CN100504897C - Method for starting protected partition - Google Patents

Abstract

A method for starting a protected partition, comprising the following steps: loading a security initialization command and at least a security initialization command in a domain manager into a first security storage area; preparing and executing a security entry command of a processor; Loading the security initialization instruction and performing integrity check, running the security initialization instruction after the integrity check is passed, and storing the integrity check value in the first or second security storage area; from the first security storage area, or After loading the domain manager into the first or second safe storage area from the storage medium of the storage domain manager, the integrity check is performed, and the integrity check value is stored in the first or second safe storage area; calling The domain manager performs initialization and manages protected partitions. This method can guarantee the security in the process of booting the protected partition.

Description

A method of booting a protected partition

technical field

The invention relates to the starting of computer system partitions, in particular to a method for starting protected partitions.

Background technique

As computers play an increasingly important role in today's society, it is bound to deal with more highly sensitive and confidential information. This information is often of high value and is an attractive target for computer hackers. As for attacks on client computer systems, both the attack frequency and the difficulty of screening are constantly increasing; and experts predict that such attacks will continue to increase in the future.

Although firewall software, virus scanners, encryption software, and other security software provide some protection, these software solutions can only protect some software with the same or higher privilege level from other software with a lot of work. Software (possibly malicious) attacks. Therefore, pure software protection measures will be more limited.

TPM (Trusted Platform Module), known as a reliable platform module, is the firmware built into the cryptographic algorithm chip on the motherboard, and is a microcontroller used to store keys, passwords, and digital certificates. It is usually fixed on the motherboard of a PC, but it can also be applied to any computing device that requires its corresponding function. The characteristics of the microcontroller ensure that the information stored in it can be protected from software attacks, preventing the above information from being obtained through physical theft, so that the information stored on it is more secure. Some processes that need security protection, such as digital signature and key exchange, can be protected by TPM. If the boot process does not meet expectations, access to data and secrets on the platform is denied. So that some key applications and functions, such as secure e-mail, secure network access, and local protection of data, will be more secure.

After the system with the operating system installed is turned on, the first thing to start is the TPM. Once the system is powered on, the TPM chip will immediately check the basic input and output system (BIOS) and related hardware including system ROM, hardware driver's master boot record (MBR) and partition table, and store their hash values in the TPM in the Platform Configuration Register (PCR). These values will be compared with the saved boot records, and if the results are inconsistent, the TPM will not allow access to the system partition; if the comparison passes, the TPM will allow the boot process to continue. Next, the master boot record (MBR) controls the boot process, which designates the active partition, loads the first sector into system memory, and is then controlled by the boot sector.

LT (LaGrande Technology) technology refers to a series of enhanced hardware components designed to help protect sensitive information from software attacks. LT features include features on microprocessors, chipsets, I/O subsystems, and other platform components. When LT technology is combined with LT-enabled operating systems and applications, it can help protect the security and integrity of data in an environment where security is increasingly threatened. The LT technology supports the process of booting the protected partition, which uses the post-boot method of the LT technology to support the booting of the protected partition without restarting the computing platform. And the original software can run under the standard partition without modification.

As shown in Figure 1, LT supports switching from a normal Windows partition to a secure Windows partition. Usually, starting a protected partition is a request issued by an operating system that supports LT features, and then divides the memory space into a series of protected memory spaces, and marks them as protected, and then loads the domain manager (Domain Manager, DM) Go to the specified memory space and register through the Authenticated Code (AC) module.

In order to support this switching, the LT chipset provides new instructions, and its secure boot process is shown in Figure 2. The specific steps are as follows:

① Load the processor's security initialization instruction (SINIT) and DM into the memory to initialize the processor;

② Execute the safe entry command (SENTER), after the command runs, all operations and other activities in the original processor are all stopped, and it is ready to enter the protected partition;

③The processor loads the SINIT instruction from the memory described in step ①, uses the public key of the processor manufacturer to authenticate the SINIT instruction, and starts the SINIT instruction after passing the authentication;

④ The SINIT instruction detects whether the main hardware configuration is correct, and at this time it is running in a protected area, and at the same time stores the integrity check value of the authenticated SINIT instruction in the corresponding platform configuration register (PCR) of the TPM;

⑤The SINIT command performs the integrity check on the DM in the memory in step ①, calls the DM after passing, and stores the integrity check value of the DM in the corresponding PCR of the TPM;

⑥ DM initializes, and gives the operation right to DM, and DM manages the protected memory partition.

In the above startup process, the purpose of SINIT execution is to detect incorrectly configured hardware; the SENTER process is used to ensure that there is no interference in startup; DM verification refers to the verification operation of DM by SENTER to detect tampering with the domain manager; Registering DM means that SENTER stores the verification value of DM in TPM; the authentication code is used to detect incorrect hardware configuration, including the chipset, and the memory is not trusted until the chipset configuration is verified; the authentication code is determined by the chipset The manufacturer uses the private key of the asymmetric key to sign, and the authentication code is authenticated by the public key of the digital signature in a special hardware protection area.

Note that in the above process, there is a security hole in the process of loading SINIT and DM: since the SINIT instruction and DM are placed in the unprotected memory area in step ①, virus programs may attack it, so in step ③ check When the SINIT integrity check value and the 5th step verify the DM integrity check value, it cannot pass the check, and can never enter the safe operating system state without restarting the computing platform.

In view of this, it is necessary to provide further protection for the SINIT instruction and DM during the process of booting the protected partition, so as to enhance the security of the entire method of booting the protected partition.

Contents of the invention

The purpose of the present invention is to provide a method for starting a protected partition, which solves the problem that in the prior art, the security initialization instruction and the storage area loaded by the domain manager are vulnerable to software virus attacks, thereby affecting the security of the entire startup process. The problem.

In order to achieve the above object, the method for starting the protected partition of the present invention comprises the following steps:

Step 100, loading the security initialization instruction and at least the security initialization instruction in the domain manager into the first security storage area;

Step 110, preparing and executing a security entry command of the processor;

Step 120, load the security initialization command from the first security storage area and perform an integrity check on the security initialization command, run the security initialization command after the integrity check is passed, and store the integrity check value in the first or a second secure storage area;

Step 130, after loading the domain manager into the first or second secure storage area from the first secure storage area or from the storage medium storing the domain manager, perform an integrity check on the domain manager, and storing the integrity check value in the first or second secure storage area;

Step 140, calling the domain manager to initialize and manage the protected partitions.

Another method for starting a protected partition of the present invention includes the following steps:

Step 200, initialize the processor, prepare and execute the security entry command;

Step 210, send the security initialization instruction and at least the security initialization instruction in the domain manager to the first security storage area, use the Hash algorithm to perform integrity check, and store the integrity check value in the first or second security storage area ;

Step 220, load the security initialization instruction from the storage medium, perform the integrity check and authentication of the authentication code on the security initialization instruction, start the security initialization instruction after passing the integrity check, and store the integrity check value in in the first or second secure storage area;

Step 230, load the domain manager into the first or second safe storage area, perform an integrity check, call the domain manager after passing, and store the integrity check value in the first, second or third safe storage area in the area;

Step 240, calling the domain manager to initialize and manage the protected memory partition.

Compared with the prior art, the beneficial effect of the present invention is: on the basis of the original method for starting the protected partition, by using the Hash algorithm to check the integrity of the loaded SINIT and DM, it is ensured that the loaded SINIT and DM further, by performing the integrity check of SINIT and DM in the safe storage area, and storing the integrity check value in the safe storage area, it can be protected from virus program attacks, thereby ensuring Security to start the protected partition process.

Description of drawings

Fig. 1 shows the schematic diagram of the system after switching from a normal Windows partition to a protected Windows partition in the LT technology;

FIG. 2 shows a flowchart of a method for starting a protected partition in the prior art;

Fig. 3 is the flow chart of the first example of the method for starting the security partition in the reserved memory area of the present invention;

Fig. 4 is the flow chart of the second example of the method for starting the security partition in the reserved memory area of the present invention;

Fig. 5 is the flow chart of the third example of the method for starting the secure partition in the reserved memory area of the present invention;

Fig. 6 is the flow chart of the method for starting the protected partition that SINIT and DM are carried out integrity verification in TPM of the present invention;

Fig. 7 is the process of performing integrity verification by TPM in the method for starting a protected partition according to the present invention, wherein the verification value is stored in a register reserved in the CPU or chipset hardware;

Fig. 8 is the process of performing integrity verification by TPM in the method for starting a protected partition according to the present invention, wherein the verification value is stored in a register reserved in the TPM;

FIG. 9 is a process of performing integrity check on SINIT by TPM in the method for starting a protected partition of the present invention, and then performing DM integrity check in the cleared memory.

Detailed ways

In order to make it easier for those skilled in the art to understand and implement the present invention, the method for starting a protected partition based on LT technology of the present invention will be described below with reference to the accompanying drawings.

In the present invention, in order to fill the loopholes in the prior art when starting the security partition, two solutions are proposed, that is, the memory isolation method and the TPM execution integrity verification method which will be described later.

memory isolation

For the memory isolation method, the present invention physically provides a special memory space in the memory, which can only be accessed by specific hardware instructions of the CPU, and software cannot use the memory space. Said specific hardware instructions can only be called by corresponding LT instructions such as SINIT. For the convenience of description, this special memory space will be referred to as a memory reserved area later.

The above memory reserved area can be realized by the following methods:

First, add control logic to certain address lines of the memory (such as low-end address lines or chip select signal lines) when decoding addresses. The control logic judges whether the current instruction is an LT instruction. If it is, access is allowed, otherwise access is not allowed . This part of the address has certain restrictions on access from the CPU and is reserved for special instruction access. Then, during the BIOS startup phase, these memory spaces protected by special instruction access are allocated for use by specific instructions.

Through the above implementation method, the reserved memory area allocated in this way can only be controlled by the LT instruction, thereby preventing external codes from attacking its stored content.

The method for starting the security partition by using the reserved memory area of the present invention will be described below with reference to FIG. 3 to FIG. 5 .

FIG. 3 is a flow chart of a first example of the method for activating a secure partition in a memory reserved area according to the present invention. As shown in Figure 3, the method for starting the protected partition of the present invention comprises the following steps:

1) Firstly, use the Hash algorithm to check the integrity of the SINIT instruction and DM stored in the hard disk or other storage media.

2) Load the SINIT instruction or DM that has passed the integrity check into the reserved memory area, and initialize the processor. If the DM is too large, only the SINIT instruction is loaded.

3) Execute the SENTER instruction. After the instruction runs, all calculations and other activities in the original processor are all stopped, and it is ready to enter the protected environment.

4) The processor loads the SINIT instruction in the memory reserved area of step 2), uses the public key of the processor manufacturer to authenticate the SINIT instruction, and starts the SINIT instruction after passing the authentication.

5) The SINIT command checks whether the main hardware configuration is correct. At this time, it is running in the memory reserved area. At the same time, the integrity check value of the authenticated SINIT command is stored in the corresponding platform configuration register of the TPM, and the memory reserved area is cleared. Memory. Note that the integrity check referred to in this step 5) is the integrity check of the SINIT command in the authentication code mode in the existing LT technology startup security partition method, and the Hash algorithm is used to perform SINIT and DM in step 1). The integrity check method is different.

6) If the DM has been loaded, the SINIT instruction performs integrity check on the DM in the memory reserved area in step 2), calls the DM after the integrity check is passed, and stores the integrity check value of the DM in the TPM In the corresponding PCR; otherwise, transfer the DM to the memory reserved area and then perform integrity verification on the DM, call the DM after the integrity verification passes, and store the integrity verification value of the DM in the corresponding PCR of the TPM . Note that the integrity check referred to in this step 6) is the integrity check of the authentication code mode for DM in the existing LT technology startup security partition method, and the Hash algorithm is used for SINIT and DM in step 1). The integrity check method is different.

7) The DM initializes, hands over the operation right to the DM, and manages the protected memory partitions by the DM.

In the first example above, by using the Hash algorithm to check the integrity of the SINIT and DM before loading them, it can be ensured that the loaded SINIT and DM are complete SINIT and DM. Moreover, the SINIT and the integrity check value of the DM that have passed the integrity check are stored in a specific PCR of the TPM, which can prevent its integrity from being damaged during the startup process. Therefore, the reliability of SINIT and DM can be further improved.

In the process of the first example above, the following modifications or changes can be made:

a. After the integrity check of SINIT and DM is performed in step 1), it may not be stored in a specific memory reserved area, because it can be considered that SINIT and DM are complete at this time.

b. When any one of SINIT and DM fails the integrity check, it can be repaired by means of automatic repair. The so-called automatic repair is realized by covering the damaged SINIT or DM with the SIINIT and DM backed up in the computer system, ensuring the integrity of the SINIT instruction and DM on the storage medium before loading, and avoiding being attacked by viruses or hacker tools .

c. In step 1), SINIT and DM do not need to perform integrity verification at the same time, and can verify DM after SINIT integrity verification and loading;

d. above-mentioned steps 5) and step 6) the integrity check value of SINIT and DM can not be stored in the specific PCR in the TPM, can be stored in the corresponding area that it allocates in the above-mentioned memory reserved area, this Some areas are not affected when the memory in the reserved area is cleared.

FIG. 4 is a flow chart of a second example of the method for activating a secure partition in a memory reserved area according to the present invention. As shown in Figure 4, the method specifically includes the following steps:

Step 41, in the BIOS start-up stage, allocate corresponding memory reserved areas for SINIT and DM respectively, that is, SINIT memory reserved area and DM memory reserved area;

Step 42, SINIT and DM are loaded into the SINIT memory reserved area and the DM memory reserved area;

Step 43, in the SINIT memory reserved area and the DM memory reserved area, use the Hash algorithm to check the integrity of SINIT and DM, and the check values are respectively stored in the SINIT memory reserved area and the DM memory reserved area;

Step 44, run the security clear instruction SCLEAR of LT, and this instruction clears other memory areas outside the reserved memory area;

Step 45, enable SINIT and DM in turn, and after DM initializes, hand over the operation right to DM, and DM manages the protected partition.

As can be seen from the flowchart in Fig. 4, compared with the method for starting the protected partition in Fig. 2, in the method for starting the protected partition of the present invention, SINIT and DM are respectively loaded into the SINIT memory reserved area allocated for it and DM memory reserved area, and perform integrity verification in the SINIT memory reserved area and DM memory reserved area respectively, and then store the check value in the SINIT memory reserved area and DM memory reserved area respectively. It can effectively prevent SINIT and DM from being attacked by viruses, and improve the reliability of SINIT and DM.

And, here, the integrity check of SINIT and DM in the existing method of starting the protected partition can be replaced by using the Hash algorithm to check the integrity of SINIT and DM loaded in the reserved memory area, omitting the second 1 example, the second integrity check, thus simplifying the process of starting the protected partition under the condition of ensuring the integrity of SINIT and DM.

Of course, the integrity check used in the existing method for booting the protected partition can be performed after loading SINIT and/or DM from the reserved memory area, so as to further ensure that the integrity of SINIT and DM is not damaged during the loading process.

FIG. 5 is a flow chart of a third example of the method for activating a secure partition in a memory reserved area according to the present invention. When the memory space required by DM is large, you can load SINIT first and then load DM. As shown in Figure 5, it is an example of loading SINIT first and then loading DM. The method specifically includes the following steps:

Step 51, in the BIOS start-up phase, respectively allocate a memory reserved area for SINIT, that is, a SINIT memory reserved area;

Step 52, loading the SINIT into the SINIT memory reserved area, utilizing the Hash algorithm to check the integrity of the SINIT, and storing the check value in the SINIT memory reserved area;

Step 53, run the security clear command SCLEAR of LT, and this command clears other memory areas other than the SINIT memory reserved area;

Step 54, call SINIT from the SINIT memory reserved area, start SINIT;

Step 55, loading the DM into a certain memory space after clearing, using the Hash algorithm to check the integrity of the DM, saving the check value in the memory space or in the corresponding PCR of the TPM, and then enabling the DM;

Step 56, after the DM initializes, hand over the operation right to the DM, and the DM manages the protected partition.

For the third example, the above steps can be modified and changed as follows:

a. In step 54, after invoking SINIT, it can be compared with the verification value in step 52 first, and in the case of consistency, start SINIT.

b. In step 52, after loading SINIT, you can not use the Hash algorithm to carry out integrity check on SINIT, but after it is called from the SINIT memory reserved area, carry out integrity check again, and the integrity check value Stored in the corresponding PCR of the TPM, or in the reserved area of the SINIT memory.

TPM performs integrity checks

The above-mentioned embodiment has described the method for starting the protected partition that performs the integrity check of SINIT and DM in the reserved memory area, and the method for starting the protected partition that performs the integrity check in the TPM will be described below in conjunction with the embodiment Be explained.

As shown in Figure 6, it is the flow chart of the method for starting the protected partition that SINIT and DM are carried out integrity verification in TPM for the present invention, and this method comprises the following steps:

Step 61, initialize the processor and prepare to execute the SENTER instruction;

Step 62, execute the SENTER instruction, and after the instruction runs, all calculations and other activities in the original processor are all stopped, and ready to enter the protected environment;

Step 63, send the SINIT instruction or DM to the TPM using the TPM_HASH instruction, and the TPM uses the Hash algorithm to check its integrity, and store the check value in the corresponding register of the TPM or CPU, so as to ensure that the previous SINIT or DM is loaded. Integrity, to avoid being attacked by viruses or hacking tools, if the DM is too large, then only load the SINIT instruction;

Step 64, the processor directly loads the SINIT instruction from the hard disk or other storage media, uses the public key of the processor manufacturer to authenticate the SINIT instruction, and starts the SINIT instruction after passing the authentication;

Step 65, the SINIT instruction detects whether the main hardware configuration is correct. At this time, it runs in a special protected area, and simultaneously stores the integrity check value of the authenticated SINIT instruction in the corresponding PCR of the TPM, and clears the memory;

Step 66, load the DM with the SINIT instruction, perform an integrity check on the DM, call the DM after passing, and store the integrity check value of the DM in the corresponding PCR of the TPM;

In step 67, the DM performs initialization, and gives the operation right to the DM, and the DM manages the protected memory partition.

In the above method, the key to the integrity check performed by the TPM is that the TPM has a hash algorithm module inside, and the execution process is completely completed inside the chip, which cannot be detected externally. Therefore, the integrity check of SINIT and DM can only be passed by The Hash command sent by the hardware to the TPM is completed by the TPM.

For the above method, there is a corresponding modification or change scheme:

The integrity checks of SINIT and DM can be performed before the processor is initialized, that is, before the processor is initialized, the integrity checks of SINIT and DM are performed in the TPM at the same time or in sequence, and the integrity check values are stored in the processing In the predetermined register in the device or TPM;

Then, after initializing the processor, execute the SENTER command, use the public key of the processor manufacturer to authenticate the SINIT command, and start the SINIT command after passing the certification;

Next, the SINIT instruction calls the DM, and the DM performs initialization, and hands over the operation right to the DM, and the DM manages the protected memory partition.

In the above method, according to the difference in the value storage area after SINIT and DM verification, and the difference in the area where DM is loaded, it is divided into three different processes, as shown in Fig. 7, Fig. 8 and Fig. 9 respectively.

Wherein, Fig. 7 shows, the check register of SINIT and DM is reserved in CPU or chip set hardware, when needing to SINIT and DM integrity checking, send corresponding TPM Hash command by CPU or chip set, by TPM To check the integrity of SINIT and DM, and store the checked values in the check registers of SINIT and DM, instead of loading SINIT and DM into the memory, the CPU completes the integrity check in the memory.

Figure 8 shows that when the integrity verification of SINIT and DM is required, the corresponding TPM Hash command of the CPU or chipset is sent to the TPM, and the TPM performs the integrity verification of SINIT and DM, and stores the verification value In the corresponding register inside the TPM, then read the pre-saved comparison reference check value to verify its integrity.

Figure 9 shows that in the case of a large DM file, it takes a long time to verify it with the TPM, therefore, the integrity verification of SINIT can be performed first. When checking the integrity of SINIT, the CPU or chipset issues a corresponding TPM Hash command, directly uses the TPM to check the integrity of SINIT, stores the check value in the internal register of the TPM, and then reads the corresponding The checksum verifies its integrity. After verifying the integrity of SINIT, enter the SENTER stage, start SINIT, clear the memory, load DM into the cleared memory, check the integrity of DM, and run it.

In summary, in the method for starting the protected partition of the present invention, SINIT and DM loading and verification are all carried out in a safe storage area, so that it is protected from possible attacks by virus programs, thereby ensuring the process of starting the protected partition security.

It should be noted that the computer system referred to in the present invention refers to such processor-based systems, such as desktop computers, notebook computers, servers, set-top boxes or other similar devices. In a specific embodiment of the present invention, the computer system generally includes a processor supporting LT technology. However, it should be pointed out that the present invention can be applied to other computer systems including processors supporting similar secure computing environments.

Claims (10)

1. method that starts protected partition may further comprise the steps:

Step 100, with in security initialization instruction and the domain manager at least security initialization instruction be loaded into first secure storage section;

The safe entry instruction of processor is prepared and carried out to step 110;

Step 120, load security initialization instruction and described safety is initially talked about instruction carry out completeness check from first secure storage section, pass through back security of operation initialization directive at completeness check, and integrity check value is stored in first or second secure storage section;

Step 130, after from first secure storage section or from the storage medium of storage domain manager, domain manager being loaded into first or second secure storage section, described domain manager is carried out completeness check, and integrity check value is stored in first or second secure storage section;

Step 140 is called domain manager and is carried out initialization, manages shielded subregion.

2. the method for claim 1 is characterized in that, before step 100 security initialization instruction and the domain manager that is stored in the storage medium is carried out completeness check, if pass through completeness check, then execution in step 100, if not by completeness check, then repair automatically.

3. method as claimed in claim 1 or 2 is characterized in that, between step 100 and 110 security initialization instruction at least that is loaded in first secure storage section is carried out completeness check, and integrity check value is stored in first secure storage section.

4. the method for claim 1 is characterized in that, between step 120 and 130 security initialization instruction at least that is loaded in first secure storage section is carried out completeness check, and integrity check value is stored in first secure storage section.

5. the method for claim 1 is characterized in that, first secure storage section is the save memory, and second secure storage section is a platform configuration register predetermined in the trusted platform module.

6. the method for claim 1 is characterized in that, above-mentioned completeness check is the completeness check of authentication code mode or the completeness check that utilizes hash algorithm.

7. method that starts protected partition may further comprise the steps:

Step 200 is carried out initialization to processor, prepares and carry out safe entry instruction;

Step 210, with in security initialization instruction and the domain manager at least security initialization instruction send to first secure storage section, utilize hash algorithm to carry out completeness check, and integrity check value be stored in first or second secure storage section;

Step 220, from storage medium, load security initialization instruction, described security initialization instruction is carried out the completeness check authentication of authentication code mode, by starting security initialization instruction behind the completeness check, and integrity check value is stored in first or second secure storage section;

Step 230 is loaded into first or second secure storage section with domain manager, carries out completeness check, by after call domain manager, and integrity check value is stored in first, second or the 3rd secure storage section;

Step 240 is called domain manager and is carried out initialization, manages shielded memory partitioning.

8. in accordance with the method for claim 7, it is characterized in that described first secure storage section is a trusted platform module.

9. method as claimed in claim 7 is characterized in that, described second secure storage section is the predetermined register of processor.

10. method as claimed in claim 7 is characterized in that, described the 3rd secure storage section is the save memory.

Images