US 2022/0092189 A1Published application

Implementation of Trusted Computing System Based on Master Controller of Solid-State Drive

AssigneeMaxio Technology (Hangzhou) Co., Ltd.

InventorsGeorge Fong, BingJun Chen, GuoYang LI, ChenLuan Wang, ZiHua Xiao, Hui Jiang

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present disclosure relates to an implementation for a trusted computing system. According to the embodiments of the present disclosure, a master controller in an SSD, which is necessarily configured in the system, is used to provide all necessary security functionality of the system's RoT. The system does not need to contain any special RoT chip or module, does not need any modifications in the system design, is easy to adopt, and can be implemented by any system comprising a hard drive. All necessary security functions are completed by the master controller of the system's hard drive. Thus, not only can the cost of the security module be reduced, but more importantly, the mechanism directly protects information and resources (e.g., operating system, user programs, user data, etc.) that actually need to be protected in the system, and once the mechanism is enabled, the protection function cannot be bypassed.

Claims16

Dependent claims

A system for realizing a trusted computing platform, wherein the system comprises:

at least one host system and at least one hard drive subsystem containing a hard drive controller,
wherein the host system comprises at least one CPU and a platform firmware required to form a computer system,
the hard drive controller comprises hardware and software components required by a traditional hard drive and further comprises:
a random number generator, a read-only memory, an engine for operating a cryptographic algorithm set, an ordinary storage space, a system-data storage space protected by a cryptographic algorithm, and a user-data storage space also protected by a cryptographic algorithm,
said cryptographic algorithm set comprises an international-standard compliant cryptographic algorithm set including RSA, SHA and AES, and/or comprises a Chinese-national-standard compliant cryptographic algorithm set including SM2, SM3 and SM4, and/or comprises multiple cryptographic algorithm sets including RSA, SHA, AES, SM2, SM3 and SM4,
the system-data storage space comprises a solid-state drive subsystem firmware, and a reserved storage space configured to store a copy of the master boot record (MBR) module according to a traditional hard drive system,
the ordinary storage space comprises at least a portion of the system boot module configured to load a special pre-boot authentication (PBA) module, at least a portion of PBA is designed according to the present disclosure, both said system boot module and said PBA are executable codes running on the host system.

4 more elements

An apparatus for implementing a trusted computing platform, comprising:

a host system, comprising a system firmware;
a solid-state drive subsystem, connected and communicated with the host system through an interface, wherein the solid-state drive subsystem comprises a processor, a random number generator, a cryptographic algorithm engine and a storage space for storing an operating system and user data,
wherein, the solid-state drive subsystem further comprises a pre-boot authentication module, which is configured to judge whether measurable components comprising the system firmware and the operating system are in a known security state by use of a cryptographic algorithm and a root of trust, so that the operating system is booted under a condition that the pre-boot authentication module judges that a system operating environment is in a security state and a user identity is legal.

An operation method for a trusted computing platform, wherein the startup method comprises:

after the trusted computing platform is powered on, running a system firmware and a solid-state drive subsystem firmware;
running a pre-boot authentication module, based on a solid-state drive subsystem;
if the pre-boot authentication module determines that a system operating environment is in a security state and user identity is legal, running a boot program for an operating system, so as to boot the operating system,
wherein, the pre-boot authentication module is configured to judge whether measurable components comprising the system firmware and the operating system are in a known security state by use of a cryptographic algorithm and a root of trust.

1 more element

Dependencies are inferred from the claim text.

Facts

Application: 17/424,960Filed 17 Mar 2020
Priority: CN 201910208445.119 Mar 2019
Published: 24 Mar 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

G06F 21/575
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
G06F 21/31
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
G06F 21/32
User authentication: using biometric data, e.g. fingerprints, iris scans or voiceprints
G06F 21/44
Authentication, i.e. establishing the identity or authorisation of security principals: program or device authentication