WO2015090196A1 - Method for creating dependable environment in power distribution terminal - Google Patents

Method for creating dependable environment in power distribution terminal Download PDF

Info

Publication number
WO2015090196A1
WO2015090196A1 PCT/CN2014/094051 CN2014094051W WO2015090196A1 WO 2015090196 A1 WO2015090196 A1 WO 2015090196A1 CN 2014094051 W CN2014094051 W CN 2014094051W WO 2015090196 A1 WO2015090196 A1 WO 2015090196A1
Authority
WO
WIPO (PCT)
Prior art keywords
power distribution
distribution terminal
integrity
trusted
chip
Prior art date
Application number
PCT/CN2014/094051
Other languages
French (fr)
Chinese (zh)
Inventor
赵保华
王志皓
徐震
杨文思
于爱民
汪丹
Original Assignee
国家电网公司
中国电力科学研究院
中国科学院信息工程研究所
国网辽宁省电力有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 国家电网公司, 中国电力科学研究院, 中国科学院信息工程研究所, 国网辽宁省电力有限公司 filed Critical 国家电网公司
Publication of WO2015090196A1 publication Critical patent/WO2015090196A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability

Definitions

  • the invention belongs to the technical field of power distribution terminal security, and particularly relates to a method for establishing a trusted environment in a power distribution terminal.
  • the power industry is responsible for the production, transmission and distribution of electrical energy, including power generation, transmission, substation, and power distribution. Since electric energy is related to the normal operation of the entire country, it is one of the important support of the entire national economy and the forerunner of the development of the national economy.
  • Today's power infrastructure was designed in the nineteenth and twentieth centuries. With the development of society, this aging electric power infrastructure can no longer assume the responsibility of future power supply.
  • countries around the world are making rapid progress toward the smart grid.
  • China announced the “Strong Smart Grid” plan, with a view to building an information-based, automated, and interactive feature based on the UHV grid as the backbone grid and the strong grid of coordinated development of all levels of power grids.
  • the communication information platform including the power generation, transmission, substation, power distribution, power consumption and dispatching of the power system, covering all voltage levels, achieving a highly integrated integration of “power flow, information flow, and business flow”.
  • Modern power grid including the power generation, transmission, substation, power distribution, power consumption and dispatch
  • distribution automation As a link in the power system that directly connects with users and distributes energy to users, power distribution is an important part of the power system and closely related to people's lives.
  • a very important part of the smart grid is distribution automation, including system monitoring and control, power distribution system management functions and interaction with users (such as load management, measurement and real-time pricing).
  • Distribution automation works in tandem with other components of the smart grid to improve system monitoring, reactive and voltage management, reduce network loss and increase asset utilization, as well as assist in optimizing personnel scheduling and maintenance operations.
  • Complex control system namely distribution automation terminal, referred to as distribution terminal.
  • the system form of power distribution terminals has gradually developed into intelligence.
  • the measurement data provided by the distribution terminal is an important basis for the power distribution master to make decisions. Once the data is tampered with, large-scale power failures will be triggered, causing catastrophic losses.
  • the mobile intelligent terminal security incidents that have appeared frequently in recent years are also reminding us that the security status of the distribution terminal system is not optimistic. It is foreseeable that if no protection is added, the attack on the distribution terminal system is only a matter of time. Because the power distribution terminal is compared with the ordinary intelligent terminal, the only difference is that the service running on the above is relatively simple, so they all face the same security threats, such as stealing rights. The middleman attacks, tampers with the data, and so on. However, the current power distribution terminal lacks an integrity protection mechanism, and the software system is vulnerable to attack and tampering. Once a malicious attacker finds a vulnerability, the loss will be incalculable.
  • the present invention provides a method for establishing a trusted environment in a power distribution terminal, by adding a trusted chip as a hardware trust root in the power distribution terminal, and storing a preset integrity reference therein. Value, then add the secure boot module to the system as the initial running module of the system.
  • the integrity of the system and the critical system image are measured to protect the integrity of the running system on the power distribution terminal, build trust, and finally establish a trusted operating environment to stop malware damage from the source.
  • the ability of system integrity to improve the security level of the distribution terminal system.
  • the present invention provides a method of establishing a trusted environment in a power distribution terminal, the method comprising the following steps:
  • Step 1 The power distribution terminal loads a secure boot module from an external non-volatile memory
  • Step 2 The secure boot module prohibits all interrupts, initializes registers and memory space, and performs integrity metrics on the state of the power distribution terminal;
  • Step 3 The security startup module determines whether the operating system of the power distribution terminal needs to be upgraded according to the flag bit. If the upgrade is required, the upgrade process is completed to complete the upgrade of the operating system; if the upgrade is not required, step 4 is performed;
  • Step 4 The secure boot module calculates the integrity metrics of the bootloader and the operating system kernel
  • Step 5 After the integrity verification is successful, the control of the power distribution terminal is transferred to the boot program and enters the normal power distribution terminal boot process.
  • the step 1 includes the following steps:
  • Step 1-1 The trusted chip is initialized, and the IO interface between the chip and the power distribution terminal is used to make the power distribution terminal enter an external Boot state.
  • Step 1-2 Restart the power distribution terminal to enter the specified Boot state.
  • Step 1-3 The power distribution terminal loads the secure boot module from the external non-volatile memory according to the specified boot state.
  • the step 2 includes the following steps:
  • Step 2-1 Invoking the integrity extension instruction ETM_Extend of the trusted chip, and extending the result of the integrity measurement to the trusted chip to ensure the security of the integrity metric;
  • Step 2-2 Invoking the integrity verification instruction ETM_PCR_Validate of the trusted chip to determine whether the current state of the power distribution terminal is authentic;
  • Step 2-3 The trusted chip determines whether to enter the next state according to the verification result. If the integrity verification fails, the trusted chip forces the power distribution terminal to restart.
  • the step 3 includes the following steps:
  • Step 3-1 If the power distribution terminal needs to be upgraded, and the data is received through the network, the upgrade server sends the upgraded operating system image to the upgrade sub-module together with the integrity reference value that the trusted chip needs to update.
  • Step 3-2 The upgrade submodule upgrades the power distribution terminal by parsing the data packet, and simultaneously calls the integrity update instruction ETM_PCRRef_Put of the trusted chip to update the integrity reference value stored in the trusted chip.
  • the step 4 includes the following steps:
  • Step 4-1 Load the bootloader and operating system kernel image from the external non-volatile memory
  • Step 4-2 Invoking the integrity extension instruction ETM_Extend of the trusted chip, and extending the result of the integrity measurement to the trusted chip to ensure the security of the integrity metric;
  • Step 4-3 Call the chip integrity verification instruction ETM_PCR_Validate to determine whether the current status of the boot program and the operating system are all trusted;
  • Step 4-4 The trusted chip determines whether to enter the next state according to the verification result. If the integrity verification of the boot program or the operating system fails, the trusted chip forces the power distribution terminal to restart.
  • 1 is a flow chart of a method for establishing a trusted environment in a power distribution terminal
  • FIG. 3 is a flowchart of an operating system upgrade of a power distribution terminal.
  • the invention applies the mechanism of the traditional PC to construct the trust chain by using the security chip to the power distribution terminal, and designs and implements the trusted chip for the power distribution terminal for the first time to provide the functions of the protection integrity metric and the integrity verification.
  • the design of the ETM takes into account the various software and hardware architectures of the embedded power distribution terminal equipment.
  • the flexibility and customization of the implementation are emphasized. Sex.
  • the invention adds a system integrity control related module in the system startup and upgrade process based on the hardware chip trust root of the security chip ETM, and finally establishes a complete set of software and hardware system system to realize the trusted operating environment. set up.
  • the embodiment provided by this patent application is exemplified by a power distribution terminal without an operating system. First, it is required to implement functions such as protecting the integrity metric and verifying the integrity status of the security chip ETM.
  • the system resources of the ETM implemented in this embodiment are described as follows:
  • the memory resource includes 12KB ROM, 25KB RAM, 1024KB Flash memory, and the memory space is allocated by the storage management unit MMU;
  • interrupt sources there are 22 interrupt sources, sharing 6 hardware interrupt entries, 2 software interrupt entries, 6 levels of interrupt priority;
  • peripheral modules mainly including 2 timers, 1 watchdog, 1 channel SCD interface (7816 slave interface) and 1 channel SCC interface (7816 master interface), 2 UART interfaces, 2 channels SPI interface, 30 GPIOs.
  • tag identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD, which means that the authorization password is required.
  • paramSize the total number of bytes of all input parameters (including tag and paramSize)
  • tag identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
  • paramSize the total number of bytes of all input parameters (including tag and paramSize)
  • ETM_PCR_Validate (Verify whether the PCR value is consistent with the PCR reference value stored in the ETM)
  • tag identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
  • paramSize the total number of bytes of all input parameters (including tag and paramSize)
  • targetPCR PCR index list to verify PCR values
  • tag identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
  • paramSize the total number of bytes of all input parameters (including tag and paramSize)
  • ETM_PCRRef_Put put PCR reference value into ETM
  • tag identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
  • paramSize the total number of bytes of all input parameters (including tag and paramSize)
  • tag identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
  • paramSize the total number of bytes of all input parameters (including tag and paramSize)
  • FIG. 2 The detailed process of establishing a trusted environment in this embodiment is shown in FIG. 2. Since the system function is relatively simple, there is no typical bootloader and operating system module, and the main business program is directly executed in the ROM, and does not need to be loaded into the memory; There are fewer system modules and the steps of loading the secure boot module and checking the integrity of the system state are omitted. Since the incoming command authorization password is required when calling the trusted chip, it is guaranteed that the chip is allowed to be used only when the authorization is obtained. Therefore, in the ROM of the power distribution terminal, the digest value of the authorization password needs to be pre-set. The specific steps for establishing a trusted environment are as follows:
  • the integrity measurement module reads the main program entry address and the length of the main program, performs integrity measurement on the main program, and obtains an integrity measure value
  • the Boot program calls the chip ETM_Extend command, and sequentially passes the command message type tag, the total number of bytes of all input parameters (including tag and paramSize), paramSize, identification command code ordinal, command authorization password.
  • the digest value cmdAuth preset in ROM
  • the PCR index pcrNum (0x2, extended to No. 2 PCR) to be updated
  • the 160-bit integrity value to be expanded (the integrity metric calculated in step 4) ), extending the integrity metric to the corresponding PCR;
  • the terminal manufacturer first needs to calculate the integrity reference value of the upgraded service main program
  • the terminal manufacturer applies to the CA center for the integrity reference value certificate of the main program of the service
  • the CA Center returns the integrity reference certificate
  • the upgrade server sends the upgraded service main program and the corresponding integrity reference value certificate to the Boot program of the power distribution terminal according to the agreed protocol;
  • the Boot program receives the upgrade instruction through the communication network, updates the main program, and receives the reference value certificate; the upgrade sub-module of the Boot program runs the chip command ETM_PCRRef_Put, and the integrity reference value certificate and the authorized password digest value stored in the ROM. Pass in as an argument to complete the in-chip integrity reference update operation.
  • TMG's MTM Mobile Trusted Module
  • the power distribution terminal has its own characteristics compared with the general mobile terminal. For example, the software and hardware architecture of the device is flexible and diverse, and the form is also various, and the application running on the power distribution terminal is relatively simple. MTM is more oriented to the general embedded platform.
  • the security function is relatively complete, it is very complicated to implement.
  • the upper layer software needs more changes to support the security boot, and is not suitable for the power distribution terminal.
  • the invention customizes the security chip ETM for the security requirements of the power distribution terminal, and the design considers more diverse hardware and software architectures of the embedded power distribution terminal equipment, and particularly emphasizes the flexibility of the implementation based on the security and function of the protection module. Sexuality and customizability for wide application and promotion.
  • the TPM chip directly measures and verifies the integrity of the key code of the system.
  • This star trust chain structure is difficult to implement, and the processing capability and upper-layer behavior of the TPM are difficult.
  • the high judgment ability is required, which will increase the production cost of the chip and lead to lower system flexibility.
  • the invention is directed to different types of power distribution terminals, and combines the characteristics of specific service systems, and proposes a general hardware and software architecture to achieve trusted startup, protect system integrity, and enhance system security, and has completed a complete production and upgrade process. The process steps are highly implementable.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)
  • Stored Programmes (AREA)

Abstract

The present invention provides a method for creating a dependable environment in a power distribution terminal. A dependable chip is added to the power distribution terminal as a hardware based root, in which a preset integrity reference value is stored; and then, a secure startup module is added to a system as an initial running module of the system. In a system startup process, integrity measurement is performed on a system state and a key system mirror, so as to protect the integrity of a system running on the power distribution terminal, establish dependence, and finally create a dependable running environment, thereby preventing a capability of malicious software of damaging system integrity from the source, and improving a security level of the system of the power distribution terminal.

Description

一种在配电终端中建立可信环境的方法Method for establishing trusted environment in distribution terminal 技术领域Technical field
本发明属于配电终端安全技术领域，具体涉及一种在配电终端中建立可信环境的方法。The invention belongs to the technical field of power distribution terminal security, and particularly relates to a method for establishing a trusted environment in a power distribution terminal.
背景技术Background technique
电力工业负责生产、输送和分配电能，包括发电、输电、变电、配电等环节。由于电能关系着整个国家的正常运转，因此是整个国民经济的重要支撑之一，也是国民经济发展的先行部门。当今的电力基础设施是在十九世纪和二十世纪设计的，随着社会的发展，这个逐渐老化的电力基础设施已不能承担未来电力供应的职责。近几年，随着信息科学技术的迅猛发展，全球各国家都在实现向智能电网的快速迈进。2009年5月21日，我国公布了“坚强智能电网”计划，以期建设具有信息化、自动化、互动化特征，以特高压电网为骨干网架、各级电网协调发展的坚强网架为基础，以通信信息平台为支撑，包含电力***的发电、输电、变电、配电、用电和调度各个环节，覆盖所有电压等级，实现“电力流、信息流、业务流”的高度一体化融合的现代电网。The power industry is responsible for the production, transmission and distribution of electrical energy, including power generation, transmission, substation, and power distribution. Since electric energy is related to the normal operation of the entire country, it is one of the important support of the entire national economy and the forerunner of the development of the national economy. Today's power infrastructure was designed in the nineteenth and twentieth centuries. With the development of society, this aging electric power infrastructure can no longer assume the responsibility of future power supply. In recent years, with the rapid development of information science and technology, countries around the world are making rapid progress toward the smart grid. On May 21, 2009, China announced the “Strong Smart Grid” plan, with a view to building an information-based, automated, and interactive feature based on the UHV grid as the backbone grid and the strong grid of coordinated development of all levels of power grids. Supported by the communication information platform, including the power generation, transmission, substation, power distribution, power consumption and dispatching of the power system, covering all voltage levels, achieving a highly integrated integration of “power flow, information flow, and business flow”. Modern power grid.
而配电作为电力***中直接与用户相连并向用户分配电能的环节，是电力***中的重要环节，和人们生活密切相关。智能电网中很重要的一部分就是配电自动化，包括***的监视与控制、配电***管理功能以及与用户的交互(如负荷管理、量测和实时定价)等等。配电自动化通过与智能电网的其他组成部分协同运行，既可改善***监视、无功与电压管理、降低网损和提高资产使用率，也可辅助优化人员调度和维修作业安排等，为此需要复杂的控制***，即配电自动化终端，简称配电终端。近年来，随着嵌入式移动智能终端的快速发展，配电终端的***形态也逐步向智能化发展。目前，大部分配电终端都已经具备强大的运算处理能力，***软件平台也多采用嵌入式实时多任务操作***，并且都具备利用移动无线网络访问网络的能力等等。这些元素使得移动缴费终端和普通的智能终端一样，面临着各种各样的安全威胁。As a link in the power system that directly connects with users and distributes energy to users, power distribution is an important part of the power system and closely related to people's lives. A very important part of the smart grid is distribution automation, including system monitoring and control, power distribution system management functions and interaction with users (such as load management, measurement and real-time pricing). Distribution automation works in tandem with other components of the smart grid to improve system monitoring, reactive and voltage management, reduce network loss and increase asset utilization, as well as assist in optimizing personnel scheduling and maintenance operations. Complex control system, namely distribution automation terminal, referred to as distribution terminal. In recent years, with the rapid development of embedded mobile intelligent terminals, the system form of power distribution terminals has gradually developed into intelligence. At present, most power distribution terminals already have powerful computing processing capabilities, and the system software platform also uses embedded real-time multitasking operating systems, and all have the ability to access the network using mobile wireless networks. These elements make mobile payment terminals face a variety of security threats, just like ordinary smart terminals.
配电终端提供的测量数据，是配电主站做决策的重要依据，一旦这些数据被篡改，大规模的电力故障就会被引发，从而造成灾难性的损失。近几年频频出现的移动智能终端安全事件也在提醒着我们配电终端***的安全状况不容乐观。可以预见的是，如果不加任何防护，针对配电终端***的攻击的出现只是迟早的问题。由于配电终端和普通智能终端相比，唯一的不同仅仅是上面运行的业务相对比较单一，因此都面临着同样的安全威胁，如窃取权限， 中间人攻击，篡改数据等等。而当前的配电终端上缺乏完整性保护机制，软件***容易受到攻击和篡改，一旦被恶意攻击者发现漏洞，带来的损失将会不可估计。The measurement data provided by the distribution terminal is an important basis for the power distribution master to make decisions. Once the data is tampered with, large-scale power failures will be triggered, causing catastrophic losses. The mobile intelligent terminal security incidents that have appeared frequently in recent years are also reminding us that the security status of the distribution terminal system is not optimistic. It is foreseeable that if no protection is added, the attack on the distribution terminal system is only a matter of time. Because the power distribution terminal is compared with the ordinary intelligent terminal, the only difference is that the service running on the above is relatively simple, so they all face the same security threats, such as stealing rights. The middleman attacks, tampers with the data, and so on. However, the current power distribution terminal lacks an integrity protection mechanism, and the software system is vulnerable to attack and tampering. Once a malicious attacker finds a vulnerability, the loss will be incalculable.
经过近十几年的发展，传统PC的信任链技术已经日趋完善，信任链能够有效保护***状态的完整性这一观点已被普遍认可。因此，我们可以将传统PC上建立信任链这种技术思路引入到配电终端上来，通过在配电终端上加入安全芯片用以提供信任根，从而保护***的完整性，最终为***建立起可信的运行环境。但是，配电终端和传统PC的软硬件架构及特点大为不同，将PC上的可信芯片直接移植到配电终端上是不合适的。所以，针对配电终端设计一整套完备的***以建立可信运行环境是一个重要挑战。After nearly a decade of development, the traditional PC's trust chain technology has become more and more perfect, and the idea that the trust chain can effectively protect the integrity of the system state has been widely recognized. Therefore, we can introduce the technical idea of establishing a trust chain on a traditional PC to a power distribution terminal, and by adding a security chip to the power distribution terminal to provide a root of trust, thereby protecting the integrity of the system, and finally establishing a system for the system. The operating environment of the letter. However, the hardware and software architecture and characteristics of the power distribution terminal and the traditional PC are quite different. It is not appropriate to directly transplant the trusted chip on the PC to the power distribution terminal. Therefore, designing a complete system for distribution terminals to establish a trusted operating environment is an important challenge.
发明内容Summary of the invention
为了克服上述现有技术的不足，本发明提供一种在配电终端中建立可信环境的方法，通过在配电终端中增加可信芯片作为硬件信任根，里面存储有预置的完整性参考值，然后在***中加入安全启动模块，作为***的初始运行模块。在***启动过程中，通过对***状态及关键的***镜像进行完整性度量，从而保护配电终端上运行***的完整性，构建信任，最终得以建立可信运行环境，从源头上遏止恶意软件破坏***完整性的能力，提高配电终端***的安全等级。In order to overcome the above deficiencies of the prior art, the present invention provides a method for establishing a trusted environment in a power distribution terminal, by adding a trusted chip as a hardware trust root in the power distribution terminal, and storing a preset integrity reference therein. Value, then add the secure boot module to the system as the initial running module of the system. In the system startup process, the integrity of the system and the critical system image are measured to protect the integrity of the running system on the power distribution terminal, build trust, and finally establish a trusted operating environment to stop malware damage from the source. The ability of system integrity to improve the security level of the distribution terminal system.
为了实现上述发明目的，本发明采取如下技术方案：In order to achieve the above object, the present invention adopts the following technical solutions:
本发明提供一种在配电终端中建立可信环境的方法，所述方法包括以下步骤：The present invention provides a method of establishing a trusted environment in a power distribution terminal, the method comprising the following steps:
步骤1：所述配电终端从外部非易失存储器上载入安全启动模块；Step 1: The power distribution terminal loads a secure boot module from an external non-volatile memory;
步骤2：所述安全启动模块禁止所有中断，初始化寄存器和内存空间，对所述配电终端的状态做完整性度量；Step 2: The secure boot module prohibits all interrupts, initializes registers and memory space, and performs integrity metrics on the state of the power distribution terminal;
步骤3：所述安全启动模块根据标志位判断是否需要对所述配电终端的操作***进行升级，如果需要升级，进入升级流程完成操作***的升级；如果不需要升级，则执行步骤4；Step 3: The security startup module determines whether the operating system of the power distribution terminal needs to be upgraded according to the flag bit. If the upgrade is required, the upgrade process is completed to complete the upgrade of the operating system; if the upgrade is not required, step 4 is performed;
步骤4：安全启动模块计算引导程序和操作***内核的完整性度量值；Step 4: The secure boot module calculates the integrity metrics of the bootloader and the operating system kernel;
步骤5：完整性验证成功后，配电终端控制权转交给引导程序，进入正常的配电终端引导过程。Step 5: After the integrity verification is successful, the control of the power distribution terminal is transferred to the boot program and enters the normal power distribution terminal boot process.
所述步骤1包括以下步骤：The step 1 includes the following steps:
步骤1-1：可信芯片初始化，并使用所述芯片与配电终端之间的IO接口使配电终端进入外部Boot状态；Step 1-1: The trusted chip is initialized, and the IO interface between the chip and the power distribution terminal is used to make the power distribution terminal enter an external Boot state.
步骤1-2：重启配电终端，使其进入指定Boot状态； Step 1-2: Restart the power distribution terminal to enter the specified Boot state.
步骤1-3：配电终端根据指定Boot状态，从外部非易失存储器上载入安全启动模块。Step 1-3: The power distribution terminal loads the secure boot module from the external non-volatile memory according to the specified boot state.
所述步骤2包括以下步骤：The step 2 includes the following steps:
步骤2-1：调用可信芯片的完整性扩展指令ETM_Extend，将完整性度量后的结果扩展到可信芯片中，以保证完整性度量值的安全；Step 2-1: Invoking the integrity extension instruction ETM_Extend of the trusted chip, and extending the result of the integrity measurement to the trusted chip to ensure the security of the integrity metric;
步骤2-2：调用可信芯片的完整性验证指令ETM_PCR_Validate，判断目前配电终端的状态是否可信；Step 2-2: Invoking the integrity verification instruction ETM_PCR_Validate of the trusted chip to determine whether the current state of the power distribution terminal is authentic;
步骤2-3：可信芯片根据验证结果决定是否进入下一状态，如果完整性验证失败，则可信芯片强制配电终端重启。Step 2-3: The trusted chip determines whether to enter the next state according to the verification result. If the integrity verification fails, the trusted chip forces the power distribution terminal to restart.
所述步骤3包括以下步骤：The step 3 includes the following steps:
步骤3-1：如果需要对所述配电终端进行升级，通过网络接收数据，升级服务器将升级后的操作***镜像连同可信芯片需要更新的完整性参考值同时发送给升级子模块；Step 3-1: If the power distribution terminal needs to be upgraded, and the data is received through the network, the upgrade server sends the upgraded operating system image to the upgrade sub-module together with the integrity reference value that the trusted chip needs to update.
步骤3-2：所述升级子模块通过解析数据包，对所述配电终端进行升级，同时调用可信芯片的完整性更新指令ETM_PCRRef_Put，更新可信芯片中存储的完整性参考值。Step 3-2: The upgrade submodule upgrades the power distribution terminal by parsing the data packet, and simultaneously calls the integrity update instruction ETM_PCRRef_Put of the trusted chip to update the integrity reference value stored in the trusted chip.
所述步骤4包括以下步骤：The step 4 includes the following steps:
步骤4-1：从外部非易失存储器上载入引导程序和操作***内核镜像；Step 4-1: Load the bootloader and operating system kernel image from the external non-volatile memory;
步骤4-2：调用可信芯片的完整性扩展指令ETM_Extend，将完整性度量后的结果扩展到可信芯片中，以保证完整性度量值的安全；Step 4-2: Invoking the integrity extension instruction ETM_Extend of the trusted chip, and extending the result of the integrity measurement to the trusted chip to ensure the security of the integrity metric;
步骤4-3：调用芯片完整性验证指令ETM_PCR_Validate，判断目前引导程序和操作***各自的状态是否都可信；Step 4-3: Call the chip integrity verification instruction ETM_PCR_Validate to determine whether the current status of the boot program and the operating system are all trusted;
步骤4-4：可信芯片根据验证结果决定是否进入下一状态，如果引导程序或操作***的完整性验证失败，则可信芯片强制配电终端重启。Step 4-4: The trusted chip determines whether to enter the next state according to the verification result. If the integrity verification of the boot program or the operating system fails, the trusted chip forces the power distribution terminal to restart.
与现有技术相比，本发明的有益效果在于：Compared with the prior art, the beneficial effects of the present invention are:
(1)针对配电终端的安全需求定制可信芯片ETM，其设计更多的考虑了嵌入式配电终端设备多样的软硬件架构，在保障模块安全性和功能的基础上，特别强调其实现的灵活性和可定制性，利于广泛应用和推广；(1) Customized trusted chip ETM for the security requirements of power distribution terminals. The design considers the various software and hardware architectures of embedded power distribution terminal equipment. On the basis of guaranteeing the security and functions of modules, special emphasis is placed on its implementation. Flexibility and customizability for wide application and promotion;
(2)针对不同形态的配电终端，结合具体业务***的特点，提出了通用的软硬件架构以实现可信启动，保护***完整性，增强***安全，其在生产和升级流程都制定了完整的流程步骤，可实施性强。(2) For different types of distribution terminals, combined with the characteristics of specific business systems, a general hardware and software architecture is proposed to achieve trusted boot, protect system integrity, enhance system security, and complete the production and upgrade processes. The process steps are highly implementable.
附图说明 DRAWINGS
图1是在配电终端中建立可信环境的方法流程图；1 is a flow chart of a method for establishing a trusted environment in a power distribution terminal;
图2是本发明实施例中可信环境建立的详细流程图；2 is a detailed flowchart of establishing a trusted environment in an embodiment of the present invention;
图3是配电终端的操作***升级流程图。FIG. 3 is a flowchart of an operating system upgrade of a power distribution terminal.
具体实施方式detailed description
下面结合附图对本发明作进一步详细说明。The invention will be further described in detail below with reference to the accompanying drawings.
本发明将传统PC利用安全芯片构建信任链的机制应用到配电终端上，首次针对配电终端设计并实现可信芯片，用以提供保护完整性度量值和完整性验证的功能。相对于PC的安全芯片来说，ETM的设计更多的考虑了嵌入式配电终端设备多样的软硬件架构，在保障模块安全性和功能的基础上，特别强调其实现的灵活性和可定制性。此外，本发明在安全芯片ETM提供硬件信任根的基础之上，通过在***启动和升级过程中加入***完整性控制相关模块，最终建立起一整套完备的软硬件***体系实现可信运行环境的建立。The invention applies the mechanism of the traditional PC to construct the trust chain by using the security chip to the power distribution terminal, and designs and implements the trusted chip for the power distribution terminal for the first time to provide the functions of the protection integrity metric and the integrity verification. Compared with the security chip of the PC, the design of the ETM takes into account the various software and hardware architectures of the embedded power distribution terminal equipment. On the basis of ensuring the security and functions of the module, the flexibility and customization of the implementation are emphasized. Sex. In addition, the invention adds a system integrity control related module in the system startup and upgrade process based on the hardware chip trust root of the security chip ETM, and finally establishes a complete set of software and hardware system system to realize the trusted operating environment. set up.
本专利申请提供的实施例以无操作***的配电终端为例说明，首先需要实现安全芯片ETM负责保护完整性度量值以及验证***完整性状态等功能。本实施例中实现的ETM所具备的***资源描述如下：The embodiment provided by this patent application is exemplified by a power distribution terminal without an operating system. First, it is required to implement functions such as protecting the integrity metric and verifying the integrity status of the security chip ETM. The system resources of the ETM implemented in this embodiment are described as follows:
1、采用32-bit RISC嵌入式微处理器，支持16/32-bit定长指令集，支持5级指令流水，内有1KB的指令Cache；1. It adopts 32-bit RISC embedded microprocessor, supports 16/32-bit fixed-length instruction set, supports 5-level instruction pipeline, and has 1KB instruction cache;
2、采用AMBA总线架构，4组DMA通道；2, using AMBA bus architecture, 4 groups of DMA channels;
3、存储器资源包括12KB ROM，25KB RAM，1024KB Flash存储器，通过存储管理单元MMU分配存储器空间；3. The memory resource includes 12KB ROM, 25KB RAM, 1024KB Flash memory, and the memory space is allocated by the storage management unit MMU;
4、有22个中断源，共享6个硬件中断入口、2个软件中断入口、6级中断优先级；4, there are 22 interrupt sources, sharing 6 hardware interrupt entries, 2 software interrupt entries, 6 levels of interrupt priority;
5、集成了大量片内外设模块，主要包括2个定时器、1个看门狗、1路SCD接口(7816从接口)和1路SCC接口(7816主接口)、2路UART接口、2路SPI接口、30个GPIO。5, integrated a large number of on-chip peripheral modules, mainly including 2 timers, 1 watchdog, 1 channel SCD interface (7816 slave interface) and 1 channel SCC interface (7816 master interface), 2 UART interfaces, 2 channels SPI interface, 30 GPIOs.
本实施例中所实现的ETM固件程序，对外提供的用以构建可信环境的命令接口定义描述如下：The definition of the command interface defined by the ETM firmware program implemented in this embodiment to construct a trusted environment is as follows:
■ETM_Extend：(将一个新的完整性度量值增加到一个PCR中)■ ETM_Extend: (add a new integrity metric to a PCR)
■输入参数描述：■ Input parameter description:
1、tag：标识命令消息类型，值为ETM_TAG_RQU_AUTH_CMD，代表需要授权口令1, tag: identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD, which means that the authorization password is required.
2、paramSize：所有输入参数(包括tag和paramSize)的总的字节数2, paramSize: the total number of bytes of all input parameters (including tag and paramSize)
3、ordinal：标识命令编码，值为0x0000000f 3, ordinal: identification command code, the value is 0x0000000f
4、cmdAuth：命令授权口令的摘要值4, cmdAuth: summary value of the command authorization password
5、pcrNum：欲更新值的PCR索引5, pcrNum: PCR index to update the value
6、inDigest：欲扩展的160位完整性值6, inDigest: 160-bit integrity value to be extended
■输出参数描述：■ Output parameter description:
1、tag：标识命令消息类型，值为ETM_TAG_RQU_AUTH_CMD1, tag: identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
2、paramSize：所有输入参数(包括tag和paramSize)的总的字节数2, paramSize: the total number of bytes of all input parameters (including tag and paramSize)
3、returnCod：ETM执行该命令的返回值3, returnCod: ETM executes the return value of the command
4、ordinal：标识命令编码，值为0x0000000f4, ordinal: identification command code, the value is 0x0000000f
5、outDigest：命令执行完成之后该PCR的值5, outDigest: the value of the PCR after the command is executed
Figure PCTCN2014094051-appb-000001
ETM_PCR_Validate(验证PCR值是否与ETM中存储的PCR参考值一致)
Figure PCTCN2014094051-appb-000001
ETM_PCR_Validate (Verify whether the PCR value is consistent with the PCR reference value stored in the ETM)
■输入参数描述：■ Input parameter description:
1、tag：标识命令消息类型，值为ETM_TAG_RQU_AUTH_CMD1, tag: identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
2、paramSize：所有输入参数(包括tag和paramSize)的总的字节数2, paramSize: the total number of bytes of all input parameters (including tag and paramSize)
3、ordinal：标识命令编码，值为0x000000103, ordinal: identification command code, the value is 0x00000010
4、cmdAuth：命令授权口令的摘要值4, cmdAuth: summary value of the command authorization password
5、targetPCR：欲验证PCR值的PCR索引列表5, targetPCR: PCR index list to verify PCR values
■输出参数描述：■ Output parameter description:
1、tag：标识命令消息类型，值为ETM_TAG_RQU_AUTH_CMD1, tag: identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
2、paramSize：所有输入参数(包括tag和paramSize)的总的字节数2, paramSize: the total number of bytes of all input parameters (including tag and paramSize)
3、returnCod：ETM执行该命令的返回值3, returnCod: ETM executes the return value of the command
4、ordinal：标识命令编码，值为0x000000104, ordinal: identification command code, the value is 0x00000010
5、validatedValue：验证的结果5, validatedValue: the result of the verification
Figure PCTCN2014094051-appb-000002
ETM_PCRRef_Put(将PCR参考值置入ETM中)
Figure PCTCN2014094051-appb-000002
ETM_PCRRef_Put (put PCR reference value into ETM)
■输入参数描述：■ Input parameter description:
1、tag：标识命令消息类型，值为ETM_TAG_RQU_AUTH_CMD1, tag: identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
2、paramSize：所有输入参数(包括tag和paramSize)的总的字节数2, paramSize: the total number of bytes of all input parameters (including tag and paramSize)
3、ordinal：标识命令编码，值为0x0000000d3, ordinal: identification command code, the value is 0x0000000d
4、cmdAuth：命令授权口令的摘要值4, cmdAuth: summary value of the command authorization password
5、keyHandle：验证PCR参考值证书签名的密钥句柄5, keyHandle: verify the key reference of the PCR reference certificate signature
6、certSize：PCR参考值证书大小 6, certSize: PCR reference value certificate size
7、pcrRefCert：PCR参考值证书7, pcrRefCert: PCR reference certificate
■输出参数描述：■ Output parameter description:
1、tag：标识命令消息类型，值为ETM_TAG_RQU_AUTH_CMD1, tag: identifies the command message type, the value is ETM_TAG_RQU_AUTH_CMD
2、paramSize：所有输入参数(包括tag和paramSize)的总的字节数2, paramSize: the total number of bytes of all input parameters (including tag and paramSize)
3、returnCod：ETM执行该命令的返回值3, returnCod: ETM executes the return value of the command
本实施例中可信环境建立的详细流程如图2所示，由于***功能比较简单，没有典型的bootloader和操作***模块，业务主程序直接在ROM中执行，不需要加载到内存；并且也因为***模块较少而略去了载入安全启动模块以及对***状态的完整性校验等步骤。由于在调用可信芯片时需要传入命令授权口令，保证只有获得授权才允许使用芯片，因此，在配电终端的ROM中首先需要预先置入授权口令的摘要值。可信环境建立的具体步骤如下：The detailed process of establishing a trusted environment in this embodiment is shown in FIG. 2. Since the system function is relatively simple, there is no typical bootloader and operating system module, and the main business program is directly executed in the ROM, and does not need to be loaded into the memory; There are fewer system modules and the steps of loading the secure boot module and checking the integrity of the system state are omitted. Since the incoming command authorization password is required when calling the trusted chip, it is guaranteed that the chip is allowed to be used only when the authorization is obtained. Therefore, in the ROM of the power distribution terminal, the digest value of the authorization password needs to be pre-set. The specific steps for establishing a trusted environment are as follows:
1、CPU***自动复位；1, the CPU system automatically resets;
2、运行Boot***初始化程序，并读取启动标志、主程序入口地址、通信参数等；2. Run the Boot system initialization program and read the startup flag, the main program entry address, communication parameters, etc.
3、判断启动标志是否为XX(启动升级的标志)，如果是启动升级，则继续执行Boot程序，等待接收程序升级指令；如果是无启动升级，则存储Boot程序的版本号和版本日期，调用完整性度量模块；3. Determine whether the startup flag is XX (the flag for starting the upgrade). If the upgrade is started, continue to execute the Boot program and wait for the program upgrade command; if it is no startup upgrade, store the version number and version date of the Boot program. Integrity measurement module;
4、完整性度量模块读取主程序入口地址和主程序长度，对主程序进行完整性度量，得到完整性度量值；4. The integrity measurement module reads the main program entry address and the length of the main program, performs integrity measurement on the main program, and obtains an integrity measure value;
5、如果完整性度量模块成功执行，Boot程序调用芯片ETM_Extend命令，依次传入命令消息类型tag、所有输入参数(包括tag和paramSize)的总的字节数paramSize、标识命令编码ordinal、命令授权口令的摘要值cmdAuth(预置在ROM中)、欲更新值的PCR索引pcrNum(0x2，扩展至第2号PCR中)、欲扩展的160位完整性值(第4步计算出的完整性度量值)，将完整性度量值扩展到相应的PCR中；5. If the integrity measurement module is successfully executed, the Boot program calls the chip ETM_Extend command, and sequentially passes the command message type tag, the total number of bytes of all input parameters (including tag and paramSize), paramSize, identification command code ordinal, command authorization password. The digest value cmdAuth (preset in ROM), the PCR index pcrNum (0x2, extended to No. 2 PCR) to be updated, the 160-bit integrity value to be expanded (the integrity metric calculated in step 4) ), extending the integrity metric to the corresponding PCR;
6、调用芯片ETM_PCR_Validate命令，验证2号PCR中的完整性度量值；6. Call the chip ETM_PCR_Validate command to verify the integrity metric in PCR No. 2;
7、如果完整性验证通过(返回值为true)后，则进入主程序；否则CPU复位。7. If the integrity verification is passed (return value is true), then enter the main program; otherwise the CPU resets.
由于保护***的完整性是通过调用芯片指令ETM_PCR_Validate将完整性度量值和芯片中的完整性参考值进行比对而实现，***升级以后完整性度量值会发生变化，因此也需要在***升级之后更新芯片中存储的相应完整性参考值，详细的升级流程如图3所示，具体步骤如下：Since the integrity of the protection system is achieved by calling the chip instruction ETM_PCR_Validate to compare the integrity metric with the integrity reference value in the chip, the integrity metric will change after the system upgrade, so it needs to be updated after the system upgrade. The corresponding integrity reference value stored in the chip, the detailed upgrade process is shown in Figure 3. The specific steps are as follows:
1、终端厂商首先需要计算出升级后的业务主程序的完整性参考值；1. The terminal manufacturer first needs to calculate the integrity reference value of the upgraded service main program;
2、终端厂商向CA中心申请该业务主程序的完整性参考值证书； 2. The terminal manufacturer applies to the CA center for the integrity reference value certificate of the main program of the service;
3、CA中心返回完整性参考值证书；3. The CA Center returns the integrity reference certificate;
4、升级服务器按照约定协议将升级后的业务主程序和相应的完整性参考值证书发送给配电终端的Boot程序；4. The upgrade server sends the upgraded service main program and the corresponding integrity reference value certificate to the Boot program of the power distribution terminal according to the agreed protocol;
5、Boot程序通过通信网络接收升级指令，更新主程序，并接收参考值证书；Boot程序运行的升级子模块会调用芯片命令ETM_PCRRef_Put，将完整性参考值证书及存储在ROM内的授权口令摘要值作为参数传入，完成芯片内的完整性参考值更新操作。5. The Boot program receives the upgrade instruction through the communication network, updates the main program, and receives the reference value certificate; the upgrade sub-module of the Boot program runs the chip command ETM_PCRRef_Put, and the integrity reference value certificate and the authorized password digest value stored in the ROM. Pass in as an argument to complete the in-chip integrity reference update operation.
单纯依靠增强***及应用软件的安全防护已经不能保证***的高安全等级，由于所有的软件***中都不可避免的存在缺陷，增加的安全模块可能会带来新的安全缺陷。因此，对于安全等级要求较高的配电终端，纯软件的安全解决方案并不足以构建可以信赖的可信运行环境。尽管TCG针对嵌入式***所设计的MTM(移动可信模块)提供了同PC机上的TPM类似的安全功能，也因此能够被用来构建嵌入式***上的可信环境。但配电终端和一般的移动终端相比，有着自己的特点，如设备的软硬件架构灵活多样，形态也各式各样，而且配电终端上运行的应用较为单一。而MTM更多的针对一般的嵌入式平台，安全功能虽然较为完整，但是实现起来很复杂，上层软件需要较多的改动以支持安全引导，并不适用于配电终端使用。本发明针对配电终端的安全需求定制安全芯片ETM，其设计更多的考虑了嵌入式配电终端设备多样的软硬件架构，在保障模块安全性和功能的基础上，特别强调其实现的灵活性和可定制性，利于广泛应用和推广。Simply relying on the security protection of the enhanced system and application software can not guarantee the high security level of the system. Due to the inevitable defects in all software systems, the added security module may bring new security defects. Therefore, for power distribution terminals with higher security levels, a pure software security solution is not sufficient to build a trusted and trusted operating environment. Although TMG's MTM (Mobile Trusted Module) designed for embedded systems provides security features similar to TPMs on PCs, it can be used to build trusted environments on embedded systems. However, the power distribution terminal has its own characteristics compared with the general mobile terminal. For example, the software and hardware architecture of the device is flexible and diverse, and the form is also various, and the application running on the power distribution terminal is relatively simple. MTM is more oriented to the general embedded platform. Although the security function is relatively complete, it is very complicated to implement. The upper layer software needs more changes to support the security boot, and is not suitable for the power distribution terminal. The invention customizes the security chip ETM for the security requirements of the power distribution terminal, and the design considers more diverse hardware and software architectures of the embedded power distribution terminal equipment, and particularly emphasizes the flexibility of the implementation based on the security and function of the protection module. Sexuality and customizability for wide application and promotion.
现有的嵌入式可信***启动设计中，均由TPM芯片直接对***的关键代码进行完整性度量和验证，这种星型的信任链结构实现难度大，对TPM的处理能力和对上层行为的判断能力要求很高，会提高芯片的生产成本，并导致***灵活性较低。本发明针对不同形态的配电终端，结合具体业务***的特点，提出了通用的软硬件架构以实现可信启动，保护***完整性，增强***安全，其在生产和升级流程都制定了完整的流程步骤，可实施性强。In the existing embedded trusted system startup design, the TPM chip directly measures and verifies the integrity of the key code of the system. This star trust chain structure is difficult to implement, and the processing capability and upper-layer behavior of the TPM are difficult. The high judgment ability is required, which will increase the production cost of the chip and lead to lower system flexibility. The invention is directed to different types of power distribution terminals, and combines the characteristics of specific service systems, and proposes a general hardware and software architecture to achieve trusted startup, protect system integrity, and enhance system security, and has completed a complete production and upgrade process. The process steps are highly implementable.
最后应当说明的是：以上实施例仅用以说明本发明的技术方案而非对其限制，尽管参照上述实施例对本发明进行了详细的说明，所属领域的普通技术人员应当理解：依然可以对本发明的具体实施方式进行修改或者等同替换，而未脱离本发明精神和范围的任何修改或者等同替换，其均应涵盖在本发明的权利要求范围当中。 Finally, it should be noted that the above embodiments are only for explaining the technical solutions of the present invention and are not limited thereto, although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the present invention can still be The invention is to be construed as being limited by the scope of the appended claims.

Claims (5)

  1. 一种在配电终端中建立可信环境的方法，其特征在于：所述方法包括以下步骤：A method for establishing a trusted environment in a power distribution terminal, characterized in that the method comprises the following steps:
    步骤1：所述配电终端从外部非易失存储器上载入安全启动模块；Step 1: The power distribution terminal loads a secure boot module from an external non-volatile memory;
    步骤2：所述安全启动模块禁止所有中断，初始化寄存器和内存空间，对所述配电终端的状态做完整性度量；Step 2: The secure boot module prohibits all interrupts, initializes registers and memory space, and performs integrity metrics on the state of the power distribution terminal;
    步骤3：所述安全启动模块根据标志位判断是否需要对所述配电终端的操作***进行升级，如果需要升级，进入升级流程完成操作***的升级；如果不需要升级，则执行步骤4；Step 3: The security startup module determines whether the operating system of the power distribution terminal needs to be upgraded according to the flag bit. If the upgrade is required, the upgrade process is completed to complete the upgrade of the operating system; if the upgrade is not required, step 4 is performed;
    步骤4：安全启动模块计算引导程序和操作***内核的完整性度量值；Step 4: The secure boot module calculates the integrity metrics of the bootloader and the operating system kernel;
    步骤5：完整性验证成功后，配电终端控制权转交给引导程序，进入正常的配电终端引导过程。Step 5: After the integrity verification is successful, the control of the power distribution terminal is transferred to the boot program and enters the normal power distribution terminal boot process.
  2. 根据权利要求1所述的在配电终端中建立可信环境的方法，其特征在于：所述步骤1包括以下步骤：The method for establishing a trusted environment in a power distribution terminal according to claim 1, wherein the step 1 comprises the following steps:
    步骤1-1：可信芯片初始化，并使用所述芯片与配电终端之间的IO接口使配电终端进入外部Boot状态；Step 1-1: The trusted chip is initialized, and the IO interface between the chip and the power distribution terminal is used to make the power distribution terminal enter an external Boot state.
    步骤1-2：重启配电终端，使其进入指定Boot状态；Step 1-2: Restart the power distribution terminal to enter the specified Boot state.
    步骤1-3：配电终端根据指定Boot状态，从外部非易失存储器上载入安全启动模块。Step 1-3: The power distribution terminal loads the secure boot module from the external non-volatile memory according to the specified boot state.
  3. 根据权利要求1所述的在配电终端中建立可信环境的方法，其特征在于：所述步骤2包括以下步骤：The method for establishing a trusted environment in a power distribution terminal according to claim 1, wherein the step 2 comprises the following steps:
    步骤2-1：调用可信芯片的完整性扩展指令ETM_Extend，将完整性度量后的结果扩展到可信芯片中，以保证完整性度量值的安全；Step 2-1: Invoking the integrity extension instruction ETM_Extend of the trusted chip, and extending the result of the integrity measurement to the trusted chip to ensure the security of the integrity metric;
    步骤2-2：调用可信芯片的完整性验证指令ETM_PCR_Validate，判断目前配电终端的状态是否可信；Step 2-2: Invoking the integrity verification instruction ETM_PCR_Validate of the trusted chip to determine whether the current state of the power distribution terminal is authentic;
    步骤2-3：可信芯片根据验证结果决定是否进入下一状态，如果完整性验证失败，则可信芯片强制配电终端重启。Step 2-3: The trusted chip determines whether to enter the next state according to the verification result. If the integrity verification fails, the trusted chip forces the power distribution terminal to restart.
  4. 根据权利要求1所述的在配电终端中建立可信环境的方法，其特征在于：所述步骤3包括以下步骤：The method for establishing a trusted environment in a power distribution terminal according to claim 1, wherein the step 3 comprises the following steps:
    步骤3-1：如果需要对所述配电终端进行升级，通过网络接收数据，升级服务器将升级后的操作***镜像连同可信芯片需要更新的完整性参考值同时发送给升级子模块；Step 3-1: If the power distribution terminal needs to be upgraded, and the data is received through the network, the upgrade server sends the upgraded operating system image to the upgrade sub-module together with the integrity reference value that the trusted chip needs to update.
    步骤3-2：所述升级子模块通过解析数据包，对所述配电终端进行升级，同时调用可信芯片的完整性更新指令ETM_PCRRef_Put，更新可信芯片中存储的完整性参考值。 Step 3-2: The upgrade submodule upgrades the power distribution terminal by parsing the data packet, and simultaneously calls the integrity update instruction ETM_PCRRef_Put of the trusted chip to update the integrity reference value stored in the trusted chip.
  5. 根据权利要求1所述的在配电终端中建立可信环境的方法，其特征在于：所述步骤4包括以下步骤：The method for establishing a trusted environment in a power distribution terminal according to claim 1, wherein the step 4 comprises the following steps:
    步骤4-1：从外部非易失存储器上载入引导程序和操作***内核镜像；Step 4-1: Load the bootloader and operating system kernel image from the external non-volatile memory;
    步骤4-2：调用可信芯片的完整性扩展指令ETM_Extend，将完整性度量后的结果扩展到可信芯片中，以保证完整性度量值的安全；Step 4-2: Invoking the integrity extension instruction ETM_Extend of the trusted chip, and extending the result of the integrity measurement to the trusted chip to ensure the security of the integrity metric;
    步骤4-3：调用芯片完整性验证指令ETM_PCR_Validate，判断目前引导程序和操作***各自的状态是否都可信；Step 4-3: Call the chip integrity verification instruction ETM_PCR_Validate to determine whether the current status of the boot program and the operating system are all trusted;
    步骤4-4：可信芯片根据验证结果决定是否进入下一状态，如果引导程序或操作***的完整性验证失败，则可信芯片强制配电终端重启。 Step 4-4: The trusted chip determines whether to enter the next state according to the verification result. If the integrity verification of the boot program or the operating system fails, the trusted chip forces the power distribution terminal to restart.
PCT/CN2014/094051 2013-12-18 2014-12-17 Method for creating dependable environment in power distribution terminal WO2015090196A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310700306.3 2013-12-18
CN201310700306.3A CN103646214B (en) 2013-12-18 2013-12-18 A kind of method setting up trusted context in distribution terminal

Publications (1)

Publication Number Publication Date
WO2015090196A1 true WO2015090196A1 (en) 2015-06-25

Family

ID=50251427

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/094051 WO2015090196A1 (en) 2013-12-18 2014-12-17 Method for creating dependable environment in power distribution terminal

Country Status (2)

Country Link
CN (1) CN103646214B (en)
WO (1) WO2015090196A1 (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111651769A (en) * 2019-03-04 2020-09-11 阿里巴巴集团控股有限公司 Method and device for obtaining measurement of secure boot
CN112163216A (en) * 2020-08-28 2021-01-01 中国电力科学研究院有限公司 Method and system for establishing safe computing environment of intelligent electric energy meter
CN112639783A (en) * 2018-08-31 2021-04-09 美光科技公司 Simultaneous mirror measurement and execution

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103646214B (en) * 2013-12-18 2016-08-31 国家电网公司 A kind of method setting up trusted context in distribution terminal
CN103995479B (en) * 2014-05-13 2017-04-12 珠海博威智能电网有限公司 Medium-voltage on-off controller system based on hardware trust control and use method thereof
CN105656860A (en) * 2014-11-20 2016-06-08 中兴通讯股份有限公司 Safety management and control method, apparatus and system for Android system
CN108804927B (en) * 2018-06-15 2021-08-10 郑州信大壹密科技有限公司 Trusted computer platform based on domestic autonomous dual-system architecture
CN109656606A (en) * 2018-12-15 2019-04-19 深圳市捷诚技术服务有限公司 POS terminal program more new control method, device, storage medium and terminal
CN109992963B (en) * 2019-04-12 2023-02-17 长沙理工大学 Information security protection method and system for power terminal and embedded system thereof
CN110543769B (en) * 2019-08-29 2023-09-15 武汉大学 Trusted starting method based on encrypted TF card
CN112269995A (en) * 2020-08-07 2021-01-26 国网河北省电力有限公司信息通信分公司 Trusted computing platform for parallel computing and protection of smart power grid environment
CN116340956B (en) * 2023-05-25 2023-08-08 国网上海能源互联网研究院有限公司 Trusted protection optimization method and device for electric embedded terminal equipment

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1808456A (en) * 2006-02-24 2006-07-26 上海方正信息安全技术有限公司 Method of adding trusted platform on portable terminal
CN101281577A (en) * 2008-05-16 2008-10-08 北京工业大学 Dependable computing system capable of protecting BIOS and method of use thereof
CN101515316A (en) * 2008-02-19 2009-08-26 北京工业大学 Trusted computing terminal and trusted computing method
CN102012979A (en) * 2010-11-15 2011-04-13 深圳市华威世纪科技股份有限公司 Embedded credible computing terminal
CN103646214A (en) * 2013-12-18 2014-03-19 国家电网公司 Method for establishing trusted environment in power distribution terminal

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001065366A1 (en) * 2000-03-02 2001-09-07 Alarity Corporation System and method for process protection
CN100454324C (en) * 2007-09-21 2009-01-21 武汉大学 Embed type platform guiding of credible mechanism
CN101877040B (en) * 2009-12-07 2011-10-05 中国航天科工集团第二研究院七○六所 High-reliability computing platform
CN102035838B (en) * 2010-12-07 2014-02-19 中国科学院软件研究所 Trust service connecting method and trust service system based on platform identity
CN102355467B (en) * 2011-10-18 2015-07-08 国网电力科学研究院 Power transmission and transformation equipment state monitoring system security protection method based on trust chain transmission
CN103020531B (en) * 2012-12-06 2015-05-27 中国科学院信息工程研究所 Method and system for trusted control of operating environment of Android intelligent terminal

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1808456A (en) * 2006-02-24 2006-07-26 上海方正信息安全技术有限公司 Method of adding trusted platform on portable terminal
CN101515316A (en) * 2008-02-19 2009-08-26 北京工业大学 Trusted computing terminal and trusted computing method
CN101281577A (en) * 2008-05-16 2008-10-08 北京工业大学 Dependable computing system capable of protecting BIOS and method of use thereof
CN102012979A (en) * 2010-11-15 2011-04-13 深圳市华威世纪科技股份有限公司 Embedded credible computing terminal
CN103646214A (en) * 2013-12-18 2014-03-19 国家电网公司 Method for establishing trusted environment in power distribution terminal

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112639783A (en) * 2018-08-31 2021-04-09 美光科技公司 Simultaneous mirror measurement and execution
CN111651769A (en) * 2019-03-04 2020-09-11 阿里巴巴集团控股有限公司 Method and device for obtaining measurement of secure boot
CN111651769B (en) * 2019-03-04 2023-05-09 阿里巴巴集团控股有限公司 Method and device for acquiring measurement of security initiation
CN112163216A (en) * 2020-08-28 2021-01-01 中国电力科学研究院有限公司 Method and system for establishing safe computing environment of intelligent electric energy meter
CN112163216B (en) * 2020-08-28 2022-04-01 中国电力科学研究院有限公司 Method and system for establishing safe computing environment of intelligent electric energy meter

Also Published As

Publication number Publication date
CN103646214B (en) 2016-08-31
CN103646214A (en) 2014-03-19

Similar Documents

Publication Publication Date Title
WO2015090196A1 (en) Method for creating dependable environment in power distribution terminal
US10826904B2 (en) Local verification of code authentication
CN102136043B (en) Computer system and measuring method thereof
US10445154B2 (en) Firmware-related event notification
US20130227556A1 (en) Guest-driven host execution
CN103347027A (en) Trusted network connecting method and system
CN108460282A (en) A kind of computer safety start method based on multi-core chip
CN104598841A (en) Double-system guide method and device facing terminal security
CN113614723A (en) Update signal
CN111125707A (en) BMC (baseboard management controller) safe starting method, system and equipment based on trusted password module
CN103106373B (en) A kind of trusted computing chip and credible accounting system
CN104346572A (en) Construction method of universal external intelligent terminal safety operation environment
CN117195231A (en) Security protection method, system and medium for real-time operation system of trusted DCS controller
Adnan et al. Secure boot process for wireless sensor node
CN110968898A (en) Apparatus, method and system for selectively providing data verification functionality
CN114238941A (en) Program measurement verification method, device and system and storage medium
CN112269980A (en) Processor architecture
Yu et al. A trust verification architecture with hardware root for secure clouds
Hei et al. From hardware to operating system: a static measurement method of android system based on TrustZone
CN211403424U (en) TCM embedded platform based on Feiteng 2000+ server
WO2023184203A1 (en) Techniques to implement confidential computing with a remote device via use of trust domains
CN109190383B (en) Access instruction processing method, device and equipment
Crispo et al. CROSSCON: Cross-platform Open Security Stack for Connected Devices
CN111385791B (en) Security threat detection method and terminal
CN201247468Y (en) Credible calculating system for protecting BIOS

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14871944

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14871944

Country of ref document: EP

Kind code of ref document: A1