KR20230067436A - Trusted computing device and operating method thereof - Google Patents

Abstract

A trusted computing device and its operating method are provided. A trusted computing device according to some embodiments includes a device driven by firmware, and a master controller that generates an authentication value from the firmware and checks integrity of the authentication value in a first cycle, wherein the master controller includes the authentication value An authentication value generator that generates an authentication value, an authentication value storage that stores authentication values, a secure core that blocks external access to authentication values stored in the authentication value storage, and integrity of authentication values stored in the authentication value storage Contains an integrity checker that checks.

Description

Trusted computing device and operating method thereof

The present invention relates to a trusted computing device and an operating method thereof.

Various hacking attacks are increasing in a computing environment that provides the Internet, and constant security patching of an operating system or software to prevent them is considered an essential element. Accordingly, attempts have been made to fundamentally solve these problems, and as a result, Trusted Computing (TC) technology has been researched and developed.

Trusted computing technology is a technology that imposes reliability so that a computer can operate as originally intended. A hardware-based security chip such as a Trusted Platform Module (TPM) is installed in devices with all computing power. It is a technology to be applied in common and to provide software for this as an open standard. Trusted computing technology can be widely used in platforms where, for example, computer authentication, network, printing, mobile phone, application security, and the like are used.

At this time, a verifier (eg, a host) granted security accesses a platform (eg, a storage device) including a plurality of devices (eg, a plurality of firmwares). When doing so, it performs security attestation on multiple devices within the platform.

At this time, in response to the verifier's security certification request, the platform may transmit authentication values for each of a plurality of devices in the platform, and integrity of the authentication values transmitted from the platform to the verifier is required. .

A technical problem to be solved by the present invention is to provide a trusted computing device that guarantees the integrity of an authentication value used for security attestation.

Another technical problem to be solved by the present invention is to provide a method of operating a trusted computing device that guarantees the integrity of an authentication value used for security attestation.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

A trusted computing device according to some embodiments of the present invention for achieving the above technical problem is a device driven by firmware, and a master controller that generates an authentication value from the firmware and checks the integrity of the authentication value in a first cycle. The master controller includes an authentication value generator for generating an authentication value, an authentication value storage for storing the authentication value, a security core for blocking external access to the authentication value stored in the authentication value storage, and authentication It includes an integrity checker that checks the integrity of the authentication value stored in the value store.

A trusted computing device according to some embodiments of the present invention for achieving the above technical problem is a first device driven by a first firmware and a second device driven by a second firmware, and a first device from the first firmware. A master controller that generates an authentication value, checks the integrity of the first authentication value in a first cycle, generates a second authentication value from a second firmware, and checks the integrity of the second authentication value in a second cycle; , The master controller includes an authentication value generator for generating a first authentication value and a second authentication value, an authentication value storage for storing the first authentication value and a second authentication value, and a first authentication value stored in the authentication value storage and a second authentication value. It includes a security core that blocks access from the outside for two authentication values, and an integrity checker that checks the integrity of the first and second authentication values stored in the authentication value storage.

A trusted computing device according to some embodiments of the present invention for achieving the above technical problem is a trusted computing device including a master controller that checks the integrity of an authentication value for firmware driving the device, wherein the master controller is authenticated. The integrity of the value is checked every first cycle, but the master controller generates an authentication value through an authentication value generator, stores the authentication value through an authentication value storage, and stores the authentication value in the authentication value storage through a secure core. For values, access from outside is blocked, and the integrity of the authentication value stored in the authentication value storage is checked through an integrity checker.

Details of other embodiments are included in the detailed description and drawings.

1 is a block diagram illustrating a trusted computing system in accordance with some embodiments.
2 is a block diagram illustrating a master controller of a trusted computing device in accordance with some embodiments.
3 is a flowchart illustrating an operating method of a master controller of a trusted computing device according to some embodiments.
4 and 5 are block diagrams illustrating operations of a master controller of a trusted computing device according to some embodiments.
6 is a block diagram illustrating an integrity checker in a master controller of a trusted computing device according to some embodiments.
7 is a flowchart illustrating an operation of an integrity checker in a master controller of a trusted computing device according to some embodiments.
8 is a block diagram illustrating an attack detector in a master controller of a trusted computing device according to some embodiments.
9 is an exemplary diagram illustrating a system to which a trusted computing device according to some embodiments is applied.
10 is an exemplary diagram illustrating a storage system to which a trusted computing device according to some embodiments is applied.
11 is an exemplary diagram illustrating a data center to which a trusted computing device according to some embodiments is applied.

1 is a block diagram illustrating a trusted computing system in accordance with some embodiments.

Referring to FIG. 1 , the trusted computing system 1 includes a verifier 10 and a platform 20 .

The verifier 10 is a user using the platform 20 and may be a user requesting a service from the platform 20 . The verifier 10 may perform an operation for attesting whether the platform 20 is trustworthy or not. A user is a subject who uses any electronic device, such as, for example, personal computers, cell phones, handheld messaging devices, laptop computers, set-top boxes, personal digital assistants, or electronic book readers. can include

The platform 20 includes a master controller 200 and a plurality of devices 202-1 to 202-n, where n is a natural number. The master controller 200 may control the overall operation of the platform 20 . Also, the master controller 200 may communicate with devices included in the platform 20 .

For example, the master controller 200 may transmit a command to a plurality of devices 202-1 to 202-n. The master controller 200 may be, for example, a Baseboard Management Controller (BMC), a Trusted Platform Module (TPM), or a Secure Processor.

Each of the plurality of devices 202-1 to 202-n may include, for example, a central processing unit (CPU), a graphic processing unit (GPU), a storage device, or a NIC (Network Interface Card).

The storage device may include, for example, a 2D NAND memory array or a 3D (or vertical) NAND (VNAND) memory array. As another example, the storage device may include other various types of non-volatile memories. For example, storage devices include magnetic RAM (MRAM), spin-transfer torque MRAM (spin-transfer torque MRAM), conductive bridging RAM (CBRAM), ferroelectric RAM (FeRAM), phase RAM (PRAM), and resistive memory (resistive RAM). And it may be a storage device to which various other types of memories are applied.

Each of the plurality of devices 202-1 to 202-n may be driven by firmware 204-1 to 204-n. In this drawing, all of the plurality of devices 202-1 to 202-n are illustrated as including firmware 204-1 to 204-n, but the present invention is not limited thereto.

That is, only some of the plurality of devices 202-1 to 202-n may include firmware.

For example, assuming that the first device 202-1 is a central processing unit, firmware is not present in the first device, and the second device 202-2 is a ROM (Read Only Memory), The first device 202-1 may execute the firmware (or code or function) 204-2 programmed in the second device 202-2.

When the verifier 10 transmits an attestation request to the platform 20 to perform an operation of attesting whether the platform 20 is trustworthy, the platform 20 performs a plurality of An attestation response proving reliability of the devices 202-1 to 202-n is sent to the verifier 10.

At this time, the platform 20 transmits authentication values for the plurality of firmwares 204-1 to 204-n together. That is, the integrity of authentication values transmitted from the platform 20 to the verifier 10 must be maintained so that the verifier 10 can trust the attestation response.

Hereinafter, the configuration and operation of maintaining the integrity of the authentication values transmitted to the verifier 10 by the platform 20 (hereinafter collectively referred to as a trusted computing device) according to some embodiments will be described in detail. .

2 is a block diagram illustrating a master controller of a trusted computing device in accordance with some embodiments.

1 and 2, the master controller 200 includes a secure core 210, an authentication value generator 220, an authentication value storage 230, an integrity checker 240, and an attack detector 250. .

The secure core 210 includes a plurality of firmwares 204-1 to 204-n or codes for the plurality of firmwares 204-1 to 204-n (hereinafter, the plurality of firmwares 204-1 to 204-n). 204-n) is received.

Thereafter, the authentication value generator 220 generates a plurality of authentication values using the codes for the plurality of firmwares 204-1 to 204-n received from the secure core 210. For example, the authentication value generator 220 may generate a plurality of authentication values by applying a hash function to codes for the plurality of firmwares 204-1 to 204-n.

A plurality of authentication values generated through the authentication value generator 220 may be stored in the authentication value storage 230 . The authentication value storage 230 may include a plurality of registers and store each of a plurality of authentication values in each register. The present invention is not limited thereto, and a plurality of authentication values may be stored in one register.

When the plurality of authentication values are stored in the authentication value storage 230, the secure core 210 locks the plurality of authentication values. For example, the security core 210 may lock a plurality of authentication values stored in the authentication value storage 230 in terms of hardware.

In more detail, the secure core 210 blocks external access to the plurality of authentication values stored in the authentication value storage 230, thereby blocking tampering with the plurality of authentication values. Access from the outside may be, for example, access of another core in the master controller 200 or access of the verifier 10 .

Thereafter, the integrity checker 240 periodically checks the integrity of the plurality of authentication values stored in the authentication value storage 230 . A cycle in which the integrity checker 240 checks the integrity of a plurality of authentication values may be real time. The period in which the integrity checker 240 checks the integrity of the plurality of authentication values may be a period in which the verifier 10 transmits an attestation request to the platform 20 without being limited thereto.

Periods at which the integrity checker 240 checks the integrity of each of the plurality of authentication values may be different. For example, the integrity checker 240 may inspect the integrity of the first authentication value in a first cycle, and the second authentication value in a second cycle. Alternatively, cycles in which the integrity checker 240 checks the integrity of each of the plurality of authentication values may be the same. For example, when the integrity checker 240 checks the integrity of the first authentication value in a first cycle and the second authentication value in a second cycle, the first cycle and the second cycle may be the same. may be

Only the secure core 210 can control a cycle in which the integrity checker 240 checks the integrity of each of the plurality of authentication values.

As a result of the integrity checker 240 examining the integrity of the plurality of authentication values, if it is determined that the integrity is maintained, the integrity check continues.

If, as a result of the integrity checker 240 examining the integrity of the plurality of authentication values, if it is determined that the integrity is not maintained, the integrity checker 240 informs the attack detector 250 that the integrity of the authentication value is not maintained. transmits a signal indicating

Upon receiving the signal indicating that integrity is not maintained, the attack detector 250 resets the authentication value for which integrity is not maintained. For example, if the authentication value for which integrity is not maintained is 0x2456781285, the attack detector 250 resets it to 00000000. In addition, the attack detector 250 informs the security core 210 that the integrity of the authentication value is not maintained.

The operation of the attack detector 250 resetting the authentication value whose integrity is not maintained and the operation of notifying the security core 210 that the integrity of the authentication value is not maintained may be performed in parallel or sequentially. It could be.

3 is a flowchart illustrating an operating method of a master controller of a trusted computing device according to some embodiments. 4 and 5 are block diagrams illustrating operations of a master controller of a trusted computing device according to some embodiments.

1 to 5, the secure core 210 receives a plurality of firmwares 204-1 to 204-n or codes for the plurality of firmwares 204-1 to 204-n (S100 ).

Thereafter, the authentication value generator 220 uses the codes (Code 1 to Code n) for the plurality of firmwares 204-1 to 204-n received from the secure core 210 to generate a plurality of authentication values ( Authentication value 1 to Authentication value n) are generated (S200). For example, the authentication value generator 220 applies a hash function to codes (Code 1 to Code n) of the plurality of firmwares 204-1 to 204-n to obtain a plurality of authentication values (Authentication value). 1 to Authentication value n) can be created.

A plurality of authentication values (Authentication value 1 to Authentication value n) generated through the authentication value generator 220 may be stored in the authentication value storage 230 (S300). The authentication value storage 230 may include a plurality of registers 232-1 to 232-n, and store each of a plurality of authentication values in each register. For example, the first authentication value (Authentication value 1) is stored in the first register 232-1, the second authentication value (Authentication value 2) is stored in the second register 232-2, and the n-th Authentication value n may be stored in the n-th register 232-n.

The present invention is not limited thereto, and a plurality of authentication values (Authentication value 1 to Authentication value n) may be stored in one register 232-1. For example, as shown in FIG. 5 , a plurality of authentication values (Authentication value 1 to Authentication value n) may be stored in one register 232-1. The number of authentication values stored in one register is not limited in this figure.

When the plurality of authentication values (Authentication value 1 to Authentication value n) are stored in the authentication value storage 230, the secure core 210 locks the plurality of authentication values (Authentication value 1 to Authentication value n). let it For example, the security core 210 may lock a plurality of authentication values stored in the authentication value storage 230 in terms of hardware.

In more detail, the security core 210 blocks access from the outside to the plurality of authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230, and the plurality of authentication values (Authentication value n). Modification of 1 to Authentication value n) can be blocked. Access from the outside may be, for example, access of another core in the master controller 200 or access of the verifier 10 .

Thereafter, the integrity checker 240 periodically checks the integrity of a plurality of authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 (S500). A cycle in which the integrity checker 240 checks the integrity of the plurality of authentication values (Authentication value 1 to Authentication value n) may be real time. The integrity checker 240 checks the integrity of the plurality of authentication values (Authentication value 1 to Authentication value n) without being limited thereto, and the verifier 10 requests the platform 20 to verify the integrity. It may be a period of transmitting .

Periods at which the integrity checker 240 checks the integrity of each of the plurality of authentication values (Authentication value 1 to Authentication value n) may be different. For example, the integrity checker 240 may check the integrity of the first authentication value (Authentication value 1) in a first cycle, and the second authentication value (Authentication value 2) in a second cycle. Alternatively, the integrity checker 240 checks the integrity of each of the plurality of authentication values (Authentication value 1 to Authentication value n) may be the same. For example, when the integrity checker 240 checks the integrity of the first authentication value (Authentication value 1) in a first cycle and the second authentication value (Authentication value 2) in a second cycle, The first period and the second period may be identical to each other.

Only the secure core 210 can control a cycle in which the integrity checker 240 checks the integrity of each of the plurality of authentication values (Authentication value 1 to Authentication value n).

As a result of the integrity checker 240 examining the integrity of the plurality of authentication values (Authentication value 1 to Authentication value n) (S600), if it is determined that the integrity is maintained (Y), the integrity check continues (S500). ).

If, as a result of the integrity checker 240 examining the integrity of a plurality of authentication values (Authentication value 1 to Authentication value n), if it is determined that the integrity is not maintained (N), the integrity checker 240 is an attack detector ( 250) transmits a signal informing that the integrity of the authentication value is not maintained.

Upon receiving the signal indicating that integrity is not maintained, the attack detector 250 resets the authentication value for which integrity is not maintained. For example, if the authentication value for which integrity is not maintained is 0x2456781285, the attack detector 250 resets it to 00000000. In addition, the attack detector 250 informs the security core 210 that the integrity of the authentication value is not maintained (S700).

The operation of the attack detector 250 resetting the authentication value whose integrity is not maintained and the operation of notifying the security core 210 that the integrity of the authentication value is not maintained may be performed in parallel or sequentially. It could be.

6 is a block diagram illustrating an integrity checker in a master controller of a trusted computing device according to some embodiments.

Referring to FIGS. 2 , 4 and 6 , the integrity checker 240 includes a virgin tag generator 242 and a comparison tag generator 244 .

In the virgin tag generator 242, the authentication value generator 220 generates authentication values (Authentication value 1 to Authentication value n), and the generated authentication values (Authentication value 1 to Authentication value n) are stored in the authentication value storage 230. ), a virgin tag for each of the authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 is created. For example, the virgin tag generator 242 generates a first virgin tag (Virgin TAG 1) for a first authentication value (Authentication value 1) and a second virgin tag (Virgin TAG 1) for a second authentication value (Authentication value 2). TAG 2) can be created.

The virgin tag generator 242 may generate a virgin tag through HMAC, hash function, cyclic redundancy checking (CRC), or parity bit.

In addition, the comparison tag generator 244 checks the integrity of the authentication values (Authentication value 1 to Authentication value n) every cycle in which the integrity checker 240 checks the integrity of the authentication values (Authentication value 1 to Authentication value n). Create real time tag. For example, the comparison tag generator 244 includes a first real time tag (Real time TAG 1) for a first authentication value (Authentication value 1) and a second real time tag (Real time TAG 1) for a second authentication value (Authentication value 2). Real time TAG 2) can be created.

The comparison tag generator 244 may generate a real time tag through HMAC, hash function, Cyclic Redundancy Checking (CRC), or parity bit.

At this time, a virgin tag generated by the virgin tag generator 242 and a real time tag generated by the comparison tag generator 244 must be generated in the same manner. For example, if the virgin tag generator 242 generates a virgin tag through CRC, the comparison tag generator 244 also needs to generate a real time tag through CRC.

Thereafter, through the comparator 246, the integrity checker 240 checks the integrity of authentication values (Authentication value 1 to Authentication value n) every cycle, real time tag (Real time TAG) and virgin tag (Virgin TAG) Compare For example, the comparator 246 compares a first real time tag (Real time TAG 1) and a first virgin tag (Virgin TAG 1). Also, for example, the comparator 246 compares the second real time tag (Real time TAG 2) with the second virgin tag (Virgin TAG 2).

At this time, if it is determined that the real time tag and the virgin tag are identical, the integrity of the authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 is maintained. judge For example, if it is determined that the first real time tag (Real time TAG 1) and the first virgin tag (Virgin TAG 1) are the same, it is determined that the integrity of the first authentication value (Authentication value 1) is maintained. Also, for example, if it is determined that the second real time tag (Real time TAG 2) and the second virgin tag (Virgin TAG 2) are the same, it is determined that the integrity of the second authentication value (Authentication value 2) is maintained. .

Then, a real time tag is continuously generated.

If it is determined that the real time tag and the virgin tag are not identical, the integrity of the authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 is not maintained. can be judged by For example, if it is determined that the first real time tag (Real time TAG 1) and the first virgin tag (Virgin TAG 1) are not identical, it is determined that the integrity of the first authentication value (Authentication value 1) is not maintained. Also, for example, if it is determined that the second real time tag (Real time TAG 2) and the second virgin tag (Virgin TAG 2) are not identical, it is determined that the integrity of the second authentication value (Authentication value 2) is not maintained. do.

At this time, the integrity checker 240 sends a signal to the attack detector 250 informing that all or some of the authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 do not maintain integrity. Thereafter, the attack detector 250 receiving the signal indicating that integrity is not maintained resets the authentication value for which integrity is not maintained. For example, if the authentication value for which integrity is not maintained is 0x2456781285, the attack detector 250 resets it to 00000000. In addition, the attack detector 250 informs the security core 210 that the integrity of the authentication value is not maintained.

7 is a flowchart illustrating an operation of an integrity checker in a master controller of a trusted computing device according to some embodiments.

Referring to FIGS. 2, 4, 6, and 7 , the virgin tag generator 242 generates authentication values (Authentication value 1 to Authentication value n) by the authentication value generator 220, and the generated authentication values. When authentication value 1 through authentication value n are stored in the authentication value storage 230, a virgin tag for each of the authentication values stored in the authentication value storage 230 (Authentication value 1 through authentication value n) is stored. Create (S502). For example, the virgin tag generator 242 generates a first virgin tag (Virgin TAG 1) for a first authentication value (Authentication value 1) and a second virgin tag (Virgin TAG 1) for a second authentication value (Authentication value 2). TAG 2) can be created.

The virgin tag generator 242 may generate a virgin tag through HMAC, hash function, cyclic redundancy checking (CRC), or parity bit.

In addition, the comparison tag generator 244 checks the integrity of the authentication values (Authentication value 1 to Authentication value n) every cycle in which the integrity checker 240 checks the integrity of the authentication values (Authentication value 1 to Authentication value n). A real time tag is created (S504). For example, the comparison tag generator 244 includes a first real time tag (Real time TAG 1) for a first authentication value (Authentication value 1) and a second real time tag (Real time TAG 1) for a second authentication value (Authentication value 2). Real time TAG 2) can be created.

The comparison tag generator 244 may generate a real time tag through HMAC, hash function, Cyclic Redundancy Checking (CRC), or parity bit.

At this time, a virgin tag generated by the virgin tag generator 242 and a real time tag generated by the comparison tag generator 244 must be generated in the same manner. For example, if the virgin tag generator 242 generates a virgin tag through CRC, the comparison tag generator 244 also needs to generate a real time tag through CRC.

Thereafter, through the comparator 246, the integrity checker 240 checks the integrity of authentication values (Authentication value 1 to Authentication value n) every cycle, real time tag (Real time TAG) and virgin tag (Virgin TAG) Compare (S506). For example, the comparator 246 compares a first real time tag (Real time TAG 1) and a first virgin tag (Virgin TAG 1). Also, for example, the comparator 246 compares the second real time tag (Real time TAG 2) with the second virgin tag (Virgin TAG 2).

At this time, a result of comparing the real time tag and the virgin tag is checked (S602). If it is determined that the real time tag and the virgin tag are identical (Y), the integrity of the authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 is maintained. judge what is going on For example, if it is determined that the first real time tag (Real time TAG 1) and the first virgin tag (Virgin TAG 1) are the same, it is determined that the integrity of the first authentication value (Authentication value 1) is maintained. Also, for example, if it is determined that the second real time tag (Real time TAG 2) and the second virgin tag (Virgin TAG 2) are the same, it is determined that the integrity of the second authentication value (Authentication value 2) is maintained. .

Then, a real time tag is continuously generated (S504).

As a result of checking the result of comparing the real time TAG and the virgin tag (S602), if it is determined that the real time TAG and the virgin tag are not identical (N), , It may be determined that the integrity of authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 is not maintained (S604). For example, if it is determined that the first real time tag (Real time TAG 1) and the first virgin tag (Virgin TAG 1) are not identical, it is determined that the integrity of the first authentication value (Authentication value 1) is not maintained. Also, for example, if it is determined that the second real time tag (Real time TAG 2) and the second virgin tag (Virgin TAG 2) are not identical, it is determined that the integrity of the second authentication value (Authentication value 2) is not maintained. do.

At this time, the integrity checker 240 sends a signal to the attack detector 250 informing that all or some of the authentication values (Authentication value 1 to Authentication value n) stored in the authentication value storage 230 do not maintain integrity. Thereafter, the attack detector 250 receiving the signal indicating that integrity is not maintained resets the authentication value for which integrity is not maintained. For example, if the authentication value for which integrity is not maintained is 0x2456781285, the attack detector 250 resets it to 00000000. In addition, the attack detector 250 informs the security core 210 that the integrity of the authentication value is not maintained.

8 is a block diagram illustrating an attack detector in a master controller of a trusted computing device according to some embodiments.

Referring to FIG. 8 , the attack detector 250 includes a reset module 252 and a notification module 254 .

The reset module 252 of the attack detector 250 receiving the signal indicating that integrity is not maintained from the integrity checker 240 resets the authentication value for which integrity is not maintained. For example, if the authentication value for which integrity is not maintained is 0x2456781285, the reset module 252 resets it to 00000000.

In addition, the notification module 254 notifies the secure core 210 that the integrity of the authentication value is not maintained.

The operation of the reset module 252 resetting the authentication value whose integrity is not maintained and the operation of the notification module 254 notifying the security core 210 that the integrity of the authentication value is not maintained may be performed in parallel. and may be performed sequentially.

9 is an exemplary diagram illustrating a system to which a trusted computing device according to some embodiments is applied.

9 is a diagram illustrating a system 1000 to which a trusted computing device according to an embodiment of the present invention is applied. The system 1000 of FIG. 9 is basically a mobile phone such as a mobile phone, a smart phone, a tablet personal computer (PC), a wearable device, a healthcare device, or an internet of things (IOT) device. (mobile) system. However, the system 1000 of FIG. 9 is not necessarily limited to a mobile system, and can be used for vehicles such as a personal computer, a laptop computer, a server, a media player, or a navigation system. It may be an automotive device or the like.

Referring to FIG. 9 , the system 1000 may include a main processor 1100, memories 1200a and 1200b, and storage devices 1300a and 1300b, and additionally includes an image capturing device. 1410, user input device 1420, sensor 1430, communication device 1440, display 1450, speaker 1460, power supplying device 1470 and connections It may include one or more of the connecting interfaces 1480 .

The main processor 1100 may control the overall operation of the system 1000, and more specifically, the operation of other components constituting the system 1000. The main processor 1100 may be implemented as a general-purpose processor, a dedicated processor, or an application processor.

The main processor 1100 may include one or more CPU cores 1110 and may further include a controller 1120 for controlling the memories 1200a and 1200b and/or the storage devices 1300a and 1300b. Depending on embodiments, the main processor 1100 may further include an accelerator 1130 that is a dedicated circuit for high-speed data operations such as artificial intelligence (AI) data operations. Such an accelerator 1130 may include a graphics processing unit (GPU), a neural processing unit (NPU), and/or a data processing unit (DPU), and may be physically independent from other components of the main processor 1100. It may be implemented as a separate chip.

The memories 1200a and 1200b may be used as main memory devices of the system 1000 and may include volatile memories such as SRAM and/or DRAM, but may include non-volatile memories such as flash memory, PRAM, MRAM, and/or RRAM. may also include The memories 1200a and 1200b may also be implemented in the same package as the main processor 1100 .

The storage devices 1300a and 1300b may function as non-volatile storage devices that store data regardless of whether or not power is supplied, and may have a relatively large storage capacity compared to the memories 1200a and 1200b. The storage devices 1300a and 1300b may include storage controllers 1310a and 1310b and non-volatile memories (NVMs) 1320a and 1320b that store data under the control of the storage controllers 1310a and 1310b. can Non-volatile memory (1320a, 1320b) may include a flash memory of a 2-dimensional (2D) structure or a 3-dimensional (3D) V-NAND (Vertical NAND) structure, but other types of PRAM and / or RRAM, etc. It may also include non-volatile memory.

The storage devices 1300a and 1300b may be included in the system 1000 while being physically separated from the main processor 1100 or may be implemented in the same package as the main processor 1100 . In addition, the storage devices 1300a and 1300b have a form such as a solid state device (SSD) or a memory card, so that other components of the system 1000 can be accessed through an interface such as a connection interface 1480 to be described later. It may also be coupled to be detachable with the . The storage devices 1300a and 1300b may be devices to which standard rules such as UFS (Universal Flash Storage), eMMC (embedded multi-media card), or NVMe (non-volatile memory express) are applied, but are not necessarily limited thereto. It's not.

Although not shown, the storage devices 1300a and 1300b may include the master controller 200 described with reference to FIGS. 1 to 8 .

The photographing device 1410 may capture a still image or a video, and may be a camera, a camcorder, and/or a webcam.

The user input device 1420 may receive various types of data input from a user of the system 1000, and may use a touch pad, a keypad, a keyboard, a mouse, and/or It may be a microphone or the like.

The sensor 1430 can detect various types of physical quantities that can be acquired from the outside of the system 1000 and convert the detected physical quantities into electrical signals. The sensor 1430 may be a temperature sensor, a pressure sensor, an illuminance sensor, a position sensor, an acceleration sensor, a biosensor, and/or a gyroscope sensor.

The communication device 1440 may transmit and receive signals with other devices outside the system 1000 according to various communication protocols. Such a communication device 1440 may be implemented by including an antenna, a transceiver, and/or a modem (MODEM).

The display 1450 and the speaker 1460 may function as output devices that output visual information and auditory information to the user of the system 1000, respectively.

The power supply device 1470 may appropriately convert power supplied from a battery (not shown) and/or an external power source built into the system 1000 and supply the power to each component of the system 1000 .

The connection interface 1480 may provide a connection between the system 1000 and an external device connected to the system 1000 and capable of exchanging data with the system 1000. The connection interface 1480 is an Advanced Technology (ATA) Attachment), Serial ATA (SATA), external SATA (e-SATA), Small Computer Small Interface (SCSI), Serial Attached SCSI (SAS), Peripheral Component Interconnection (PCI), PCI express (PCIe), NVMe, IEEE 1394, It can be implemented in various interface methods such as USB (universal serial bus), SD (secure digital) card, MMC (multi-media card), eMMC, UFS, eUFS (embedded universal flash storage), CF (compact flash) card interface, etc. there is.

10 is an exemplary diagram illustrating a storage system to which a trusted computing device according to some embodiments is applied.

10 is a block diagram illustrating a host-storage system 2000 to which a trusted computing device according to an exemplary embodiment of the present invention is applied.

The host-storage system 2000 may include a host 2100 and a storage device 2200 . The host 2100 may be the verifier 10 described above with reference to FIGS. 1 to 8 . Also, the storage device 2200 may be the trusted computing device 20 described above with reference to FIGS. 1 to 8 .

Also, the storage device 2200 may include a storage controller 2210 and a nonvolatile memory (NVM) 2220 . Also, according to an exemplary embodiment of the present invention, the host 2100 may include a host controller 2110 and a host memory 2120 . The host memory 2120 may function as a buffer memory for temporarily storing data to be transmitted to the storage device 2200 or data transmitted from the storage device 2200 .

The storage device 2200 may include storage media for storing data according to a request from the host 2100 . As an example, the storage device 2200 may include at least one of a solid state drive (SSD), an embedded memory, and a removable external memory. When the storage device 2200 is an SSD, the storage device 2200 may be a device conforming to the non-volatile memory express (NVMe) standard. When the storage device 2200 is an embedded memory or an external memory, the storage device 2200 may be a device conforming to a universal flash storage (UFS) standard or an embedded multi-media card (eMMC) standard. The host 2100 and the storage device 2200 may each generate and transmit a packet according to an adopted standard protocol.

When the nonvolatile memory 2220 of the storage device 2200 includes a flash memory, the flash memory may include a 2D NAND memory array or a 3D (or vertical) NAND (VNAND) memory array. As another example, the storage device 2200 may include other various types of non-volatile memories. For example, the storage device 2200 may include a magnetic RAM (MRAM), a spin-transfer torque MRAM (Spin-Transfer Torgue MRAM), a conductive bridging RAM (CBRAM), a ferroelectric RAM (FeRAM), a phase RAM (PRAM), and a resistive memory ( Resistive RAM) and other various types of memory may be applied.

According to an embodiment, the host controller 2110 and the host memory 2120 may be implemented as separate semiconductor chips. Alternatively, in some embodiments, the host controller 2110 and the host memory 2120 may be integrated on the same semiconductor chip. As an example, the host controller 2110 may be any one of a plurality of modules included in an application processor, and the application processor may be implemented as a system on chip (SoC). In addition, the host memory 2120 may be an embedded memory included in the application processor, or may be a non-volatile memory or a memory module disposed outside the application processor.

The host controller 2110 stores data (eg, write data) of the buffer area of the host memory 2120 in the non-volatile memory 2220 or data (eg, read data) of the non-volatile memory 2220 in the buffer area. You can manage the operation of saving to .

The storage controller 2210 may include a host interface 2211 , a memory interface 2212 , and a central processing unit (CPU) 2213 . In addition, the storage controller 2210 includes a flash translation layer (FTL) 2214, a master controller 2215, a buffer memory 2216, an error correction code (ECC) 2217 engine, and encryption/decryption (Encryption/Decryption). Decryption) engine 2218 may be further included. The storage controller 2210 may further include a working memory (not shown) into which the flash translation layer (FTL) 2214 is loaded, and the non-volatile memory 2220 is stored by the CPU 2213 executing the flash translation layer. Data write and read operations for may be controlled.

The host interface 2211 may transmit and receive packets to and from the host 2100 . A packet transmitted from the host 2100 to the host interface 2211 may include a command or data to be written to the non-volatile memory 2220, and is transmitted from the host interface 2211 to the host 2100. The packet may include a response to a command or data read from the non-volatile memory 2220 . The memory interface 2212 may transmit data to be written in the nonvolatile memory 2220 to the nonvolatile memory 2220 or may receive data read from the nonvolatile memory 2220 . The memory interface 2212 may be implemented to comply with standard protocols such as Toggle or Open NAND Flash Interface (ONFI).

The flash translation layer 2214 may perform various functions such as address mapping, wear-leveling, and garbage collection. The address mapping operation is an operation of changing a logical address received from the host 2100 into a physical address used to actually store data in the nonvolatile memory 2220 . Wear-leveling is a technology for preventing excessive deterioration of a specific block by uniformly using blocks in the non-volatile memory 2220, exemplarily a firmware technology for balancing erase counts of physical blocks can be implemented through Garbage collection is a technique for securing usable capacity in the non-volatile memory 2220 by copying valid data of a block to a new block and then erasing the old block.

The master controller 2215 may be the master controller 200 described above with reference to FIGS. 1 to 8 .

The buffer memory 2216 may be included in the storage controller 2210, but may be disposed outside the storage controller 2210.

The ECC engine 2217 may perform error detection and correction functions for read data read from the nonvolatile memory 2220 . More specifically, the ECC engine 2217 may generate parity bits for write data to be written in the non-volatile memory 2220, and the parity bits generated in this way are used together with the write data in the non-volatile memory ( 2220) can be stored in. When data is read from the non-volatile memory 2220, the ECC engine 2217 corrects an error in the read data by using parity bits read from the non-volatile memory 2220 together with the read data, and the error-corrected read data can output

The encryption/decryption engine 2218 may perform at least one of an encryption operation and a decryption operation on data input to the storage controller 2210 .

For example, the encryption/decryption engine 2218 may perform an encryption operation and/or a decryption operation using a symmetric-key algorithm. In this case, the encryption/decryption engine 2218 may perform an encryption and/or decryption operation using, for example, an Advanced Encryption Standard (AES) algorithm or a Data Encryption Standard (DES) algorithm.

Also, for example, the encryption/decryption engine 2218 may perform an encryption operation and/or a decryption operation using a public key encryption algorithm. In this case, the encryption engine 2218 may perform encryption using a public key during an encryption operation, and decryption using a private key during a decryption operation, for example. For example, the encryption/decryption engine 2218 may use Rivest Shamir Adleman (RSA), Elliptic Curve Cryptography (ECC), or Diffie-Hellman (DH) encryption algorithms.

Without being limited thereto, the encryption/decryption engine 218 performs an encryption operation and/or a decryption operation using a quantum cryptography technology such as Homomorphic Encryption (HE), Post-Quantum Cryptography (PQC), or Functional Encryption (FE). can do.

11 is an exemplary diagram illustrating a data center to which a trusted computing device according to some embodiments is applied.

Referring to FIG. 11 , a data center 3000 is a facility that stores various types of data and provides services, and may also be referred to as a data storage center. The data center 3000 may be a system for operating a search engine and database, and may be a computing system used by companies such as banks or government agencies. The data center 3000 may include application servers 3100_1 to 3100_n and storage servers 3200_1 to 3200_m. The number of application servers 3100_1 to 3100_n and the number of storage servers 3200_1 to 3200_m may be variously selected according to embodiments, and the number of application servers 3100_1 to 3100_n and storage servers 3200_1 to 3200_m 3200_m) may be different from each other.

The application server 3100 or the storage server 3200 may include at least one of processors 3110 and 3210 and memories 3120 and 3220 . Taking the storage server 3200 as an example, the processor 3210 may control the overall operation of the storage server 3200, access the memory 3220, and send instructions and/or data loaded into the memory 3220. can run Memory 3220 includes DDR double data rate synchronous DRAM (SDRAM), high bandwidth memory (HBM), hybrid memory cube (HMC), dual in-line memory module (DIMM), Optane DIMM, and/or non-volatile DIMM (NVMDIMM). ) can be. According to embodiments, the number of processors 3210 and memories 3220 included in the storage server 3200 may be variously selected. In one embodiment, processor 3210 and memory 3220 may provide a processor-memory pair. In one embodiment, the number of processors 3210 and memories 3220 may be different from each other. Processor 3210 may include a single core processor or a multi-core processor. The above description of the storage server 3200 may be similarly applied to the application server 3100 . According to embodiments, the application server 3100 may not include the storage device 3150. The storage server 3200 may include one or more storage devices 3250 . The number of storage devices 3250 included in the storage server 3200 may be variously selected according to embodiments.

The application servers 3100_1 to 3100_n and the storage servers 3200_1 to 3200_m may communicate with each other through the network 3300 . The network 3300 may be implemented using Fiber Channel (FC) or Ethernet. At this time, FC is a medium used for relatively high-speed data transmission, and an optical switch providing high performance/high availability may be used. According to the access method of the network 3300, the storage servers 3200_1 to 3200_m may be provided as file storage, block storage, or object storage.

In one embodiment, network 3300 may be a storage-only network, such as a Storage Area Network (SAN). For example, the SAN may be an FC-SAN that uses an FC network and is implemented according to FC Protocol (FCP). As another example, the SAN may be an IP-SAN using a TCP/IP network and implemented according to the iSCSI (SCSI over TCP/IP or Internet SCSI) protocol. In another embodiment, network 3300 may be a generic network such as a TCP/IP network. For example, the network 3300 may be implemented according to protocols such as FC over Ethernet (FCoE), Network Attached Storage (NAS), and NVMe over Fabrics (NVMe-oF).

Hereinafter, the application server 3100_1 and the storage server 3200_1 will be mainly described. The description of the application server 3100_1 may be applied to other application servers 3100_n, and the description of the storage server 3200_1 may also be applied to other storage servers 3200_m.

The application server 3100_1 may store data requested by a user or client to be stored in one of the storage servers 3200_1 to 3200_m through the network 3300 . Also, the application server 3100_1 may acquire data requested by a user or client to read from one of the storage servers 3200_1 to 3200_m through the network 3300 . For example, the application server 3100_1 may be implemented as a web server or a database management system (DBMS).

The application server 3100_1 may access the memory 3120_n or the storage device 3150_n included in another application server 3100_n through the network 3300, or may access the storage servers 3200_1- through the network 3300. The memories 3220_1 to 3220_m or the storage devices 3250_1 to 3250_m included in the 3200_m may be accessed. Accordingly, the application server 3100_1 may perform various operations on data stored in the application servers 3100_1 to 3100_n and/or the storage servers 3200_1 to 3200_m. For example, the application server 3100_1 may execute a command for moving or copying data between the application servers 3100_1 to 3100_n and/or the storage servers 3200_1 to 3200_m. At this time, the data is transferred from the storage devices 3250_1-3250_m of the storage servers 3200_1-3200_m through the memories 3220_1-3220_m of the storage servers 3200_1-3200_m or directly to the application servers 3100_1-3100_n. may be moved to the memories 3120-3120n of Data traveling through the network 3300 may be encrypted data for security or privacy.

Although not shown, the master controller 200 described above with reference to FIGS. 1 to 8 may be included in the storage devices 3250_1 to 3250_m.

Taking the storage server 3200_1 as an example, the interface 3254_1 may provide a physical connection between the processor 3210_1 and the controller 3251_1 and a network interconnect (NIC) 3240_1 and the controller 3251_1. . For example, the interface 3254_1 may be implemented in a Direct Attached Storage (DAS) method that directly connects the storage device 3250_1 with a dedicated cable. Also, for example, the interface 3254_1 may include Advanced Technology Attachment (ATA), Serial ATA (SATA), external SATA (e-SATA), Small Computer Small Interface (SCSI), Serial Attached SCSI (SAS), and Peripheral SATA (PCI). Component Interconnection), PCIe (PCI express), NVMe (NVM express), IEEE 1394, USB (universal serial bus), SD (secure digital) card, MMC (multi-media card), eMMC (embedded multi-media card), It may be implemented in various interface methods such as UFS (Universal Flash Storage), eUFS (embedded Universal Flash Storage), and/or CF (compact flash) card interface.

The storage server 3200_1 may further include a switch 3230_1 and a NIC 3240_1. The switch 3230_1 may selectively connect the processor 3210_1 and the storage device 3250_1 or selectively connect the NIC 3240_1 and the storage device 3250_1 under the control of the processor 3210_1.

In one embodiment, the NIC 3240_1 may include a network interface card, a network adapter, and the like. The NIC 3240_1 may be connected to the network 3300 through a wired interface, a wireless interface, a Bluetooth interface, an optical interface, or the like. The NIC 3240_1 may include an internal memory, a digital signal processor (DSP), a host bus interface, and the like, and may be connected to the processor 3210_1 and/or the switch 3230_1 through the host bus interface. The host bus interface may be implemented as one of the examples of the interface 3254_1 described above. In one embodiment, the NIC 3240_1 may be integrated with at least one of the processor 3210_1 , the switch 3230_1 , and the storage device 3250_1 .

In the storage servers 3200_1-3200_m or application servers 3100_1-3100_n, the processor transmits commands to the storage devices 3150_1-3150_n and 3250_1-3250_m or memories 3120_1-3120_n and 3220_1-3220_m to program data. or can lead. In this case, the data may be error-corrected data through an Error Correction Code (ECC) engine. The data is data subjected to data bus inversion (DBI) or data masking (DM) processing, and may include Cyclic Redundancy Code (CRC) information. The data may be encrypted data for security or privacy.

The storage devices 3150_1 to 3150_n and 3250_1 to 3250_m may transmit control signals and command/address signals to the NAND flash memory devices 3252_1 to 3252_m in response to a read command received from the processor. Accordingly, when data is read from the NAND flash memory devices 3252_1 to 3252_m, the RE (Read Enable) signal may be input as a data output control signal and output data to the DQ bus. A Data Strobe (DQS) may be generated using the RE signal. Command and address signals may be latched in the page buffer according to a rising edge or a falling edge of a write enable (WE) signal.

The controller 3251_1 may control overall operations of the storage device 3250_1. In one embodiment, the controller 3251_1 may include static random access memory (SRAM). The controller 3251_1 may write data into the NAND flash 3252_1 in response to a write command, or may read data from the NAND flash 3252_1 in response to a read command. For example, a write command and/or a read command may be received from a processor 3210_1 in a storage server 3200_1, a processor 3210_m in another storage server 3200_m, or a processor 3110_1 or 3110_n in application servers 3100_1 or 3100_n. can be provided. The DRAM 3253_1 may temporarily store (buffer) data to be written to the NAND flash 3252_1 or data read from the NAND flash 3252_1. Also, the DRAM 3253_1 may store meta data. Here, the meta data is user data or data generated by the controller 3251_1 to manage the NAND flash 3252_1. The storage device 3250_1 may include a Secure Element (SE) for security or privacy.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, the present invention is not limited to the above embodiments and can be manufactured in a variety of different forms, and those skilled in the art in the art to which the present invention belongs A person will understand that the present invention may be embodied in other specific forms without changing the technical spirit or essential features. Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting.

1: Trusted Computing System 10: Validator 20: Trusted Computing Device 200: master controller 202-1 to 202-n: Devices 204-1 to 204-n: Firmwares 210: secure core 220: authentication value generator 230: authentication value storage 232-1 to 232-n: Registers 240: integrity checker 242: Virgin Tag Generator 244: comparison tag generator 246: comparator 250: attack detector 252: reset module 254 Notification module

Claims (10)

device powered by firmware; and
A master controller generating an authentication value from the firmware and inspecting the integrity of the authentication value in a first cycle,
The master controller,
an authentication value generator for generating the authentication value;
an authentication value storage for storing the authentication value;
A security core that blocks access from the outside to the authentication value stored in the authentication value storage;
and an integrity checker configured to check integrity of the authentication value stored in the authentication value storage. According to claim 1,
The authentication value generator,
A trusted computing device generating the authentication value by applying a hash function to the firmware. According to claim 1,
The authentication value storage,
A trusted computing device comprising a register for storing the authentication value. According to claim 1,
The integrity checker,
a virgin tag generator for generating a virgin tag for the authentication value when the authentication value generator generates the authentication value;
a comparison tag generator for generating a comparison tag for the authentication value in each of the first cycles;
A comparator for comparing the virgin tag and the comparison tag,
The comparator,
The trusted computing device recognizing maintaining the integrity of the authentication value when the virgin tag and the comparison tag are the same. According to claim 4,
The virgin tag generator,
A trusted computing device that generates the virgin tag through HMAC, hash function, Cyclic Redundancy Checking (CRC), or parity bit. According to claim 4,
The master controller,
When a signal indicating that the integrity of the authentication value is not maintained when the virgin tag and the comparison tag are different is received from the integrity checker,
A reset module for resetting the authentication value;
The trusted computing device further comprising an attack detector including a notification module notifying the secure core that integrity of the authentication value is not maintained. a first device driven by a first firmware and a second device driven by a second firmware; and
A first authentication value is generated from the first firmware, the integrity of the first authentication value is checked in a first cycle, and a second authentication value is generated from the second firmware to check the integrity of the second authentication value. Including a master controller that inspects in the second cycle,
The master controller,
an authentication value generator for generating the first authentication value and the second authentication value;
an authentication value storage for storing the first authentication value and the second authentication value;
a security core for blocking external access to the first authentication value and the second authentication value stored in the authentication value storage;
and an integrity checker configured to check integrity of the first authentication value and the second authentication value stored in the authentication value storage. According to claim 7,
The authentication value storage,
A first register for storing the first authentication value;
and a second register for storing the second authentication value. According to claim 8,
The first register and the second register are the same trusted computing device. A trusted computing device including a master controller that checks the integrity of authentication values for firmware that drives the device,
The master controller checks the integrity of the authentication value every first cycle,
The master controller,
Generating the authentication value through an authentication value generator;
Storing the authentication value through an authentication value storage;
Through a secure core, access from the outside is blocked for the authentication value stored in the authentication value storage,
and checking integrity of the authentication value stored in the authentication value storage using an integrity checker.

Images