CN201203868Y - A Trusted Platform Module - Google Patents

Abstract

A trusted platform module relates to a information safety domain. The trusted platform module TPM is the trusted root of the trusted computer platform and is core module of trusted computation. The utility model provides a new trusted platform module, aiming at the problem of the formation of the core root of trust of measurement CRTM and information chain establishment in the TPM chip and a measurement mode of initiative mode based on the trusted platform module is also provided and the trusted measurement root of the platform is designed in the trusted platform module, so as to solve the trusted root safety danger due to BIOS falsification and a trust chain of initiative mode is established using the module as the trusted root. The module is a trusted platform control module TPCM for realizing the control function of trusted root in the whole platform.

Description

A Trusted Platform Module

technical field

The utility model relates to the field of information security, in particular to a trusted platform module.

Background technique

The basic idea of trusted computing proposed by the International Trusted Computing Organization TCG is: to build a root of trust (Root of trust), and start from the root of trust, use the method of hash measurement to establish a verifiable chain of trust, from the hardware platform From the BIOS, the operating system, to the application, one level of verification is required to extend this trust to the entire computer system to ensure that the computer system is credible.

TCG has launched a series of specifications based on trusted platform modules TPM (Trusted P1atform modules), using TPM as the root of trust to establish a trust chain from the underlying hardware to the operating system to form a trusted platform.

Three trust roots are given in the TCG specification, trusted storage root, trusted report root and trusted measurement root. The first two roots are placed in the trusted platform module TPM chip, but the trusted measurement root is placed in the BIOS. In engineering practice, this method has caused problems such as BIOS tampering and root of trust establishment.

root of trust

In the TCG system, the root of trust is unconditionally trusted, and the system does not detect the behavior of the root of trust. Therefore, whether the root of trust is really trustworthy is the key to the system's credibility. This requires the function of the root of trust to be minimized, theoretically it should be trustworthy in the mathematical sense, and in engineering implementation, it should be based on hardware-based physical protection. Literature [2] gives three trust roots:

Root of Trust for Measurement (RTM), that is, root of trust for measurement;

Root of Trust for Storage (RTS) for storage, i.e. trusted storage root;

Root of Trust for Report (RTR), the trusted reporting root;

RTM is a starting point for integrity measurement, a calculation engine capable of reliable integrity measurement.

The RTS is a computational component capable of maintaining correct records of integrity message digests and sequence of message digests.

The RTR is the computational component that correctly reports the reliability of the information held by the RTS.

Among them, the trusted storage root and the trusted reporting root are stored in the non-tamperable trusted platform module TPM. The core root of trust measurement CRTM is stored in the basic input and output system BIOS, that is to say, the CRTM and RTM are not in the TPM. The root of trust measurement is an important part of establishing a trust chain. Its credibility is the foundation of the entire system. Storing the CRTM in the BIOS may cause the modification of viruses and malicious programs, thereby causing the destruction of the entire root of trust and leading to trust. chain failure.

Root of Trust Metrics stored in BIOS which can be modified reduces the security of the system. Because the chain of trust is a one-way transmission chain, if any node has a problem, the establishment of the entire trust environment will fail. Therefore, once the trusted measurement root is tampered with, it is impossible to establish a trusted computing environment in the trusted terminal system. , leading to potential security risks in the trusted terminal system.

Utility model content

The purpose of the utility model is to provide a Trusted Platform Module (TPCM) Trusted Platform ControlModule, and an active measurement method based on the Trusted Platform Module. The trusted platform module is a hardware core module integrated in the trusted computing platform to establish and guarantee the source of trust, and provides functions such as integrity measurement, secure storage, trusted reporting, and cryptographic services for trusted computing.

In order to achieve the above object, the technical solution of the utility model is specifically realized in the following way:

A trusted platform module is characterized in that it includes a control unit and an active measurement unit. Among them, the active measurement unit, which includes a data access module, a data analysis module, a hash algorithm module and a synchronous clock module, is used to actively read the external information to be measured after the TPCM is powered on, and complete the measurement of the information ; Wherein the control unit includes a control execution module and a state detection module, which are used to determine how to control the hardware of the hardware devices in the computer system, and send control signals to the hardware devices.

Data access module: connected with the externally expanded storage body through the trusted platform module chip pins. After power-on, the control operation of data reading is performed on the externally extended memory bank of the trusted platform module.

Data analysis module: connected with the data access module, responsible for implementing the communication protocol and reading the data content collected by the data access module, and converting the collected data into data that can be directly operated by the hash operation module.

Hash algorithm module: it is the main execution unit of measurement operation. It is connected with the data analysis module, performs hash value operation on the data converted by the data analysis module, and generates measurement value or measurement reference value.

Synchronous clock module: connected with the externally expanded storage body through the trusted platform module chip pins. Responsible for providing a synchronous clock to external storage that is actively reading data.

Control execution module: directly connected to the enable signal input end of the hardware resource, responsible for sending a control signal to the hardware resource.

Status detection module: responsible for real-time detection of the working status of hardware resources.

Described Trusted Platform Module (TPCM) carries out active measuring method, comprises the following steps:

a) Host power supply, Trusted Platform Module TPCM and BIOS chip are powered on before other hardware units on the motherboard at the same time, and execute the initialization module code;

b) TPCM performs a status check to determine whether it is in a disabled state; at the same time, the status detection module collects hardware resource information and current usage status on the PC through the communication bus;

c) If the TPCM is in the enabled state, the control execution module of the TPCM will send a switching command to the signal switching unit to prepare for an active measurement operation, and the synchronous clock module will provide a synchronous working clock to the BIOS chip; the control execution module will send a command to the BIOS chip. The data access module reads out the key codes in the BIOS, and after being analyzed by the data analysis module, it is handed over to the hash algorithm module for measurement and storage of the measurement results; if the BIOS measurement is unsuccessful, the control execution module sends control to the signal switching signal device Instruction, after the switching unit is switched to the normal startup mode, the platform is started under control, and the TPCM enters the failure processing flow, and the predetermined management strategy or the on-site operation by the platform administrator choose to enter the untrusted working mode: the platform is powered off or restarted;

d) If the TPCM measures the key codes of the BIOS correctly, the control execution module of the TPCM sends a switching signal to the signal switching unit, and the signal switching unit sends a platform power-on signal, the platform is powered on, and the BIOS starts to execute; if it is judged that the TPCM is disabled state, the signal switching unit performs the switching operation, then the platform is powered on normally, the BIOS starts, the system does not go through the measurement link, and then goes through the steps of MBR startup and kernel loading in turn, so that the platform enters the untrusted working mode;

e) The key code in the BIOS completes the measurement of other parts of the BIOS code and the MBR, and stores the measurement result in the TPCM;

f) If the MBR measurement is successful, the MBR starts;

g) MBR measures OS Loader and stores the measurement results in TPCM;

h) If the OS Loader measurement is successful, the OS kernel is loaded;

i) The system enters the trusted working mode.

The trusted platform module is characterized in that the integrity measurement root is placed inside the TPCM, and is realized by cooperation of hardware and firmware, and is used to realize the active measurement operation on the trusted computing platform and the trusted computing system. After the TPCM is powered on and initialized, firstly, according to the trusted integrity measurement function, before the CPU on the trusted computing platform is powered on, it will actively check the BIOS code stored in the BOOTROM, the firmware of peripheral hardware devices, and the operating system. Each part carries out the integrity check step by step in order to ensure that the software code in the platform startup chain has not been tampered with and the hardware device has not been illegally replaced, and then the CPU is powered on to read the BIOS code. And at the same time of initializing the external equipment, check the integrity and reliability of the specified external equipment to realize the credible report function; when switching between the active measurement phase and the normal computer work phase, it needs to be realized through the signal switching unit.

Implementation Effect:

The utility model designs a trusted platform module (TrustedPlatformmodules, TPCM), which realizes the function of the TPM, and implants the trusted measurement root RTM in the TPCM. In this way, the three trust roots proposed by the TPM are all stored in a chip with physical protection to prevent the outside world from tampering with the trust root, so its credibility is more guaranteed.

Proactive measurement mode is proposed in the establishment of trust chain. Design an independent isolated power supply to power TPCM and CPU, let TPCM start before CPU, make TPCM run in active mode, verify the integrity of BIOS boot code (Boot Block), and realize the trust of the trusted platform module as the entire platform properties of the root.

Compared with TCG's TPM solution, the TPCM solution not only improves the reliability of the chip, but also reflects the controllability of the root of trust. In the scheme of this paper, TPCM is the only trust root of the platform, so only the TPCM chip is axiomatically trusted by default; Measurement, CRTM) is trusted by default, and CRTM includes BIOS, keyboard, etc. Obviously, the TPCM scheme is more secure.

Description of the drawings:

Figure 1 TPCM structure diagram

Figure 2 TPCM internal firmware composition diagram

Figure 3 Flow chart of TPCM trustworthiness measurement

Figure 4 TPCM detailed work flow chart

Figure 5 The timing relationship between TPCM and other general-purpose devices on the motherboard

Figure 6 Signal switching unit connection diagram

Detailed ways

TPCM hardware composition structure

The trusted platform module adopts the classic SOC design scheme and mainly completes the basic functions of TPCM (see Figure 1). The internal implementation of the chip includes CPU, non-volatile storage unit, volatile storage unit, random number generator, cryptographic algorithm engine, key generator, timer, control unit, active measurement unit, input-output bridge unit and bus control device, and these functional units are mapped to the access address space of the on-chip microprocessor by the input-output bridge unit. In addition, in addition to the LPC controller, the chip is equipped with multiple controller interfaces to adapt to different motherboard buses.

Among them, the active measurement unit, which includes a data access module, a data analysis module, a hash algorithm module and a synchronous clock module, is used to actively read the external information to be measured after the TPCM is powered on, and complete the measurement of the information ; Wherein the control unit includes a control execution module and a state detection module, which are used to determine how to control the hardware of the hardware devices in the computer system, and send control signals to the hardware devices.

Module implementation method:

1) Data access module: This module is realized by hardware, and is mainly responsible for completing the access operation of TPCM to the external data storage body actively. The composition mainly includes the switching control part of the master-slave mode of the LPC communication bus, the data control reading part, the reading quantity control part, the reading timing control part and so on. The I/O ports of the module mainly include enable signal ports, input and output signal ports, interrupt signal ports, etc.

2) Data analysis module: This module is realized by hardware, connected with the data access module, responsible for implementing the communication protocol and reading the data content collected by the data access module, and converting the collected data into data that can be directly operated by the hash operation module The data. The communication protocol part is based on the LPC communication protocol to realize the communication protocol of the customized trusted platform control module. This part includes data analysis operation and data encapsulation operation. Data parsing operations are mainly for data classification, illegal data filtering, data format conversion, data combination, etc. The data encapsulation operation is to package and encapsulate the processed data according to the custom communication protocol. The I/O ports of the module mainly include enable signal ports, input and output signal ports, function selection ports, etc.

3) Hash algorithm module: This module is realized by hardware and is the main execution unit of measurement operation. It is connected with the data analysis module, performs hash value operation on the data converted by the data analysis module, and generates measurement value or measurement reference value. The module I/O ports mainly include enable signal ports, input and output signal ports, and interrupt signal ports.

4) Synchronous clock module: connected to the externally expanded storage body through the trusted platform module chip pins. Responsible for providing a working clock synchronized with the trusted platform module to the external storage whose data is actively read. The synchronous clock signal can be generated internally by the trusted platform module, or can be obtained from an external branch signal.

5) Control execution module: directly connected to the enable signal input end of the hardware resource, responsible for sending a control signal to the hardware resource. Operations such as enabling and disabling hardware resources, and switching control of signal switching units can be performed. It mainly includes the enable signal control port, interrupt port, data communication port, etc. of connected devices.

6) Status detection module: responsible for real-time detection of the working status of hardware resources. Query the usage status and related information of hardware resources through the SMBUS bus interface.

TPCM firmware composition

TPCM firmware is the core control program inside the chip, which is mainly responsible for assisting hardware units to realize trusted computing functions, and at the same time manage and maintain hardware resources in software. The basic functions of TPCM are implemented by internal firmware, and its firmware consists of five parts (see Figure 2):

●Initialization module: responsible for initializing the module and self-testing of the module.

● Input and output driver module: the driver function library for input and output in the module, responsible for the bus controller inside the trusted platform module.

●Active measurement module: responsible for controlling the active measurement unit and active measurement of Boot ROM.

●Instruction processing module: responsible for parsing and executing instructions sent by external entities.

●Access control module: responsible for assisting the control unit to realize access control to hardware resources and detection of working status.

TPCM Trust Measuring Process

TPCM credibility measurement process (see Figure 3):

a) Host power supply, TPCM and BIOS chips are powered on before other hardware units on other motherboards at the same time, and execute the initialization module code.

b) The TPCM performs a status check to determine whether it is in a disabled state. At the same time, the status inspection module collects hardware resource information and current usage status on the PC through the I ² C or SMbus bus.

c) If the TPCM is in the enabled state, the control execution module of the TPCM will send a switching command to the signal switching unit to prepare for an active measurement operation, and at the same time, the synchronous clock module provides a synchronous working clock to the BIOS chip. The control execution module sends an enable signal to the BIOS chip, and the data access module reads out the key codes in the BIOS, and after being analyzed by the data analysis module, it is handed over to the hash algorithm module for measurement and storage of the measurement results. If the BIOS measurement is unsuccessful, the control execution module sends a control command to the signal switching annunciator. After the switching unit switches to the normal startup mode, the platform starts under control, and the TPCM enters the failure processing flow, which is operated by a predetermined management strategy or on-site by the platform administrator. , choose to enter the untrusted working mode or power off or restart the platform.

d) If the TPCM measures the key codes of the BIOS correctly, the control execution module of the TPCM sends a switching signal to the signal switching unit, and the signal switching unit sends a platform power-on signal, the platform is powered on, and the BIOS starts to execute. If it is judged that the TPCM is in the disabled state and the signal switching unit performs a switching operation, the platform is normally powered on, the BIOS starts, the system does not go through the measurement link, and the system goes through the steps of MBR startup and kernel loading in turn, so that the platform enters an untrusted working mode.

e) The key code in the BIOS completes the measurement of other parts of the BIOS code and the MBR, and stores the measurement result in the TPCM.

f) If the measurement of the MBR is successful, then the MBR starts.

g) MBR measures OS Loader and stores the measurement results in TPCM.

h) If the OS Loader measurement is successful, the OS kernel is loaded.

i) The system enters the trusted working mode.

TPCM detailed workflow

The detailed workflow of TPCM is divided into three parts (see Figure 4): trusted working mode process, exception handling workflow and non-trusted working mode process.

可信工作模式流程:

Trusted working mode process:

1) After the TPCM starts normally, it completes a series of actions including initialization self-inspection, measurement, authentication binding, and sending a trusted computing platform startup signal, and starts to enter the trusted working mode.

2) Receiving instructions: TPCM receives instructions through the bus controller and data analysis module. If no instruction is received, it is in the state of waiting to receive an instruction.

3) Password judgment: Some instructions in the instruction set need to pass the authorization password judgment before they can be executed. If it is not judged by the password, it should return an instruction failure response signal to the trusted computing platform, and switch to an idle state waiting to receive instructions.

4) Instruction analysis: through the data analysis module and the instruction processing module in the firmware, the received instructions are analyzed in detail and converted into reusable primitive operations.

5) Access permission check: If the instruction needs to use a hardware device, it is necessary to check the current user's permission to use the device. Instructions that pass the inspection can continue to be executed, and instructions that fail the inspection cannot be executed, and an instruction failure response signal is returned to the trusted computing platform.

6) Instruction execution: Execute all primitive operations contained in the instruction that passed the inspection.

7) Returning a successful response: when all the primitive operations included in the instruction are executed, the instruction execution success response signal should be sent to the trusted computing platform.

8) TPCM power-off judgment: After the command execution success response signal is sent to the trusted computing platform, the TPCM power-off judgment should be made. If there is a power-down request, the control execution module inside the TPCM should send a switching operation to the signal switching unit, and execute the platform and TPCM power-down operation, and finally exit. If there is no power-down request, it should return to the state of waiting to receive instructions.

Exception handling workflow:

After TPCM is powered on and started, when it is in the function enable state, it should perform error status check, initialization self-check, measure EMM1, and authentication binding operations. If any of the above operations cannot be completed, the exception handling work should be completed according to the following process:

1) In an error state: After TPCM starts, it is necessary to check whether the TPCM is in an error state. If it is in an error state, it is necessary to save the audit log and hand it over to the administrator to handle the error.

2) Initialization and self-inspection: After TPCM is started, it needs to perform initialization and active self-inspection work, and save audit logs. The self-inspection work must include active and passive self-inspection methods.

3) Measure BIOS key codes: the trusted measurement root RTM in TPCM actively measures the integrity of key codes in BIOS, and saves measurement logs.

4) Authentication binding: After TPCM starts, it needs to authenticate whether the current platform is the object bound in the last trusted computing platform binding operation. If not, signal an error and save an audit log.

5) Save the failure type: If one of the above four situations occurs, the failure type and the audit log should be saved.

6) platform startup signal: after saving the failure type, the startup signal should be sent to the platform, and TPCM can also close other parts on the platform except mouse/keyboard/display at this moment, further control the startup environment of the platform.

7) Displaying failure information: when the platform is started and the BIOS is executed, the failure type information should be displayed to the user according to the stored failure type.

8) Administrator login: After the failure information is displayed, the administrator needs to log in to process the failure information.

9) Exception handling operation: the administrator performs corresponding exception handling operations according to the cause of the failure.

10) Disable TPCM: When the administrator cannot process the failure information in time, the administrator can issue a TPCM function disabling operation. After the function is disabled, the startup process of the system does not change.

11) If the TPCM disabling operation is performed, a TPCM disabling signal should be sent to the trusted computing platform. And display it to the user through the BIOS.

12) Platform and TPCM restart: administrators can perform platform power-off and TPCM restart operations.

非可信工作模式流程:

Untrusted working mode process:

After the TPCM is powered on and started, when it is in the function disabled state or in the error state, the processing flow of the function disabled state or error state should be completed according to the following process:

1) Platform startup signal: When the TPCM is in a function disabled state or in an error state, the TPCM control execution module sends a platform normal startup signal to the signal switching unit and the trusted computing platform.

2) User login: the trusted computing platform BIOS starts, and the system prompts the user to log in. If you are logged in as an administrator, you can enter the operation process of setting the enabling state of TPCM. If an ordinary user logs in, you can choose whether to continue to start and enter an untrusted operating system, or to power off the platform and TPCM and exit the system. If you log in as an administrator, you can choose whether to enable TPCM, and execute platform power-off, TPCM restart, or both platform and TPCM power-off, and exit the system.

TPCM power supply design

In order to realize the active measurement function, the power supply subsystem of the motherboard is improved, a TPCM isolated power supply circuit is designed, and the startup sequence of the existing platform motherboard is adjusted (see Figure 5).

After the computer is started, TPCM, BIOS and system clock are first powered on with the CPU at the same time. First, the TPCM performs integrity measurement on the initial startup code (Boot Block) of the Boot ROM and the hardware device of the motherboard. After the RTM in the TPCM completes the measurement, it sends a switching signal to the signal switching unit to start normally. At this time, the signal switching unit sends a comprehensive power supply signal to the power controller to start general-purpose devices such as CPU, chipset and dynamic memory, so as to realize normal booting.

Engineering experiments show that the scope of modification of the main board is not large, the cost is very small, and the modified main board is fully compatible with the original main board.

Signal switching unit design

In the normal working stage of the computer, the trusted platform module and the BIOS are regarded as controlled devices relative to the computer motherboard, and are directly controlled by the computer device controller (see FIG. 6 ). In the active measurement phase of the computer startup process, the Trusted Platform Control Module is regarded as the control terminal, and the BIOS is regarded as the controlled device of the TPCM, which accepts the active measurement and detection of the TPCM. In this way, there are two working stages between the trusted platform control module and the computer device controller, and the problem of switching between the two control masters.

In order to solve the switching problem between the TPCM and the computer equipment controller, it is necessary to design a signal switching unit controlled by the TPCM, which is respectively connected to the computer equipment controller, TPCM, BIOS and the power controller, and is responsible for providing power during the two-stage switching. Signal switching and anti-interference function. The communication lines mainly connected include: data line, address line and control line (including the synchronous clock signal line provided by TPCM to BIOS separately and the signal line connected to the power controller).

Specific requirements:

1) The communication protocol used by TPCM in the active measurement phase should be consistent with the communication protocol used by BIOS.

2) The communication speed between TPCM and BIOS can be adaptively set according to the synchronous clock provided by TPCM within the operating range of both chips. Generally defined as 33MHZ.

3) In each stage, the signal switching unit should ensure that only one main control terminal exists at the same time.

4) When working at any main control terminal, the signal switching unit shall ensure that normal communication is not affected by crosstalk from external circuits.

5) On the premise that the TPCM function is enabled, the signal switching unit connects the TPCM to the BIOS by default when the computer is started, and sends a comprehensive power supply signal to the power controller.

The difference from TPM is that TPCM is powered independently of the system CPU, so it can be started as a master device before the CPU. There are two purposes of this design: one is that the root of trusted measurement can be designed inside TPCM, and TPCM provides a root of trusted measurement based on hardware level, and the trust chain is established with TPCM as the starting point; Measurement, monitoring and recording of the information platform environment.

Claims (1)

1. a credible platform module is characterized in that: comprise control module and active metric element; Wherein initiatively metric element is realized by hardware, comprise Data access module, data resolution module, hash algorithm module and synchronous clock module, be to be used for after credible platform module powers on, initiatively read outside information to be measured, and finish tolerance work described information; Wherein control module comprises control and executive module and state detection module, how is used for determining the hardware device of computer system is carried out hardware controls, and sends control signal to hardware device;

Data access module: be connected by the memory bank of credible platform module chip pin with outside expansion; After powering on, the outside memory bank of expanding of credible platform module is carried out the control operation of data read;

Data resolution module: link to each other with Data access module, be responsible for the data content that realization communications protocol and reading of data access modules collect, and can be by the data of hash computing module direct control with the data-switching one-tenth that collects;

Hash algorithm module: be the main performance element of tolerance computing, link to each other, the data after the conversion of data parsing module are carried out the Hash Value computing, generate metric or reference metric value with data resolution module;

Synchronous clock module: be connected by the memory bank of credible platform module chip pin with outside expansion; Be responsible for to being provided synchronous clock by the exterior storage of active reading of data;

Control and executive module: be directly connected to the enable signal input end of the hardware device in the computer system, be responsible for sending control signal to hardware device;

State detection module: the duty of being responsible for the hardware device in the real-time detection computations machine system.

Images