CN101794362A - Trusted computation trust root device for computer and computer - Google Patents

Abstract

An embodiment of the present invention provides a trusted computing root of trust device for a computer and a computer. The device includes: a circuit board, an interface conversion module and at least one root of trust module; the circuit board is provided with an interface, and the interface matches a PCI interface or a PCI-E interface or a USB interface of a computer motherboard; the interface conversion The module and the trust root module are all arranged on the circuit board; the interface conversion module is used to exchange data between each module through the interface of the circuit board and the PCI interface or PCI-E interface or USB interface of the computer; the trust The root module is used for key generation, encryption and decryption processing, and storage of keys and sensitive data, providing integrity measurement, data security protection and identity authentication information. The device can be used in an ordinary computer, so that the ordinary computer has the security of a trusted computer.

Description

Trusted Computing Trust Root Devices and Computers for Computers

technical field

The invention relates to the technical field of computers, in particular to a computer-used trusted computing root-of-trust device and a computer.

Background technique

Traditional security methods are often concentrated on the network border, which is a misunderstanding in people's treatment of information security issues. In fact, the terminal is the source of creating and storing important data, and the vast majority of attacks are initiated from the terminal. The root cause of the security problem is mainly caused by the insecurity of the terminal architecture and operating system. For example, resources may be used arbitrarily, especially the execution code can be modified, malicious programs can be implanted into attack programs, and wanton damage is even more serious. What is serious is that there is no strict access control for legal users, and access beyond authority can be performed, resulting in unsafe accidents. Traditional security methods overemphasize ease of use, while ignoring security. In traditional systems, keys and authorization information are stored directly in memory and hard disks, and attackers have many ways to obtain them. lead to terminal insecurity.

In order to solve how to implement high-level security precautions from the terminal operating platform, the unsafe factors will be controlled from the source of the terminal. Currently, it is realized through trusted computing (Trusted Computing, TC) technology. Trusted computing refers to the computer hardware platform Introduce security chip (TPM, Trusted Platform Module, trusted platform module or TCM, Trusted Cryptography Module, trusted password module) architecture, secret data such as keys and authorization information are protected by security chip (TPM or TCM) . Through the security features it provides to improve the security of the terminal system, it fundamentally realizes the active defense against various unsafe factors. Its core is to establish a trust mechanism between users, computers and network platforms.

Existing computers with trusted computing architecture, because of the need to set up a security chip (TPM or TCM), generally use a motherboard with a special architecture, integrate a security chip (TPM or TCM) on it, or install a security chip (TPM or TCM) by setting a special interface. chip (TPM or TCM), thus forming a computer with trusted computing functions. Ordinary computers do not have a security chip (TPM or TCM) on the motherboard, or do not have an interface for installing a security chip (TPM or TCM), resulting in the inability to implement trusted computing, resulting in the inability of ordinary computers to use trusted computing technology To improve the safety in use.

Contents of the invention

Based on the problems existing in the above-mentioned prior art, an embodiment of the present invention provides a trusted computing root of trust device for computers and a computer to solve the problem that ordinary computers cannot be installed with security chips to implement trusted computing.

The purpose of the present invention is achieved through the following technical solutions:

An embodiment of the present invention provides a trusted computing root of trust device for computers, including:

a circuit board, an interface conversion module, and at least one root of trust module;

Described circuit board is provided with interface, and described interface matches with the PCI interface of computer motherboard or PCI-E interface or USB interface; Described interface conversion module and root of trust module are all arranged on circuit board;

The interface conversion module is used to exchange data between each module through the interface of the circuit board and the PCI interface or PCI-E interface or USB interface of the computer;

The root of trust module is used for key generation, encryption and decryption processing, and storage of keys and sensitive data, providing integrity measurement, data security protection and identity authentication information.

The embodiment of the present invention also provides a computer, including:

A host, a trusted computing root of trust device, a storage device, an input device, and an output device; wherein the trusted computing root of trust device adopts the above-mentioned trusted computing root of trust device;

The storage device, the input device and the output device are all electrically connected to the motherboard in the host; the trusted computing trust root device is connected to the PCI slot or PCI-E slot or USB interface of the motherboard in the host and The main board is electrically connected.

As can be seen from the technical solutions provided by the above-mentioned embodiments of the present invention, in the embodiments of the present invention, an interface conversion module, an identity recognition The module, the main control module and at least one root-of-trust module form a trusted computing root-of-trust device that can be connected to a PCI interface, a PCI-E interface, or a USB interface of a common computer motherboard. Utilizing the root of trust device for trusted computing enables ordinary computers to add trusted computing functions, and enables ordinary computers to have the security of trusted computers in a relatively simple manner.

Description of drawings

FIG. 1 is a structural block diagram of a trusted computing root of trust device provided by Embodiment 1 of the present invention;

FIG. 2 is a structural block diagram of another trusted computing root of trust device provided by Embodiment 1 of the present invention;

FIG. 3 is a structural block diagram of a trusted computing root of trust device provided by Embodiment 2 of the present invention;

FIG. 4 is a structural block diagram of another trusted computing root of trust device provided by Embodiment 2 of the present invention;

FIG. 5 is a schematic structural diagram of a computer provided by Embodiment 3 of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Embodiment one

Embodiment 1 provides a trusted computing root of trust device for computers, which is applied to ordinary computers to enable ordinary computers to have trusted computing functions. As shown in Figure 1, the trusted computing root of trust device includes:

A circuit board 1, an interface conversion module 3 and at least one root of trust module 4;

Wherein, described circuit board 1 is provided with interface 2, and interface 2 can adopt PCI interface or PCI-E interface or USB interface, and it and the PCI interface of computer motherboard or PCI-E interface (namely the PCI slot on the computer motherboard or PCI-E slot) or USB interface; when interface 2 adopts PCI interface or PCI-E interface, it is generally a PCI interface or PCI-E interface formed by the electrical connection between the interface module and the golden finger printed on the circuit board, The gold fingers on the circuit board are physically compatible with the PCI slot or the PCI-E slot, and the interface module is compatible with the PCI slot or the PCI-E slot data exchange protocol of the computer motherboard; interface 2 When a USB interface is used, it is generally a USB interface formed by an electrical connection between an interface module and a USB plug. compatible;

The interface conversion module 3 and the root of trust module 4 in the trusted computing root of trust device are both arranged on the circuit board 1;

The interface conversion module 3 is electrically connected with the interface 2 of the circuit board 1 and each module respectively, and is used for each module (root of trust module 4) through the interface 2 of the circuit board 1 and the PCI interface or PCI-E of the computer. interface or USB interface for data exchange; the interface conversion module 3 can adopt the ASIC chip with PCI interface or PCI-E interface or USB interface function; or adopt CPLD chip or FPGA chip, and use IP core to realize on CPLD chip or FPGA chip PCI interface or PCI-E interface bridge function or USB interface function;

The root of trust module 4 is a chip that can independently perform key generation, encryption and decryption, and has a chip with an independent processor and storage unit inside. TPM chips or TCM chips are generally used. The root of trust module 4 can store keys and sensitive data, providing integrity measurement, data security protection and identity authentication services for the computing platform where it resides. As shown in Figure 2, multiple root-of-trust modules can generally be set up, and each root-of-trust module can be used to provide trusted computing data processing and storage for users with different permissions.

When the interface in the trusted computing root of trust device above adopts a USB interface, it can be made into a built-in device or an external device, and connected to an ordinary computer through the USB interface, so that the ordinary computer has the function of a trusted computer; when the above-mentioned trusted computing When the connection in the root-of-trust device adopts PCI interface or PCI-E interface, the root-of-trust device can be made into a board form, which can be plugged into the PCI slot or PCI-E slot of an ordinary computer motherboard for use, which is convenient to use. The advantages.

When the above trusted computing root of trust device is in use, it can be connected to the PCI slot or PCI-E slot or USB interface of a common computer motherboard; after the computer is powered on, the trusted computing root of trust device starts, and after the computer BIOS starts, it can Normal access to the corresponding root-of-trust module on the trusted computing root-of-trust device, after obtaining the root-of-trust data from the trust board module, start normally, and the subsequent startup process is consistent with the general trusted computer startup mode. In addition, by integrating identification and control software in BIOS or OS Loader, user identification and scheduling of multiple root-of-trust modules can be realized.

The root of trust device provided by the embodiment of the present invention can be easily connected to the common computer mainboard for use without redesigning the computer mainboard due to having an interface matching the PCI slot or the PCIE slot or the USB interface on the common computer mainboard. , as long as the corresponding software for trusted computing is installed and upgraded, the ordinary computer can realize all the functions of a trusted computer. Moreover, when multiple root-of-trust modules (that is, multiple TPM chips or TCM chips are provided) are set on a root-of-trust device for trusted computing, each operating system on a virtual machine system running on a computer can independently use a piece of trust root chip requirements, and improve the security of multiple operating systems on virtual machines.

Embodiment two

The second embodiment provides a trusted computing root of trust device for computers, which is applied to ordinary computers to enable ordinary computers to have trusted computing functions. The structure of this root of trust device is basically the same as that given in the first embodiment above. The same, but the difference is that the root of trust device in this embodiment is also provided with an identity recognition module 5 and a main control module 6, as shown in Figure 3, the identity recognition module 5 and the main control module 6 of the root of trust device are all arranged on the circuit board 1, the identity recognition module 5 and the main control module 6 are electrically connected to the interface conversion module 3 respectively, and the main control module 6 is electrically connected to the identity recognition module 5 and each trust root module respectively;

Described identification module 5 is used for identifying user's identity, and the user information confirmed after identification is transmitted to described main control module 6; This identification module 4 can adopt fingerprint identification module, iris identification module, USB KEY Any one of identification devices such as identification modules and smart card (IC card) identification modules;

The main control module 6 is used to open the corresponding trust root module according to the authority of the confirmed user information of the identity recognition module 5, so as to realize scheduling access to a plurality of trust root modules; the main control module 6 can adopt an ASIC chip ; Or adopt CPLD chip or FPGA chip, and use IP core to realize control function on CPLD chip or FPGA chip.

The root of trust modules in the root of trust device of this embodiment can generally also be provided with multiple, respectively electrically connected to the main control module 6 and the interface conversion module 3, and each root of trust module is used to provide trusted Computational data processing and storage.

The above-mentioned root of trust device can also be provided with a non-volatile storage module 7, which is electrically connected to the main control module 6 and the interface conversion module 3 respectively, and is used to store the root of trust when the root of trust module controlled by the main control module 6 has insufficient storage space. The data encrypted by the module is stored, and the safe reading and writing of the non-volatile memory module 7 is controlled by the main control module 6 . The non-volatile storage module 7 generally adopts a Flash chip, which is a supplement to the limited storage space of the root-of-trust module in the root-of-trust device.

The interface conversion module 3 in the above-mentioned root of trust device can be separately arranged on the circuit board 1, and is electrically connected with the interface 2 and each module; the interface conversion module 3 can also be arranged in the main control module 6 (see FIG. The module 6 realizes the electrical connection with the interface 2 and each module, that is, realizes the functions of two modules (namely, the main control module and the interface conversion module) in one main control module 6 . This interface conversion module 3 mainly provides the connection of the root of trust module 4, the identity recognition module 5 and the interface 2 (i.e. PCI interface or PCI-E interface or USB interface), and each module compatible with other forms of interfaces passes through the interface conversion module 3 Realize compatibility with interface 2 (i.e. PCI interface or PCI-E interface or USB interface). For example, most of the root-of-trust chip TPM or TCM external interfaces are LPC interfaces, which cannot be directly connected to PCI interfaces, PCI-E interfaces or USB interfaces. , and the root of trust chip can be connected to the PCI interface or the PCI-E interface or the USB interface through the interface conversion module 3; the identification module 5 generally provides a serial port or a USB interface, and cannot directly connect with the PCI interface or the PCI-E interface. Interface connection, and the identity identification module can be connected with the PCI interface or the PCI-E interface through the interface conversion module 3. It is also possible to integrate the interface module (see Fig. 4) of interface 2 in the main control module 6 of the integrated interface conversion module 3, such as the interface module that can integrate the main control module, interface conversion module 3 and interface 2 in a CPLD or FPGA, In this way, the functions of the three modules are integrated in one main control module, which improves the degree of integration and facilitates the reduction of the cost of the entire device.

When the interface in the trusted computing root of trust device above adopts a USB interface, it can be made into a built-in device or an external device, and connected to an ordinary computer through the USB interface, so that the ordinary computer has the function of a trusted computer; when the above-mentioned trusted computing When the connection in the root-of-trust device adopts PCI interface or PCI-E interface, the root-of-trust device can be made into a board form, which can be plugged into the PCI slot or PCI-E slot of an ordinary computer motherboard for use, which is convenient to use. The advantages.

When the above Trusted Computing Root of Trust device is used, it can be connected to the PCI slot or PCI-E slot or USB interface of the motherboard of a common computer. After the computer is powered on, the user first needs to identify the identity on the Trusted Computing Root of Trust device. The module performs identity authentication. After the identity authentication is passed, the main control module activates the corresponding root of trust module according to the user's authority, and the computer BIOS starts, and the corresponding root of trust module can be accessed normally. After obtaining the root of trust data from the trust board module, normal Startup, the subsequent startup process is consistent with the general trusted computer startup mode.

The root of trust device provided by the embodiment of the present invention can be easily connected to an ordinary computer motherboard for use without redesigning the computer due to having an interface that matches a PCI slot or a PCI-E slot or a USB interface on an ordinary computer motherboard. The motherboard, as long as the corresponding software for trusted computing is installed and upgraded, the ordinary computer can realize all the functions of a trusted computer. By utilizing the root of trust device, the identification of the user by an ordinary computer is completed in the root of trust device, and the software on the computer cannot directly contact the root of trust device, thereby improving the security of identification. Moreover, when multiple root-of-trust modules are provided on a root-of-trust device (that is, multiple TPM chips or TCM chips are provided), each operating system on a virtual machine system running on a computer can independently use a root-of-trust chip. To improve the security of multiple operating systems on virtual machines.

Embodiment three

Embodiment 3 provides a computer. As shown in FIG. 5, the computer includes:

Host 21, trusted computing root of trust device 25, storage device (not shown in the figure), input device 22 and output device 23; wherein the host 21 is provided with a motherboard 24, and the trusted computing root of trust device 25 adopts the above-mentioned The trusted computing trust root device given in Embodiment 1;

The storage device, the input device 22 and the output device 23 are all electrically connected to the motherboard 24 in the host computer 21; the trusted computing root of trust device 25 is connected to the PCI slot or PCI slot of the motherboard 24 in the host computer 21. The -E slot or the USB interface is electrically connected to the main board 24 .

The hardware structure of this computer is basically the same as that of an ordinary computer, and the difference is that the computer also includes a trusted computing root of trust device, by connecting the trusted computing root of trust device to the PCI slot or PCI-E slot of the motherboard in the host computer or USB interface, so that the computer has the security of a trusted computer with the cooperation of the corresponding software.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (10)

1. A computer trust root device for trusted computing, characterized in that it comprises: a circuit board, an interface conversion module, and at least one root of trust module; Described circuit board is provided with interface, and described interface matches with the PCI interface of computer motherboard or PCI-E interface or USB interface; Described interface conversion module and root of trust module are all arranged on circuit board; The interface conversion module is used to exchange data between each module through the interface of the circuit board and the PCI interface or PCI-E interface or USB interface of the computer; The root of trust module is used for key generation, encryption and decryption processing, and storage of keys and sensitive data, providing integrity measurement, data security protection and identity authentication information. 2. The trusted computing root-of-trust device for computers according to claim 1, wherein there may be multiple root-of-trust modules, which are respectively used to correspondingly process security data of users with different rights. 3. The computer trust root device for trusted computing as claimed in claim 1 or 2, wherein the root of trust device also includes: an identity recognition module and a main control module; both the identity recognition module and the main control module arranged on the circuit board and electrically connected to the interface conversion modules respectively; The identity identification module is used to identify the identity of the user, and transmit the user information confirmed after identification to the main control module; The main control module is used to open a corresponding trust root module according to the authority of the user information confirmed by the identity recognition module. 4. The trusted computing root-of-trust device for computers as claimed in claim 3, wherein the root-of-trust device further comprises: a non-volatile storage module electrically connected to the main control module, for when the When the storage space of the root of trust module controlled by the main control module is insufficient, the encrypted data of the root of trust module is stored. 5. computer as claimed in claim 3 trusts root equipment with trusted computing, is characterized in that, described identification module adopts any one in fingerprint identification module, iris identification module, USB KEY identification module, smart card identification module. 6. computer as claimed in claim 3 trusts root of trust device with trusted computing, it is characterized in that, described main control module adopts ASIC chip; Or described main control module adopts the CPLD chip that realizes control function thereon by IP core or FPGA chips. 7. The trusted computing root of trust device for computers as claimed in claim 1, wherein the interface conversion module is separately arranged on the circuit board, and is electrically connected to the interface of the circuit board and each module; or , the interface conversion module is arranged in the main control module, and is electrically connected with the interface of the circuit board and each module through the main control module. 8. The trusted computing root of trust device for computers as claimed in any one of claims 1, 2 or 7, wherein the interface conversion module adopts an ASIC chip with a PCI interface or a PCI-E interface or a USB interface; or The interface conversion module adopts a CPLD chip or an FPGA chip on which a PCI interface, a PCI-E interface or a USB interface function is realized through an IP core. 9. The trusted computing root-of-trust device for computers according to claim 1, wherein the root-of-trust module adopts a TPM chip or a TCM chip. 10. A computer, characterized in that, comprising: A host, a trusted computing root of trust device, a storage device, an input device, and an output device; wherein the trusted computing root of trust device adopts the trusted computing root of trust device described in any one of claims 1 to 9; The storage device, the input device and the output device are all electrically connected to the motherboard in the host; the trusted computing trust root device is connected to the PCI slot or PCI-E slot or USB interface of the motherboard in the host and The main board is electrically connected.

Images