Realization method, device, module and system of firmware trusted platform module based on RISC-V architecture

Abstract

The invention relates to a firmware trusted platform module realized by utilizing a PMP memory protection mechanism in a framework, which is used for solving the problems of realization complexity of a current firmware TPM (Trusted Platform Module) scheme under an RISC-V (Reduced Infrastructure Standard-Virtualization) framework and support requirements on extra hardware. The method comprises the following modules: (1) an NVRAM security memory module using a PMP mechanism: based on an RISC-V instruction set, realizing memory isolation by using a privilege architecture and a physical memory protection (PMP) technology, dividing a plurality of memory areas and configuring different access permissions; through the mode, the security of the memory is ensured from the aspect of hardware, and meanwhile, a reducible key is generated by adopting a DRAM (Dynamic Random Access Memory) latch PUF (Physical Unclonable Function), so that the security risk of key storage is avoided. The PMP technology is further used for controlling access to Flash equipment, so that the NVRAM data can be safely encrypted and stored and effectively protected. And (2) an RISC-V architecture rollback attack defense module: modifying part of TPM command semantics and utilizing an NVRAM to maintain a scheme of error attempt times so as to cope with the problems of rollback attacks possibly faced by the TPM, lack of a security clock and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of embedded systems, and in particular to an implementation method, device, module and system of a firmware trusted platform module based on a RISC-V architecture. Background Art

[0002] Trusted Platform Module is a chip that is embedded in a computer and provides a root of trust for the computer. Its specifications are formulated by the Trusted Computing Organization. Currently, the industry has begun to widely adopt TPM to achieve security functions, including preventing rollback (Google), protecting static data (Microsoft and Google), virtualizing smart cards (Microsoft) and anti-malware in early startup. TPM has been applied to most commercial PCs, servers and personal computers.

[0003] However, hardware TPM is not flexible enough and cannot meet the usage scenarios of some mobile devices and embedded devices: most TPM chips are mainly for x86 architecture; for some lightweight devices, it is inconvenient to load an additional TPM chip; when new specifications are formulated, the original TPM hardware cannot be updated and will be eliminated. Therefore, academia and industry have proposed firmware TPM architecture solutions.

[0004] There are already some firmware TPM implementations, such as Intel, AMD and other processor manufacturers, but their work has not been made public. There are also some related works in academia, such as the design of firmware TPM 2.0 based on ARM TrustZone.

[0005] RISC-V is an open instruction set architecture released in 2011. It has attracted great attention from academia and industry due to its features such as no licensing fees, elimination of unnecessary features in existing ISAs, and flexibility of modular expansion. As a result, it can be used in a variety of applications, from low-end embedded devices running bare metal programs to high-end servers running Linux operating systems. RISC-V has a natural security advantage, but there is currently no firmware TPM implementation for the RISC-V architecture, and the existing software TPM implementations based on other instruction set architectures generally rely on a trusted execution environment and a certain degree of hardware expansion (such as an EMMC controller that supports PRMB), which is not conducive to the use of embedded devices. Summary of the invention

[0006] In view of the lack of TPM implementation under the RISC-V architecture, the present invention proposes a method for implementing a firmware trusted platform (rTPM) module based on the RISC-V architecture. The method combines various characteristics of RISC-V and existing technical solutions, designs NVRAM secure storage without security hardware expansion, and implements a firmware trusted platform module solution under the RISC-V architecture.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0008] A first aspect provides a method for implementing a firmware trusted platform module based on a RISC-V architecture physical memory protection mechanism, including:

[0009] Isolate different modules of the program with different privilege priorities of RISC-V modes;

[0010] A data security storage and access control mechanism based on DRAM delayed physical unclonable function is set up, specifically: a symmetric key is generated by using delayed physical unclonable function technology, wherein each write operation uses a new symmetric key to encrypt key data and then stores it in NVRAM, a physical memory protection mechanism is used to map SPI Flash to physical memory, and PMP registers are configured to access data in NVRAM under controlled permissions;

[0011] A defense mechanism against rollback attacks is set up, specifically: a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts, where the hardware counter is updated for each incorrect attempt and the number of incorrect password attempts is read when the system starts.

[0012] In one implementation, a delayed physical unclonable function technique is used to generate a symmetric key, including:

[0013] By reading a specific DRAM storage area multiple times and counting error patterns, a symmetric key with unique physical characteristics is generated.

[0014] In one embodiment, when reading the critical data in the NVRAM, the method further includes:

[0015] The stored critical data is decrypted using a symmetric key generated using delayed physically unclonable function technology, and the decryption result is cached in the secure memory of the TPM.

[0016] In one embodiment, critical data in NVRAM includes data structures defined by the TPM architecture as well as user or platform specific unstructured data.

[0017] In one embodiment, the method further comprises:

[0018] During TPM operation, any data that needs to be written to NVRAM is cached and encrypted and updated in batches to NVRAM.

[0019] In one embodiment, the method further includes using the mtime register to calculate the lock time during system operation, and introducing a dirty bit to indicate whether the system is currently in a locked state, wherein the mtime register is a register on RISC-V that records the clock cycle since startup.

[0020] Based on the same inventive concept, the second aspect of the present invention provides a device for implementing a firmware trusted platform module based on a RISC-V architecture physical memory protection mechanism, comprising:

[0021] Isolation module, used to isolate different modules of the program with different privilege priorities of RISC-V modes;

[0022] The data security storage and access control mechanism setting module is used to set the data security storage and access control mechanism based on the DRAM delayed physical unclonable function, specifically: using the delayed physical unclonable function technology to generate a symmetric key, wherein each write operation uses a new symmetric key to encrypt the key data and then store it in NVRAM, using the physical memory protection mechanism, mapping the SPI Flash to the physical memory, and configuring the PMP register to access the data in the NVRAM under controlled permissions;

[0023] The defense mechanism setting module is used to set the defense mechanism against rollback attacks, specifically: a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts, wherein the hardware counter is updated for each incorrect attempt, and the number of incorrect password attempts is read when the system starts.

[0024] Based on the same inventive concept, the third aspect of the present invention provides a firmware trusted platform module, which is implemented using the method described in the first aspect, including an NVRAM secure memory module based on the PMP mechanism and a rollback attack defense module based on the RISC-V architecture, wherein the NVRAM secure memory module based on the PMP mechanism is used to implement memory isolation based on the RISC-V instruction set, utilizing the privileged architecture and physical memory protection mechanism of the RISC-V instruction set, and divide multiple memory areas and configure different access rights; the rollback attack defense module based on the RISC-V architecture is used to define a space in NVRAM to simulate a hardware counter for the number of incorrect password attempts, which is updated for each incorrect attempt, and the number of incorrect password attempts is read at the first time when the system starts, to achieve defense against rollback attacks.

[0025] In one embodiment, the rollback attack defense module based on the RISC-V architecture is also used to:

[0026] The mtime register is used to calculate the lock time during system operation, and a dirty bit is introduced to indicate whether it is currently in a locked state. The mtime register is a register on RISC-V that records the clock cycle since startup.

[0027] Based on the same inventive concept, the fourth aspect of the present invention provides a firmware TPM prototype system based on RISC-V architecture, including the firmware trusted platform module described in the third aspect.

[0028] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0029] The present invention proposes a method for implementing a firmware trusted platform module based on the physical memory protection mechanism of the RISC-V architecture, sets a data protection mechanism, and proposes a solution for reproducible generation of security keys without hardware storage, solving the problem of secure storage of firmware TPM NVRAM under the RISC-V architecture. In view of the problem that the software TPM lacks hardware monotonic counters and trusted clocks and is vulnerable to rollback attacks, a defense mechanism is set up to use NVRAM to record the number of password errors in the current state, and then read and restore the value from NV when the system restarts, solving the rollback attack problem faced by the software TPM.

[0030] In view of the fact that there is no firmware TPM solution for RISC-V architecture, the present invention makes full use of the characteristics of RISC-V architecture and designs and implements a firmware TPM prototype system based on RISC-V architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 A flowchart of a method for implementing a firmware trusted platform module based on a RISC-V architecture physical memory protection mechanism provided in an embodiment of the present invention;

[0033] Figure 2 This is a design diagram of a firmware TPM prototype system design framework based on the RISC-V architecture in an embodiment of the present invention.

[0034] Figure 3 This is the RISC-V secure boot process of an embodiment of the present invention.

[0035] Figure 4It is a schematic diagram of a rollback attack defense measure in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The inventor of this application has found through extensive research and practice that RISC-V has a natural security advantage, but there is currently no firmware TPM implementation for the RISC-V architecture, and the existing software TPM implementations based on other instruction set architectures generally rely on a trusted execution environment and a certain degree of hardware expansion (such as an EMMC controller that supports PRMB), which is not conducive to the use of embedded devices. Although pure software TPM cannot provide the same level of security as TPM chips, especially in terms of physical attacks, executing firmware TPM in the protected execution domain of the RISC-V core and using on-chip memory can resist software attacks and limited physical attacks. Implementing firmware TPM under the RISC-V architecture can greatly improve the security of embedded device systems at a very low cost.

[0037] Based on this, the present invention proposes a method for implementing a firmware trusted platform (rTPM) module based on the RISC-V architecture. The method combines various characteristics of RISC-V and existing technical solutions, designs NVRAM secure storage without the need for secure hardware extension, and implements a firmware trusted platform module solution under the RISC-V architecture. The solution includes two parts: (1) an NVRAM secure storage solution based on RISC-V physical memory protection and PUF (2) a defense mechanism against rollback attacks.

[0038] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] Embodiment 1

[0040] The present invention discloses a method for implementing a firmware trusted platform module based on a RISC-V architecture physical memory protection mechanism. Figure 1 , the method comprising:

[0041] Isolate different modules of the program with different privilege priorities of RISC-V modes;

[0042] A data security storage and access control mechanism based on DRAM delayed physical unclonable function is set up, specifically: a symmetric key is generated by using delayed physical unclonable function technology, wherein each write operation uses a new symmetric key to encrypt key data and then stores it in NVRAM, a physical memory protection mechanism is used to map SPI Flash to physical memory, and PMP registers are configured to access data in NVRAM under controlled permissions;

[0043] A defense mechanism against rollback attacks is set up, specifically: a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts, where the hardware counter is updated for each incorrect attempt and the number of incorrect password attempts is read when the system starts.

[0044] Specifically, by generating a unique key through DRAM Latency PUF and combining it with the PMP protection mechanism, high-security encrypted storage and access control of NVRAM data in TPM are achieved.

[0045] In one embodiment, the error attempt count and lock status are persistently stored in NVRAM, and the dirty bit and mtime timer are used to ensure that the correct count and lock status are maintained after the system is restarted, thereby effectively defending against rollback attacks.

[0046] Specifically, the implementation method provided in this embodiment isolates different modules of the program with the privileged priority of RISC-V U mode (user mode or user layer), S mode (supervisor mode or supervisor layer) and M mode (machine mode or machine layer) to ensure the security of the program, and adopts NVRAM design based on PMP (physical memory protection mechanism) and DRAM latency PUF (DRAM latency physical unclonable function) to defend against rollback attacks. The data protection mechanism includes an NVRAM secure storage solution.

[0047] The NVRAM secure storage solution based on RISC-V physical memory protection and PUF includes the following steps:

[0048] Step 1: NVRAM data encryption protection mechanism

[0049] (1) Data encryption and access control: In order to ensure the security of data in NVRAM, the present invention first encrypts the data when writing it to ensure that it is stored in NVRAM in ciphertext form. DRAM Latency PUF technology is used to generate encryption keys, and a new symmetric key is used to encrypt the data for each write operation and then stored in NVRAM. To prevent physical access risks, the present invention adopts the PMP mechanism to map SPI Flash to physical memory and configure PMP registers to only allow access to NVRAM data under controlled permissions. Through this protection mechanism, any unauthenticated access behavior cannot read or modify NVRAM data unless authorized by PMP. (SPI is Serial Peripheral Interface, because this project is applied to embedded systems, it is used to distinguish it from the usual parallel flash)

[0050] (2) Access and update of NVRAM data: During the initialization process of TPM, when reading key data from NVRAM, the present invention uses the symmetric key generated by DRAM Latency PUF to decrypt the stored data and cache the decrypted result in the secure memory of TPM to improve access efficiency and reduce direct access to NVRAM. At the same time, during the operation of TPM, the present invention caches any data that needs to be written to NVRAM and encrypts and updates it in batches to NVRAM, reducing the frequency of write operations and extending the service life of NVRAM.

[0051] Step 2: Construct a TPM NVRAM secure storage module based on DRAM Latency PUF. The present invention generates encryption keys through DRAM Latency PUF technology to ensure the security and uniqueness of data in NVRAM. The design of DRAM Latency PUF is based on the use of error modes that occur in specific DRAM cells when the refresh cycle is reduced. The method generates an encryption key with unique physical characteristics by reading a specific storage area multiple times and counting error modes. In practical applications, the TPM NVRAM module of the present invention calls DRAM Latency PUF each time the system starts, generates a key, and then performs decryption and encryption operations on NVRAM data.

[0052] The defense mechanism against firmware TPM rollback attacks includes the following steps:

[0053] Step 1: First define the failed_tries_counter (hardware counter variable) area in NVRAM used to simulate rTPM, and record the current number of failed attempts in a persistent manner. Each time user authentication fails, the current Failed_Tries (number of failed attempts) value is written to the failed_tries_counter in NVRAM to ensure the persistence of the failed attempt count. In the case of a system restart, the failed_tries_counter value in NVRAM is read and the Failed_Tries in memory is initialized to this value to protect against data loss caused by restart.

[0054] Step 2: When the device restarts, the system first checks the failed_tries_counter value in NVRAM. If the count value has reached the preset threshold, the system will directly enter the locked state and deny service, thereby ensuring that the rollback attack cannot reset the failure count. During the system lock period, the lock state is recorded by detecting the dirty bit to ensure that the correct state information is maintained in any case. The dirty bit is cleared when the lock state is released, and the system allows continued authentication attempts only when it is not locked.

[0055] Step 3: When the preset error threshold is reached, the system will automatically enter the locked state and prohibit all authentication attempts. The locked state will last until the time recorded by the mtime counter reaches the preset lock interval. During system operation, the mtime register records the time elapsed since the system was started, and normal operation can only be resumed after the count reaches the unlock interval. If the system is restarted during the lock period, the mtime register is restarted but the dirty bit remains locked to ensure that the lock cycle is not interrupted by the restart.

[0056] Specifically, NVRAM secure storage based on PMP physical memory protection includes the following:

[0057] Step 1: RISC-V secure boot. The boot process is as follows Figure 3 shown.

[0058] In the secure boot process of RISC-V, the core code of Zero Stage Bootloader (ZSBL) is first obtained from the read-only memory (ROM). Its main task is to perform basic hardware initialization and settings to provide the necessary environment for system startup. ZSBL is the most basic stage of the boot process and is responsible for the most basic initialization, including setting up key resources such as stack pointers and memory controllers to ensure reliable boot of the system. Then, ZSBL loads First Stage Bootloader (FSBL). FSBL is responsible for further hardware initialization, including starting Phase-Locked Loops (PLLs), that is, phase-locked loops, to generate stable clock signals, and initialize DDR memory to prepare for subsequent loading of the operating system. Next is the initialization of OpenSBI, which is a standard and portable supervisor binary interface on RISC-V, designed to support communication and interaction between the operating system and firmware. Our DRAM PUF (Physical Unclonable Function) module and rTPM (firmware TPM under the RISC-V architecture) module are executed in this step. Finally, control is transferred to U-Boot, which loads the operating system kernel.

[0059] When the rTPM starts, it first uses PUF to generate an encryption key store_key, which is always stored in the rTPM's memory space during the operation of the rTPM. Then, the rTPM reads the NVRAM encrypted by store_key from the specified area of ​​the flash, decrypts it using the key store_key, obtains the decrypted NVRAM data, and caches it in the rTPM memory. After that, each time a write operation to the NVRAM occurs, the rTPM first caches the write data in the NVRAM area in the memory, then encrypts it, and the encryption result is immediately updated and written back to the flash. It should be noted that NVRAM is an abstract storage area that stores persistent data required by the TPM. Flash is an external non-volatile memory that stores encrypted NVRAM data (critical data) externally. When a write occurs, it is first written to the memory, and then encrypted and written back to the flash.

[0060] Step 2: Use DRAM latency PUF (DRAM latency physical unclonable function) as the encryption key. In the present invention, in order to solve the problem of no hardware encryption module in the RISC-V architecture, DRAM latency PUF is used as the encryption key. The design principle is based on the access delay characteristics of DRAM. The read and write operations of DRAM need to be completed within a specific refresh cycle to ensure that data is not lost. When the refresh cycle is longer (i.e., the delay increases), some cells in the DRAM will produce errors due to leakage effects, and these errors will show specific patterns with slight differences in the physical environment and manufacturing process. These patterns remain roughly the same in each test and become a unique feature that can be used to generate "fingerprints" or key information. These features are derived from: (1) Differences in the manufacturing process: During the manufacturing process of DRAM, the physical properties of each cell will be slightly different, such as slight differences in capacitance, which will affect its data retention ability under delay conditions. (2) Changes in the working environment: Environmental factors such as temperature and humidity can also affect the stability of DRAM cells, thereby forming different delay patterns. In actual implementation, the access and refresh cycles of DRAM are controlled to test the error conditions of the unit under specific delay conditions, and finally a challenge-response pair is generated, and the features are extracted and quantified to achieve key generation.

[0061] The present invention uses DRAM latency PUF as an encryption key for NVRAM, which can generate a unique key without storing the key, thereby enhancing the security of device authentication while providing an unclonable hardware feature.

[0062] The rollback defense mechanism for firmware tpm is as follows Figure 4 As shown, specifically including the following:

[0063] Compared with hardware TPM, software TPM does not have a hardware counter (failed_tries_counter) to record the current number of incorrect password attempts. If only one variable is used to count incorrect attempts, it may be bypassed by an attacker using a restart. The present invention defines a space in NVRAM to simulate a hardware counter for the number of incorrect password attempts, which is updated for each incorrect attempt, and the number of incorrect password attempts is read at the first time when the system starts, ultimately achieving defense against rollback attacks. In addition, the present invention also uses a dirty bit to maintain the locked state of the system.

[0064] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and embodiments.

[0065] 1. The NVRAM secure storage solution based on DRAM latency PUF is described as follows:

[0066] In the TPM architecture, NVRAM is used to store two types of key data structures: (1) Data structures defined by the TPM architecture: including privacy data such as authorization values, seeds, evidence, counters, and clocks. This data must always be kept confidential and needs to be stored for a long time, and can still be accessed even if the device is powered off and restarted. (2) User- or platform-specific unstructured data: Accessed through indexes, providing users with a flexible storage interface. TPM supports user-defined data areas and access through index values.

[0067] DRAM Latency PUF uses the error patterns of DRAM under reduced latency parameters as a unique feature of the device to generate device-specific encryption keys. These error patterns are based on random differences in the manufacturing process, are unpredictable and difficult to replicate, and form a unique physical feature.

[0068] Generation process: (1) Write and read: Write known data (such as 4 rows ≈ 8KB) in a fixed storage segment of the LPDDR3 DRAM, and reduce the timing parameters to read the data to produce a unique failure mode. (2) Statistical strong 1 and strong 0: Through multiple experiments, the probability of 1 and 0 appearing in each unit under failure conditions is statistically analyzed. These statistical results are used to generate a key with a stable error rate. (3) Use error correction code: Based on the repetitive code error correction design, specific DRAM cells are selected during the registration phase to generate a stable 128-bit key. Through experiments, it is determined that these bits appear as 1 or 0 with a higher probability, and the statistical probability forms a stable key with a low error rate. (4) Secure key generation: Every time the device starts, DRAM Latency PUF generates an encryption key, without the need to store the key on the device, enhancing security.

[0069] Each time the rTPM writes NVRAM data, the rTPM first encrypts the data using the key (store_key) generated by the DRAM Latency PUF, and writes the ciphertext into the Flash, ensuring that physical access cannot crack the critical data. Based on the uniqueness and stability of the DRAM Latency PUF, the present invention provides a highly secure encryption key with low overhead, without the need to store additional keys.

[0070] 2. Rollback attack defense mechanism Figure 4 The specific instructions are as follows:

[0071] TPM has a mechanism to prevent dictionary attacks. Since the hardware counter cannot be directly accessed using software TPM, the present invention implements defense against rollback attacks through NVRAM persistent storage. (1) Define NVRAM space: Open up an area in NVRAM to save the simulated failed_tries_counter. Every time the password verification fails, update the counter value in NVRAM. (2) Read the counter value: After each system restart, first read the current value of failed_tries_counter from NVRAM, and assign the value to the Failed_Tries variable in memory to ensure that the restart does not reset the counter. (3) Implement rollback defense: If Figure 4 As shown in the figure, when an attacker makes Failed_Tries close to the threshold by guessing the password, the system will restore the value of failed_tries_counter from NVRAM after restarting, thus maintaining the original error count state. In this way, the attacker cannot bypass the dictionary attack limit by frequently restarting.

[0072] TPM's anti-dictionary attack mechanism also includes locking the device for a period of time after a certain number of incorrect attempts. This solution uses the mtime register and dirty bit to implement time management. A dirty bit is introduced to indicate whether it is currently in a locked state. When the system is locked, it will mark this bit as 1 and synchronize this state to the NVRAM. After restarting, the system can read the dirty bit to determine whether it is in a locked state. The mtime register is a register on RISC-V that records the clock cycle since startup. The solution uses the mtime register to calculate the lock time when the system is running. For example, when the system is in a locked state, read the value of the mtime register and calculate the elapsed lock time. If the system is restarted during the lock period, the system will still read the lock state in the dirty bit after the restart. mtime will count again from 0 at the restart, and the system will remeasure until the preset lock time is reached before releasing the lock state. This ensures that the system restart will not bypass the lock time.

[0073] In general, the key points to be protected by the present invention and the technical effects that can be achieved are as follows:

[0074] (1) In view of the fact that there is currently no firmware TPM solution for the RISC-V architecture, the present invention makes full use of the characteristics of the RISC-V architecture and designs and implements a firmware TPM prototype system based on the RISC-V architecture.

[0075] (2) A scheme for reproducibly generating secure keys without hardware storage is designed, solving the problem of secure storage of firmware TPM NVRAM under the RISC-V architecture.

[0076] (3) In view of the problem that software TPM lacks hardware monotonic counters and trusted clocks and is vulnerable to rollback attacks, the present invention uses NVRAM to record the number of password errors in the current state, and then reads and restores the value from NV when the system restarts, thereby solving the rollback attack problem faced by software TPM.

[0077] Embodiment 2

[0078] Based on the same inventive concept, this embodiment discloses a device for implementing a firmware trusted platform module based on a RISC-V architecture physical memory protection mechanism, including:

[0079] Isolation module, used to isolate different modules of the program with different privilege priorities of RISC-V modes;

[0080] The data security storage and access control mechanism setting module is used to set the data security storage and access control mechanism based on the DRAM delayed physical unclonable function, specifically: using the delayed physical unclonable function technology to generate a symmetric key, wherein each write operation uses a new symmetric key to encrypt the key data and then store it in NVRAM, using the physical memory protection mechanism, mapping the SPI Flash to the physical memory, and configuring the PMP register to access the data in the NVRAM under controlled permissions;

[0081] The defense mechanism setting module is used to set the defense mechanism against rollback attacks, specifically: a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts, wherein the hardware counter is updated for each incorrect attempt, and the number of incorrect password attempts is read when the system starts.

[0082] Since the device introduced in the second embodiment of the present invention is a device used to implement the method for implementing the firmware trusted platform module based on the RISC-V architecture physical memory protection mechanism in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the device, so it is not repeated here. All devices used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0083] Embodiment 3

[0084] Based on the same inventive concept, the present invention also provides a firmware trusted platform module, which is implemented using the method described in Example 1, including an NVRAM secure memory module based on the PMP mechanism and a rollback attack defense module based on the RISC-V architecture, wherein the NVRAM secure memory module based on the PMP mechanism is used to implement memory isolation based on the RISC-V instruction set, utilizing the privileged architecture and physical memory protection mechanism of the RISC-V instruction set, and divide multiple memory areas and configure different access rights. The rollback attack defense module based on the RISC-V architecture is used to define a space in NVRAM to simulate a hardware counter for the number of incorrect password attempts, which is updated for each incorrect attempt, and the number of incorrect password attempts is read at the first time when the system starts, to achieve defense against rollback attacks.

[0085] In one embodiment, the rollback attack defense module based on the RISC-V architecture is also used to:

[0086] The mtime register is used to calculate the lock time during system operation, and a dirty bit is introduced to indicate whether it is currently in a locked state. The mtime register is a register on RISC-V that records the clock cycle since startup.

[0087] Embodiment 4

[0088] The present invention also provides a firmware TPM prototype system based on RISC-V architecture, including the firmware trusted platform module described in implementation three.

[0089] See also Figure 2 , which is a design diagram of a firmware TPM prototype system design framework based on the RISC-V architecture in an embodiment of the present invention.

[0090] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0091] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0092] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for implementing a firmware trusted platform module based on RISC-V architecture, characterized in that: include: Isolate different modules of the program with different privilege priorities of RISC-V modes; A data security storage and access control mechanism based on DRAM delayed physical unclonable function is set up, specifically: a symmetric key is generated by using delayed physical unclonable function technology, wherein each write operation uses a new symmetric key to encrypt key data and then stores it in NVRAM, a physical memory protection mechanism is used to map SPI Flash to physical memory, and PMP registers are configured to access data in NVRAM under controlled permissions; A defense mechanism against rollback attacks is set up, specifically: a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts, where the hardware counter is updated for each incorrect attempt and the number of incorrect password attempts is read when the system starts.

2. The method for implementing a firmware trusted platform module based on the RISC-V architecture as claimed in claim 1, characterized in that: The delayed physical unclonable function technology is used to generate symmetric keys, including: By reading a specific DRAM storage area multiple times and counting error patterns, a symmetric key with unique physical characteristics is generated.

3. The method for implementing a firmware trusted platform module based on the RISC-V architecture as claimed in claim 1, characterized in that: When reading the key data in the NVRAM, the method further includes: The stored critical data is decrypted using a symmetric key generated using delayed physical unclonable function technology, and the decryption result is cached in the TPM's memory.

4. The method for implementing a firmware trusted platform module based on the RISC-V architecture as claimed in claim 3, characterized in that: Critical data in NVRAM includes data structures defined by the TPM architecture as well as user- or platform-specific unstructured data.

5. The method for implementing a firmware trusted platform module based on the RISC-V architecture as claimed in claim 1, characterized in that: The method further comprises: During TPM operation, any data that needs to be written to NVRAM is cached and encrypted and updated in batches to NVRAM.

6. The method for implementing a firmware trusted platform module based on the RISC-V architecture as claimed in claim 1, characterized in that: The method also includes using the mtime register to calculate the locking time when the system is running, and introducing a dirty bit to indicate whether it is currently in a locked state, wherein the mtime register is a register on RISC-V that records the clock cycle since startup.

7. A device for implementing a firmware trusted platform module based on RISC-V architecture, characterized in that: include: Isolation module, used to isolate different modules of the program with different privilege priorities of RISC-V modes; The data security storage and access control mechanism setting module is used to set the data security storage and access control mechanism based on the DRAM delayed physical unclonable function, specifically: using the delayed physical unclonable function technology to generate a symmetric key, wherein each write operation uses a new symmetric key to encrypt the key data and then store it in NVRAM, using the physical memory protection mechanism, mapping the SPI Flash to the physical memory, and configuring the PMP register to access the data in the NVRAM under controlled permissions; The defense mechanism setting module is used to set the defense mechanism against rollback attacks, specifically: a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts, wherein the hardware counter is updated for each incorrect attempt, and the number of incorrect password attempts is read when the system starts.

8. A firmware trusted platform module, characterized in that: The method described in any one of claims 1 to 6 is adopted for implementation, including an NVRAM secure memory module based on a PMP mechanism and a rollback attack defense module based on a RISC-V architecture, wherein the NVRAM secure memory module based on the PMP mechanism is used to utilize the privileged architecture and physical memory protection mechanism of the RISC-V instruction set to implement memory isolation, divide multiple memory areas and configure different access rights, and the rollback attack defense module based on the RISC-V architecture is used to define a space in NVRAM to simulate a hardware counter of the number of incorrect password attempts, which is updated for each incorrect attempt, and the number of incorrect password attempts is read at the first time when the system starts, to achieve defense against rollback attacks.

9. The firmware trusted platform module according to claim 8, characterized in that: The rollback attack defense module based on the RISC-V architecture is also used to: The mtime register is used to calculate the lock time during system operation, and a dirty bit is introduced to indicate whether it is currently in a locked state. The mtime register is a register on RISC-V that records the clock cycle since startup.

10. A firmware TPM prototype system based on RISC-V architecture, characterized in that: Comprising the firmware trusted platform module as claimed in claim 8.

Images