基于分布式消息驱动的分层可信密码服务框架

doi:10.6040/j.issn.1671-9352.2.2019.205

摘要/Abstract

摘要：

可信计算为系统安全问题提供了一种全新的解决途径。目前的国内外标准中所定义的可信密码功能访问方式一般为API接口方式，如TCG提出的可信软件栈(TSS)以及国家标准的TCM服务模块(TSM)等规定的接口，这些接口非常复杂，且存在相互间的兼容性问题，影响可信计算的开发和推广。为解决这些问题，本文中提出了一种基于消息驱动的分层可信密码服务框架，通过模块封装来屏蔽复杂的访问可信根的细节，简化接口，解决兼容性问题，并通过消息驱动的方式实现分布式、互相协作的可信根访问，以灵活支持不同应用所需要的可信服务。最后通过2个可信密码机制应用实例来说明本框架的可行性、框架中模块的通用性，以及框架在简化可信密码机制实现上的效果。

关键词: 可信密码服务框架, 消息驱动, 模块化, 可信应用开发

Abstract:

Trusted computing provides a new way to solve system security problems. The trusted cryptography function access methods defined in the current domestic and international standards are generally API interface methods, such as trusted software stack (TSS) in TCG standard and TCM service module (TSM) in Chinese national standards. These interfaces are very complicated. And there are compatibility issues between each other, affecting the development and promotion of trusted computing. In order to solve these problems, a message-driven hierarchical trusted cryptography service framework is proposed, which can shield complex trusted root access details through module encapsulation, simplify interfaces, solve compatibility problems, and implement distributed and collaborative trusted root access in a message-driven ways. Finally, two examples are given to illustrate the feasibility of the framework, the generality of the modules in the framework, and the effect of the framework in simplifying the implementation of the trusted cryptography mechanism.

Key words: trusted cryptography service framework, message drive, modular, trusted application development

中图分类号:

TP309

李颖,胡俊. 基于分布式消息驱动的分层可信密码服务框架[J]. 《山东大学学报(理学版)》, 2020, 55(3): 19-27.

Ying LI,Jun HU. Hierarchical trusted cryptography service framework based on distributed message drive[J]. JOURNAL OF SHANDONG UNIVERSITY(NATURAL SCIENCE), 2020, 55(3): 19-27.

图/表 9

图1

表1

表2

表3

表4

表5

表6

图2

图3

参考文献 14

1	张焕国, 韩文报, 来学嘉, 等. 网络空间安全综述[J]. 中国科学:信息科学, 2016, 46 (2): 125- 164.
	ZHANG Huanguo , HAN Wenbao , LAI Xuejia , et al. Overview of cyberspace security[J]. Scientia Sinica Informationis, 2016, 46 (2): 125- 164.
2	Trusted Computing Group. TPM 2.0 library specification[EB/OL]. (2013-03-15)[2019-10-21] https://trustedcomputinggroup.org/resource/tpm-library-specification/.
3	Trusted Computing Group. TPM 2.0: a brief introduction[EB/OL]. (2019-06-07)[2019-12-05] https://trustedcomputinggroup.org/wp-content/uploads/2019_TCG_TPM2_BriefOverview_DR02web.pdf
4	刘毅, 沈昌祥. 一种可信软件栈的兼容性改进方案[J]. 武汉大学学报(理学版), 2009, 55 (1): 57- 61. doi: 10.3321/j.issn:1671-8836.2009.01.013
	LIU Yi , SHEN Changxiang . Improvement about the compatibility of TCG software stack[J]. Journal of Wuhan University(Natural Science Edition), 2009, 55 (1): 57- 61. doi: 10.3321/j.issn:1671-8836.2009.01.013
5	ARTHUR W, CHALLENER D, GOLDMAN K. A practical guide to TPM 2.0[M]. Berkeley: Apress, 2015.
6	Trusted Computing Group. TSS system level API and TPM command transmission interface specification[EB/OL]. (2015-01-26)[2019-12-05] https://trustedcomputinggroup.org/wp-content/uploads/TSS_system_API.pdf
7	Trusted Computing Group. TCG TSS 2.0 marshaling/unmarshaling API specification[EB/OL]. (2018-01-04)[2019-12-06] https://trustedcomputinggroup.org/wp-content/uploads/TSS_Marshaling_Unmarshaling_API_Version-1.0_Revision-04_review_ENDS030918.pdf
8	李晓丹.基于PCIe接口的可信计算应用平台的设计[D].太原:中北大学, 2019.
	LI Xiaodan. Design of trusted computing application platform based on PCIe interface[D]. Taiyuan: North University of China, 2019.
9	姚爽.基于SGX保护国密算法运行环境的研究与实现[D].北京:北京交通大学, 2018.
	YAO Shuang. Research and implementation of protecting the runtime environment for national cryptographic algorithm based on software guard extensions[D]. Beijing: Beijing Jiaotong University, 2018.
10	刘磊. 基于可信计算技术的密码服务平台[J]. 信息安全研究, 2017, 3 (4): 305- 309.
	LIU Lei . Cryptographic service platform based on trusted computing technology[J]. Journal of Information Security Research, 2017, 3 (4): 305- 309.
11	STVBLE C , ZAERIN A . μTSS-a simplified trusted software stack[M]. Berlin: Springer, 2010: 124- 140.
12	SHI Wenchang. On design of a trusted software base with support of TPCM[C]// The First International Conference on Trusted Systems. Beijing: Springer, 2009: 1-15.
13	TAO Zheng, HU Jun, ZHAN Jing, et al. An application-oriented efficient encapsulation system for trusted software development[C]// 7th International Conference on Trusted Systems. Beijing: Springer, 2015: 153-168.
14	胡俊, 沈昌祥, 公备. 可信计算3.0工程初步[M]. 北京: 人民邮电出版社, 2018: 13- 35.
	HU Jun , SHEN Changxiang , GONG Bei . Trusted computing 3.0 engineering fundamentals[M]. 2nd Ed Beijing: Posts and Telecommunications Press, 2018: 13- 35.

多维度评价

Viewed

Full text

Abstract

Cited

Shared

Discussed

通用模块名称	功能
create_key	创建密钥
ekpub_send	发送EK公钥
ekpub_store	存储EK公钥
pik_casign	CA验证PIK申请，签发PIK证书并将证书封装到PIK激活包中
pik_client	PIK申请方发送PIK申请及激活CA返回的PIK激活包
pikcert_store	存储PIK证书
pikcert_verify	验证PIK证书
sessionkey_switch	会话密钥交换
key_certify	密钥证明
quote_report	生成可信报告
uuid_symm_crypt	对称密钥加密

名称	数据类型	内容
uuid^[32]	BYTE	密钥对象的UUID
vtcm_uuid^[32]	BYTE	密钥所在TCM的UUID
issmkwrapped	BYTE	密钥是否为SMK封装
key_usage	UINT32	密钥的TCM_KEY_USAGE属性
key_flags	UINT32	密钥的TCM_KEY_FLAGS属性
pcrinfo_uuid^[32]	BYTE	密钥的绑定PCR信息
wrapkey_uuid^[32]	BYTE	密钥使用的封装密钥的UUID

名称	数据类型	内容
uuid^[32]	BYTE	密钥对象的UUID
vtcm_uuid^[32]	BYTE	密钥所在TCM的UUID
ispubek	BYTE	密钥是否为TCM的EK公钥
key_usage	UINT32	密钥的TCM_KEY_USAGE属性
key_flags	UINT32	密钥的TCM_KEY_FLAGS属性
pcrinfo^[32]	BYTE	密钥的绑定PCR信息
prikey_uuid^[32]	BYTE	对应私钥的UUID

定制模块名称	功能
key_check	密钥检查
localkey_gen	本地密钥生成
localkey_store	本地密钥存储
remotekey_gen	远程密钥生成
remotekey_send	远程密钥发送

名称	数据类型	内容
user_name	BYTE	用户名
pik_uuid	BYTE	PIK的UUID
pikcert_uuid	BYTE	PIK证书的UUID
signkey_uuid	BYTE	签名密钥的UUID
unbindkey_uuid	BYTE	解除绑定密钥的UUID