

Create a CSP hash and digital signature interface based on the TSPI interface of TSM. The CSP hash and digital signature interface is used to generate and destroy hash objects, obtain and set hash object parameters, sign and verify signatures.

Through the CSP hash and digital signature interface, data signature is performed inside the TCM chip. If the signature key used is authorized, the TCM chip verifies the authorization data of the signature key.

The above CSP hash and digital signature interface includes the following functions:

CPCreateHash function: used to generate an empty hash object;

CPHashData function: used to generate the hash value of the given data;

CPGetHashParam function: used to obtain the parameters of the hash object;

CPSetHashParam function: used to set the parameters of the hash object;

CPDestroyHash function: used to destroy the hash object;

CPHashSessionKey function: used to generate a hash value for the key object;

CPSignHash function: used to sign the specified hash object;

CPVerifySignature function: used to verify the signature.

Among them, the specific implementation of the CPCreateHash function is as follows:

To generate a hash object, the TSPI interface called includes:

Tspi_Context_CreateObject(), used to create a hash object;

Record the hash object and return its handle.

The specific implementation of the CPHashData function is as follows:

Append data to the TSM hash object, and the TSPI interface called includes:

Tspi_Hash_UpdateHashValue(), used to update the hash value of the hash object.

The specific implementation of the CPDestroyHash function is as follows:

To close the TSM hash object, the TSPI interface called includes:

Tspi_Context_CloseObject(), used to destroy the object associated with a hash object handle and release the related resources of the object;

Delete the hash object record.

The specific implementation of the CPHashSessionKey function is as follows:

Take the BLOB of the session key for hash calculation, and the TSPI interface called includes:

Tspi_GetAttribData(), used to obtain the encrypted data block of the session key;

Tspi_Hash_UpdateHashValue(), used to update the hash value of the hash object.

The TSPI interface called by the CPSignHash function is as follows:

Tspi_Hash_UpdateHashValue(), used to update the hash value of the hash object;

CPGetUserKey(), used to obtain the signature key handle;

Tspi_Key_LoadKey, used to load the signature key into TCM;

Tspi_Hash_Sign(), used to sign the hash value of the hash object using the signature key;

Tspi_Key_UnloadKey(), used to unload the key data block that has been loaded into the TCM;

CPDestroyKey(), used to release the signing key object.

The TSPI interface and specific implementation of the CPVerifySignature function call are as follows:

Tspi_Hash_VerifySignature(), used to verify the signature.

The invention utilizes the TCM chip and the calling interface TSPI in the TSM based on the TCM chip to develop the above-mentioned CSP connection interface, CSP key generation and exchange interface, CSP encryption and decryption interface, and CSP hash and digital signature interface. A hardware CSP is provided. All the keys in the CSP are generated inside the TCM chip, and the encryption and decryption operations and signature verification operations are all completed inside the TCM chip. When using the private key of the asymmetric key in the CSP Authorization and authentication are required to ensure the security of the CSP key. And, above-mentioned function name and purpose are consistent with the name and purpose of function in existing CSP, therefore, security application developer needn't relearn TCM cryptographic service call interface system (TSPI) and just can utilize the CSP of the hardware that the present invention provides, also convenient It facilitates the rapid transplantation of traditional applications to TCM, and reduces the resistance of TCM application promotion.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (11)

1. a CSP module based on the TSPI interface of TSM, is characterized in that, comprises: The TCM chip, the TSM of the TCM chip, the call interface TSPI of the TSM, and the CSP connection interface, CSP key generation and exchange interface, CSP encryption and decryption interface, and CSP hash and digital signature interface created based on the TSPI, The CSP key generation and exchange interface includes a key derivation module for deriving a key so that it produces a copy key; the TSPI interface called by the key derivation module includes: Tspi key data loading interface, used to load the specified key data block into TCM; Tspi migration ticket provides an interface for providing a migration ticket for the migration process; Tspi key migration data block creation interface, used to create the migration data block of the current key; Tspi key data block unloading interface, used to unload the key data block loaded into TCM; Wherein, the CSP connection interface is used to obtain and clear the CSP key container, set and obtain container parameters, and release the CSP key container; The CSP key generation and exchange interface is used for CSP to generate and destroy key objects, import and export key objects, load key objects, obtain and set key object parameters, and generate random numbers; The CSP encryption and decryption interface is used for CSP encryption and decryption; The CSP hash and digital signature interface is used for generating and destroying hash objects, acquiring and setting parameters of hash objects, signing and verifying signatures. 2. the CSP module based on the TSPI interface of TSM according to claim 1, is characterized in that, described CSP connection interface comprises: CSP environment acquisition module: used to specify the CSP, return the handle of the CSP key container, obtain the TCM chip SMK object and TCM object, and use the SMK as the parent key to generate the SM2 container key. The SM2 container key is all subsequent keys. key's parent key; Key container release module: used to destroy the CSP key container handle; CSP attribute setting module: used to set the attributes of CSP; CSP attribute acquisition module: used to acquire the attributes of CSP. 3. the CSP module based on the TSPI interface of TSM according to claim 1, is characterized in that: described key is generated and stored in the hardware of TCM chip, and is described CSP key in conjunction with storage and computing resource of computer Perform hardware protection. 4. the CSP module based on the TSPI interface of TSM according to claim 1, is characterized in that, described CSP key generation and exchange interface also comprise: Key generation module: used to generate keys; Key object generation module: used to generate key objects; Key destruction module: used to destroy the generated key; Key derivation module: used to derive the key to generate a copy key; Key import module: used to import the copy key into the CSP; Key parameter acquisition module: used to acquire key parameters; Key parameter setting module: used to set key parameters; Random number generation module: used to generate random numbers. 5. the CSP module based on the TSPI interface of TSM according to claim 4, is characterized in that, the TSPI interface that described key import module calls comprises: Tspi key object creation interface, used to create a key object; Tspi policy object allocation interface, used to bind the key object to the policy object; Tspi key object data setting interface, used to set the data of the key object; Tspi data block conversion interface, used to convert migration data blocks into common key data blocks. 6. the CSP module based on the TSPI interface of TSM according to claim 4, is characterized in that, the TSPI interface that described random number generation module calls comprises: Tspi random number generation interface, used to generate random numbers. 7. the CSP module based on the TSPI interface of TSM according to claim 1, is characterized in that, described CSP encryption and decryption interface comprises: Data encryption module: used for data encryption; Data decryption module: used for data decryption. 8. the CSP module based on the TSPI interface of TSM according to claim 1, is characterized in that, described CSP hash and digital signature interface comprise: Hash object generation module: used to generate empty hash objects; Hash value generating module: for generating a hash value of given data; Hash object parameter acquisition module: used to obtain the parameters of the hash object; Hash object parameter setting module: used to set the parameters of the hash object; Hash object destruction module: used to destroy hash objects; Hash value generation module: used to generate a hash value for the key object; Hash object signature module: used to sign the specified hash object; Signature verification module: used to verify the signature. 9. the CSP module based on the TSPI interface of TSM according to claim 8, is characterized in that, the TSPI interface that described hash object signature module calls comprises: Tspi hash value update interface, used to update the hash value of the hash object; Signature key handle acquisition interface, used to obtain the signature key handle; Tspi key loading interface, used to load the signature key into TCM; Tspi hash value signature interface, used to sign the hash value of the hash object with the signature key; Tspi key data block unloading interface, used to unload the key data block loaded into TCM; Signature key object release interface, used to release the signature key object. 10. the CSP module based on the TSPI interface of TSM according to claim 8, is characterized in that, the TSPI interface that described signature verification module calls comprises: Tspi signature verification interface, used to verify the signature. 11. The CSP implementation method based on the TSPI interface of TSM, including: Acquiring and clearing the CSP key container, setting and obtaining container parameters, and releasing the CSP key container through the CSP connection interface; Through the CSP key generation and exchange interface, CSP generates and destroys key objects, imports and exports key objects, loads key objects, obtains and sets key object parameters, and generates random numbers; The CSP key generation and exchange interface includes a key derivation module for deriving a key so that it produces a copy key; the TSPI interface called by the key derivation module includes: Tspi key data loading interface, used to load the specified key data block into TCM; Tspi migration ticket provides an interface for providing a migration ticket for the migration process; Tspi key migration data block creation interface, used to create the migration data block of the current key; Tspi key data block unloading interface, used to unload the key data block loaded into TCM; CSP encryption and decryption through the CSP encryption and decryption interface; Through the CSP hash and digital signature interface, the generation and destruction of hash objects, the acquisition and setting of hash object parameters, signatures and signature verification are performed.