Apparatus, Method, and Computer-Readable Recording Medium for Supporting Confidentiality and Portability in DSM Implementation

Abstract

The present invention relates to an apparatus, method, and computer-readable recording medium that support confidentiality and portability when implementing a DSM during the design and operation of an SoC semiconductor chip. By implementing some security module services as a simple protocol so that they can be processed by an application processor during DSM implementation, and by implementing this protocol in the DSM_KM portion linked to the hardware security module, the processing burden on the hardware security module can be reduced.

Description

Technology Field

[0001] The present invention relates to an apparatus, method, and computer-readable recording medium that support confidentiality and portability when implementing a DSM during the design and operation of an SoC semiconductor chip. Background Technology

[0002] As the demand for AI / HPC increases, data centers and other facilities are implementing these requirements through NPU accelerators.

[0003] In such systems, technical standards for device authentication of data processing units, access restrictions during data communication, and encrypted communication are established, and when implementing a system-on-chip, these requirements must be satisfied.

[0004] For device authentication, the Open Computing Project established a standard for a hardware security module design called Caliptra, and the PCIe specification proposed device authentication using the SPDM protocol and PCIe encryption standard transmission using encryption via IDE (Integrity and Device Encryption).

[0005] In these encryption standard transmission methods and devices, the authentication process of the PCI device is carried out according to a standard called SPDM (Secure Protocol and Data Model) before data transmission encryption. Once authentication is complete, a key exchange process is performed using ECDHE (Elliptic Curve Diffie-Hellman Ephemeral).

[0006] And when establishing encrypted communication using the exchanged key, there is a process of setting the encryption key to be used for encryption during PCIe communication using the IDE_KM protocol defined in the PCI specification, and the device that receives the command adopts a method of setting the encryption key through a bus that can be independently accessed from the system-on-chip.

[0007] However, with this existing method, if the encryption key setting part is implemented as an independent bus, access is restricted to the Hardware Security Module (HSM), creating a problem where other main processors, such as ARM CPUs, cannot access it at all.

[0008] In addition, there is a problem where the ease of implementation is significantly limited due to access restrictions on the encryption key management module, even in places where the entire device runs only authenticated software depending on the application of the system-on-chip, where it is sufficient to implement it with security software implemented in the main processor. Prior art literature

[0009] Republic of Korea Published Patent No. 10-2020-0099065 (Published August 21, 2020) The problem to be solved

[0010] Therefore, the objective of the present invention is to provide an apparatus and method that facilitate the implementation of a hardware security module by moving away from the method of implementing all security module services in the hardware security module when implementing a DSM, and enabling some of these services to be implemented in an application processor, thereby reducing the processing burden on the hardware security module. means of solving the problem

[0011] A method for implementing a system to support confidentiality and portability when implementing a hardware security module according to the present invention for achieving the above-mentioned purpose comprises: a) generating a simple protocol including some security-related functions used during encryption communication setup among SPDM protocols in a device security manager (DSM); b) transmitting the simple protocol generated during encryption communication setup to the DSM_KM of the hardware security module from an application processor; c) performing a Key Provisioning service using the simple protocol received through the DSM_KM of the hardware security module; and d) performing IDE Key settings of a PCI block through the Key provisioning service.

[0012] In one embodiment, the simple protocol is implemented with a predetermined size or smaller.

[0013] In one embodiment, the simple protocol includes at least one of PCI communication encryption and decryption, Secure SPDM message encryption and decryption, session key generation, and session key storage processing implementation.

[0014] In one embodiment, the functions to be processed by the simple protocol include the delivery of a certificate request, a response to a device measure and signature generation, the generation of a DHE (Diffie-Hellman) key pair and a response to the secret key portion, and an encryption / decryption request using a session key.

[0015] In one embodiment, the DSM implements x.509 related libraries, encryption-related code, SPDM protocol processing, and PCI Mailbox (DOE) sending and receiving functions, and the DSM_KM implements the message signing part used in GET_MEASUREMENTS, key generation required in the ECDHE key exchange method used in KEY_EXCHANGE, secret key storage, session key storage, and message encryption and decryption processing required in a secure session using the stored session key.

[0016] In one embodiment, the DSM is implemented with the function of storing a device certificate and a device runtime measurement value, and responding with the stored device certificate and device runtime measurement value upon request.

[0017] In one embodiment, when the DSM_KM receives a decryption request using an internally stored session key, if the message contains information such as a system communication security key, it responds by invalidating the key portion of the message in the decryption message.

[0018] According to another embodiment of the present invention, a computer-readable recording medium for supporting confidentiality and portability when implementing a hardware security module stores instructions that, when executed by one or more processors, the one or more processors generate a simple protocol including some security-related functions used during encryption communication setup in the SPDM protocol in the device security manager (DSM); transmit the simple protocol generated during encryption communication setup to the DSM_KM of the hardware security module from the application processor; perform a Key Provisioning service using the simple protocol received through the DSM_KM of the hardware security module; and perform an IDE Key setting of a PCI block through the Key provisioning service.

[0019] According to another embodiment of the present invention, a device for supporting confidentiality and portability when implementing a hardware security module comprises: a DSM (device security manager) module implemented within an application processor including a protocol and a communication module for device authentication, which generates a simple protocol including some security-related functions used during encryption communication setup among SPDM protocols, and transmits the generated simple protocol during encryption communication setup to the DSM_KM of the hardware security module from the application processor; and a DSM_KM module implemented within a hardware security module that implements key exchange and encryption and decryption of security communication, which performs a Key Provisioning service using the received simple protocol and proceeds with IDE Key setting of a PCI block through the Key provisioning service. Effects of the invention

[0020] The present invention implements some security module services into a simple protocol so that they can be processed by the application processor when implementing DSM, and implements this protocol in the DSM_KM portion linked to the hardware security module, thereby reducing the processing burden on the hardware security module.

[0021] In addition, the ease of implementing access restrictions for encryption key management modules can be significantly improved in situations where it is sufficient to implement security software in the main process, such as where the entire device runs only authenticated software depending on the system-on-chip usage. Brief explanation of the drawing

[0022] FIG. 1 is a schematic diagram of a device for implementing DSM according to one embodiment of the present invention. FIG. 2 exemplarily illustrates a procedure for device authentication and security session creation using SPAM between a DSM and a host's TSM according to the present invention. Figure 3 shows an exemplary message format of the Simple Protocol. Figure 4 shows the main commands and responses used in the simple protocol. Figure 5 shows the message format during the encryption and decryption process after creating a secure session. Figure 6 shows the request processing process after the Secure Session. Figure 7 shows an example of a modified message in which the key portion of the decrypted message is filled with zeros. Figure 8 is a flowchart schematically illustrating a system implementation method for supporting confidentiality and portability when implementing a hardware security module. Specific details for implementing the invention

[0023] The following detailed description of the invention refers to the accompanying drawings, which illustrate specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that various embodiments of the invention are different but need not be mutually exclusive. For example, specific shapes, structures, and characteristics described herein with respect to one embodiment may be implemented in other embodiments without departing from the spirit and scope of the invention. It should also be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not intended to be limiting, and the scope of the invention is limited only by the appended claims, including all equivalents to those claimed therein, provided appropriately described. Similar reference numerals in the drawings refer to the same or similar functions across various aspects.

[0024] Terms such as "first" or "second" may be used to describe various components, but these terms should be interpreted solely for the purpose of distinguishing one component from another. For example, the first component may be named the second component, and similarly, the second component may be named the first component.

[0025] When it is stated that a component is "connected" to another component, it should be understood that it may be directly connected to or coupled with that other component, or that there may be other components in between.

[0026] The singular expression includes the plural expression unless the context clearly indicates otherwise. In this specification, terms such as "comprising" or "having" are intended to specify the existence of the described features, numbers, steps, actions, components, parts, or combinations thereof, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0027] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by those skilled in the art. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology, and should not be interpreted in an ideal or overly formal sense unless explicitly defined in this specification.

[0028] Hereinafter, embodiments will be described in detail with reference to the attached drawings. In the description with reference to the attached drawings, identical components are given the same reference numeral regardless of the drawing number, and redundant descriptions thereof will be omitted.

[0029] FIG. 1 is a schematic diagram of a device for implementing DSM according to one embodiment of the present invention.

[0030] The hardware security module (120) according to the present invention is composed of an independent part of the system and consists of a CPU core such as RISC-V, a hardware encryption module, and a public key generation module. Generally, the hardware security module includes SRAM within several hundred KB for operation, but there were many limitations in terms of ease of implementation of the firmware and portability with other hardware security modules when implementing the entire function for device authentication and encrypted communication setup required by PCI, namely the Device Security Manager (DSM). For example, security hardware access libraries, operating systems, SPDM protocol transmission techniques (DOE (Data Object Exchange)), MTCP (SMBUS)), and resource constraints differ from company to company that manufactures hardware security module IP.

[0031] Meanwhile, in order to solve these problems, the present invention runs a DSM (210) (called an SPDM responder in the SPDM spec and a DSM in the PCI TDISP spec, but referred to uniformly as a DSM in the present invention) on an application processor (110), and only the parts for storing the secret key during key exchange (ECDHE) used during encryption communication setup, storing the session key, and setting up the security key used for encryption of the PCI IDE are performed in a module implemented as a DSM_KM (220) in the hardware security module (120).

[0032] And in Fig. 1, DSM (210) and DSM_KM (22) are implemented with a simple protocol.

[0033] Accordingly, the DSM implementation device (100) according to the present invention illustrated in FIG. 1 is a device for supporting confidentiality and portability when implementing a hardware security module, and is implemented within an application processor that includes a protocol and a communication module for device authentication, and includes a DSM (device security manager) module (210) that generates a simple protocol including some security-related functions used when setting up encrypted communication among SPDM protocols, and transmits the simple protocol generated when setting up encrypted communication from the application processor to the DSM_KM of the hardware security module, and a DSM_KM module (220) that is implemented within a hardware security module that implements key exchange and encryption and decryption of secure communication, performs a Key Provisioning service using the received simple protocol, and proceeds with IDE Key setting of a PCI block through the Key provisioning service.

[0034] In order to resolve ease of implementation and system resource constraints, the device (100) according to the present invention implements a DSM (210) including an SPDM protocol processing unit, a data communication unit (PCI DOE Library) (230), etc., within an application processor (110).

[0035] And, the device (100) according to the present invention implements the part responsible for PCI communication encryption, Secure SPDM message encryption / decryption, and session key generation and storage within the hardware insulation module (120) in the DSM_KM (220) part, and implements the part responsible for the IDE Key setting part of the PCI block as the Key Provisioning Service (240).

[0036] In addition, message transmission and reception between DSM (210) and DSM_KM (220) in the device (100) according to the present invention are implemented using only a simple protocol for portability and simplicity of implementation. To this end, it is preferable that the simple protocol between DSM (210) and DSM_KM (220) be implemented only to a size smaller than or equal to a predetermined size.

[0037] In the present invention, a method for ensuring data confidentiality between DSM (210) and DSM_KM (220) is described later with reference to FIG. 7.

[0038] FIG. 2 exemplarily illustrates a procedure for device authentication and security session creation using SPAM between a DSM and a host's TSM according to the present invention.

[0039] The flowchart of Figure 2 shows the message transfer procedure between the Requester (e.g., the Host's TSM) and the Responder (e.g., the DSM). Specific details regarding this are explained in materials such as DMTF, "DSP0274: Security protocol and data model (SPDM) specification, v.1.1.0," Distributed Management Task Force, Tech. Rep., Jul 2020, www.dmtf.org / sites / default / files / standards / documents / DSP0274 1.1.0.pdf, so a detailed explanation is omitted.

[0040] Referring to FIGS. 1 and FIGS. 2, the implementation of SPDM in DSM (210) is implemented with complex code such as x.509 related libraries, namely code related to certificates and encryption, and code related to SPDM protocol processing and PCI Mailbox (DOE) transmission and reception, most of which are implemented by DSM (210).

[0041] And, DSM (210) may also implement a function to store device certificates and device runtime measurements for confidentiality and to respond with the stored device certificates and device runtime measurements when requested.

[0042] And DSM_KM (220) implements the message signature part used in GET_MEASUREMENTS of FIG. 2, the key generation and secret key storage required in the ECDHE key exchange method used in KEY_EXCHANGE, the session key storage, and the message encryption / decryption processing required in the secure session using the stored session key.

[0043] Figure 3 shows an exemplary message format of the Simple Protocol.

[0044] The simple protocol between DSM (210) and DSM_KM (220) includes at least one of PCI communication encryption and decryption, Secure SPDM message encryption and decryption, session key generation and session key storage processing implementation, and, for example, the functions to be processed by the simple protocol include delivery of a certificate request, response to a device MEASUREMENT and signature generation, DHE (Diffie Hellman) key pair generation and secret key part response, and encryption / decryption request using the session key.

[0045] As illustrated in FIG. 3, the simple protocol used for message transmission and reception between DSM (210) and DSM_KM (220) in the present invention can operate independently of the version of the upper SPDM (Secure Protocol and Data Model), and can be defined as a protocol for processing only essential information between DSM and DSM_KM (an essential command processing unit operating in HSM) without being involved in complex communication control methods required to process the protocol.

[0046] That is, messages using the simple protocol are simply configured as shown in Fig. 3, and the format of the payload is implemented differently in detail depending on each command.

[0047] Figure 4 shows the main commands and responses used in the simple protocol.

[0048] The example in Fig. 4 shows the protocol processing process before establishing a secure session, and the specific process is illustrated with omissions.

[0049] First, referring to FIG. 4, after a request for device authentication and other authentication is made from the Host (spdm requester, 250) to the DSM (spdm responder, 210) of the application processor as shown in FIG. 2, the DSM (210) sends a GET_CERTIFICATE message (300) to the DSM_KM (220) of the hardware security module (HSM). Then, the DSM_KM (220) responds with a device certificate (310) stored in the HSM. Then, when the DSM (210) sends a GET_MEASUREMENT message (301) to the DSM_KM (220) of the hardware security module (HSM), the DSM_KM (220) responds with a device MEASUREMENT BLOCK (320) collected in the HSM.

[0050] Then, the DSM (210) sends a SIGN_MESSAGE message (302) to the DSM_KM (220) of the hardware security module (HSM). In the response to GET_MEASUREMENTS in the SPDM protocol, the response must include a signature in the message during the SPDM response between the host (250) and the DSM (210) through the device's private key (330) to verify the measurement value generated by the device. This command is a command requesting the signature of the message. Upon receiving the SIGN_MESSAGE, the DSM_KM (220) performs an internal verification operation on the message to verify that the measurement value, etc., is being converted by the DSM (211).

[0051] Meanwhile, in Fig. 4, SIGNER (340) performs the following functions.

[0052] When SIGNER (340) receives a SIGN_MESSAGE command, it goes through a process of verifying that the message is a message generated by DSM_KM (220). In the SPDM protocol, there are messages that require a signature, such as GET_MEASUREMENT and KEY_EXCHANGE_RSP. Upon a GET_MEASUREMENTS request, DSM_KM transmits the Measurement blocks to DSM (210), and DSM (210) generates a response message to the Host (250)'s GET_MEASUREMENTS and then requests the message from DSM_KM (220) as SIGN_MESSAGE.

[0053] Meanwhile, DSM_KM (220) undergoes a message verification step upon receiving a SIGN_MESSAGE (302) request. For example, if the Response Code at the 1st byte offset of the message is 0x60 (MEASUREMENTS), it verifies that the Measurement value located at the Offset (4 bytes) is identical to the Measurement value stored in the device and generates a Signature.

[0054] And when the DSM (210) sends a KEY_EXCHANGE message (304) to the DSM_KM (220) of the hardware security module (HSM), the DSM_KM (220) generates a Key Pair in response to the ECDHE (Elliptic-curve Diffie-Hellman) key exchange request, stores the session key used for communication with the secret key and the received public key in the DSM_KM (220), and responds with the public key portion of the generated Key Pair.

[0055] Other repetitive protocol messages are omitted from the explanation.

[0056] Referring again to Fig. 2, when the key exchange is completed in the SPDM protocol, a Secure Session is created, and thereafter, the message in the format shown in Fig. 5 requires an encryption / decryption process using the session key.

[0057] Figure 5 shows the message format during the encryption and decryption process after creating a secure session.

[0058] For confidentiality, the session key is not stored in the DSM (210), and the process of obtaining the Plain Message is performed by requesting encryption / decryption to the DSM_KM (220).

[0059] Figure 6 shows the request processing process after the Secure Session.

[0060] FIG. 6 illustrates the message encryption / decryption part after the secure session. To explain only the major parts related to the present invention, first, when DSM (210) sends DECRYPT_MESSAGE (400) to DSM_KM (220), this message is a request for decryption of the Encrypted SPDM Vendor Defined Message (Application Data) received by DSM (210). If it is a part regarding an encryption key such as PCI, a separate processing step is required.

[0061] Then, in response to the ENCRYP_MESSAGE (410) message, which is an SPDM respond Message encryption request sent from DSM (210) to DSM_KM (220), DSM_KM (220) sends the response message to DSM (210).

[0062] Meanwhile, referring to FIG. 6, in step 404, after decrypting the message using the session key, in order to prevent the leakage of the key from the application process or other systems in the case of a data stream encryption key setting command used for communication, the received encryption key is programmed into PCI_IDE_KM, and then the key part of the decrypted message is filled with '0' as shown in FIG. 7 and responded to the host DSM (210) to maintain confidentiality. In this step 404, the key setting part may also be sent separately by adding a separate 'Simple Protocol'.

[0063] Figure 7 shows an example of a modified message in which the key portion of the decrypted message is filled with zeros.

[0064] Figure 8 is a flowchart schematically illustrating a system implementation method for supporting confidentiality and portability when implementing a hardware security module.

[0065] Referring to FIG. 8, a system implementation method for supporting confidentiality and portability when implementing a hardware security module according to the present invention includes a simple protocol generation step (S11), a step of transmitting a simple protocol from DSM to DSM_KM (S12), a Key Provisioning service execution step (S13), and a PCI block IDE key setting step (S14).

[0066] In the simple protocol creation step (S11), the device security manager (DSM) creates a simple protocol that includes some security-related functions used when setting up encrypted communication among the SPDM protocols. Since the implementation method and functions of the simple protocol are the same as those described above, redundant descriptions are omitted.

[0067] In the step of transmitting a simple protocol from DSM to DSM_KM (S12), the simple protocol generated during the encryption communication setup is transmitted from the application processor to the DSM_KM of the hardware security module, and in the step of performing a Key Provisioning service (S13), a Key Provisioning service is performed using the simple protocol received through the DSM_KM of the hardware security module, and in the step of setting the PCI block IDE key (S14), the process of setting the IDE Key of the PCI block through the Key provisioning service is carried out.

[0068] The present invention implements some security module services into a simple protocol so that they can be processed by the application processor when implementing DSM, and implements this protocol in the DSM_KM portion linked to the hardware security module, thereby reducing the processing burden on the hardware security module.

[0069] In addition, the ease of implementing access restrictions for encryption key management modules can be significantly improved in situations where it is sufficient to implement security software in the main process, such as where the entire device runs only authenticated software depending on the system-on-chip usage.

[0070] Meanwhile, it will be readily understood by those skilled in the art that the present invention is not limited to the typical preferred embodiments described above, but can be implemented with various improvements, modifications, substitutions, or additions within the scope of the essence of the invention. If such implementation through improvements, modifications, substitutions, or additions falls within the scope of the appended claims below, the technical concept thereof should also be considered to belong to the present invention. Explanation of the symbols

[0071] 100: Device 110: Application processor 120: Hardware security module 210: DSM 220: DSM_KM 230: PCI DEO Library 240: Key Provisioning Service 250: Host

Claims

Claim 1 A method for implementing a system to support confidentiality and portability when implementing a hardware security module, comprising: a) generating a simple protocol including some security-related functions used during encryption communication setup among SPDM protocols in a device security manager (DSM); b) transmitting the simple protocol generated during encryption communication setup to the DSM_KM of the hardware security module from an application processor; c) performing a Key Provisioning service using the simple protocol received through the DSM_KM of the hardware security module; and d) performing IDE Key settings of a PCI block through the Key provisioning service. Claim 2 A method according to claim 1, characterized in that the simple protocol is implemented at a size smaller than or equal to a predetermined size. Claim 3 A method according to claim 1, wherein the simple protocol comprises at least one of PCI communication encryption and decryption, Secure SPDM message encryption and decryption, session key generation, and session key storage processing implementation. Claim 4 A method according to claim 1, wherein the functions to be processed by the simple protocol include transmission of a certificate request, response to a device measure and signature generation, generation of a DHE (Diffie-Hellman) key pair and response to a secret key portion, and a request for encryption / decryption using a session key. Claim 5 A method according to claim 1, wherein the DSM implements x.509 related libraries, encryption-related code, SPDM protocol processing, and PCI Mailbox (DOE) sending / receiving functions, and the DSM_KM implements a message signature part used in GET_MEASUREMENTS, key generation required in the ECDHE key exchange method used in KEY_EXCHANGE, secret key storage, session key storage, and message encryption and decryption processing functions required in a secure session using the stored session key. Claim 6 A method according to claim 5, wherein the DSM is characterized by having a function that stores a device certificate and a device runtime measurement value, and responds with the stored device certificate and device runtime measurement value upon request. Claim 7 A method according to claim 5, wherein the DSM_KM responds by invalidating the key portion of the message in the decryption message when receiving a decryption request using an internally stored session key, if the message contains information such as a system communication security key. Claim 8 A computer-readable recording medium for supporting confidentiality and portability when implementing a hardware security module, characterized by storing an instruction that, when executed by one or more processors, causes one or more processors to generate a simple protocol including some security-related functions used during encryption communication setup in the SPDM protocol of the DSM (device security manager); transmits the simple protocol generated during encryption communication setup from an application processor to the DSM_KM of the hardware security module; performs a Key Provisioning service using the simple protocol received through the DSM_KM of the hardware security module; and proceeds with IDE Key settings of a PCI block through the Key provisioning service. Claim 9 A computer-readable recording medium characterized in that, in claim 8, the simple protocol is implemented at a size smaller than or equal to a predetermined size. Claim 10 A computer-readable recording medium according to claim 8, characterized in that the simple protocol includes at least one of PCI communication encryption and decryption, Secure SPDM message encryption and decryption, session key generation, and session key storage processing implementation. Claim 11 A computer-readable recording medium according to claim 8, characterized in that the functions to be processed by the simple protocol include transmission of a certificate request, response to a device measure and signature generation, generation of a DHE (Diffie-Hellman) key pair and response to a secret key portion, and a request for encryption / decryption using a session key. Claim 12 A computer-readable recording medium according to claim 8, wherein the DSM implements x.509-related libraries, encryption-related code, SPDM protocol processing, and PCI Mailbox (DOE) transmission and reception functions, and the DSM_KM implements a message signature portion used in GET_MEASUREMENTS, key generation required in the ECDHE key exchange method used in KEY_EXCHANGE, secret key storage, session key storage, and message encryption and decryption processing functions required in a secure session using the stored session key. Claim 13 A computer-readable recording medium according to claim 12, characterized in that the DSM stores a device certificate and a device runtime measurement value, and implements a function to respond with the stored device certificate and device runtime measurement value upon request. Claim 14 A computer-readable recording medium according to claim 12, characterized in that when the DSM_KM receives a decryption request using an internally stored session key, if the message contains information such as a system communication security key, it responds by invalidating the key portion of the message in the decryption message. Claim 15 A device for supporting confidentiality and portability when implementing a hardware security module, comprising: a DSM (device security manager) module implemented within an application processor including a protocol and a communication module for device authentication, which generates a simple protocol including some security-related functions used during encryption communication setup among SPDM protocols, and transmits the generated simple protocol during encryption communication setup from the application processor to the DSM_KM of the hardware security module; and a DSM_KM module implemented within a hardware security module that implements key exchange and encryption and decryption of secure communication, which performs a Key Provisioning service using the received simple protocol and proceeds with IDE Key setting of a PCI block through the Key provisioning service. Claim 16 A device according to claim 15, characterized in that the simple protocol is implemented at a predetermined size or smaller. Claim 17 A device according to claim 15, characterized in that the simple protocol includes at least one of PCI communication encryption and decryption, Secure SPDM message encryption and decryption, session key generation, and session key storage processing implementation. Claim 18 A device according to claim 15, characterized in that the functions to be processed by the simple protocol include transmission of a certificate request, response to a device measure and signature generation, generation of a DHE (Diffie-Hellman) key pair and response to a secret key part, and encryption / decryption requests using a session key. Claim 19 An apparatus according to claim 15, wherein the DSM implements x.509 related libraries, encryption-related code, SPDM protocol processing, and PCI Mailbox (DOE) transmission and reception functions, and the DSM_KM implements a message signature part used in GET_MEASUREMENTS, key generation required in the ECDHE key exchange method used in KEY_EXCHANGE, secret key storage, session key storage, and message encryption and decryption processing functions required in a secure session using the stored session key. Claim 20 A device according to claim 19, characterized in that the DSM stores a device certificate and a device runtime measurement value, and implements a function to respond with the stored device certificate and device runtime measurement value upon request. Claim 21 A device according to claim 19, characterized in that when the DSM_KM receives a decryption request using an internally stored session key, if the message contains information such as a system communication security key, it responds by invalidating the key portion of the message in the decryption message.

Images