Umbutho ongenzi nzuzo lowRISC kunye noGoogle kunye nabanye abaxhasi ngoNovemba 5, 2019 thaca iprojekthi I-OpenTitan, ebiza "iprojekthi yokuqala yomthombo ovulekileyo wokudala i-chip evulekileyo, i-architecture ye-chip ephezulu kunye neengcambu zokuthembela (i-RoT) kwinqanaba le-hardware."

I-OpenTitan esekelwe kuyilo lwe-RISC-V yi-chip yenjongo ekhethekileyo yokufakelwa kwiiseva kumaziko edatha kunye nakwesiphi na esinye isixhobo apho kuyimfuneko ukuqinisekisa ubunyani be-boot, ukukhusela i-firmware kwiinguqu kunye nokuphelisa ukuba nokwenzeka kwee-rootkits: ezi ziibhodi zomama, amakhadi enethiwekhi, iirotha, izixhobo ze-IoT, izixhobo eziphathwayo, njl.

Ewe kunjalo, iimodyuli ezifanayo zikhona kwiiprosesa zanamhlanje. Ngokomzekelo, imodyuli ye-Intel Hardware Boot Guard iyingcambu yokuthembela kwi-Intel processors. Iqinisekisa ubunyani be-UEFI BIOS ngekhonkco lokuthembela phambi kokulayisha i-OS. Kodwa umbuzo ngulo, singazithemba kangakanani iingcambu zokuthembela, ekubeni singenasiqinisekiso sokuba akuyi kubakho bugs kuyilo, kwaye akukho ndlela yokuyijonga? Jonga inqaku “UKhuphelo oluthembekileyo lukaSchrödinger. Intel Boot Guard" ngenkcazelo “yendlela ibug esele yenziwe ngayo iminyaka kwimveliso yabathengisi abaninzi ivumela umhlaseli onokuthi asebenzise obu buchwepheshe ukwenza i-rootkit efihlakeleyo engenakususwa (nokuba ngumdwelisi) kwinkqubo.”

Isoyikiso sokuthotywa kwezixhobo kwikhonkco lobonelelo liyinyani ngokumangalisayo: ngokucacileyo, nayiphi na injineli ye-elektroniki ye-amateur. ingathengisa ibug kwi-motherboard yomncedisiusebenzisa izixhobo ezingabizi ngaphezulu kweedola ezingama-200. Ezinye iingcali zirhanela ukuba “imibutho enohlahlo lwabiwo-mali lwamakhulu ezigidi zeerandi inokwenza oku kangangeminyaka emininzi.” Nangona kungekho bungqina, ngokwethiyori kunokwenzeka.

"Ukuba awukwazi ukuthemba i-bootloader ye-hardware, umdlalo uphelile," utsho Gavin Ferris, ilungu lebhodi yabalawuli be-lowRISC. - Akunandaba nokuba yintoni inkqubo yokusebenza - ukuba ngexesha ukulayisha inkqubo yokusebenza uphazamisekile, ke enye yinto yeteknoloji. Sele ugqibile."

Le ngxaki kufuneka isonjululwe ngeyokuqala yohlobo lwayo oluvulekileyo lweqonga lehardware iOpenTitan (Indawo yokugcina yeGitHub, amaxwebhu, iinkcukacha zehardware). Ukushenxa kwizisombululo zobunini kuya kunceda ukutshintsha “ishishini le-RoT elinobuvila nelineziphene,” utshilo uGoogle.

UGoogle ngokwakhe waqala ukuphuhlisa iTitan emva kokufumanisa inkqubo yokusebenza yeMinix eyakhelwe kwi-Intel Management Engine (ME) chips. Le OS entsonkothileyo yandisa indawo yokuhlaselwa ngeendlela ezingalindelekanga nezingalawulekiyo. Uphando wazama ukususa i-Intel Management Engine (ME), kodwa akuphumelelanga.

Yintoni ingcambu yokuthembana?

Inqanaba ngalinye lenkqubo yokuqalisa inkqubo ijonga ubunyani benqanaba elilandelayo, ngaloo ndlela ivelisa ikhonkco lokuthembela.

I-Root of Trust (i-RoT) yi-hardware-based authentication eqinisekisa ukuba umthombo womyalelo wokuqala ophunyeziweyo kwikhonkco lokuthembela awunakuguqulwa. I-RoT lukhuselo olusisiseko kwi-rootkits. Eli linqanaba eliphambili lenkqubo yokuqalisa, ebandakanyekayo ekuqalisweni okulandelayo kwenkqubo - ukusuka kwi-BIOS ukuya kwi-OS kunye nezicelo. Kufuneka iqinisekise ubunyani benyathelo ngalinye elilandelayo lokukhuphela. Ukwenza oku, isethi yezitshixo ezisayinwe ngedijithali zisetyenziswa kwinqanaba ngalinye. Omnye wemigangatho ethandwa kakhulu yokukhusela isitshixo se-hardware yi-TPM (iModyuli yePlatform ethembekileyo).

Ukuseka ingcambu yokuthembana. Ngentla yinkqubo yokuqalisa enamanyathelo amahlanu eyenza ikhonkco lokuthembela, iqala nge-bootloader kwimemori engaguqukiyo. Inyathelo ngalinye lisebenzisa isitshixo sikawonke-wonke ukungqinisisa isazisi secandelo elilandelayo eliza kulayishwa. Umfanekiso ovela kwincwadi kaPerry Lee "I-Intanethi ye-Architecture yezinto"

I-RoT inokusungulwa ngeendlela ezahlukeneyo:

• ukulayisha umfanekiso kunye nesitshixo sengcambu kwi-firmware okanye kwimemori engenakuguquguquka;
• ukugcina iqhosha lengcambu kwimemori yexesha elinye enokucwangciswa usebenzisa amasuntswana e-fuse;
• Ukulayisha ikhowudi kwindawo yememori ekhuselweyo kwindawo yokugcina ekhuselweyo.

Iiprosesa ezahlukeneyo ziphumeza ingcambu yokuthembela ngokwahlukileyo. Intel kunye ne-ARM
xhasa ezi teknoloji zilandelayo:

• I-ARM TrustZone. I-ARM ithengisa ibhloko ye-silicon yobunini kubavelisi betshiphu ebonelela ngengcambu yokuthembana kunye nezinye iindlela zokhuseleko. Oku kwahlula i-microprocessor kwi-core engakhuselekanga; iqhuba i-Trusted OS, inkqubo yokusebenza ekhuselekileyo ene-interface echazwe kakuhle yokunxibelelana namacandelo angakhuselekanga. Izixhobo ezikhuselweyo zihlala kumbindi othembekileyo kwaye kufuneka zibe khaphukhaphu kangangoko. Ukutshintsha phakathi kwamacandelo eentlobo ezahlukeneyo kwenziwa ngokusebenzisa ukutshintshwa kwemeko ye-hardware, ukuphelisa imfuno yesofthiwe ekhuselekileyo yokubeka iliso.
• Intel Boot Guard yindlela yehardware yokuqinisekisa ubunyani bebhloko yokuqala yesiqalo ngeendlela ezifihlakeleyo okanye ngenkqubo yomlinganiselo. Ukuqinisekisa ibhloko yokuqala, umenzi kufuneka avelise isitshixo se-2048-bit, equlethwe ngamacandelo amabini: esidlangalaleni kunye nangasese. Isitshixo sikawonke-wonke siprintwa ebhodini ngokuthi "detonating" bits fuse ngexesha lokuvelisa. La masuntswana asetyenziswa kanye kwaye akanakuguqulwa. Inxalenye yangasese yesitshixo ivelisa utyikityo lwedijithali ukwenzela ukuqinisekiswa okulandelayo kwenqanaba lokukhuphela.

Iqonga le-OpenTitan libonisa iindawo eziphambili ze-hardware / inkqubo yesoftware, njengoko kubonisiwe kumzobo ongezantsi.

Iqonga le-OpenTitan

Ukuphuhliswa kweqonga le-OpenTitan lilawulwa ngumbutho ongenzi nzuzo ophantsi kweRISC. Iqela lobunjineli lisekelwe eCambridge (UK), kwaye umxhasi oyintloko nguGoogle. Amaqabane asekayo aquka i-ETH Zurich, i-G + D yoKhuseleko lweSelula, i-Nuvoton Technology kunye ne-Western Digital.

Uphando upapashe isaziso iprojekthi kuGoogle Open Source blog corporate. Inkampani yathi i-OpenTitan izimisele "ukubonelela ngesikhokelo esikumgangatho ophezulu kwi-RoT yoyilo kunye nokudibanisa ukusetyenziswa kwiiseva zamaziko edatha, ukugcinwa, izixhobo ezinqamlekileyo kunye nokunye."

Ingcambu yokuthembela ikhonkco lokuqala kwikhonkco lokuthembela kwinqanaba elisezantsi kwimodyuli yekhompyutha ethembekileyo, ehlala ithenjwa ngokupheleleyo yinkqubo.

I-RoT ibalulekile kwizicelo ezibandakanya iziseko ezingundoqo zoluntu (ii-PKIs). Isisiseko senkqubo yokhuseleko apho inkqubo eyinkimbinkimbi efana nesicelo se-IoT okanye isikhungo sedatha sisekelwe. Ke kucacile ukuba kutheni uGoogle eyixhasa le projekthi. Ngoku inamaziko eenkcukacha ze-19 kumazwekazi amahlanu. Amaziko eenkcukacha, ukugcinwa, kunye nezicelo ezibalulekileyo ze-mission zibonisa indawo enkulu yokuhlaselwa, kunye nokukhusela esi sakhiwo, i-Google yaqala yavelisa ingcambu yayo yokuthembela kwi-chip ye-Titan.

Itshiphu yeTitan yobunini kumaziko edatha kaGoogle aqalwa aziswa ngoMatshi 2017 kwinkomfa elandelayo yeLifu likaGoogle. “Iikhompyuter zethu zenza uvavanyo lwe-cryptographic kwiphakheji nganye yesoftware kwaye emva koko zithathe isigqibo sokuba ziyinike ukufikelela kwimithombo yenethiwekhi. I-Titan idibanisa kule nkqubo kwaye inikezela ngokhuseleko olongezelelweyo, "abameli bakaGoogle batsho kumboniso.

Itshiphu yeTitan kwiseva kaGoogle

I-architecture ye-Titan ngaphambili yayiyeyeGoogle, kodwa ngoku yenziwa idomeyini yoluntu njengeprojekthi yomthombo ovulekileyo.

Inqanaba lokuqala leprojekthi kukuyilwa koyilo lwe-RoT olunengqiqo kwinqanaba le-chip, kubandakanywa nomthombo ovulekileyo we-microprocessor. lowRISC ibex, i-cryptographic processors, i-hardware random number generator, i-key and memory hierarchies yokugcinwa okungaguqukiyo kunye nokungaguqukiyo, iindlela zokukhusela, ii-peripherals ze-I / O kunye neenkqubo ezikhuselekileyo zokuqalisa.

UGoogle uthi i-OpenTitan isekwe kwimigaqo emithathu engundoqo:

• wonke umntu unethuba lokujonga iqonga kunye negalelo;
• ukwanda kokuguquguquka ngokuvula uyilo olukhuselekileyo lwengqiqo olungathintelwanga zizithintelo zokuthengisa;
• umgangatho awuqinisekiswanga kuphela luyilo ngokwalo, kodwa kunye ne-firmware yereferensi kunye namaxwebhu.

“Iitshiphusi zangoku ezineengcambu zokuthembela zingabanini. Babanga ukhuseleko, kodwa eneneni uyithatha nje kancinci kwaye awukwazi ukuyiqinisekisa ngokwakho, ”utshilo uDominic Rizzo, ingcali ekhokelayo kwezokhuseleko kwiprojekthi kaGoogle Titan. “Ngoku, okwesihlandlo sokuqala, kuyenzeka ukubonelela ngokhuseleko ngaphandle kokholo olumfamekileyo kubaphuhlisi bengcambu yoyilo lwentembeko. Ke isiseko asiqinanga nje kuphela, sinokuqinisekiswa. ”

URizzo wongeze ukuba i-OpenTitan inokuthathelwa ingqalelo "njengoyilo olucacileyo ngokuthelekiswa nemeko yangoku yezinto."

Ngokutsho kwabaphuhlisi, i-OpenTitan akufuneki ithathwe njengemveliso egqityiweyo, kuba uphuhliso alukagqitywa. Bavula ngamabomu iinkcukacha kunye noyilo oluphakathi kophuhliso ukuze wonke umntu akwazi ukuphonononga, anike igalelo, kwaye aphucule inkqubo ngaphambi kokuba imveliso iqale.

Ukuqala ukuvelisa iitshiphusi ze-OpenTitan, kufuneka ufake isicelo kwaye ufumane isiqinisekiso. Ngokucacileyo, akukho mali ifunekayo.

umthombo: www.habr.com