Implementation method, device, module and system of firmware trusted platform module based on RISC-V architecture

Abstract

The present invention utilizes a firmware trusted platform module implemented by the PMP memory protection mechanism in the architecture to solve the problems of implementation complexity and the need for additional hardware support in the current firmware TPM solution under the RISC-V architecture. The method includes the following modules: (1) NVRAM secure memory module using the PMP mechanism: Based on the RISC-V instruction set, its privileged architecture and physical memory protection (PMP) technology are used to implement memory isolation, divide multiple memory areas and configure different access rights. In this way, the security of the memory is guaranteed from the hardware perspective, and at the same time, DRAM latency PUF is used to generate reversible keys, avoiding the security risks of key storage. PMP technology is further used to control access to Flash devices, so that NVRAM data can be securely encrypted and stored and effectively protected. (2) RISC-V architecture rollback attack defense module: Modify some TPM command semantics and use NVRAM to maintain the number of error attempts to deal with the problems that TPM may face, such as rollback attacks and lack of a secure clock.

Description

Technical Field

[0001] The present invention relates to the technical field of embedded systems, and in particular to an implementation method, device, module and system of a firmware trusted platform module based on the RISC-V architecture. Background Art

[0002] A Trusted Platform Module (TPM) is a chip embedded in a computer that provides a root of trust in trusted computing. Its specifications are developed by the Trusted Computing Group. Currently, the industry has begun to widely adopt TPMs for security features, including rollback prevention (Google), protection of static data (Microsoft and Google), virtualization of smart cards (Microsoft), and anti-malware during early boot. TPMs are already used in most commercial PCs, servers, and personal computers.

[0003] However, hardware TPMs lack flexibility and cannot adequately meet the needs of some mobile and embedded device scenarios. Most TPM chips are primarily designed for the x86 architecture; adding an additional TPM chip is inconvenient for lightweight devices; and when new specifications are developed, existing TPM hardware cannot be updated and becomes obsolete. Consequently, both academia and industry have proposed firmware TPM architectures.

[0004] There are already some firmware TPM implementations, such as those from processor manufacturers like Intel and AMD, but none of their work has been made public. There is also some related work in academia, such as the design of firmware TPM 2.0 based on ARM TrustZone.

[0005] RISC-V is an open instruction set architecture released in 2011. It has attracted significant attention from both academia and industry due to its lack of licensing fees, elimination of unnecessary features from existing ISAs, and flexibility in modular expansion. As a result, it can be used in a wide range of applications, from low-end embedded devices running bare-metal programs to high-end servers running the Linux operating system. RISC-V offers inherent security advantages, but there are currently no firmware TPM implementations specific to the RISC-V architecture. Existing software TPM implementations based on other instruction set architectures generally rely on a trusted execution environment and certain hardware extensions (such as an EMMC controller supporting PRMB), which hinders its use in embedded devices. Summary of the Invention

[0006] To address the lack of TPM implementations in the RISC-V architecture, this paper proposes a method for implementing a firmware trusted platform (rTPM) module based on the RISC-V architecture. This method combines the various characteristics of RISC-V with existing technical solutions to design NVRAM secure storage that does not require secure hardware extensions, thus realizing a firmware trusted platform module solution for the RISC-V architecture.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0008] A first aspect provides a method for implementing a firmware trusted platform module based on a RISC-V architecture physical memory protection mechanism, including:

[0009] Isolate different modules of the program using different RISC-V mode privilege priorities;

[0010] A data security storage and access control mechanism based on DRAM delayed physical unclonable functions is established. Specifically, a symmetric key is generated using delayed physical unclonable functions. Each write operation uses a new symmetric key to encrypt critical data before storing it in NVRAM. A physical memory protection mechanism is used to map the SPI Flash to physical memory, and the PMP register is configured to allow access to data in NVRAM under controlled permissions.

[0011] Set up a defense mechanism against rollback attacks. Specifically, define a space in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts. The hardware counter is updated with each incorrect attempt and the number of incorrect password attempts is read at system startup.

[0012] In one embodiment, a delayed physical unclonable function technique is used to generate a symmetric key, including:

[0013] By reading a specific DRAM storage area multiple times and counting error patterns, a symmetric key with unique physical characteristics is generated.

[0014] In one embodiment, when reading critical data in the NVRAM, the method further includes:

[0015] The stored critical data is decrypted using a symmetric key generated using delayed physically unclonable function technology, and the decryption result is cached in the TPM's secure memory.

[0016] In one embodiment, the critical data in NVRAM includes data structures defined by the TPM architecture as well as user- or platform-specific unstructured data.

[0017] In one embodiment, the method further comprises:

[0018] During TPM operation, any data that needs to be written to NVRAM is cached and encrypted and updated in batches to NVRAM.

[0019] In one embodiment, the method further includes using the mtime register to calculate the lock time during system operation, and introducing a dirty bit to indicate whether the system is currently in a locked state, wherein the mtime register is a register on RISC-V that records clock cycles since startup.

[0020] Based on the same inventive concept, the second aspect of the present invention provides an implementation device of a firmware trusted platform module based on the physical memory protection mechanism of the RISC-V architecture, comprising:

[0021] Isolation module, used to isolate different modules of the program with different privilege priorities of RISC-V modes;

[0022] The data security storage and access control mechanism setting module is used to set up a data security storage and access control mechanism based on the DRAM delayed physical unclonable function. Specifically, the delayed physical unclonable function technology is used to generate a symmetric key. In each write operation, a new symmetric key is used to encrypt the critical data and then store it in NVRAM. The physical memory protection mechanism is used to map the SPI Flash to the physical memory, and the PMP register is configured to allow access to the data in the NVRAM under controlled permissions.

[0023] The defense mechanism setting module is used to set the defense mechanism against rollback attacks. Specifically, a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts. Each incorrect attempt will update the hardware counter, and the number of incorrect password attempts will be read when the system starts.

[0024] Based on the same inventive concept, the third aspect of the present invention provides a firmware trusted platform module, which is implemented using the method described in the first aspect, including an NVRAM secure memory module based on the PMP mechanism and a rollback attack defense module based on the RISC-V architecture. The NVRAM secure memory module based on the PMP mechanism is used to implement memory isolation based on the RISC-V instruction set, utilizing the privileged architecture and physical memory protection mechanism of the RISC-V instruction set, dividing multiple memory areas and configuring different access rights. The rollback attack defense module based on the RISC-V architecture is used to define a space in NVRAM to simulate a hardware counter for the number of incorrect password attempts. The counter will be updated for each incorrect attempt, and the number of incorrect password attempts will be read as soon as the system starts to achieve defense against rollback attacks.

[0025] In one embodiment, the rollback attack defense module based on the RISC-V architecture is further used to:

[0026] The mtime register is used to calculate the lock time during system operation, and a dirty bit is introduced to indicate whether it is currently in a locked state. The mtime register is a register on RISC-V that records the clock cycle since startup.

[0027] Based on the same inventive concept, the fourth aspect of the present invention provides a firmware TPM prototype system based on the RISC-V architecture, including the firmware trusted platform module described in the third aspect.

[0028] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0029] This paper proposes a method for implementing a firmware trusted platform module based on the physical memory protection mechanism of the RISC-V architecture. This method incorporates a data protection mechanism and proposes a solution for reproducible secure key generation without hardware storage, addressing the secure storage issues of firmware TPM NVRAM in the RISC-V architecture. To address the vulnerability of software TPMs to rollback attacks due to their lack of hardware monotonic counters and trusted clocks, a defense mechanism is implemented that uses NVRAM to record the number of password errors in the current state. This value is then read and restored from NVRAM upon system restart, addressing the rollback attack issues faced by software TPMs.

[0030] To address the current lack of a firmware TPM solution for the RISC-V architecture, this paper fully utilizes the characteristics of the RISC-V architecture to design and implement a firmware TPM prototype system based on the RISC-V architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 Flowchart of a method for implementing a firmware trusted platform module based on the RISC-V architecture physical memory protection mechanism provided in an embodiment of the present invention;

[0033] Figure 2 This is a design diagram of the firmware TPM prototype system design framework based on the RISC-V architecture in an embodiment of the present invention.

[0034] Figure 3 This is the RISC-V secure boot process of an embodiment of the present invention.

[0035] Figure 4Schematic diagram of rollback attack defense measures in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] Through extensive research and practice, the inventors of this application have discovered that RISC-V has a natural security advantage, but there is currently no firmware TPM implementation for the RISC-V architecture, and existing software TPM implementations based on other instruction set architectures generally rely on a trusted execution environment and a certain degree of hardware extension (such as an EMMC controller that supports PRMB), which is not conducive to the use of embedded devices. Although pure software TPM cannot provide the same level of security as a TPM chip, especially in terms of physical attacks, executing firmware TPM in the protected execution domain of the RISC-V core and using on-chip memory can resist software attacks and limited physical attacks. Implementing firmware TPM under the RISC-V architecture can greatly improve the security of embedded device systems at a very low cost.

[0037] Based on this, the present invention proposes a method for implementing a firmware trusted platform (rTPM) module based on the RISC-V architecture. This method combines various features of RISC-V with existing technical solutions, designs NVRAM secure storage that does not require secure hardware extension, and implements a firmware trusted platform module solution under the RISC-V architecture. The solution includes two parts: (1) an NVRAM secure storage solution based on RISC-V physical memory protection and PUF; and (2) a defense mechanism against rollback attacks.

[0038] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0039] Example 1

[0040] The present invention discloses a method for implementing a firmware trusted platform module based on the physical memory protection mechanism of the RISC-V architecture. Figure 1 , the method comprising:

[0041] Isolate different modules of the program using different RISC-V mode privilege priorities;

[0042] A data security storage and access control mechanism based on DRAM delayed physical unclonable functions is established. Specifically, a symmetric key is generated using delayed physical unclonable functions. Each write operation uses a new symmetric key to encrypt critical data before storing it in NVRAM. A physical memory protection mechanism is used to map the SPI Flash to physical memory, and the PMP register is configured to allow access to data in NVRAM under controlled permissions.

[0043] Set up a defense mechanism against rollback attacks. Specifically, define a space in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts. The hardware counter is updated with each incorrect attempt and the number of incorrect password attempts is read at system startup.

[0044] Specifically, by generating a unique key through DRAM Latency PUF and combining it with the PMP protection mechanism, high-security encrypted storage and access control of NVRAM data in TPM are achieved.

[0045] In one embodiment, the error attempt count and lock status are persistently stored in NVRAM, and the dirty bit and mtime timer are used to ensure that the correct count and lock status are maintained after the system is restarted, thereby effectively defending against rollback attacks.

[0046] Specifically, the implementation method provided in this embodiment uses RISC-V's U-mode (user mode or user layer), S-mode (supervisor mode or supervisor layer), and M-mode (machine mode or machine layer) privilege priorities to isolate different program modules to ensure program security. It also employs an NVRAM design based on PMP (physical memory protection mechanism) and DRAM latency PUF (DRAM latency physically unclonable function) and provides defense against rollback attacks. The data protection mechanism includes an NVRAM secure storage solution.

[0047] The NVRAM secure storage solution based on RISC-V physical memory protection and PUF includes the following steps:

[0048] Step 1: NVRAM data encryption protection mechanism

[0049] (1) Data encryption and access control: In order to ensure the security of data in NVRAM, the present invention first encrypts the data when writing it to ensure that it is stored in NVRAM in ciphertext form. The encryption key is generated using DRAM Latency PUF technology, and a new symmetric key is used to encrypt the data for each write operation and then stored in NVRAM. To prevent physical access risks, the present invention adopts the PMP mechanism to map SPI Flash to physical memory and configure the PMP register to only allow access to NVRAM data under controlled permissions. Through this protection mechanism, any unauthenticated access behavior cannot read or modify NVRAM data unless authorized by PMP. (SPI is Serial Peripheral Interface, because this project is used in embedded systems, it is used to distinguish it from the usual parallel flash)

[0050] (2) NVRAM Data Access and Update: During TPM initialization, when reading critical data from NVRAM, the present invention uses the symmetric key generated by the DRAM Latency PUF to decrypt the stored data and caches the decrypted result in the TPM's secure memory to improve access efficiency and reduce direct access to NVRAM. Simultaneously, during TPM operation, the present invention caches any data that needs to be written to NVRAM and encrypts and updates it in batches, reducing the frequency of write operations and extending the lifespan of NVRAM.

[0051] Step 2: Construct a TPM NVRAM secure storage module based on DRAM Latency PUF. This invention generates encryption keys using DRAM Latency PUF technology to ensure the security and uniqueness of data in NVRAM. The design of DRAM Latency PUF is based on the utilization of error patterns that occur in specific DRAM cells when the refresh cycle is reduced. This method generates an encryption key with unique physical characteristics by repeatedly reading a specific storage area and counting the error patterns. In practical applications, the TPM NVRAM module of this invention calls DRAM Latency PUF each time the system boots up, generates a key, and then performs decryption and encryption operations on the NVRAM data.

[0052] The defense mechanism against firmware TPM rollback attacks includes the following steps:

[0053] Step 1: First, define the failed_tries_counter (a hardware counter variable) area in NVRAM used to simulate the rTPM and persistently record the current number of failed attempts. Each time user authentication fails, the current Failed_Tries value is written to the failed_tries_counter in NVRAM to ensure the persistence of the failed attempt count. In the event of a system reboot, the failed_tries_counter value in NVRAM is read and the Failed_Tries in memory is initialized to that value, protecting against data loss caused by reboot.

[0054] Step 2: When the device reboots, the system first checks the failed_tries_counter value in NVRAM. If the counter reaches the preset threshold, the system enters a lockout state and denies service, ensuring that a rollback attack cannot reset the failure counter. During the lockout period, the lockout state is recorded by checking the dirty bit to ensure that the correct state information is maintained under all circumstances. The dirty bit is cleared when the lockout state is released, and the system allows further authentication attempts only if the lockout state is not released.

[0055] Step 3: When the preset error threshold is reached, the system automatically enters a lockout state, prohibiting all authentication attempts. This lockout state persists until the mtime counter reaches the preset lockout interval. During system operation, the mtime register records the elapsed time since system startup. Normal operation can only resume after the unlock interval has been reached. If the system is rebooted during the lockout period, the mtime register resets, but the dirty bit remains locked, ensuring that the lockout period is not interrupted by a reboot.

[0056] Specifically, NVRAM secure storage based on PMP physical memory protection includes the following:

[0057] Step 1: RISC-V secure boot. The boot process is as follows Figure 3 shown.

[0058] During the RISC-V secure boot process, the Zero Stage Bootloader (ZSBL) core code is first retrieved from read-only memory (ROM). Its primary task is to perform basic hardware initialization and setup, providing the necessary environment for system boot. The ZSBL is the initial stage of the boot process and is responsible for the most basic initialization, including setting up key resources such as the stack pointer and memory controller to ensure reliable system boot. The ZSBL then loads the First Stage Bootloader (FSBL). The FSBL is responsible for further hardware initialization, including starting the Phase-Locked Loops (PLLs) to generate a stable clock signal and initializing the DDR memory to prepare for subsequent loading of the operating system. Next, OpenSBI is initialized, a standard, portable supervisor binary interface on RISC-V designed to support communication and interaction between the operating system and firmware. Our DRAM PUF (Physical Unclonable Function) module and rTPM (firmware TPM in the RISC-V architecture) module are implemented in this step. Finally, control is transferred to U-Boot, which loads the operating system kernel.

[0059] When the rTPM starts, it first uses the PUF to generate the encryption key store_key, which is always stored in the rTPM's memory space during the operation of the rTPM. The rTPM then reads the NVRAM encrypted by store_key from the specified area of ​​the flash, decrypts it using the key store_key, obtains the decrypted NVRAM data, and caches it in the rTPM memory. Each subsequent write operation to the NVRAM occurs, the rTPM first caches the write data in the NVRAM area in the memory, then encrypts it, and the encryption result is immediately updated and written back to the flash. It should be noted that NVRAM is an abstract storage area that stores the persistent data required by the TPM. Flash is an external non-volatile memory that stores the encrypted NVRAM data (critical data) externally. When a write occurs, it is first written to the memory and then encrypted and written back to the flash.

[0060] Step 2: Use DRAM latency PUF (DRAM latency physical unclonable function) as the encryption key. In this invention, in order to solve the problem of no hardware encryption module in the RISC-V architecture, DRAM latency PUF is used as the encryption key. The design principle is based on the access delay characteristics of DRAM. The read and write operations of DRAM need to be completed within a specific refresh cycle to ensure that data is not lost. When the refresh cycle is longer (i.e., the delay increases), some cells in the DRAM will produce errors due to leakage effects. These errors will show specific patterns with slight differences in the physical environment and manufacturing process. These patterns remain roughly the same in each test and become a unique feature that can be used to generate "fingerprints" or key information. These features come from: (1) Differences in the manufacturing process: During the manufacturing process of DRAM, the physical properties of each cell will be slightly different, such as slight differences in capacitance, which will affect its data retention ability under delay conditions. (2) Changes in the working environment: Environmental factors such as temperature and humidity will also affect the stability of DRAM cells, thereby forming different delay patterns. In actual implementation, the access and refresh cycles of DRAM are controlled to test the error conditions of the unit under specific delay conditions, and finally a challenge-response pair is generated, and the features are extracted and quantified to achieve key generation.

[0061] The present invention uses DRAM latency PUF as the encryption key of NVRAM, which can generate a unique key without storing the key, thereby enhancing the security of device authentication and providing an unclonable hardware feature.

[0062] Rollback defense mechanism for firmware tpm Figure 4 As shown, specifically including the following:

[0063] Compared to hardware TPMs, software TPMs lack a hardware counter (failed_tries_counter) to record the current number of incorrect password attempts. Using only a single variable to count incorrect attempts could allow attackers to bypass the counter by rebooting the system. The present invention defines a block of space in NVRAM to simulate a hardware counter for incorrect password attempts. This counter is updated with each incorrect attempt and read immediately upon system startup, ultimately achieving defense against rollback attacks. Furthermore, the present invention uses a dirty bit to maintain the system's locked state.

[0064] The technical solution of the present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0065] 1. The NVRAM secure storage solution based on DRAM latency PUF is described as follows:

[0066] In the TPM architecture, NVRAM is used to store two types of key data structures: (1) Data structures defined by the TPM architecture: including private data such as authorization values, seeds, evidence, counters, and clocks. This data must remain confidential and stored for a long time, and can be accessed even after the device is powered off and restarted. (2) User- or platform-specific unstructured data: Accessed through indexes, providing users with a flexible storage interface. The TPM supports user-defined data areas and accessing them through index values.

[0067] DRAM Latency PUF uses DRAM error patterns under reduced latency parameters as unique characteristics of a device to generate device-specific encryption keys. These error patterns, based on random variations in the manufacturing process, are unpredictable and difficult to replicate, forming a unique physical signature.

[0068] Generation process: (1) Write and read: Write known data (e.g., 4 rows ≈ 8KB) in a fixed storage segment of the LPDDR3 DRAM, and read the data with reduced timing parameters to generate a unique failure mode. (2) Statistical strong 1 and strong 0: Through multiple experiments, the probability of 1 and 0 appearing in each unit under failure conditions is statistically analyzed. These statistical results are used to generate a key with a stable error rate. (3) Use error correction code: Based on the repetitive code error correction design, specific DRAM units are selected during the registration phase to generate a stable 128-bit key. Through experiments, it is determined that these bits appear as 1 or 0 with a higher probability, and the statistical probability forms a stable key with a low error rate. (4) Secure key generation: Each time the device starts, the DRAM Latency PUF generates an encryption key, eliminating the need to store the key on the device, thereby enhancing security.

[0069] Each time the rTPM writes data to NVRAM, it first encrypts the data using a key (store_key) generated by the DRAM Latency PUF and writes the ciphertext to Flash, ensuring that physical access to the critical data is inaccessible. This invention leverages the uniqueness and stability of the DRAM Latency PUF to provide highly secure encryption keys with low overhead, without the need to store additional keys.

[0070] 2. Rollback attack defense mechanism Figure 4 The specific instructions are as follows:

[0071] TPM has a mechanism to prevent dictionary attacks. Since the hardware counter cannot be directly accessed using software TPM, the present invention implements defense against rollback attacks through NVRAM persistent storage. (1) Define NVRAM space: Open up an area in NVRAM to save the simulated failed_tries_counter. Every time the password verification fails, update the counter value in NVRAM. (2) Read the counter value: After each system restart, first read the current value of failed_tries_counter from NVRAM and assign the value to the Failed_Tries variable in memory to ensure that the restart will not reset the counter. (3) Implement rollback defense: If Figure 4 As shown in Figure 1, when an attacker brings Failed_Tries close to the threshold by guessing passwords, the system restores the failed_tries_counter value from NVRAM after reboot, thus maintaining the original error count state. This prevents attackers from bypassing dictionary attack restrictions by frequently rebooting.

[0072] The TPM's dictionary attack protection mechanism also includes locking the device for a period of time after a certain number of incorrect attempts. This solution implements time management using the mtime register and the dirty bit. A dirty bit is introduced to indicate whether the device is currently locked. When the system is locked, this bit is marked as 1 and the status is synchronized to NVRAM. After a reboot, the system can read the dirty bit to determine whether it is in the locked state. The mtime register is a RISC-V register that records clock cycles since boot. This solution uses the mtime register to calculate the lock time during system operation. For example, when the system is locked, the value of the mtime register is read and the lock time is calculated. If the system is rebooted during the lock period, the lock status in the dirty bit will still be read after the reboot. The mtime register restarts from 0 upon reboot, and the system remeasures until the preset lock time is reached before releasing the lock state. This ensures that the lock time cannot be bypassed by a system reboot.

[0073] In general, the key points to be protected and the technical effects that can be achieved by the present invention are as follows:

[0074] (1) In view of the fact that there is no firmware TPM solution for RISC-V architecture, the present invention makes full use of the characteristics of RISC-V architecture and designs and implements a firmware TPM prototype system based on RISC-V architecture.

[0075] (2) A secure key regeneration scheme that does not require hardware storage is designed to solve the secure storage problem of firmware TPM NVRAM under the RISC-V architecture.

[0076] (3) To address the problem that software TPM lacks a hardware monotonic counter and a trusted clock, making it vulnerable to rollback attacks, the present invention uses NVRAM to record the number of password errors in the current state, and then reads and restores this value from NV when the system restarts, thus solving the rollback attack problem faced by software TPM.

[0077] Example 2

[0078] Based on the same inventive concept, this embodiment discloses a device for implementing a firmware trusted platform module based on the physical memory protection mechanism of the RISC-V architecture, including:

[0079] Isolation module, used to isolate different modules of the program with different privilege priorities of RISC-V modes;

[0080] The data security storage and access control mechanism setting module is used to set up a data security storage and access control mechanism based on the DRAM delayed physical unclonable function. Specifically, the delayed physical unclonable function technology is used to generate a symmetric key. In each write operation, a new symmetric key is used to encrypt the critical data and then store it in NVRAM. The physical memory protection mechanism is used to map the SPI Flash to the physical memory, and the PMP register is configured to allow access to the data in the NVRAM under controlled permissions.

[0081] The defense mechanism setting module is used to set the defense mechanism against rollback attacks. Specifically, a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts. Each incorrect attempt will update the hardware counter, and the number of incorrect password attempts will be read when the system starts.

[0082] Since the device described in the second embodiment of the present invention is used to implement the method for implementing the firmware trusted platform module based on the RISC-V architecture physical memory protection mechanism in the first embodiment of the present invention, those skilled in the art will be able to understand the specific structure and variations of the device based on the method described in the first embodiment of the present invention, and therefore will not be described in detail here. All devices used in the method of the first embodiment of the present invention fall within the scope of protection of the present invention.

[0083] Example 3

[0084] Based on the same inventive concept, the present invention also provides a firmware trusted platform module, which is implemented using the method described in Example 1, including an NVRAM secure memory module based on the PMP mechanism and a rollback attack defense module based on the RISC-V architecture. The NVRAM secure memory module based on the PMP mechanism is used to implement memory isolation based on the RISC-V instruction set, utilizing the privileged architecture and physical memory protection mechanism of the RISC-V instruction set, divide multiple memory areas and configure different access rights. The rollback attack defense module based on the RISC-V architecture is used to define a space in NVRAM to simulate a hardware counter for the number of incorrect password attempts. The counter will be updated for each incorrect attempt, and the number of incorrect password attempts will be read immediately when the system starts, thereby achieving defense against rollback attacks.

[0085] In one embodiment, the rollback attack defense module based on the RISC-V architecture is further used to:

[0086] The mtime register is used to calculate the lock time during system operation, and a dirty bit is introduced to indicate whether it is currently in a locked state. The mtime register is a register on RISC-V that records the clock cycle since startup.

[0087] Example 4

[0088] The present invention also provides a firmware TPM prototype system based on the RISC-V architecture, including the firmware trusted platform module described in the third embodiment.

[0089] See Figure 2 , which is a design diagram of the firmware TPM prototype system design framework based on the RISC-V architecture in an embodiment of the present invention.

[0090] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0091] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0092] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they are aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, the present invention is intended to include such changes and modifications to the embodiments of the present invention if they fall within the scope of the claims and their equivalents.

Claims

1. A method for implementing a firmware trusted platform module based on the RISC-V architecture, characterized in that: include: Isolate different modules of the program using the privilege priorities of different RISC-V modes, specifically: isolate different modules of the program using the privilege priorities of RISC-V U mode (user mode or user layer), S mode (supervisor mode or supervisor layer), and M mode (machine mode or machine layer); A data security storage and access control mechanism based on DRAM delayed physical unclonable functions is established. Specifically, a symmetric key is generated using delayed physical unclonable functions. Each write operation uses a new symmetric key to encrypt critical data before storing it in NVRAM. A physical memory protection mechanism is used to map the SPI Flash to physical memory, and the PMP register is configured to allow access to data in NVRAM under controlled permissions. Set up a defense mechanism against rollback attacks. Specifically, define a space in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts. The hardware counter is updated with each incorrect attempt and the number of incorrect password attempts is read at system startup.

2. The method for implementing a firmware trusted platform module based on the RISC-V architecture according to claim 1, wherein: The delayed physical unclonable function technology is used to generate symmetric keys, including: By reading a specific DRAM storage area multiple times and counting error patterns, a symmetric key with unique physical characteristics is generated.

3. The method for implementing a firmware trusted platform module based on the RISC-V architecture according to claim 1, wherein: When reading the key data in the NVRAM, the method further includes: The stored critical data is decrypted using a symmetric key generated using delayed physical unclonable function technology, and the decryption result is cached in the TPM memory.

4. The method for implementing a firmware trusted platform module based on the RISC-V architecture according to claim 3, wherein: Critical data in NVRAM includes data structures defined by the TPM architecture as well as user- or platform-specific unstructured data.

5. The method for implementing a firmware trusted platform module based on the RISC-V architecture according to claim 1, wherein: The method further comprises: During TPM operation, any data that needs to be written to NVRAM is cached and encrypted and updated in batches to NVRAM.

6. The method for implementing a firmware trusted platform module based on the RISC-V architecture according to claim 1, wherein: The method also includes using the mtime register to calculate the lock time during system operation and introducing a dirty bit to indicate whether the system is currently in a locked state, wherein the mtime register is a register on RISC-V that records clock cycles since startup.

7. A device for implementing a firmware trusted platform module based on the RISC-V architecture, characterized in that: include: An isolation module is used to isolate different modules of a program based on the privilege priorities of different RISC-V modes, specifically: isolating different modules of a program based on the privilege priorities of RISC-V U mode (user mode or user layer), S mode (supervisor mode or supervisor layer), and M mode (machine mode or machine layer); The data security storage and access control mechanism setting module is used to set up a data security storage and access control mechanism based on the DRAM delayed physical unclonable function. Specifically, the delayed physical unclonable function technology is used to generate a symmetric key. In each write operation, a new symmetric key is used to encrypt the critical data and then store it in NVRAM. The physical memory protection mechanism is used to map the SPI Flash to the physical memory, and the PMP register is configured to allow access to the data in the NVRAM under controlled permissions. The defense mechanism setting module is used to set the defense mechanism against rollback attacks. Specifically, a space is defined in the NVRAM of the firmware trusted platform module to simulate a hardware counter for the number of incorrect password attempts. Each incorrect attempt will update the hardware counter, and the number of incorrect password attempts will be read when the system starts.

8. A firmware trusted platform module, characterized in that: The method according to any one of claims 1 to 6 is adopted for implementation, comprising an NVRAM secure memory module based on the PMP mechanism and a rollback attack defense module based on the RISC-V architecture, wherein the NVRAM secure memory module based on the PMP mechanism is used to utilize the privileged architecture and physical memory protection mechanism of the RISC-V instruction set to implement memory isolation, divide multiple memory areas and configure different access rights, and the rollback attack defense module based on the RISC-V architecture is used to define a space in NVRAM to simulate a hardware counter for the number of incorrect password attempts, which is updated for each incorrect attempt and read for the first time when the system starts, to achieve defense against rollback attacks.

9. The firmware trusted platform module according to claim 8, wherein: The rollback attack defense module based on the RISC-V architecture is also used to: The mtime register is used to calculate the lock time during system operation, and a dirty bit is introduced to indicate whether it is currently in a locked state. The mtime register is a register on RISC-V that records the clock cycle since startup.

10. A firmware TPM prototype system based on RISC-V architecture, characterized in that: Comprising the firmware trusted platform module as claimed in claim 8.

Images