WO2019062577A1 - 一种基于Trustzone技术的微码签名安全管理***及方法 - Google Patents

一种基于Trustzone技术的微码签名安全管理***及方法 Download PDF

Info

Publication number
WO2019062577A1
WO2019062577A1 PCT/CN2018/105980 CN2018105980W WO2019062577A1 WO 2019062577 A1 WO2019062577 A1 WO 2019062577A1 CN 2018105980 W CN2018105980 W CN 2018105980W WO 2019062577 A1 WO2019062577 A1 WO 2019062577A1
Authority
WO
WIPO (PCT)
Prior art keywords
signature
microcode
operating system
file
encrypted
Prior art date
Application number
PCT/CN2018/105980
Other languages
English (en)
French (fr)
Inventor
陈艳红
周智
姚挺
蒋培福
朱朋光
曹锜
Original Assignee
晶晨半导体(上海)股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 晶晨半导体(上海)股份有限公司 filed Critical 晶晨半导体(上海)股份有限公司
Priority to US16/324,145 priority Critical patent/US11296891B2/en
Publication of WO2019062577A1 publication Critical patent/WO2019062577A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
    • H04N21/4627—Rights management associated to the content
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
    • H04N21/4623—Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
    • H04L2209/127—Trusted platform modules [TPM]

Definitions

  • the present invention relates to the field of data security storage technologies, and in particular, to a microcode signature security management system and method based on Trustzone technology.
  • microcode is the core technology of video decoding, and the correctness of microcode itself is crucial.
  • the microcode loading management mechanism of the manufacturer compiles the microcode into the platform firmware system in the form of code data segments, or stores them in a directory of the platform firmware system in the form of binary files, and stores them according to the preset firmware during the video playback process. Path, find microcode, load run.
  • the existing microcode management mechanism generally satisfies the function of being successfully loaded during playback. However, both of the above forms are at risk of being modified and modified.
  • the microcode stored in the system directory as a binary file is also at risk of being replaced. Regardless of the modification or replacement, no management protection is added to the management mechanism.
  • the present invention provides a microcode signature security management system and method based on Trustzone technology.
  • the invention adopts the following technical solutions:
  • a microcode signature security management system based on Trustzone technology which is applicable to a hardware device including a microprocessor based on Trustzone technology, in which a microcode file encrypted by a signature is pre-stored, and the microprocessor is physically
  • the kernel is divided into a virtual security core and a common core, the microprocessor providing a secure execution environment and a common execution environment, the secure execution environment providing a secure operating system based on the secure core, the common execution environment providing a common operating environment of a common core, the microprocessor switching between the secure operating system and the general operating system based on its own monitoring mode;
  • the normal operating system After the hardware device is turned on, the normal operating system is started, and the ordinary operating system acquires the microcode file encrypted by the signature and outputs the microcode file and the switching signal after being encrypted by the signature, and the microprocessor receives The switching signal starts the monitoring mode to start the security operating system, and the security operating system receives the microcode file encrypted by the signature and performs signature verification on the microcode file after the signature is encrypted, and The signature verification passes the file when loaded and outputs a microcode error message when the signature verification fails.
  • the hardware device includes:
  • the storage module is configured to store the microcode file encrypted by a signature
  • the signature encryption module is connected to the storage module, and the signature encryption module is configured to acquire the microcode file and perform signature encryption on the microcode file, and output the micro coded and encrypted Code file.
  • the common operating system includes:
  • the client application module is connected to the signature encryption module, the client application module is configured to receive the microcode file encrypted by a signature, and output the microcode file and the switch signal.
  • the hardware device further includes:
  • monitoring mode module is connected to the client application module, and the monitoring mode module is configured to receive the switching signal and switch the microprocessor to the security operating system.
  • the security operating system comprises:
  • An application end module the application end module is connected to the client application module, and the application end module is configured to receive the microcode file that has been signed and encrypted, and perform signature verification on the microcode file that has been signed and encrypted, and For loading the microcode file when the signature verification is passed, and outputting the microcode error information when the signature verification fails.
  • a microcode signature security management method based on Trustzone technology based on the above microcode signature security management system, comprising:
  • Step S1 After the hardware device is turned on, the normal operating system is started;
  • Step S2 The ordinary operating system acquires the microcode file encrypted by the signature and outputs the microcode file encrypted by the signature and the switching signal;
  • Step S3 the microprocessor receives the switching signal and turns on the monitoring mode to start the security operating system
  • Step S4 The security operating system receives the microcode file encrypted by the signature and performs signature verification on the microcode file after the signature is encrypted, and determines whether the signature verification is passed:
  • the security operating system outputs the microcode error information.
  • the normal operating system acquires the microcode file encrypted by the signature through the client application module, and outputs the microcode file encrypted by the signature and the switching signal.
  • the microprocessor receives the switching signal through the monitoring mode module and starts the monitoring mode to start the security operating system.
  • the security operating system receives the signature-encrypted microcode file through the application end module, and performs signature verification on the microcode file after the signature is encrypted, and determines whether the signature verification is passed. .
  • the invention has the beneficial effects of ensuring the security of the microcode based on the secure operating system (secure os) security environment that is not accessible by the system layer; and adopting the cryptographic tool means to ensure the security, integrity and correctness of the loaded microcode. To solve the risk of the damaged modification of the existing microcode management mechanism.
  • FIG. 1 is a schematic diagram of functional modules of a microcode signature security management system based on Trustzone technology in a preferred embodiment of the present invention
  • FIG. 2 is a flowchart of a micro-code signature security management method based on Trustzone technology in a preferred embodiment of the present invention.
  • a micro-code signature security management system based on Trustzone technology is applicable to a hardware device including a microprocessor based on Trustzone technology, and the hardware device 1 pre-stores a microcode file encrypted by a signature.
  • the physical core of the microprocessor 5 is divided into a virtual security core and a common core.
  • the microprocessor 5 provides a secure execution environment and a common execution environment.
  • the security execution environment provides a secure operating system based on the security core
  • the above-mentioned common execution environment provides The above-mentioned microprocessor 5 switches between the above-mentioned security operating system and the above-mentioned common operating system based on its own monitoring mode; the above-mentioned hardware device 1 starts up and starts the above-mentioned ordinary operating system, and the above-mentioned ordinary operating system acquires After the above-mentioned microcode file encrypted by the signature and outputting the microcode file and the switching signal encrypted by the signature, the microprocessor 5 receives the switching signal and starts the monitoring mode to start the security operating system, and the security operating system receives the signature. Encrypted above microcode And the above-described microcode file signature verification signature encryption, and load the file when the above-described signature verification by the signature verification and error message output microcode failed.
  • the hardware device 1 includes:
  • a storage module 2 wherein the storage module 2 is configured to store the microcode file encrypted by a signature
  • the signature encryption module 3 is connected to the storage module 2, and the signature encryption module 3 is configured to acquire the microcode file and perform signature encryption on the microcode file, and output the microcode file encrypted by the signature. .
  • the above common operating system includes:
  • the client application module 6 is connected to the signature encryption module 3, and the client application module 6 is configured to receive the microcode file encrypted by the signature, and output the microcode file and the switching signal.
  • the hardware device 1 further includes:
  • the monitoring mode module 4 is connected to the client application module 6, and the monitoring mode module 4 is configured to receive the switching signal and switch the microprocessor 5 to the security operating system.
  • the foregoing security operating system includes:
  • the application module 7 is connected to the client application module 6, and the application module 7 is configured to receive the microcode file encrypted by the signature and perform signature verification on the microcode file encrypted by the signature, and The above file is loaded when the signature verification is passed, and the microcode error message is output when the signature verification fails.
  • the security management mechanism proposed by the present invention requires a microprocessor 5 of the trustzone technology.
  • the trustzone technology confuses each physical processor core into a security core and a common core, and divides the system into common domains (corresponding to Normal operating system) and security domain (corresponding to a secure operating system). A normal operating system cannot access resource data for obtaining a secure operating system.
  • the monitoring mode (Minitor Mode) provided by the ARM TrustZone is used, and the user sends a fast interrupt (FIQ) through the above-mentioned common operating system to enter the above monitoring mode, and the ARM is modified in the above monitoring mode.
  • the NS bit of the Security Configuration Register (SCR) of the processor (microprocessor 5) is set to zero, causing the ARM processor state to switch to the secure operating system described above.
  • the microcode file is signed and encrypted, and the microcode file after the signature encryption is stored in a fixed path of the hardware device 1, and the microcode signature security management system starts the client.
  • the end application module 6, referred to as CA sends the microcode file encrypted by the client to the trusted application module 7, referred to as TA.
  • the application module 7 performs signature verification on the microcode file that has been signed and encrypted, and the microcode file is loaded after the verification is passed; when the verification fails, the microcode error information is fed back and is not preloaded.
  • the system performs digital signature encryption on the microcode file and performs signature verification in the secure operating system, which effectively ensures the security, integrity and correctness of the microcode file to be loaded.
  • the system's microcode loading management mechanism is based on the secure operating system (secure os) security environment that is not accessible by the system layer to ensure the security of the microcode.
  • the cryptographic tools are used to ensure the correctness of the loaded microcode.
  • the cryptographic digital signature algorithm is used to ensure the integrity of the microcode; on the other hand, based on the secure os trustzone security system, the security of the microcode signature verification is ensured.
  • the introduction of this mechanism can greatly avoid the video playback decoding problem caused by the microcode being damaged and modified, which brings convenience to the video decoding support personnel.
  • a security management method for microcode signature based on Trustzone technology is based on the above microcode signature security management system, including:
  • Step S1 After the hardware device 1 is turned on, the foregoing common operating system is started;
  • Step S2 The foregoing common operating system acquires the microcode file encrypted by the signature and outputs the microcode file encrypted by the signature and the switching signal;
  • Step S3 the microprocessor 5 receives the switching signal and turns on the monitoring mode to start the security operating system
  • Step S4 The security operating system receives the microcode file encrypted by the signature and performs signature verification on the microcode file after the signature is encrypted, and determines whether the signature verification is passed:
  • the security operating system outputs the microcode error information.
  • the ordinary operating system acquires the microcode file encrypted by the signature through the client application module 6, and outputs the microcode file encrypted by the signature and the switching signal.
  • the microprocessor 5 receives the switching signal through the monitoring mode module 4 and turns on the monitoring mode to activate the secure operating system.
  • the security operating system receives the signature-encrypted microcode file through the application module 7 and performs signature verification on the signature-encrypted microcode file to determine whether the signature verification is passed. .
  • the hardware device 1 performs digital signature encryption on the microcode binary file in advance, and the hardware device 1 starts to run the CA module, and the TA module receives the integrity and correctness of the verification microcode.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)

Abstract

本发明提供一种基于Trustzone技术的微码签名安全管理***，属于数据安全存储领域，硬件设备开启后启动普通操作***，普通操作***获取经过签名加密的微码文件并输出经过签名加密后的微码文件和切换信号，微处理器接收切换信号并开启监控模式以启动安全操作***，安全操作***接收签名加密后的微码文件并对签名加密后的微码文件进行签名验证，并在签名验证通过时加载文件以及在签名验证未通过时输出微码错误信息。本发明的有益效果：基于***层访问不到的安全操作***(secure os)安全环境，确保微码的安全性；采用密码学工具手段，确保被加载微码的安全性、完整性及正确性，解决现存微码管理机制存在的被破坏修改替代的风险。

Description

一种基于Trustzone技术的微码签名安全管理***及方法 技术领域
本发明涉及数据安全存储技术领域，尤其涉及一种基于Trustzone技术的微码签名安全管理***及方法。
背景技术
目前嵌入式多媒体产品大都基于芯片厂家的硬件解码功能的支持。硬件解码的关键是视频播放过程中能否成功加载相应的微码进行视频的正确解码。微码是视频解码的核心技术，微码本身的正确性至关重要。目前厂家微码加载管理机制是将微码以代码数据段的形式编译进平台固件***，或者以二进制文件的形式存放于平台固件***某一目录，而在视频播放过程中根据预设的固件存放路径，查找微码，加载运行。
现存的微码管理机制一般情况下虽然可以满足播放时被成功加载使用的功能。但是上述两种形式都存在被破坏修改的风险，以二进制文件形式存放于***目录的微码还有被替换的风险。无论破坏修改或者替换，管理机制中都没有加入任何的检测保护手段。
发明内容
针对现有技术中存在的问题，本发明提供了一种基于Trustzone技术的微码签名安全管理***及方法。本发明采用如下技术方案：
一种基于Trustzone技术的微码签名安全管理***，适用于包括基于Trustzone技术的微处理器的硬件设备，所述硬件设备中预 先存储有经过签名加密的微码文件，所述微处理器物理的内核划分为虚拟的安全核和普通核，所述微处理器提供安全执行环境和普通执行环境，所述安全执行环境提供基于所述安全核的安全操作***，所述普通执行环境提供基于所述普通核的普通操作环境，所述微处理器基于自身的监控模式在所述安全操作***和所述普通操作***之间切换；
所述硬件设备开启后启动所述普通操作***，所述普通操作***获取经过签名加密的所述微码文件并输出经过签名加密后的所述微码文件和切换信号，所述微处理器接收所述切换信号并开启所述监控模式以启动所述安全操作***，所述安全操作***接收签名加密后的所述微码文件并对签名加密后的所述微码文件进行签名验证，并在签名验证通过时加载所述文件以及在签名验证未通过时输出微码错误信息。
优选的，所述硬件设备包括：
存储模块，所述存储模块用于存储经过签名加密的所述微码文件；
签名加密模块，所述签名加密模块连接所述存储模块，所述签名加密模块用于获取所述微码文件并对所述微码文件进行签名加密，以及用于输出经过签名加密的所述微码文件。
优选的，所述普通操作***包括：
客户端应用模块，所述客户端应用模块连接所述签名加密模块，所述客户端应用模块用于接收经过签名加密的所述微码文件，以及用于输出所述微码文件和所述切换信号。
优选的，所述硬件设备还包括：
监控模式模块，所述监控模式模块连接所述客户端应用模块， 所述监控模式模块用于接收所述切换信号并将所述微处理器切换至所述安全操作***。
优选的，所述安全操作***包括：
应用端模块，所述应用端模块连接所述客户端应用模块，所述应用端模块用于接收经过签名加密的所述微码文件并对经过签名加密的所述微码文件进行签名验证，以及用于在签名验证通过时加载所述微码文件，在签名验证未通过时输出微码错误信息。
一种基于Trustzone技术的微码签名安全管理方法，基于上述微码签名安全管理***，包括：
步骤S1、所述硬件设备开启后启动所述普通操作***；
步骤S2、所述普通操作***获取经过签名加密的所述微码文件并输出经过签名加密后的所述微码文件和所述切换信号；
步骤S3、所述微处理器接收所述切换信号并开启所述监控模式以启动所述安全操作***；
步骤S4、所述安全操作***接收签名加密后的所述微码文件并对签名加密后的所述微码文件进行签名验证并判断签名验证是否通过：
若判断结果为是，则所述安全操作***加载所述文件；
若判断结果为否，则所述安全操作***输出所述微码错误信息。
优选的，所述步骤S2中，所述普通操作***通过所述客户端应用模块获取经过签名加密的所述微码文件并输出经过签名加密后的所述微码文件和所述切换信号。
优选的，所述步骤S3中，所述微处理器通过所述监控模式模块接收所述切换信号并开启所述监控模式以启动所述安全操作***。
优选的，所述步骤S4中，所述安全操作***通过所述应用端模块接收签名加密后的所述微码文件并对签名加密后的所述微码文件进行签名验证并判断签名验证是否通过。
本发明的有益效果：基于***层访问不到的安全操作***(secure os)安全环境，确保微码的安全性；采用密码学工具手段，确保被加载微码的安全性、完整性及正确性，解决现存微码管理机制存在的被破坏修改替代的风险。
附图说明
图1为本发明一种较佳的实施例中，基于Trustzone技术的微码签名安全管理***的功能模块示意图；
图2为本发明一种较佳的实施例中，基于Trustzone技术的微码签名安全管理方法的流程图。
具体实施方式
需要说明的是，在不冲突的情况下，下述技术方案，技术特征之间可以相互组合。
下面结合附图对本发明的具体实施方式作进一步的说明：
如图1所示，一种基于Trustzone技术的微码签名安全管理***，适用于包括基于Trustzone技术的微处理器的硬件设备，上述硬件设备1中预先存储有经过签名加密的微码文件，上述微处理器5物理的内核划分为虚拟的安全核和普通核，上述微处理器5提供安全执行环境和普通执行环境，上述安全执行环境提供基于上述安全核的安全操作***，上述普通执行环境提供基于上述普通核的普通操作环境，上述微处理器5基于自身的监控模式在上述安全操作 ***和上述普通操作***之间切换；上述硬件设备1开启后启动上述普通操作***，上述普通操作***获取经过签名加密的上述微码文件并输出经过签名加密后的上述微码文件和切换信号，上述微处理器5接收上述切换信号并开启上述监控模式以启动上述安全操作***，上述安全操作***接收签名加密后的上述微码文件并对签名加密后的上述微码文件进行签名验证，并在签名验证通过时加载上述文件以及在签名验证未通过时输出微码错误信息。
较佳的实施例中，上述硬件设备1包括：
存储模块2，上述存储模块2用于存储经过签名加密的上述微码文件；
签名加密模块3，上述签名加密模块3连接上述存储模块2，上述签名加密模块3用于获取上述微码文件并对上述微码文件进行签名加密，以及用于输出经过签名加密的上述微码文件。
较佳的实施例中，上述普通操作***包括：
客户端应用模块6，上述客户端应用模块6连接上述签名加密模块3，上述客户端应用模块6用于接收经过签名加密的上述微码文件，以及用于输出上述微码文件和上述切换信号。
较佳的实施例中，上述硬件设备1还包括：
监控模式模块4，上述监控模式模块4连接上述客户端应用模块6，上述监控模式模块4用于接收上述切换信号并将上述微处理器5切换至上述安全操作***。
较佳的实施例中，上述安全操作***包括：
应用端模块7，上述应用端模块7连接上述客户端应用模块6，上述应用端模块7用于接收经过签名加密的上述微码文件并对经过签名加密的上述微码文件进行签名验证，以及用于在签名验证通 过时加载上述文件，在签名验证未通过时输出微码错误信息。
在本实施例中，本发明提出的安全管理机制硬件上需要trustzone技术的微处理器5，trustzone技术将每个物理的处理器内核虚化成安全核和普通核，将***划分为普通域(对应普通操作***)和安全域(对应安全操作***)。普通操作***不可以访问获取安全操作***的资源数据。
上述普通操作***切换到上述安全操作***时，需使用到ARM TrustZone提供的监控模式(Minitor Mode)，用户通过上述普通操作***发送快速中断(FIQ)进入上述监控模式，在上述监控模式下修改ARM处理器(微处理器5)的安全配置寄存器(SCR)的NS位，将其置为0，使得ARM处理器状态切换到上述安全操作***。
基于安全操作***的安全环境，包括PC工具(硬件设备1)对微码文件进行签名加密，签名加密后的微码文件存放于硬件设备1某一固定路径，微码签名安全管理***开机启动客户端应用模块6，简称CA，客户端进程将签名加密后的微码文件发送至可信任的应用端模块7，简称TA。
应用端模块7对经过签名加密的微码文件进行签名验证，验证通过则加载该微码文件；验证失败则反馈微码错误信息，不预加载。
该***对微码文件进行数字签名加密，并在安全操作***进行签名验证，有效保证了要加载的微码文件的安全性、完整性和正确性。
该***的微码加载管理机制中基于***层访问不到的安全操作***(secure os)安全环境，确保微码的安全性；采用密码学工 具手段，确保被加载微码的正确性，一方面利用密码学数字签名算法，确保微码的完整性；另一方面基于secure os trustzone安全***，确保微码签名验证的安全性。这种机制的引入可以大大避免因为微码被破坏修改替代引起的视频播放解码问题，给视频解码支持人员带来了的方便。
如图2所示，一种基于Trustzone技术的微码签名安全管理方法，基于上述的微码签名安全管理***，包括：
步骤S1、上述硬件设备1开启后启动上述普通操作***；
步骤S2、上述普通操作***获取经过签名加密的上述微码文件并输出经过签名加密后的上述微码文件和上述切换信号；
步骤S3、上述微处理器5接收上述切换信号并开启上述监控模式以启动上述安全操作***；
步骤S4、上述安全操作***接收签名加密后的上述微码文件并对签名加密后的上述微码文件进行签名验证并判断签名验证是否通过：
若判断结果为是，则上述安全操作***加载上述微码文件；
若判断结果为否，则上述安全操作***输出上述微码错误信息。
较佳的实施例中，上述步骤S2中，上述普通操作***通过上述客户端应用模块6获取经过签名加密的上述微码文件并输出经过签名加密后的上述微码文件和上述切换信号。
较佳的实施例中，上述步骤S3中，上述微处理器5通过上述监控模式模块4接收上述切换信号并开启上述监控模式以启动上述安全操作***。
较佳的实施例中，上述步骤S4中，上述安全操作***通过上 述应用端模块7接收签名加密后的上述微码文件并对签名加密后的上述微码文件进行签名验证并判断签名验证是否通过。
在本实施例中，硬件设备1预先对微码二进制文件进行数字签名加密，硬件设备1启动运行CA模块，TA模块接收验证微码的完整性及正确性。
通过说明和附图，给出了具体实施方式的特定结构的典型实施例，基于本发明精神，还可作其他的转换。尽管上述发明提出了现有的较佳实施例，然而，这些内容并不作为局限。
对于本领域的技术人员而言，阅读上述说明后，各种变化和修正无疑将显而易见。因此，所附的权利要求书应看作是涵盖本发明的真实意图和范围的全部变化和修正。在权利要求书范围内任何和所有等价的范围与内容，都应认为仍属本发明的意图和范围内。

Claims (9)

  1. 一种基于Trustzone技术的微码签名安全管理***，适用于包括基于Trustzone技术的微处理器的硬件设备，所述硬件设备中预先存储有经过签名加密的微码文件，所述微处理器物理的内核划分为虚拟的安全核和普通核，所述微处理器提供安全执行环境和普通执行环境，所述安全执行环境提供基于所述安全核的安全操作***，所述普通执行环境提供基于所述普通核的普通操作环境，所述微处理器基于自身的监控模式在所述安全操作***和所述普通操作***之间切换；其特征在于，
    所述硬件设备开启后启动所述普通操作***，所述普通操作***获取经过签名加密的所述微码文件并输出经过签名加密后的所述微码文件和切换信号，所述微处理器接收所述切换信号并开启所述监控模式以启动所述安全操作***，所述安全操作***接收签名加密后的所述微码文件并对签名加密后的所述微码文件进行签名验证，并在签名验证通过时加载所述文件以及在签名验证未通过时输出微码错误信息。
  2. 根据权利要求1的微码签名安全管理***，其特征在于，所述硬件设备包括：
    存储模块，所述存储模块用于存储经过签名加密的所述微码文件；
    签名加密模块，所述签名加密模块连接所述存储模块，所述签名加密模块用于获取所述微码文件并对所述微码文件进行签名加密，以及用于输出经过签名加密的所述微码文件。
  3. 根据权利要求2的微码签名安全管理***，其特征在于，所述普通操作***包括：
    客户端应用模块，所述客户端应用模块连接所述签名加密模块，所述客户端应用模块用于接收经过签名加密的所述微码文件，以及用于输出经过签名加密的所述微码文件和所述切换信号。
  4. 根据权利要求3的微码签名安全管理***，其特征在于，所述硬件设备还包括：
    监控模式模块，所述监控模式模块连接所述客户端应用模块，所述监控模式模块用于接收所述切换信号并将所述微处理器切换至所述安全操作***。
  5. 根据权利要求4的微码签名安全管理***，其特征在于，所述安全操作***包括：
    应用端模块，所述应用端模块连接所述客户端应用模块，所述应用端模块用于接收经过签名加密的所述微码文件并对经过签名加密的所述微码文件进行签名验证，以及用于在签名验证通过时加载所述微码文件，在签名验证未通过时输出微码错误信息。
  6. 一种基于Trustzone技术的微码签名安全管理方法，采用如权利要求1-5中任意一项所述的基于Trustzone技术的微码签名安全管理***，其特征在于，包括：
    步骤S1、所述硬件设备开启后启动所述普通操作***；
    步骤S2、所述普通操作***获取经过签名加密的所述微码文件并输出经过签名加密后的所述微码文件和所述切换信号；
    步骤S3、所述微处理器接收所述切换信号并开启所述监控模式以启动所述安全操作***；
    步骤S4、所述安全操作***接收签名加密后的所述微码文件并对签名加密后的所述微码文件进行签名验证并判断签名验证是否通过：
    若判断结果为是，则所述安全操作***加载所述微码文件；
    若判断结果为否，则所述安全操作***输出所述微码错误信息。
  7. 根据权利要求6的微码签名安全管理***，其特征在于，所述步骤S2中，所述普通操作***通过所述客户端应用模块获取经过签名加密的所述微码文件并输出经过签名加密后的所述微码文件和所述切换信号。
  8. 根据权利要求6的微码签名安全管理***，其特征在于，所述步骤S3中，所述微处理器通过所述监控模式模块接收所述切换信号并开启所述监控模式以启动所述安全操作***。
  9. 根据权利要求6的微码签名安全管理***，其特征在于，所述步骤S4中，所述安全操作***通过所述应用端模块接收签名加密后的所述微码文件并对签名加密后的所述微码文件进行签名验证并判断签名验证是否通过。
PCT/CN2018/105980 2017-09-27 2018-09-17 一种基于Trustzone技术的微码签名安全管理***及方法 WO2019062577A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/324,145 US11296891B2 (en) 2017-09-27 2018-09-17 Microcode signature security management system based on trustzone technology and method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710892977.2A CN107707981B (zh) 2017-09-27 2017-09-27 一种基于Trustzone技术的微码签名安全管理***及方法
CN201710892977.2 2017-09-27

Publications (1)

Publication Number Publication Date
WO2019062577A1 true WO2019062577A1 (zh) 2019-04-04

Family

ID=61174504

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/105980 WO2019062577A1 (zh) 2017-09-27 2018-09-17 一种基于Trustzone技术的微码签名安全管理***及方法

Country Status (3)

Country Link
US (1) US11296891B2 (zh)
CN (1) CN107707981B (zh)
WO (1) WO2019062577A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112929392A (zh) * 2021-03-19 2021-06-08 杭州市电力设计院有限公司余杭分公司 一种基于tee的电力物联网安全通信模组改进方法
DE202022102514U1 (de) 2022-05-07 2022-05-20 Tanweer ALAM Kryptographiebasiertes intelligentes System für die Sicherheitsverwaltung von Mikrocodesignaturen

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107707981B (zh) * 2017-09-27 2020-10-30 晶晨半导体(上海)股份有限公司 一种基于Trustzone技术的微码签名安全管理***及方法
CN108155986A (zh) * 2017-12-14 2018-06-12 晶晨半导体(上海)股份有限公司 一种基于可信执行环境的密钥烧录***及方法
CN108804935A (zh) * 2018-05-31 2018-11-13 中国-东盟信息港股份有限公司 一种基于TrustZone的安全加密存储***及方法
US20220156381A1 (en) * 2020-11-19 2022-05-19 Moxa Inc. Method of Handling Security of an Operating System
CN117668845A (zh) * 2022-08-27 2024-03-08 华为技术有限公司 操作***安全启动方法、操作***安装方法及相关装置
CN116436681B (zh) * 2023-04-25 2024-01-02 上海物盾信息科技有限公司 一种基于TrustZone的安全隔离***、方法、终端及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090217050A1 (en) * 2008-02-26 2009-08-27 Texas Instruments Incorporated Systems and methods for optimizing signature verification time for a cryptographic cache
CN103136488A (zh) * 2011-12-02 2013-06-05 三星电子株式会社 保护触摸输入的方法和装置
CN104918116A (zh) * 2015-05-28 2015-09-16 北京视博数字电视科技有限公司 用于智能终端的资源播放方法及***
CN105138930A (zh) * 2015-08-12 2015-12-09 山东超越数控电子有限公司 一种基于TrustZone的加密***及方法
CN107707981A (zh) * 2017-09-27 2018-02-16 晶晨半导体(上海)股份有限公司 一种基于Trustzone技术的微码签名安全管理***及方法

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6938164B1 (en) * 2000-11-22 2005-08-30 Microsoft Corporation Method and system for allowing code to be securely initialized in a computer
US20060156008A1 (en) * 2005-01-12 2006-07-13 Microsoft Corporation Last line of defense ensuring and enforcing sufficiently valid/current code
US7895465B2 (en) * 2008-06-03 2011-02-22 International Business Machines Corporation Memory preserved cache failsafe reboot mechanism
US7975169B2 (en) * 2008-06-03 2011-07-05 International Business Machines Corporation Memory preserved cache to prevent data loss
WO2012116180A1 (en) * 2011-02-23 2012-08-30 Cavium, Inc. Microcode authentication
US8850177B2 (en) * 2011-07-08 2014-09-30 Openpeak Inc. System and method for validating components during a booting process
US9367688B2 (en) * 2012-06-22 2016-06-14 Intel Corporation Providing geographic protection to a system
JP6223137B2 (ja) * 2013-11-15 2017-11-01 キヤノン株式会社 画像形成装置及びその制御方法、並びにプログラム
US10079681B1 (en) * 2014-09-03 2018-09-18 Amazon Technologies, Inc. Securing service layer on third party hardware
US9491111B1 (en) * 2014-09-03 2016-11-08 Amazon Technologies, Inc. Securing service control on third party hardware
US9594927B2 (en) * 2014-09-10 2017-03-14 Intel Corporation Providing a trusted execution environment using a processor
US10374805B2 (en) * 2015-07-20 2019-08-06 Intel Corporation Technologies for trusted I/O for multiple co-existing trusted execution environments under ISA control
US10817609B2 (en) * 2015-09-30 2020-10-27 Nvidia Corporation Secure reconfiguration of hardware device operating features
US10146940B2 (en) * 2016-01-13 2018-12-04 Gbs Laboratories, Llc Multiple hardware-separated computer operating systems within a single processor computer system to prevent cross-contamination between systems
US10397230B2 (en) * 2017-06-15 2019-08-27 International Business Machines Corporation Service processor and system with secure booting and monitoring of service processor integrity
US20190004788A1 (en) * 2017-06-30 2019-01-03 Intel Corporation Secure microcode update

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090217050A1 (en) * 2008-02-26 2009-08-27 Texas Instruments Incorporated Systems and methods for optimizing signature verification time for a cryptographic cache
CN103136488A (zh) * 2011-12-02 2013-06-05 三星电子株式会社 保护触摸输入的方法和装置
CN104918116A (zh) * 2015-05-28 2015-09-16 北京视博数字电视科技有限公司 用于智能终端的资源播放方法及***
CN105138930A (zh) * 2015-08-12 2015-12-09 山东超越数控电子有限公司 一种基于TrustZone的加密***及方法
CN107707981A (zh) * 2017-09-27 2018-02-16 晶晨半导体(上海)股份有限公司 一种基于Trustzone技术的微码签名安全管理***及方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112929392A (zh) * 2021-03-19 2021-06-08 杭州市电力设计院有限公司余杭分公司 一种基于tee的电力物联网安全通信模组改进方法
DE202022102514U1 (de) 2022-05-07 2022-05-20 Tanweer ALAM Kryptographiebasiertes intelligentes System für die Sicherheitsverwaltung von Mikrocodesignaturen

Also Published As

Publication number Publication date
CN107707981B (zh) 2020-10-30
US11296891B2 (en) 2022-04-05
US20210359861A1 (en) 2021-11-18
CN107707981A (zh) 2018-02-16

Similar Documents

Publication Publication Date Title
WO2019062577A1 (zh) 一种基于Trustzone技术的微码签名安全管理***及方法
US9735960B2 (en) Method for protecting data stored within a disk drive of a portable computer
TWI582593B (zh) 以區段映射表爲基礎之快速資料加密策略順從
US10032029B2 (en) Verifying integrity of backup file in a multiple operating system environment
KR101402542B1 (ko) 지속형 보안 시스템 및 지속형 보안 방법
TWI544332B (zh) 用於以經加密塊為基礎之快速資料加密策略順從的方法與電腦儲存媒體
US7930743B2 (en) Information processing system, information processing method, information processing program, computer readable medium and computer data signal
US20100082960A1 (en) Protected network boot of operating system
US20110087920A1 (en) Computing device with recovery mode
JP5346608B2 (ja) 情報処理装置およびファイル検証システム
JP2015072683A (ja) 匿名データの第三者の監視を実行するためのシステム及び方法
JP2014191509A (ja) 情報処理装置、情報処理プログラム
TW200405963A (en) Sleep protection
KR20080072452A (ko) 전자기기의 부팅 방법 및 부팅 인증 방법
WO2007091492A1 (ja) セキュア処理装置、方法、プログラム
TW201310344A (zh) 存取基本輸入輸出系統設定的認證方法
EP2005356A1 (en) Authentication of a request to alter at least one of a bios and a setting associated with the bios
US10346179B2 (en) Information processing apparatus, server apparatus, information processing system, control method, and computer program
JP5689429B2 (ja) 認証装置、および、認証方法
US20190057220A1 (en) Information processing device and information processing system
JP2007310688A (ja) マイクロコンピュータおよびそのソフトウェア改竄防止方法
TW201629820A (zh) 對儲存裝置之電纜調換安全性攻擊的預防技術
JP4707748B2 (ja) 外部記憶デバイス、外部記憶デバイスに記憶されたデータを処理するための方法、プログラムおよび情報処理装置
JP2007048008A (ja) 外部記憶装置およびコンピュータおよびｓｂｃ制御方法
US20140156994A1 (en) Information processing apparatus and method for activating computer

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18861801

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18861801

Country of ref document: EP

Kind code of ref document: A1