Method for upgrading function of creditable calculation modules

Abstract

The method comprises: a server side for providing data update, a client side comprising a dependable computing module and a dependable computing module are provided; using the code of the dependable computing module as the secret information shared by the update provider and the dependable computing, by which the mutual authentication mechanism and encryption communication are established between the server side and client side in order to download the update data to client side; the secret communication also be set between the client side and TPM, and when the TPM conforms the correction of update data from the client side, it make update.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method for online upgrading of the protection function of a Trusted Computing Module (TPM) formulated by the International Trusted Computing Group (TCG). Background technique [0002] The trusted computing module formulated by the TCG specification is an information security module presented in the form of a hardware chip used on the motherboard of a personal computer, etc., and realizes various protection functions stipulated in the TCG specification by interacting with communication commands such as a personal computer platform. According to the requirements of the trusted computing module formulated by the TCG specification, once the TPM is used in the field, the TPM needs a mechanism to allow the update of the protection function (command). For a given TPM with different upgrade implementations, there are various execution protection function upgrades The method, thi...

AI Technical Summary

Problems solved by technology

[0005] 2. The upgrade process can only change the protection function

[0006] 3. The upgrade process can only access the data in the shielded area inside the TPM. The data in it is necessary for the TPM owner, which can make the TPME effective and control the data block

[0007] Judging from the current existing technologies, there are four upgrade schemes: fixed upgrade key strategy; temporarily generated key upgrade strategy; use certificate certificate (Endorsment Key Credential, referred to as EK certificate) upgrade strategy; and use identity verification certificate (Attestation IdentityKey Credential (referred to as AIK certificate) upgrade strategy, etc. Among them, the first three obviously do not meet the requirements of TCG specifications. As for the fourth solution (AIK certificate upgrade strategy), although this solution is allowed by TCG, it is also relatively safe. However, data protection still needs another solution. The most important thing is that there are no channels and conditions for issuing AIK certificates, and the use of certificates involves operations such as certificate issuance, replacement, and revocation, both in terms of use and commercial operations. Both are very complicated, therefore, the fourth option is not yet ready for implementation

Images