Method for configuring a security module with at least one derived key

Abstract

The invention claims a method for configuring a security module (SD) with at least one derived key, comprising the following steps: - providing a key (MK); - deriving (KDF) further keys (K1 to KN) from the provided key or from a key previously derived from the provided key, characterized in that a changeable digital fingerprint (FP) is entered as a key derivation parameter in the derivation, which is formed as a function of a measurable current runtime configuration of a runtime environment (R) communicating with the security module.

Description

Background Art

[0001] Modern data processing systems require a so-called Trust Anchor for cryptographic operations such as encrypting data or authenticating between systems or (software) modules. The Trust Anchor or Trust Point forms the basis for protecting devices such as IoT (Internet of Things) devices or field devices or data processing systems such as embedded systems or control computers. It is possible to ensure the uncompromised operation of the data processing system at system startup and / or during continuous operation with the help of a Trust Anchor. The Trust Anchor can include cryptographic keys, which can be used, for example, for a secure boot process or for authenticating the data processing system or for a key file for using the data processing system or for verifying the operating state of the data processing system or for checking update files (Firmware Update). Therefore, the term "anchor" (German: Anker) is based on the fact that the security or trust mechanism concept of the data processing system uses the Trust Anchor as a basis, and it is assumed or must be assumed here that the Trust Anchor itself is secure and uncompromised.

[0002] A known Trust Anchor is, for example, the Trusted Platform Module (TPM) specified in ISO / IEC 11889 in 2009, which exists in every modern PC and is assumed by modern operating systems to be mandatory for certain cryptographic operations. For example, the hard disk encryption "BitLocker" of the widely used operating system "Windows" is based on the TPM. However, various other implementations of Trust Anchors can be envisaged, such as cryptographic controllers, authentication modules or Secure Elements integrated into the CPU.

[0003] It is possible to run a security module with n≥2 keys. For all 1 < i ≤ n, the key of the i-th generation can be iteratively derived from the key of the i - 1-th generation and stored in storage section i. Thus, category-sorted cryptographic operations can be performed, where the cryptographic operation of the k-th category is performed using the key stored in the k-th storage section, where 1 ≤ k ≤ n.

[0004] Other keys can be derived, for example, from the stored keys with the help of a Key Derivation Function (KDF). The derivation of the keys is based on static attributes. For example, the key derivation is based on a software binary file, a fixed label in the file system or a hard-coded derivation value in the firmware. If an attacker gains control of a part of the system, for example, by exploiting a software vulnerability, the derived keys are not sufficiently protected. In particular, the keys used by other software components can be reconstructed (derived) by the attacker at any time. Summary of the Invention

[0005] It is therefore an object of the present invention to specify a method for processing cryptographic keys which, compared to the method mentioned at the outset, has improved protection against attackers.

[0006] The object of the present invention is to improve a method and a device or a facility or an apparatus compared to the above-mentioned prior art.

[0007] This object is achieved by the features specified in the independent claim. Advantageous developments of the invention are presented in the dependent claims.

[0008] The invention claims a method for configuring a security module with at least one derived key, comprising the following steps:

[0009] - provide the key;

[0010] - derive other keys from the supplied key or from keys previously derived from the supplied key,

[0011] It is characterized in that a changeable or variable digital fingerprint is entered or taken into account in the derivation as a key derivation parameter, which is formed as a function of a measurable current runtime configuration of a runtime environment communicating with the security module.

[0012] Here, the configuration of the security module is performed during the runtime of the runtime environment in which the security module is run. The security module is thus reconfigured according to the actual current runtime configuration. This can be performed once, preferably but repeatedly during the runtime of the runtime environment. Preferably, the respectively current fingerprints of the runtime environment are determined when performing key derivation, and the key derivation is performed accordingly. Here, preferably, measurements for determining the fingerprint are also performed when performing key derivation. The measurement can be performed by the runtime environment itself and provided to the security module. For this reason, a specific fingerprint measurement process (or fingerprint measurement process task) is preferably performed in addition to other processes in the runtime environment. The measurement process can be isolated from other processes, for example, by a hypervisor. However, the measurement can be performed on a separate computing core (Core) of a multi-core runtime environment, on a separate measuring device, for example, on a separate microcontroller, or by the security module itself.

[0013] The security module may be part of the device. The key provided may be a master key or an initial key or derived therefrom. In the design of the present invention, the initial key may be implemented so that any further access is blocked or physically impossible.

[0014] The runtime environment is formed, for example, by a CPU or a computing facility which responds to or controls a security module or communicates with a security module, wherein the security module is configured by the method according to the invention.

[0015] Runtime properties of a regular, functioning runtime environment can be detected and used as input parameters for key derivation. A measurable or monitorable current runtime configuration provides a fingerprint that changes when the system is manipulated. Manipulations are, for example, the startup of additional processes or integrity information of running data. The fingerprint is determined dynamically at runtime and entered as a key derivation parameter into a key derivation function or as a key formation parameter into a key generation function. This has the advantage that the cryptographic key in an unmanipulated state cannot be determined if the runtime integrity information is changed.

[0016] The above-mentioned step of deriving other keys can be repeated one or more times (iteratively). At least one cryptographic operation can be performed with the aid of the derived other keys. A key change event can be, for example, a specific command for key update or a change of the upper-level data processing system to another (operating) state. The execution of a cryptographic operation can also be used as a key change event, which allows the implementation of keys to be used only once for an operation (e.g., for encryption of data), wherein these keys can then also be used for other operations (e.g., decryption or verification).

[0017] The measurable runtime configuration may include at least one determinable state of the runtime environment or at least one state of the runtime environment triggered by a monitorable event occurrence. In this case, the state of the runtime environment and / or the event occurrence are measurable runtime attributes of the runtime environment at a determined moment. The runtime configuration may form a variable fingerprint (Runtime Integrity Fingerprint) that ensures integrity. For example, HW counters, real-time clocks, meta information (about ongoing processes or about file systems, file attributes, special files, security mechanisms for state determination, static data, file contents, process names, process numbers, process priorities, watchdogs, benchmark functions, states of peripheral devices, power consumption profiles, electromagnetic radiation profiles, etc. may be measured at a determined moment.

[0018] Advantageously, one-way functions are used for key derivation. A one-way function is a function with which the base key can be inferred from the derived key only with very high expenditure (in terms of computing power and memory).

[0019] Monitorable or measurable runtime attributes are both static attributes (e.g. checksums of read-only file systems) and dynamic attributes (e.g. the current runtime of the system since power-on reset (POR)). Repeated derivations of the same key are therefore linked to the state of the runtime environment. If this state changes, either due to a change in the settings of the runtime phase or due to changes caused by an attack, additional keys are derived. Side channel information can also be measured as fingerprints, such as temporal behavior (e.g. cache timing) or power consumption profiles.

[0020] Attacks (changes that occur during runtime, such as the launch of a harmful process after exploiting a software weakness) can lead to changes in the runtime properties of the runtime environment. If these are taken into account in the key derivation, such attacks automatically lead to the fact that the same keys can no longer be derived as in the complete state of the device, and therefore critical data (such as encrypted files) are better protected from attackers.

[0021] The invention furthermore relates to a security module, a device and a computer program product.

[0022] The claimed security module can be configured with at least one derived key, the security module having:

[0023] - a receiving unit for the provided key;

[0024] - a derivation unit for deriving other keys from the provided key or from a key previously derived from the provided key,

[0025] Features

[0026] A generation unit is designed to form a changeable or variable fingerprint using a measurable current runtime configuration of a runtime environment communicating with the security module, which fingerprint is included in the derivation as a key derivation parameter.

[0027] The device having the runtime environment has such a security module, characterized in that

[0028] - a provisioning unit for providing a key, and

[0029] A measuring unit for measuring the current runtime configuration, with the aid of which a variable fingerprint is formed, which fingerprint is used as a key derivation parameter in the derivation of further keys from the provided key or from a key previously derived from the provided key.

[0030] A computer program product comprising computer-executable instructions which, when loaded into a device (eg a computer), are designed to perform a method according to the types and embodiments mentioned above.

[0031] In addition, a computer program (product) comprising a program code is provided, which can be executed by at least one processor and which causes the at least one processor to perform the (operation) method according to the invention and its embodiments. The computer program can be run on a device / module or apparatus of the type mentioned above or stored as a computer program product on a computer-readable medium.

[0032] The apparatus, the device or the apparatus, the module and the computer program (product) can be designed according to the refinements / embodiments of the above-mentioned method and the refinements / embodiments thereof, and vice versa. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above-described characteristics, features and advantages of the present invention and the manner and method of achieving these characteristics, features and advantages become clearer and more understandable in conjunction with the following description of the embodiments, which are explained in more detail in conjunction with the figures. Here, a schematic diagram is shown:

[0034] The single FIGURE shows a schematic diagram of a device D. It should be pointed out that the explanation of the invention in conjunction with the device is made purely by way of example and without limiting the invention to such a device. DETAILED DESCRIPTION

[0035] The figure shows a device D. The relationship between the runtime properties of the runtime environment R, the division into N different system states S1 to SN and the derivation of the corresponding keys with the help of the master key MK is shown. The basic functions are implemented by a runtime measurement key derivation function (Runtime Measurement Key Derivation Function) RM-KDF, which is integrated in a security module SD, which is integrated into the device D or coupled to the device D. The basic functions can also be implemented in a distributed manner, that is, the first part of the runtime measurement key derivation function RM-KDF can be integrated in the security module and the second part of the runtime measurement key derivation function RM-KDF can be coupled to the security module.

[0036] The system or runtime states 1 to N differ in the runtime properties of one or more components, such as the process P running at the time of key derivation, the file system properties FS and the hardware state HW, such as the value of the hardware counter. If the key is to be derived, the RM-KDF measurement value (such as the one-way value or hash value of the file) is obtained from the runtime environment R. Which parts of the runtime environment should be measured are predetermined by the measurement rule system MP (Measurement Policy (measurement strategy)). All of the measured values ​​M (which can be recorded with continuous hash values, for example) are then used together with the master key MK as input parameters of the key derivation function KDF, for example based on HMAC-SHA256. If the state of the measured runtime component no longer corresponds to the expected state due to an attack, for example, because the attacker starts a process that is not set in this state, the derived key is also changed. Therefore, objects protected by keys can only be accessed in the state of the runtime environment that is defined as valid.

[0037] States 1 to N are implicitly defined by the measurement strategy (measurement rules) MP and the states of the runtime components being measured. The measurement strategy MP can be different for each state or the same for multiple states. Therefore, multiple RM-KDFs can be used on the device D, which use different measurement strategies, derivation functions KDF and / or master key measurement strategies MP, all measurement functions for the measurement value M, and the key derivation function KDF can be implemented in principle in software or hardware components. Here, the master key MK used for derivation can be stored in hardware (e.g., a hardware-based trust anchor) or implemented in software (e.g., as part of an obfuscation routine).

[0038] In the following, several possibilities for measurable runtime properties are shown. These possibilities can be combined as desired to form measurement strategies MP.

[0039] • The runtime of the device D up to now since a reset, for example by means of a hardware counter or a real-time clock. The runtime of the software, for example the Linux kernel ( / proc / uptime), up to now can also be used here.

[0040] • Performance runtime data (e.g. CPU load, memory utilization, input / output interfaces, utilization of e.g. network interfaces, DMA transfers, interrupt frequency).

[0041] • Power consumption profile, electromagnetic radiation profile (e.g. time variation, spectrum).

[0042] • Meta information about the running process P, such as the user (under which the process runs), which process has started the process (process tree / parent-child relationship of processes / “process chain”), process priority, process number, SELinux domain of the process, namespace and cgroups in which the process runs.

[0043] • The currently attached file system and its attributes (e.g. read-only). Thus, keys can also be derived from existing replaceable peripheral modules (such as USB dongles).

[0044] • Dedicated files that reflect the integrity of the current system. For example, security-critical events can be written by a host-based intrusion detection system (HIDS) into a special file that is measured together with the key derivation process. Another possibility is to include configuration data that restricts (or even completely prevents) logging into the system into the measurement: in the case of an attack that changes the configuration so that logging in is possible again (especially in order to be able to observe the system "from the inside" during runtime), then only the wrong keys are still derived.

[0045] • The state of certain security mechanisms can be included together. Thus, on Linux-based systems, the correct keys for an application can only be derived when one or more security mechanisms are in a certain state (eg SELinux is in "enforcing" mode).

[0046] • Static data such as hardware IDs or configuration files in the file system can be measured together. If the runtime measurement key derivation function RM-KDF is executed in another environment (additional hardware and thus hardware IDs, additional configuration) or if files that are assumed to be static are manipulated, additional keys are derived accordingly.

[0047] • The existence of certain file contents can be checked, which should be present, for example, from the provisioning phase of the device.

[0048] • Meta-information of the file system, such as the size of certain parts, access or change times, permissions, user / owner, targets of symbolic links, etc.

[0049] • How to use or call the runtime measurement key derivation function RM-KDF can also be included. Thus, the runtime measurement key derivation function can, for example, also include a process chain starting from the called component to the root of the process tree. In this case, the names of the processes contained in the process chain can, for example, be hashed successively and used as part of the key derivation parameters. It can thus be ensured that the correct key can only be derived in the process of the provided call.

[0050] • A watchdog (hardware or software function) may be included together, which monitors the integrity of the runtime environment.

[0051] The execution time of a specially set reference function can be measured and included in the derivation (with a certain margin for normal measurement variance). If the execution of such a function requires, for example, 250 ms and the standard deviation (Sigma) is 10 ms, then on an unmanipulated device with 5-Sigma reliability (integer) divided by 100 ms yields the value 2. This makes it difficult for an attacker to replicate the derived key in a simulated or emulated environment, since now the behavior of the device must also be simulated sufficiently accurately (in the example: + / -20%).

[0052] Applications (wherein applications are represented by AP in the figure, for example) can derive keys with the help of libraries at runtime in order to perform cryptographic operations with the help of derived keys. Such operations can protect and access security-critical objects, such as encrypted file systems or private keys for TLS connections. If keys are to be derived, the runtime measurement key derivation function RM-KDF uses a measurement function and a measurement strategy MP to measure or determine a specified part or specified event of the runtime environment at one or more specific times and specify it as a runtime configuration. Through the measurement function, information about the currently attached file system (Mounts (loaded file system)), the status of certain peripheral device modules (such as FPGA, GPIO, MAC address), the operating system's runtime until now (Uptime (normal operation time)), static content from the file system (Filesystem) and the name of the process in the caller's process chain are aggregated into a running hash value. Subsequently, the aggregated value is used as a key derivation parameter of the key derivation function with the master key MK. The derived keys K1 to KN are different depending on the calling application because these keys belong to different process chains.

[0053] The variable fingerprint FP formed by the runtime configuration and the consideration as a key derivation parameter can be regarded as the configuration of the security module. The application can use these derived keys, for example, to access a private file system. If an attacker attempts to derive a key with the help of another process, also with the help of the runtime measurement key derivation function RM-KDF, the key will be different. Not only offline attacks but also online attacks usually change the dynamic properties of the runtime environment (e.g., configuration files, options of attached file systems). Therefore, it is very difficult to access the key from a valid state.

[0054] The invention has the advantage that access to keys can be linked to the current state of static and especially dynamic properties of the runtime environment. In the event of interference with the runtime environment (physical attack, remote attack), key derivation can be affected and thus it is no longer possible to derive valid keys in an untrusted environment. In addition, the state correlation can be used deliberately to provide different keys in different runtime phases with software. This has the advantage in particular that in the event of a compromised runtime phase, keys for the current phase and other phases cannot be derived.

[0055] Although the present invention has been illustrated and described in more detail by means of preferred embodiments, the present invention is not restricted to the disclosed examples and further variants may be derived therefrom by a person skilled in the art without departing from the scope of protection of the present invention.

[0056] The execution of the processes or method flows described above can be carried out according to instructions, which are present on a computer-readable storage medium or in a volatile computer memory (hereinafter generally referred to as a computer-readable memory). Computer-readable memories are, for example, volatile memories such as caches, buffers or RAMs and non-volatile memories such as exchangeable media, hard disks, etc.

[0057] The functions or steps described above may be present in the form of at least one instruction set in / on a computer-readable memory. The functions or steps are not associated with a specific instruction set or a specific form of an instruction set or a specific storage medium or a specific processor or a specific execution scheme, but can be executed by software, firmware, microcode, hardware, processor, integrated circuit, etc., alone or in any combination. In this case, very different processing strategies can be used, such as serial processing or multiprocessing or multitasking or parallel processing by a single processor, etc.

[0058] The instructions may be stored in a local memory, but it is also possible to store the instructions on a remote system and to access the remote system via a network.

[0059] The device D may have one or more processors. The terms "processor", "central signal processing device", "control unit" or "data evaluation device" include processing devices in the broadest sense, i.e., for example, servers, general-purpose processors, graphics processors, digital signal processors, application-specific integrated circuits (ASICs), programmable logic circuits, such as FPGAs, discrete analog or digital circuits and any combination thereof, including all other processing devices known to those skilled in the art or developed in the future. The processor may consist of one or more devices or facilities or units. If the processor consists of a plurality of devices, these devices may be designed or configured to process or execute instructions in parallel or sequentially.

Claims

1. A method for configuring a security module (SD) for a device (D) with at least one derived key, comprising the following steps: - provide a secret key (MK); - deriving (KDF) other keys (K1 to KN) from the provided key or from a key previously derived from the provided key; It is characterized in that A digital fingerprint (FP) which is dynamically determined during runtime and which can be changed, is entered into the derivation as a key derivation parameter and is formed as a function of a measurable, current runtime configuration of a runtime environment (R) communicating with the security module, the parts of which are to be measured being predetermined by a measurement algorithm.

2. The method according to claim 1, It is characterized in that The steps for deriving additional keys are repeated one or more times.

3. The method according to claim 1 or 2, It is characterized in that At least one cryptographic operation is performed using the derived other key.

4. The method according to claim 1 or 2, It is characterized in that The measurable runtime configuration includes at least one determinable state (1 to N) of the runtime environment (R) or at least one state of the runtime environment that is triggered by the occurrence of a monitorable event.

5. The method according to claim 3, It is characterized in that The measurable runtime configuration includes at least one determinable state (1 to N) of the runtime environment (R) or at least one state of the runtime environment that is triggered by the occurrence of a monitorable event.

6. A security module (SD) for a device (D), the security module being configurable with at least one derived key, the security module comprising: - a receiving unit for the provided key (MK); a derivation unit (KDF) for deriving further keys (K1 to KN) from the provided key or from keys previously derived from the provided key, Features a generation unit, which is designed to form a digital fingerprint (FP) which is dynamically determined at runtime and which can be changed by means of a measurable current runtime configuration of a runtime environment (R) communicating with the security module, said digital fingerprint being entered as a key derivation parameter in the derivation, and A measuring algorithm which specifies which parts of the runtime environment are to be measured.

7. A device (D) having a runtime environment (R) having a security module (SD) according to claim 6, characterized in that - a providing unit for providing a secret key (MK), and a measuring unit (M) for measuring the current runtime configuration, with the aid of which a changeable fingerprint (FP) determined dynamically during runtime is formed, which fingerprint is used as a key derivation parameter in the derivation of further keys (K1 to KN) from the provided key or from a key previously derived from the provided key.

8. A computer program product comprising computer executable instructions, which when loaded into a device are designed to execute the method according to any one of claims 1 to 5.

Images