CN121659330A - Safe starting hardware trust root module integrated on main board and verification method - Google Patents
Safe starting hardware trust root module integrated on main board and verification methodInfo
- Publication number
- CN121659330A CN121659330A CN202610172331.6A CN202610172331A CN121659330A CN 121659330 A CN121659330 A CN 121659330A CN 202610172331 A CN202610172331 A CN 202610172331A CN 121659330 A CN121659330 A CN 121659330A
- Authority
- CN
- China
- Prior art keywords
- root module
- hardware trust
- trust root
- hardware
- password
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Storage Device Security (AREA)
Abstract
The invention relates to the technical field of computer hardware security, in particular to a security starting hardware trust root module integrated on a main board and a verification method. And after passing the verification, generating a secure start token containing the temporary session key, and transmitting the secure start token to the next-level component. The next-stage component needs to send a credential confirmation request, after being verified again by the hardware module, the control right of the system is released, and then the hardware module enters a silence monitoring state. The method ensures the authenticity of the measurement source data from the physical layer, realizes the dynamic transmission and continuous maintenance of trust through a bidirectional confirmation mechanism, and effectively improves the capability of the bottom layer of the system for defending against firmware tampering and persistent attack.
Description
Technical Field
The invention relates to the technical field of computer hardware security, in particular to a security starting hardware trust root module integrated on a main board and a verification method.
Background
The secure boot mechanism of current computing platforms mostly adopts firmware-based schemes. Such schemes typically store the authentication code in a rewritable memory that is executed by a central processor. The process is chain verification, namely the code of the current stage is responsible for reading and checking the hash value of the code of the next stage, and whether the code is released or not is determined by comparing the hash value with a preset reference. The execution of the entire authentication process depends on the processor and system bus environment.
Such conventional architectures have limitations. The execution body and the data path of the metrics are established in the running environment to be verified. Once the initial boot code is corrupted, the entire verification process may be bypassed or falsified. In addition, the transmission of the trust chain is unidirectional and broken, the verification is handed over after passing the control right, the bottom hardware trust root does not participate in the subsequent state confirmation any more, and whether the runtime code is replaced maliciously cannot be perceived.
There is a need for a hardware-level secure boot method that ensures that the source of the measured data is authentic and that enables continued trust verification. The method requires that the hardware trust root can actively and separately acquire the original firmware data and maintain a verifiable session state in the later starting period, so that a more stable trust root is established against the threat of the tampered bottom firmware.
Disclosure of Invention
The invention aims to solve the defects in the prior art, and provides a secure boot hardware trust root module integrated on a main board and a verification method.
In order to achieve the above purpose, the invention adopts the following technical scheme that the safe starting verification method integrated on the main board comprises the following steps:
After the main board is electrified, the hardware trust root module extracts and executes initialization firmware from the read-only memory, and an execution environment of trusted measurement is established;
The hardware trust root module reads a reference password abstract value set stored in an internal nonvolatile memory of the hardware trust root module;
the hardware trust root module actively acquires original binary data of a firmware image to be verified through a private bus on a main board, and in a security isolation area inside the hardware trust root module, performs password hash operation on the original binary data to generate a password abstract value to be verified;
Matching the password abstract value to be verified with a corresponding reference value in the reference password abstract value set, if matching is successful, generating a verification passing signal by the hardware trust root module, and packaging the verification passing signal and a temporary session key into a safe starting token;
The hardware trust root module transmits the secure start token to the next-stage firmware or an operating system loader on the main board through a secure channel;
The next level firmware or the operating system loader sends a certificate confirmation request containing self summary information to the hardware trust root module;
and after verifying the abstract information in the certificate confirmation request, the hardware trust root module releases the control right of the system and enters a silent monitoring state.
As a further aspect of the present invention, the hardware trust root module reads a reference cryptographic digest value set stored in an internal nonvolatile memory thereof, including:
the hardware trust root module accesses an encrypted storage area in an internal nonvolatile memory;
Using a hardware decryption engine built in the hardware trust root module to decrypt the content of the encrypted storage area according to a preset decryption flow to obtain an encrypted abstract data block;
Carrying out integrity check on the encrypted summary data block obtained by decryption, wherein the integrity check comprises cyclic redundancy check and structural validity check;
after verification is passed, analyzing the structure of the encrypted abstract data block, and extracting a plurality of reference password abstract values respectively corresponding to different firmware components;
And loading the extracted multiple reference password digest values into a secure random access memory in the hardware trust root module to form the reference password digest value set for quick comparison.
As a further solution of the present invention, the hardware trust root module actively obtains, through a private bus on a motherboard, original binary data of a firmware image to be verified, including:
The hardware trust root module initiates a read operation instruction with a time sequence requirement to a flash memory chip storing the firmware image to be verified through the private bus;
receiving an original data stream returned by the flash memory chip, and reorganizing the original data stream according to an organization format of an internal buffer area of the hardware trust root module;
while receiving data, a stream checker built in the hardware trust root module executes real-time integrity check on the original data stream, wherein the real-time integrity check is used for detecting bit errors in a physical transmission process;
And sequentially storing the data blocks which are subjected to recombination and pass through real-time integrity check into a safety buffer zone appointed in the hardware trust root module to form the complete original binary data of the firmware image to be verified.
As a further aspect of the present invention, in a secure isolation area inside the hardware trust root module, performing a cryptographic hash operation on the original binary data, to generate a cryptographic digest value to be verified, including:
the hardware trust root module sets a password operation area which is physically isolated in the hardware trust root module into an active state, and the password operation area and other parts of the hardware trust root module have electrical isolation characteristics;
introducing the original binary data stored in the secure buffer into the cryptographic operation area in batches in units of data blocks;
In the password operation area, a special password hash circuit performs iterative computation on each imported data block according to a preset hash algorithm, and an internal state register is updated;
after all the original binary data are subjected to iterative computation, a final operation result is read from a state register of the password operation area;
And carrying out format standardization processing on the final operation result to ensure that the length and the format of the final operation result are consistent with the standard value in the standard password digest value set, thereby generating the password digest value to be verified.
As a further aspect of the present invention, matching the password digest value to be verified with a reference value corresponding to the reference password digest value set includes:
Searching a target reference password digest value with the same identity identifier from the reference password digest value set according to the identity identifier of the firmware image to be verified;
Inputting the password digest value to be verified and the searched target reference password digest value into a comparison circuit;
The comparison circuit compares whether each binary bit of the password digest value to be verified and the target reference password digest value is equal bit by bit;
Counting the total number of equal bits, and calculating the phase similarity percentage between the password digest value to be verified and the target reference password digest value;
And judging whether the phase position percentage reaches a preset hundred percent matching threshold value or not, and outputting a Boolean type matching result signal.
As a further aspect of the present invention, if the matching is successful, the hardware trust root module generates a verification passing signal, and encapsulates the verification passing signal and a temporary session key into a secure boot token, including:
when the matching result signal of successful matching is received, a true random number generator of the hardware trust root module is triggered to generate a random number sequence with a specified length;
Inputting the random number sequence into a key derivation function processing unit to generate the temporary session key which is used once;
combining the verification passing signal representing the verification passing, the temporary session key and the timestamp information of the current system into a structured data packet;
performing digital signature operation on the structured data packet by using a private key of the hardware trust root module to generate signature data;
And encapsulating the structured data packet and the corresponding signature data together to generate the secure start token with tamper-proof and identity authentication properties.
As a further aspect of the present invention, the hardware trust root module transmits the secure boot token to a next level firmware or an operating system loader on a motherboard through a secure channel, including:
The hardware trust root module detects and establishes a physical communication path with the next-level firmware or an operating system loader;
Activating a link encryption protocol based on a symmetric encryption algorithm on the physical communication path, and upgrading the physical communication path to the secure channel;
The communication controller of the hardware trust root module splits the security start token into a plurality of data frames meeting the transmission format requirement according to a preset framing protocol;
Adding a serial number and an error correction code to each data frame, and sequentially transmitting the serial number and the error correction code to the next-stage firmware or an operating system loader through the secure channel;
After the sending is completed, the hardware trust root module waits for and receives a receipt confirmation receipt of the secure boot token from the next level firmware or an operating system loader.
As a further aspect of the present invention, the sending, by the next level firmware or the operating system loader, a credential confirmation request including self digest information to the hardware trust root module includes:
After the next-stage firmware or the operating system loader obtains the control right, calculating the password abstract of the own code segment to generate the own abstract information;
The next-level firmware or an operating system loader extracts the temporary session key from the received secure boot token;
encrypting the request data containing the self summary information by using the temporary session key to form an encrypted request packet;
And the next-stage firmware or the operating system loader sends the encryption request packet and a synchronous challenge random number to the hardware trust root module to form the complete credential confirmation request.
As a further aspect of the present invention, after verifying the summary information in the credential validation request, the hardware trust root module releases the system control right and enters a silent monitoring state, including:
The hardware trust root module decrypts the received encryption request packet by using the stored temporary session key, and restores the self abstract information sent by the next-stage firmware or an operating system loader;
the hardware trust root module reads pre-stored expected abstract information corresponding to legal next-level firmware or an operating system loader from an internal nonvolatile memory;
comparing the decrypted and restored self abstract information with the expected abstract information;
if the comparison is consistent, the hardware trust root module generates a final authorization signal, and disconnects the active drive of the hardware trust root module to the main board key control bus to finish the operation of releasing the system control right;
And then, the hardware trust root module is switched to monitor the silence monitoring state without active intervention, and continuously monitors key events in the subsequent starting process.
As a further scheme of the invention, the invention also comprises a secure boot hardware trust root module integrated on the main board, which is constructed by the secure boot verification method integrated on the main board.
Compared with the prior art, the invention has the advantages and positive effects that:
The hardware trust root module directly accesses the memory chip and acquires the original binary data of the firmware to be verified through a physically independent private bus channel. This is done in a secure isolation area inside the hardware module, completely independent of the host processor and the system bus. This eliminates the risk of failure of the metrology process due to the possible corruption of the host processor execution environment, isolates potential system level software attacks from physical and data source heads, and ensures the purity of the measured firmware image.
After the verification is passed, the hardware trust root module generates a secure boot token encapsulating the temporary session key and passes it to the next level component. The component must proactively send a credential validation request containing its cryptographic digest to the hardware trust root. After the hardware module verifies the request again, the system control right can be released and the system can be turned into the silent monitoring state. The bidirectional interaction mechanism converts a unidirectional verification event into a session establishment procedure requiring a response from the other party. The method completes the final rechecking of the identity of the starting component before the control right is handed over, and enables the hardware trust root to have the potential capability of continuously monitoring and responding to the key security event during the system operation through the established session basis, thereby realizing the extension of trust verification from static starting to dynamic operation.
Drawings
FIG. 1 is a flow chart of a security start verification method integrated on a motherboard according to the present invention;
FIG. 2 is a flow chart of a cryptographic hash operation.
Detailed Description
The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.
In the description of the present invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," and the like indicate orientations or positional relationships based on the orientation or positional relationships shown in the drawings, merely to facilitate describing the present invention and simplify the description, and do not indicate or imply that the devices or elements referred to must have a specific orientation, be configured and operated in a specific orientation, and therefore should not be construed as limiting the present invention. Furthermore, in the description of the present invention, the meaning of "a plurality" is two or more, unless explicitly defined otherwise.
Referring to fig. 1, after the motherboard is powered up, the hardware trust root module extracts and executes the initialization firmware from the rom, and the process establishes an execution environment for trusted metrics. The hardware trust root module reads the reference cryptographic digest value set stored in its internal non-volatile memory. The hardware trust root module actively acquires the original binary data of the firmware image to be verified through a private bus on the main board, and then in a security isolation area inside the hardware trust root module, the hardware trust root module executes password hash operation on the original binary data to generate a password abstract value to be verified. Matching the password abstract value to be verified with a corresponding reference value in the reference password abstract value set, if matching is successful, generating a verification passing signal by the hardware trust root module, and packaging the verification passing signal and a temporary session key into a security start token. The hardware trust root module transmits the secure start token to the next level firmware or the operating system loader on the main board through a secure channel. The next level firmware or operating system loader sends a credential validation request containing self summary information to the hardware trust root module. And after verifying the abstract information in the certificate confirmation request, the hardware trust root module releases the control right of the system and enters a silent monitoring state.
In one embodiment of the invention, the hardware root of trust module initiates a read flow of the reference cryptographic digest value set. The microcode instruction pointer of the hardware trust root module points to a routine that accesses an encrypted memory area in the internal non-volatile memory, the encrypted memory area having an independent physical address space and access control lock. In some embodiments, a hardware decryption engine built in the hardware trust root module is configured to operate according to a predetermined decryption flow, wherein the predetermined decryption flow includes reading header metadata of the encrypted storage area to obtain an encryption algorithm identifier and an initial vector, the hardware decryption engine loads corresponding hardwired decryption logic according to the encryption algorithm identifier, uses key material derived from the one-time programmable fuse of the hardware trust root module to decrypt ciphertext content of the encrypted storage area in combination with the initial vector, and the decryption operation outputs an encrypted summary data block. It will be appreciated that this encrypted summary data block is the original data set that is packaged in an encrypted format.
The hardware trust root module then performs an integrity check on the encrypted digest data block obtained by the decryption. The cyclic redundancy check stage calculates the cyclic redundancy check code of the encrypted abstract data block, and compares the calculation result with the cyclic redundancy check code reference value stored in the fixed position of the encrypted abstract data block. In a specific implementation, the structure validity checking stage analyzes the internal structure of the encrypted summary data block, and verifies whether the encrypted summary data block accords with a predefined template, wherein the predefined template comprises a magic mark, a version field, an item number field, and an arrangement rule and a value range of each item length field, and a functional relationship for verifying the data integrity can be expressed as follows:
wherein: representing the encrypted summary data block obtained after decryption, Function representing predefined structure verification rules solidified in read-only memory of hardware trust root moduleExecution pairIs a function of the parsing operation of (1)According to rulesJudging whether the analyzed structure is legal or not, and performing a functionAnd outputting a Boolean value result. In some embodiments, if the cyclic redundancy check code is inconsistent in comparison or the structural validity check functionAnd returning a negative result, triggering a security exception by the hardware trust root module and stopping the starting flow.
After the integrity check is passed, the hardware trust root module executes the analysis operation of the encrypted abstract data block. The parsing operation sequentially reads each entry in the encrypted digest data block according to the verified structure information, each entry containing an identifier of the firmware component and a reference cryptographic digest value associated therewith. The extraction process is completed through a data handling direct memory access unit of the hardware trust root module, and the reference password abstract value data of each entry is moved to a target position from a non-volatile memory buffer zone. Alternatively, the reference cryptographic digest value may be 256 bits or 512 bits in length, with the specific length indicated by the encrypted digest data block header information. The hardware trust root module finally loads the extracted multiple reference password abstract values into a safe random access memory in the hardware trust root module, the safe random access memory is provided with a physical protection layer for preventing a hardware probe from scanning, and the loaded multiple reference password abstract values are arranged in the safe random access memory according to an identity identifier index to form a reference password abstract value set which can be used for rapid comparison.
In one embodiment of the present invention, referring to fig. 2, the hardware trust root module initiates a process of actively obtaining original binary data of a firmware image to be verified through a private bus, and the hardware trust root module initiates a read operation instruction to a flash memory chip storing the firmware image to be verified through the private bus, where the read operation instruction includes an explicit memory start address, a data length, and an accurate timing requirement controlled by a clock source of the hardware trust root module. In some embodiments, the private bus adopts a serial peripheral interface or a double data rate bus protocol, the hardware trust root module is used as a master device to control the initiation and clock signals of the transaction, the original data stream returned by the flash memory chip is received, and the original data stream arrives at a receiving buffer zone of the hardware trust root module in the form of data packets or burst transmission. The data reorganization engine in the hardware trust root module reorganizes the original data stream according to the organization format of the buffer zone in the hardware trust root module, the organization format of the buffer zone defines the bit width, byte order and address mapping relation of the data word, and the reorganization operation comprises removing the communication protocol packet header, correcting byte alignment and writing the data into the continuous memory space in sequence.
While receiving the original data stream, the built-in stream checker of the hardware trust root module is activated to perform real-time integrity check, the stream checker is a hardware circuit working in parallel, which samples and calculates the data in each bit transmission, and is used for detecting bit errors occurring due to signal interference or time sequence offset in the physical transmission process. It will be appreciated that the calculation of the real-time integrity check can be accomplished in synchronization with the data reception without causing additional delay, and that the instantaneous check code output by the stream verifier is compared with the expected value pre-stored in the command sequence, and that a functional relationship describing this check process can be expressed as:
wherein: Representing the sequentially received first Data blocks of original data stream, functionRepresenting a streaming verifier pair slaveTo the current blockAll data accumulated and calculated real-time check codeSymbol, symbolRepresenting a bitwise exclusive or operation,Representing a pre-stored expected check code for the data segment of the transmission, indicating that a bit error exists if the exclusive or result is non-zero. The hardware trust root module sequentially stores the data blocks which are recombined and pass through the real-time integrity check into a safety buffer zone appointed in the hardware trust root module, the safety buffer zone is provided with a memory protection mechanism for preventing unauthorized access, and all the data blocks are sequentially stored to form the original binary data of the complete firmware image to be verified.
After original binary data is ready, cryptographic hash operation is started in a security isolation area inside a hardware trust root module, the hardware trust root module sets a cryptographic operation area physically isolated inside the hardware trust root module into an active state, and the operation of setting into the active state comprises power supply to the cryptographic operation area, release of a reset signal and loading of a fixed microcode program. In some embodiments, the cryptographic operation region has electrical isolation characteristics from other parts of the hardware root of trust module, such electrical isolation being achieved by separate power rails, clock domains, and physical isolation trenches. The original binary data stored in the secure buffer is imported into the cryptographic operation area in batches by taking the data block as a unit, the data handling work is executed by a direct memory access controller of the hardware trust root module, and the direct memory access controller operates according to a preset transmission descriptor. In the cryptographic operation area, a dedicated cryptographic hash circuit performs iterative computation on each imported data block according to a predetermined hash algorithm, which may be a SHA-256 or SHA-512 algorithm, the dedicated cryptographic hash circuit comprising a set of fixed logic units for performing algorithm round operations and a state register for storing intermediate states, the value of the state register being updated once every data block is processed.
After all the original binary data are subjected to iterative computation, the hardware trust root module reads a final operation result from a state register of a password operation area, and the state register stores output after the hash algorithm finishes processing all the data blocks. It will be appreciated that the length of the final result is determined by the selected hashing algorithm, e.g. SHA-256 algorithm, producing a 256 bit output. The hardware trust root module then performs a format normalization process on the final operation result, where the format normalization process includes possible byte order conversion, bit stuffing or truncation operations, in order to keep the length and format of the finally generated password digest value to be verified consistent with the reference value in the reference password digest value set. Optionally, if the reference value in the reference cryptographic digest value set is stored in a large endian mode and the dedicated cryptographic hash circuit outputs a small endian result, the format normalization process includes a byte order inversion operation.
In one embodiment of the invention, the matching pairing process is initiated according to the identity identifier of the firmware image to be verified, and the hardware trust root module uses the identity identifier of the firmware image to be verified as a search key to search in the reference password digest value set. In some embodiments, the set of reference cryptographic digest values are organized in a secure random access memory in the form of a hash table or an ordered list, the lookup operation is performed by a dedicated coprocessor of the hardware root of trust module, which compares the identity identifier of the firmware image to be verified with the identity identifier field of each entry in the list, and when a completely consistent field is found, the lookup operation stops and returns the reference cryptographic digest value of the corresponding entry as the target reference cryptographic digest value. The hardware trust root module loads the password digest value to be verified and the found target reference password digest value into an input register of a comparison circuit in parallel, and the comparison circuit consists of a group of parallel exclusive-OR gates and accumulators.
The comparison circuit compares whether each binary bit of the password digest value to be verified and the target reference password digest value is equal bit by bit, and the comparison of each binary bit is realized through an exclusive-or NOT gate which outputs a logic high level at the same time of two input bits. The accumulator of the comparison circuit sums the output results of all the exclusive nor gates, counts the total number of equal bits, and the bit width of the accumulator is enough to accommodate the total number of bits of the cipher digest. The calculation unit built in the comparison circuit calculates the phase degree percentage between the password digest value to be verified and the target reference password digest value according to the total number of the equal bits and the total number of bits of the password digest, and a mathematical expression for describing the calculation process can be expressed as follows:
wherein: Representing the first cryptographic digest value to be verified The number of binary bits is one,Represents the first thing of the target reference password digest valueBinary bits, symbolsRepresenting an exclusive nor operation (i.e. outputting a1 when equal),Representing the total number of bits of the code abstract, functionThe output of (a) is the total number of phase equality, and the phase similarity percentage is represented byAnd obtaining the product. The hundred percent matching threshold value preset in the comparison circuit is a fixed value, the judgment logic compares the calculated phase similarity percentage with the threshold value, if the calculated phase similarity percentage is equal to one hundred percent, a matching result signal of a logic high level is output, and if the calculated phase similarity percentage is equal to one hundred percent, a logic low level is output.
When the arbitration logic of the hardware trust root module receives a successfully matched matching result signal, a true random number generator of the hardware trust root module is triggered, and the true random number generator works based on physical entropy sources such as ring oscillator sampling or quantum noise and the like to generate an original random number sequence with a specified length. In some embodiments, the specified length may be 256 bits or 128 bits, and the original random number sequence is fed into a key derivation function processing unit of the hardware root of trust module, which executes a standard algorithm such as a hash-based message authentication code or key derivation function, generating a one-time-use temporary session key. It will be appreciated that the generation of the temporary session key is tied to the current initiated session.
The encapsulation unit of the hardware root of trust module combines the verification passing signal representing the verification passing, the temporary session key and the timestamp information of the current system obtained from the secure clock of the hardware root of trust module into a structured data packet, the verification passing signal being a fixed byte sequence with a specific code. Optionally, the structured data packet may include a version field, a signal field, a key field, and a timestamp field, each arranged according to a predefined offset. The hardware trust root module uses an asymmetric cipher private key protected inside to carry out digital signature operation on the structured data packet, and the digital signature operation uses an elliptic curve digital signature algorithm or an RSA probability signature scheme to generate signature data through operation. The final encapsulation operation of the hardware trust root module packages the structured data packet and the corresponding signature data together, and attaches a header containing the length and the type to generate a secure boot token with tamper-proof and identity authentication properties.
In one embodiment of the invention, the hardware trust root module performs the operation of passing the secure boot token to the next level firmware or operating system loader, and the link management unit of the hardware trust root module detects a physical communication path with the next level firmware or operating system loader, which may be a serial bus or parallel bus interface on the motherboard. In some embodiments, the detection mechanism includes sending a hardware level handshake signal and monitoring a response signal from a next level firmware or operating system loader preset pin, when the response signal meets an expected level timing, the hardware trust root module acknowledges that the physical communication path has been established. On the physical communication path, the hardware trust root module activates a link encryption protocol based on a symmetric encryption algorithm, the activation process of the link encryption protocol involves a short key negotiation stage, and the hardware trust root module uses a pre-shared seed key or an asymmetric encryption algorithm to temporarily negotiate a symmetric session encryption key, so that the original physical communication path is upgraded into a secure channel with confidentiality and integrity. An expression describing this key derivation initiation phase can be written as:
wherein: representing a symmetric session encryption key for link encryption, Representing a standard key derivation function,Representing a pre-programmed shared secret between the hardware root of trust module and the next level component,AndRepresenting the random numbers generated by the hardware trust root module and the next-level component in the negotiation process respectively.
After the secure channel is established, the communication controller of the hardware trust root module processes the secure start token according to a preset framing protocol, and the preset framing protocol defines the maximum transmission unit size and the frame start and end marks. The communication controller splits the secure launch token into a plurality of data frames conforming to the transport format requirements, each data frame comprising a payload portion and a protocol overhead portion. A sequence number is added to each data frame to identify the transmission order of the frame, and an error correction code, such as a reed-solomon code, is used in forward error correction coding to detect and correct a limited number of bit errors during transmission. The hardware trust root module sequentially sends all data frames to the next-stage firmware or the operating system loader through a secure channel, and the secure channel encrypts the complete content (comprising a serial number and an error correction code) of each data frame by applying a symmetric encryption algorithm on a physical layer. After the transmission is completed, the hardware trust root module starts a timer and waits for a receipt acknowledgement of the secure boot token from the next level firmware or operating system loader, which must contain acknowledgement information related to the last transmitted frame sequence number.
After the next level firmware or the operating system loader obtains the control right and completely receives the security start token, the generation process of the credential confirmation request is started. The next level firmware or operating system loader first calculates the cryptographic digest of its own code segment, and the calculation process traverses its read-only code region stored in flash memory, generating its own digest information using a hash algorithm negotiated or predefined with the hardware trust root module. The next level firmware or operating system loader extracts the temporary session key from the received secure boot token, the extraction operation including parsing the structured data packet of the secure boot token and locating the key field. The request data containing the self digest information is encrypted using a temporary session key, and the encryption operation uses a symmetric encryption algorithm such as the AES-GCM mode which provides both encryption and authentication functions, and the encryption results in an encrypted request packet. It will be appreciated that the next level firmware or operating system loader will also generate a synchronization challenge random number that is used to prevent replay attacks and ensure freshness of the response. And finally, the next-stage firmware or the operating system loader packages the encryption request packet and the synchronous challenge random number together, and sends the encryption request packet and the synchronous challenge random number to the hardware trust root module through the same physical communication path to form a complete credential confirmation request. Referring to table 1, the request packet and the synchronization challenge random number are encrypted in the transmission format.
TABLE 1 credential validation request packet Format Table
| Field offset (byte) | Field length (bytes) | Field name | Description of the invention |
| 0 | 2 | Packet type identification | A fixed value identifying this as a credential validation request |
| 2 | 2 | Encryption request packet length | Indicating the number of bytes of the field of the subsequent encryption request packet |
| 4 | N | Encryption request packet | Data including self digest information encrypted with temporary session key |
| 4+N | 16 | Synchronous challenge random number | Cryptographic random number generated by next level component |
In one embodiment of the invention, the hardware trust root module receives and processes credential validation requests from the next level firmware or operating system loader and decrypts received encrypted request packets using the stored temporary session key. The decryption operation is performed by a symmetric cipher decryption engine within the hardware trust root module that identifies the encryption algorithm mode used to encrypt the request packet, such as the AES-GCM mode, which requires the provision of a temporary session key, initialization vector, and authentication ticket. In a specific implementation, the initialization vector and the authentication tag may be obtained from an auxiliary data field of the encrypted request packet, and the decrypted engine outputs restored plaintext data after operation, where the plaintext data includes self-digest information and other possible metadata fields sent by the next-level firmware or the os loader.
The hardware trust root module reads pre-stored expected digest information corresponding to legal next level firmware or an operating system loader from the internal non-volatile memory, the expected digest information being stored in a specific area of the hardware trust root module non-volatile memory, the area being written and locked during the hardware trust root module production phase. In some embodiments, the process of reading the expected digest information is accompanied by an integrity check, which is accomplished by calculating the cyclic redundancy check code of the expected digest information storage area and comparing it to a cured value. It can be appreciated that the decrypted and restored self digest information is fed into the comparison logic of the hardware root of trust module for comparison with the expected digest information read from the non-volatile memory, and the comparison logic performs a bit-by-bit comparison. A functional expression describing the result of the alignment verification may be defined as:
wherein: Representing the decrypted and restored self-digest information, Representing expected digest information read from non-volatile memory, symbolsRepresenting a bitwise exclusive or operation, the function being such that when the result is a zero vectorReturning a logic true value to indicate that the comparison is consistent.
If the comparison is consistent, the state machine of the hardware trust root module generates a final authorization signal, wherein the final authorization signal is an electronic signal with a specific voltage level or specific code. In some embodiments, the hardware root of trust module performs an operation of releasing system control while generating the final grant signal, the operation of releasing system control being embodied in that the hardware root of trust module disconnects its own active drive to the motherboard critical control bus. The main board key control bus comprises a system management bus, a platform environment control interface bus or a reset control signal line, the action of disconnecting the active drive is executed by an output driver module of the hardware trust root module, and the driver module switches relevant pins of the driver module from an output mode to a high-resistance state. Optionally, the hardware trust root module may send a clock synchronization pulse with a preset sequence before switching the pin state, and notify other devices on the bus that the control right is about to be handed over.
The master logic of the hardware trust root module switches to a silence monitoring state that only listens for no active intervention, the switching to the silence monitoring state involves turning off unnecessary functional circuitry of the hardware trust root module to reduce power consumption while enabling a set of event monitors. In an implementation, the event monitor continuously monitors key events in a subsequent boot flow, the key events including write attempts to a specific memory address range, illegal access requests to a hardware trust root module's own registers, or trigger signals of a system management interrupt. The hardware trust root module does not actively initiate any bus transactions in the silence monitoring state, but retains the ability to respond to preset security violation events and re-take some control.
The present invention is not limited to the above embodiments, and any equivalent embodiments which can be changed or modified by the technical disclosure described above can be applied to other fields, but any simple modification, equivalent changes and modification made to the above embodiments according to the technical matter of the present invention will still fall within the scope of the technical disclosure.
Claims (10)
1. The method for verifying the safe start integrated on the main board is characterized by comprising the following steps:
After the main board is electrified, the hardware trust root module extracts and executes initialization firmware from the read-only memory, and an execution environment of trusted measurement is established;
The hardware trust root module reads a reference password abstract value set stored in an internal nonvolatile memory of the hardware trust root module;
the hardware trust root module actively acquires original binary data of a firmware image to be verified through a private bus on a main board, and in a security isolation area inside the hardware trust root module, performs password hash operation on the original binary data to generate a password abstract value to be verified;
Matching the password abstract value to be verified with a corresponding reference value in the reference password abstract value set, if matching is successful, generating a verification passing signal by the hardware trust root module, and packaging the verification passing signal and a temporary session key into a safe starting token;
The hardware trust root module transmits the secure start token to the next-stage firmware or an operating system loader on the main board through a secure channel;
The next level firmware or the operating system loader sends a certificate confirmation request containing self summary information to the hardware trust root module;
and after verifying the abstract information in the certificate confirmation request, the hardware trust root module releases the control right of the system and enters a silent monitoring state.
2. The method for secure boot verification integrated on a motherboard according to claim 1, wherein the hardware trust root module reads a reference cryptographic digest value set stored in its internal nonvolatile memory, comprising:
the hardware trust root module accesses an encrypted storage area in an internal nonvolatile memory;
Using a hardware decryption engine built in the hardware trust root module to decrypt the content of the encrypted storage area according to a preset decryption flow to obtain an encrypted abstract data block;
Carrying out integrity check on the encrypted summary data block obtained by decryption, wherein the integrity check comprises cyclic redundancy check and structural validity check;
after verification is passed, analyzing the structure of the encrypted abstract data block, and extracting a plurality of reference password abstract values respectively corresponding to different firmware components;
And loading the extracted multiple reference password digest values into a secure random access memory in the hardware trust root module to form the reference password digest value set for quick comparison.
3. The method for securely starting verification integrated on a motherboard according to claim 1, wherein the hardware trust root module actively obtains original binary data of a firmware image to be verified through a private bus on the motherboard, comprising:
The hardware trust root module initiates a read operation instruction with a time sequence requirement to a flash memory chip storing the firmware image to be verified through the private bus;
receiving an original data stream returned by the flash memory chip, and reorganizing the original data stream according to an organization format of an internal buffer area of the hardware trust root module;
while receiving data, a stream checker built in the hardware trust root module executes real-time integrity check on the original data stream, wherein the real-time integrity check is used for detecting bit errors in a physical transmission process;
And sequentially storing the data blocks which are subjected to recombination and pass through real-time integrity check into a safety buffer zone appointed in the hardware trust root module to form the complete original binary data of the firmware image to be verified.
4. The method for securely starting up and verifying integrated on a motherboard according to claim 1, wherein performing a cryptographic hash operation on the original binary data in a secure isolation area inside the hardware root of trust module, generating a cryptographic digest value to be verified, comprises:
the hardware trust root module sets a password operation area which is physically isolated in the hardware trust root module into an active state, and the password operation area and other parts of the hardware trust root module have electrical isolation characteristics;
introducing the original binary data stored in the secure buffer into the cryptographic operation area in batches in units of data blocks;
In the password operation area, a special password hash circuit performs iterative computation on each imported data block according to a preset hash algorithm, and an internal state register is updated;
after all the original binary data are subjected to iterative computation, a final operation result is read from a state register of the password operation area;
And carrying out format standardization processing on the final operation result to ensure that the length and the format of the final operation result are consistent with the standard value in the standard password digest value set, thereby generating the password digest value to be verified.
5. The method for securely starting and verifying integrated on a motherboard according to claim 1, wherein matching the password digest value to be verified with a corresponding reference value in the reference password digest value set comprises:
Searching a target reference password digest value with the same identity identifier from the reference password digest value set according to the identity identifier of the firmware image to be verified;
Inputting the password digest value to be verified and the searched target reference password digest value into a comparison circuit;
The comparison circuit compares whether each binary bit of the password digest value to be verified and the target reference password digest value is equal bit by bit;
Counting the total number of equal bits, and calculating the phase similarity percentage between the password digest value to be verified and the target reference password digest value;
And judging whether the phase position percentage reaches a preset hundred percent matching threshold value or not, and outputting a Boolean type matching result signal.
6. The method for securely enabling verification integrated on a motherboard according to claim 5 wherein if the matching is successful, the hardware root of trust module generates a verification passing signal and encapsulates the verification passing signal with a temporary session key into a secure enabling token, comprising:
when the matching result signal of successful matching is received, a true random number generator of the hardware trust root module is triggered to generate a random number sequence with a specified length;
Inputting the random number sequence into a key derivation function processing unit to generate the temporary session key which is used once;
combining the verification passing signal representing the verification passing, the temporary session key and the timestamp information of the current system into a structured data packet;
performing digital signature operation on the structured data packet by using a private key of the hardware trust root module to generate signature data;
And encapsulating the structured data packet and the corresponding signature data together to generate the secure start token with tamper-proof and identity authentication properties.
7. The method for verifying secure boot integrated on a motherboard according to claim 1, wherein the hardware trust root module passes the secure boot token to a next level firmware or an operating system loader on the motherboard via a secure channel, comprising:
The hardware trust root module detects and establishes a physical communication path with the next-level firmware or an operating system loader;
Activating a link encryption protocol based on a symmetric encryption algorithm on the physical communication path, and upgrading the physical communication path to the secure channel;
The communication controller of the hardware trust root module splits the security start token into a plurality of data frames meeting the transmission format requirement according to a preset framing protocol;
Adding a serial number and an error correction code to each data frame, and sequentially transmitting the serial number and the error correction code to the next-stage firmware or an operating system loader through the secure channel;
After the sending is completed, the hardware trust root module waits for and receives a receipt confirmation receipt of the secure boot token from the next level firmware or an operating system loader.
8. The method for secure boot verification integrated on a motherboard according to claim 1, wherein the sending, by the next level firmware or an operating system loader, a credential validation request including self digest information to the hardware root of trust module comprises:
After the next-stage firmware or the operating system loader obtains the control right, calculating the password abstract of the own code segment to generate the own abstract information;
The next-level firmware or an operating system loader extracts the temporary session key from the received secure boot token;
encrypting the request data containing the self summary information by using the temporary session key to form an encrypted request packet;
And the next-stage firmware or the operating system loader sends the encryption request packet and a synchronous challenge random number to the hardware trust root module to form the complete credential confirmation request.
9. The method for securely starting and verifying integrated on a motherboard according to claim 8, wherein the hardware trust root module releasing the system control right and entering a silent monitoring state after verifying the summary information in the credential confirmation request, comprises:
The hardware trust root module decrypts the received encryption request packet by using the stored temporary session key, and restores the self abstract information sent by the next-stage firmware or an operating system loader;
the hardware trust root module reads pre-stored expected abstract information corresponding to legal next-level firmware or an operating system loader from an internal nonvolatile memory;
comparing the decrypted and restored self abstract information with the expected abstract information;
if the comparison is consistent, the hardware trust root module generates a final authorization signal, and disconnects the active drive of the hardware trust root module to the main board key control bus to finish the operation of releasing the system control right;
And then, the hardware trust root module is switched to monitor the silence monitoring state without active intervention, and continuously monitors key events in the subsequent starting process.
10. A secure boot hardware trust root module integrated on a motherboard, characterized in that it is constructed by a secure boot verification method integrated on a motherboard according to any of claims 1 to 9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202610172331.6A CN121659330A (en) | 2026-02-06 | 2026-02-06 | Safe starting hardware trust root module integrated on main board and verification method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202610172331.6A CN121659330A (en) | 2026-02-06 | 2026-02-06 | Safe starting hardware trust root module integrated on main board and verification method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN121659330A true CN121659330A (en) | 2026-03-13 |
Family
ID=98989099
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202610172331.6A Pending CN121659330A (en) | 2026-02-06 | 2026-02-06 | Safe starting hardware trust root module integrated on main board and verification method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN121659330A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104794393A (en) * | 2015-04-24 | 2015-07-22 | 杭州字节信息技术有限公司 | Embedded type partition image security certification and kernel trusted boot method and equipment thereof |
| CN110321715A (en) * | 2019-07-08 | 2019-10-11 | 北京可信华泰信息技术有限公司 | Credible measurement method, apparatus and processor |
| CN114510751A (en) * | 2021-12-30 | 2022-05-17 | 中电科技(北京)股份有限公司 | Hardware replacement prevention device and method based on processor security kernel |
| CN120068051A (en) * | 2025-04-27 | 2025-05-30 | 赛飞特工程技术集团有限公司 | Firmware protection method and system based on security coprocessor |
| CN120744931A (en) * | 2025-06-27 | 2025-10-03 | 南方电网科学研究院有限责任公司 | Equipment starting method and device based on encryption authentication of safe trusted module |
| CN120781398A (en) * | 2025-06-27 | 2025-10-14 | 王树兰 | Mainboard safety device integrating physical isolation and front-end starting verification function |
-
2026
- 2026-02-06 CN CN202610172331.6A patent/CN121659330A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104794393A (en) * | 2015-04-24 | 2015-07-22 | 杭州字节信息技术有限公司 | Embedded type partition image security certification and kernel trusted boot method and equipment thereof |
| CN110321715A (en) * | 2019-07-08 | 2019-10-11 | 北京可信华泰信息技术有限公司 | Credible measurement method, apparatus and processor |
| CN114510751A (en) * | 2021-12-30 | 2022-05-17 | 中电科技(北京)股份有限公司 | Hardware replacement prevention device and method based on processor security kernel |
| CN120068051A (en) * | 2025-04-27 | 2025-05-30 | 赛飞特工程技术集团有限公司 | Firmware protection method and system based on security coprocessor |
| CN120744931A (en) * | 2025-06-27 | 2025-10-03 | 南方电网科学研究院有限责任公司 | Equipment starting method and device based on encryption authentication of safe trusted module |
| CN120781398A (en) * | 2025-06-27 | 2025-10-14 | 王树兰 | Mainboard safety device integrating physical isolation and front-end starting verification function |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104463007B (en) | Data verification method and device thereof | |
| CN102138300B (en) | Application of message authentication code precomputation in secure memory | |
| US20050283826A1 (en) | Systems and methods for performing secure communications between an authorized computing platform and a hardware component | |
| CN112035860B (en) | File encryption method, terminal, device, equipment and medium | |
| US20220150260A1 (en) | Hardware Detection Method and Apparatus, Device, and Storage Medium | |
| TWI631462B (en) | Computing system and computing device-implemented method to secure on-board bus transactions and non-transitory computer readable storage medium | |
| CN106165339A (en) | Method and system for improving data security during communication | |
| CN112400294A (en) | Secure communications from within a non-volatile memory device | |
| JP2020126586A (en) | Protecting integrity of log data | |
| CN112703500A (en) | Protecting data stored in memory of IoT devices during low power mode | |
| CN119892522B (en) | Negative control terminal program trusted loading method and electronic device | |
| CN117935894A (en) | Secure computer memory | |
| US7979628B2 (en) | Re-flash protection for flash memory | |
| WO2025214368A1 (en) | Secure communication method and apparatus | |
| CN108242997B (en) | Method and device for secure communication | |
| CN121659330A (en) | Safe starting hardware trust root module integrated on main board and verification method | |
| US12413407B2 (en) | Ciphers to protect keystrokes | |
| CN112769764A (en) | Metering data transmission key storage method of instrument and transmission method and device thereof | |
| CN113221189B (en) | Identity authentication system, authentication method, medium and terminal based on block chain | |
| CN117118613B (en) | Whole vehicle instrument data security protection method, equipment and readable storage medium | |
| CN120729649B (en) | Data transmission method, electronic device, storage medium, and program product | |
| JP6124338B2 (en) | Information processing system | |
| CN121682809A (en) | System on chip, security start verification method, chip and device | |
| CN121530555A (en) | RDMA secure hardware offloading device, RDMA network card and secure communication method | |
| CN121887387A (en) | Local key preassembling method, PC (personal computer) terminal and terminal equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |