Wifi router online upgrade security verification method and system

Abstract

The invention relates to the field of equipment safety verification, in particular to a wifi router on-line upgrading safety verification method and a wifi router on-line upgrading safety verification system. A wifi router online upgrade security verification system comprises a firmware package construction module, a firmware package verification module and a guarantee activation module. According to the method, a firmware packet header protection logic closed loop is formed through an innovatively designed multi-order composite verification structural body and an anti-offset signature positioning framework; the system can detect the nanoscale tampering of an attacker to the length identification field in real time, cuts off the power supply of the flash memory controller and erases the data buffer area at the hardware fusing level response speed when verification fails, and compared with a traditional scheme, the response efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of equipment security verification, and in particular to a WiFi router online upgrade security verification method and system. Background Art

[0002] The current online upgrade process for WiFi routers generally suffers from critical security flaws. Firmware transmission mostly relies on basic encryption protocols, making it difficult to defend against firmware tampering caused by man-in-the-middle attacks, allowing attackers to implant malicious code and hijack device control. Traditional verification schemes provide insufficient protection for the firmware package structure, making the length identifier field susceptible to buffer overflow attacks, leading to signature verification bypass. Signature positioning also lacks an anti-drift mechanism, allowing attackers to forge legitimate signature trigger areas by modifying field offsets. Furthermore, there is a lack of hardware-level linkage response after verification fails on the device side, and abnormal power outages or malicious flashing can easily damage both dual-boot partitions, resulting in permanent device failure.

[0003] Existing technologies have not yet effectively addressed the challenges of multi-level threat linkage: the firmware package structure lacks self-verification capabilities, making it difficult to identify subtle tampering of header fields; the hash verification process does not incorporate real-time hardware status, and environmental changes such as high temperature may lower the security threshold; the device lacks pre-boot diagnostics for the wireless module and file system during startup, making it impossible to block persistent attacks already implanted in memory. These defects make the upgrade process a vulnerable point for supply chain attacks, and there is an urgent need to establish a full-chain protection system covering transmission encryption, strong structural verification, hardware fuses, and startup diagnostics. Therefore, the present invention proposes a method and system for online upgrade security verification of WiFi routers. Summary of the Invention

[0004] The present invention forms a logical closed loop for firmware header protection through an innovatively designed multi-stage composite verification structure and an anti-drift signature positioning architecture. This system can detect in real time any nano-level tampering of the length identification field by an attacker, and when verification fails, it cuts off the power supply to the flash memory controller and erases the data buffer at a hardware fuse-level response speed, improving response efficiency compared to traditional solutions.

[0005] A WiFi router online upgrade security verification method, comprising: Calculate the cryptographic hash value H1 of the original firmware, sign H1 with the manufacturer's private key using the elliptic curve algorithm, and generate a digital signature Sign; construct a structured firmware package, which includes an N-byte firmware length identification field, L1 consecutive bytes of original firmware data, an M-byte signature length identification field, L2 consecutive bytes of digital signature Sign, and an anti-tampering verification structure; After the router device obtains the firmware package through the encrypted transmission channel, it reads the first N bytes from the start of the firmware package and parses them into the firmware length value L1. It then extracts the consecutive L1 bytes starting from the Nth byte offset as the original firmware copy. It determines the expected signature length L2_exp based on the preset elliptic curve algorithm type. After verifying the tamper-proof structure, it reads consecutive M bytes from the last L2_exp+M bytes at the end of the firmware package and parses them into the signature length identification value L2. If L2 and L2_exp are inconsistent, the process is terminated. Otherwise, it extracts consecutive L2 bytes from the last L2 bytes at the end of the firmware package as the signature data. It uses the preset public key to decrypt the signature data to obtain a reference hash value H1'. It then performs the same cryptographic hash operation on the original firmware copy as on the cloud using a parallel segmented hashing strategy to obtain a local hash value H2. The firmware is deemed legitimate if and only if H1' completely matches H2 and the signature verification passes. After verification, the original firmware copy is written to the backup partition of the memory and then booted up, and pre-boot diagnosis is performed, monitoring kernel signals. If successful, the backup partition is activated. If the timeout occurs, it automatically rolls back to the original partition and restarts.

[0006] Preferably, the specific operations of generating and verifying the tamper-proof verification structure include: When constructing the firmware package on the cloud, a multi-stage checksum synthesis operation is performed. First, the leading valid bit segment of the firmware length identification field and the trailing valid bit segment of the signature length identification field are extracted for a first-level bitwise exclusive OR operation. The operation result is then subjected to a second-level logical AND operation with the preset hardware architecture feature code. The device model cyclic redundancy check value is then superimposed to form a composite checksum structure that is not symmetrically embedded in the firmware package.

[0007] Preferably, the tamper-proof structure is verified, and the specific operations include: After the device extracts the firmware copy, it triggers the verification coprocessor to generate a dynamic verification code. When the similarity between the composite verification structure and the dynamic verification code is lower than the preset dynamic safety threshold, the hardware-level fuse protection is activated: the power supply of the flash memory controller write channel is first cut off, and then the data partition to be verified in the transmission buffer is erased. At the same time, the dangerous operation event containing the complete firmware header hash value, verification failure position bitmap and clock stamp is recorded in the kernel audit log.

[0008] Preferably, the signature data location and extraction process adopts a dual verification architecture that is resistant to address offset, and the specific operations are as follows: Before parsing the signature length identifier value L2, the device starts the digital signature pre-check module. This module calculates the theoretical storage area boundary address of the signature data based on the preset elliptic curve algorithm type and creates a restricted access sandbox area in the flash memory controller through reverse memory mapping technology. When performing a tail addressing operation, a two-stage positioning process is initiated simultaneously: the first stage reads the L2 identification value according to the offset calculation strategy of L2_exp+M. The second stage dynamically scans the characteristic header identifier of the digital signature Sign in the sandbox area through a cryptographic security pointer. The signature data copy channel is activated only when both the L2 value and the Sign characteristic header size check pass. A continuous verification mechanism is introduced in the signature extraction stage. The first 4 binary bits of the digital signature Sign are subjected to double protection by parity check and (7,4) Hamming code. The Hamming code check bit occupies a fixed 3-bit storage space. If a single-bit error is detected, it is corrected immediately. If multiple-bit errors exceeding the error correction capability limit are detected, the signature verification process is interrupted and the error vector register in the secure storage area is marked.

[0009] Preferably, the specific content of the parallel segmented hashing strategy is as follows: The device initializes a dynamic block partitioning engine, which determines the optimal sub-block partitioning parameters based on the current total amount of free memory, the number of processor cores, and the multiplication factor of the original firmware copy, creating a multi-threaded computing array with a ring buffer topology, in which each thread is bound to a dedicated processor core and connected to a dedicated memory pool via a high-speed interconnect bus. During the hash calculation startup phase, the main scheduler cuts the firmware data stream into multi-dimensional data slices based on cache line alignment and distributes them to working threads. Each thread uses a pipeline mode to perform a three-stage hash pipeline operation: the first stage preprocessing performs bit rearrangement on the input data block, the second stage executes multiple rounds of hash compression function iterations, and the final stage generates a timestamp hash intermediate value summary. The global monitor detects thread status in real time and implements failover: when the calculation delay of a thread exceeds the dynamic response window, its task is immediately assigned to the adjacent computing unit within the same processor core to perform takeover operations, and the cache area of ​​the abnormal thread is locked for memory error diagnosis scanning.

[0010] Preferably, pre-boot diagnostics are performed to monitor kernel signals, specifically as follows: In the initial stage of the device booting from the backup partition, the hierarchical diagnostic controller is started to execute the verification operation chain: the first-level hardware trusted root verification stage performs digital certificate chain verification on the kernel header and matches the signature policy matrix; the second-level wireless hardware self-test stage sends a customized diagnostic command sequence to the RF module while monitoring the signal spectrum integrity; the third-level file system static analysis stage initiates offline media scanning for key partitions to calculate double-end redundancy check values; each diagnostic level has an independent fuse mechanism: hardware verification failure will lock the boot decryption module, wireless anomalies will trigger the RF module power closed-loop control, and file system check errors will activate the bad block remapping engine; persistent faults at any level will trigger the diagnostic interrupt vector to be injected into the processor's non-maskable interrupt line. This pin is physically connected to the processor's non-maskable interrupt line, forcing a jump to the partition rollback microcode execution environment.

[0011] A WiFi router online upgrade security verification system, comprising: The firmware package construction module is used to calculate the cryptographic hash value H1 of the original firmware, sign H1 with the manufacturer's private key using the elliptic curve algorithm, and generate a digital signature Sign; construct a structured firmware package, which includes an N-byte firmware length identification field, a continuous L1-byte original firmware data body, an M-byte signature length identification field, a continuous L2-byte digital signature Sign, and an anti-tampering verification structure; The firmware package verification module is used to read the first N bytes from the starting position of the firmware package and parse them into the firmware length value L1 after the router device obtains the firmware package through the encrypted transmission channel, and extract the consecutive L1 bytes starting from the Nth byte offset position as the original firmware copy; determine the signature length expected value L2_exp based on the preset elliptic curve algorithm type, verify the tamper-proof structure, read consecutive M bytes from the last L2_exp+M bytes at the end of the firmware package and parse them into the signature length identification value L2, if L2 is inconsistent with L2_exp, the process is terminated, otherwise, the consecutive L2 bytes are extracted from the last L2 bytes at the end of the firmware package as the signature data; use the preset public key to decrypt the signature data to obtain a reference hash value H1', ​​perform the same cryptographic hash operation as the cloud on the original firmware copy through a parallel segmented hash strategy, and obtain a local hash value H2; if and only if H1' completely matches H2 and the signature verification passes, the firmware is determined to be legal; The activation module is used to write the original firmware copy to the backup partition of the memory after verification, boot and start, perform pre-boot diagnosis, monitor kernel signals, and activate the backup partition if successful. If the timeout occurs, it will automatically roll back to the original partition and restart.

[0012] The present invention has the following advantages: 1. The present invention forms a logical closed loop for firmware header protection through an innovatively designed multi-stage composite verification structure and an anti-drift signature positioning architecture. This system can detect in real time any nano-level tampering of the length identification field by an attacker. When verification fails, it cuts off the power supply to the flash memory controller and erases the data buffer at hardware-fuse-level response speed, improving response efficiency compared to traditional solutions.

[0013] 2. The present invention uses a multi-threaded hash array with a ring buffer topology to perform segmented verification, combined with a three-level pre-boot diagnosis and fuse-redirection linkage system. When encountering upgrade anomalies, this mechanism forms a failure protection depth through hardware-level isolation and a microcode-level rollback engine. Even in extreme scenarios where dual-boot partitions are simultaneously damaged, the device can still maintain a minimum operational state. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1This is a structural diagram of the WiFi router online upgrade security verification system used in an embodiment of the present invention. DETAILED DESCRIPTION

[0015] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0016] Example 1, a WiFi router online upgrade security verification method, comprising: Calculate the cryptographic hash value H1 of the original firmware, sign H1 with the manufacturer's private key using the elliptic curve algorithm, and generate a digital signature Sign. Construct a structured firmware package, which includes, in sequence, an N-byte firmware length identification field encoded in little-endian format, L1 consecutive bytes of original firmware data (the value L1 is the byte length of the original firmware), an M-byte signature length identification field encoded in little-endian format, L2 consecutive bytes of digital signature Sign, and an anti-tampering verification structure. The value of L2 is determined by the elliptic curve algorithm type, and the elliptic curve P-256 corresponds to 64 bytes. The hash value provides a benchmark for the integrity of the firmware itself. Any data tampering will cause the hash value to change dramatically. The digital signature uses private key encryption to bind the manufacturer's identity, ensuring that the firmware source is trustworthy and cannot be forged by a third party. After the router device obtains the firmware package through the encrypted transmission channel, it reads the first N bytes from the start of the firmware package and parses them into the firmware length value L1. It extracts the consecutive L1 bytes starting from the offset position of the Nth byte as the original firmware copy; based on the preset elliptic curve algorithm type, it determines the expected value of the signature length L2_exp (L2_exp=64 for the P-256 algorithm and L2_exp=96 for the P-384 algorithm), implements the header integrity verification based on the anti-tampering verification structure, and reads the consecutive M bytes from the last L2_exp+M bytes of the firmware package and parses them into the signature length identification value L2. If L2 is different from L2_exp, If they are consistent, the process is terminated; otherwise, consecutive L2 bytes are extracted from the L2th byte from the end of the firmware package as signature data; the preset public key is used to decrypt the signature data to obtain a reference hash value H1', ​​and the same cryptographic hash operation as the cloud is performed on the original firmware copy through a parallel segmented hash strategy to obtain a local hash value H2; the firmware is judged to be legal if and only if H1' and H2 completely match and the signature verification passes; among them, the tail reverse signature extraction mechanism of the present invention is immune to firmware expansion and overwriting attacks. At the same time, the anti-tampering structure prior header integrity → signature length and value double verification → hash-signature two-factor authentication forms a three-level progressive defense.

[0017] After verification, the original firmware copy is written to the backup partition of the memory. After writing is completed, the boot flag of the boot configuration area is updated to point to the backup partition; the system restart is triggered to make the device boot from the backup partition. When the device starts from the backup partition, the pre-boot diagnostic sequence is executed, the timeout monitoring window is opened and the operating system kernel ready signal is monitored within the window period. If a valid signal is captured, the backup partition is permanently activated; if the window times out, the boot pointer of the original active partition is automatically reset according to the multi-stage transaction mark status and the rollback restart process is triggered.

[0018] The specific operations of generating and verifying the tamper-proof verification structure include: When constructing a firmware package on the cloud, a multi-stage checksum synthesis operation is performed. First, the leading valid bit segment of the firmware length identifier field and the trailing valid bit segment of the signature length identifier field are extracted and subjected to a first-level bitwise exclusive-OR operation. The result of this operation is then subjected to a second-level logical-AND operation with the preset hardware architecture signature. The cyclic redundancy check value of the device model identifier is then superimposed to form a composite checksum structure, which is asymmetrically embedded in strategic locations within the firmware package. During the device-side parsing process, the verification coprocessor is triggered immediately after the firmware copy is extracted, and a dynamic verification code is generated through the same multi-stage operation process. When it is detected that the similarity between the composite verification structure and the dynamic verification code is lower than the preset dynamic safety threshold (the threshold is determined by experts based on the current temperature), the hardware-level fuse protection is activated: the power supply of the flash memory controller write channel is first cut off, and then the data partition to be verified in the transmission buffer is erased. At the same time, the dangerous operation event containing the complete firmware header hash value, the verification failure position bitmap and the clock stamp is recorded in the kernel audit log.

[0019] The signature data location and extraction process uses a dual verification architecture that resists address offsets. The specific operations are as follows: Before parsing the signature length identifier value L2, the device starts the digital signature pre-check module. This module calculates the theoretical storage area boundary address of the signature data based on the preset elliptic curve algorithm type and creates a restricted access sandbox area in the flash memory controller through reverse memory mapping technology. When performing a tail addressing operation, a two-stage positioning process is initiated simultaneously: the first stage reads the L2 identification value according to the offset calculation strategy of L2_exp+M. The second stage dynamically scans the characteristic header identifier of the digital signature Sign in the sandbox area through a cryptographic security pointer. The signature data copy channel is activated only when both the L2 value and the Sign characteristic header size check pass. A continuous verification mechanism is introduced in the signature extraction stage. The first 4 binary bits of the digital signature Sign are subjected to double protection by parity check and (7,4) Hamming code. The Hamming code check bit occupies a fixed 3-bit storage space. If a single-bit error is detected, it is corrected immediately. If multiple-bit errors exceeding the error correction capability limit are detected, the signature verification process is interrupted and the error vector register in the secure storage area is marked.

[0020] The specific content of the parallel segmented hashing strategy is as follows: The device initializes a dynamic block partitioning engine, which determines the optimal sub-block partitioning parameters based on the current total amount of free memory, the number of processor cores, and the multiplication factor of the original firmware copy, creating a multi-threaded computing array with a ring buffer topology, in which each thread is bound to a dedicated processor core and connected to a dedicated memory pool via a high-speed interconnect bus. During the hash calculation startup phase, the main scheduler cuts the firmware data stream into multi-dimensional data slices based on cache line alignment and distributes them to working threads. Each thread uses a pipeline mode to perform a three-stage hash pipeline operation: the first stage preprocessing performs bit rearrangement on the input data block, the second stage executes multiple rounds of hash compression function iterations, and the final stage generates a timestamp hash intermediate value summary. The global monitor detects thread status in real time and implements failover: when the calculation delay of a thread exceeds the dynamic response window, its task is immediately assigned to the adjacent computing unit within the same processor core to perform takeover operations, and the cache area of ​​the abnormal thread is locked for memory error diagnosis scanning.

[0021] The establishment and maintenance of the encrypted transmission channel includes a hardware-enhanced two-way authentication system. Before the router initiates an upgrade request, the pre-activated cryptographic coprocessor in the secure boot engine first generates a true random number sequence based on a quantum noise source. Specifically, the national secret TRNG module (GM / T0062 standard) in the router's built-in SM4 chip is called to generate the true random number sequence, extracting key fragments from the sequence as transient session factors. At the same time, the device's unique DNA code stored in the hardware trusted module is collected and a one-way hash transformation is performed. A deeply integrated network security processing unit is used to construct a multi-layer encapsulated transmission frame. The core layer is structured business data containing the original firmware request, the middle layer is an authentication header embedded with the transient session factor and DNA hash value, and the outer layer is encapsulated as an IPSec security association tunnel with dynamic key rotation. When receiving a cloud response, the tunnel decapsulation module prioritizes the timeliness of the session factor and its temporal correlation characteristics with the original request, and then implements chained device identity authentication through DNA hash value comparison. Failure of verification at any link triggers the transmission channel self-destruct sequence: all copies of the current session key seed are destroyed, the network protocol stack state machine is reset to the initial security baseline, and the intermediate operation cache of the cryptographic coprocessor is cleared.

[0022] The pre-boot diagnostic sequence integrates a multi-dimensional failure protection strategy, specifically as follows: In the initial stage of the device booting from the backup partition, the hierarchical diagnostic controller is started to execute the verification operation chain: in the first-level hardware trusted root verification stage, the digital certificate chain is verified on the kernel header and matched with the signature policy matrix. The signature policy matrix is ​​pre-placed in the secure storage area. In the second-level wireless hardware self-test stage, a customized diagnostic command sequence is sent to the RF module while monitoring the signal spectrum integrity. In the third-level file system static analysis stage, an offline media scan is initiated for the key partition to calculate the double-end redundancy check value. Each diagnostic level has an independent fuse mechanism: hardware verification failure will lock the boot decryption module, wireless anomalies will trigger the RF module power closed-loop control, and file system check errors will activate the bad block remapping engine. A persistent fault at any level will trigger the diagnostic interrupt vector to be injected into the processor's non-maskable interrupt line. Specifically, a reset signal is sent to the CPU through the INT_NMI pin of the hardware watchdog module. This pin is physically connected to the processor's non-maskable interrupt line, forcing a jump to the partition rollback microcode execution environment.

[0023] Example 2, a WiFi router online upgrade security verification system, such as Figure 1 As shown, including: The firmware package construction module is used to calculate the cryptographic hash value H1 of the original firmware, sign H1 with the manufacturer's private key using the elliptic curve algorithm, and generate a digital signature Sign. It also constructs a structured firmware package, which includes, in sequence, an N-byte firmware length identification field encoded in little-endian format, L1 consecutive bytes of original firmware data (the value L1 is the byte length of the original firmware), an M-byte signature length identification field encoded in little-endian format, L2 consecutive bytes of digital signature Sign, and an anti-tampering verification structure. The value of L2 is determined by the elliptic curve algorithm type, and the elliptic curve P-256 corresponds to 64 bytes. The firmware package verification module is used to read the first N bytes from the start of the firmware package after the router device obtains the firmware package through the encrypted transmission channel, parse it into the firmware length value L1, and extract the consecutive L1 bytes starting from the offset position of the Nth byte as the original firmware copy; determine the expected signature length L2_exp based on the preset elliptic curve algorithm type (L2_exp=64 for the P-256 algorithm and L2_exp=96 for the P-384 algorithm), perform header integrity verification based on the anti-tampering verification structure, read M consecutive bytes from the last L2_exp+M bytes of the firmware package to parse it into the signature length identifier value L2, terminate the process if L2 and L2_exp do not match, otherwise extract the consecutive L2 bytes from the last L2 bytes of the firmware package as the signature data; use the preset public key to decrypt the signature data to obtain a reference hash value H1', ​​and perform the same cryptographic hash operation on the original firmware copy as the cloud through a parallel segmented hashing strategy to obtain a local hash value H2; if and only if H1' completely matches H2 and the signature verification passes, the firmware is deemed legitimate; The activation guarantee module is used to write the original firmware copy to the backup partition of the memory after verification, and update the boot flag of the boot configuration area to point to the backup partition after writing is completed; trigger the system restart to make the device boot from the backup partition, execute the pre-boot diagnostic sequence when the device starts from the backup partition, open the timeout monitoring window and listen to the operating system kernel ready signal within the window period, and permanently activate the backup partition if a valid signal is captured; if the window times out, the boot pointer of the original active partition is automatically reset according to the multi-stage transaction mark status and trigger the rollback restart process.

[0024] It should be understood that those skilled in the art may make improvements or modifications based on the above description, and all such improvements and modifications shall fall within the scope of protection of the appended claims. Any portion of this specification not described in detail is prior art known to those skilled in the art.

Claims

1. A WiFi router online upgrade security verification method, characterized in that: include: Calculate the cryptographic hash value H1 of the original firmware, use the elliptic curve algorithm to sign H1 with the manufacturer's private key, and generate a digital signature Sign; Construct a structured firmware package, which includes an N-byte firmware length identification field, a continuous L1-byte original firmware data body, an M-byte signature length identification field, a continuous L2-byte digital signature Sign, and an anti-tampering verification structure. After the router device obtains the firmware package through the encrypted transmission channel, it reads the first N bytes from the start of the firmware package and parses them into the firmware length value L1. It then extracts the consecutive L1 bytes starting from the Nth byte offset as the original firmware copy. It determines the expected signature length L2_exp based on the preset elliptic curve algorithm type. After verifying the tamper-proof structure, it reads consecutive M bytes from the last L2_exp+M bytes at the end of the firmware package and parses them into the signature length identification value L2. If L2 and L2_exp are inconsistent, the process is terminated. Otherwise, it extracts consecutive L2 bytes from the last L2 bytes at the end of the firmware package as the signature data. It uses the preset public key to decrypt the signature data to obtain a reference hash value H1'. It then performs the same cryptographic hash operation on the original firmware copy as on the cloud using a parallel segmented hashing strategy to obtain a local hash value H2. The firmware is deemed legitimate if and only if H1' completely matches H2 and the signature verification passes. After verification, the original firmware copy is written to the backup partition of the memory and then booted up, and pre-boot diagnosis is performed, monitoring kernel signals. If successful, the backup partition is activated. If the timeout occurs, it automatically rolls back to the original partition and restarts.

2. A WiFi router online upgrade security verification method according to claim 1, characterized in that: The specific operations of generating and verifying the tamper-proof verification structure include: When constructing the firmware package on the cloud, a multi-stage checksum synthesis operation is performed. First, the leading valid bit segment of the firmware length identification field and the trailing valid bit segment of the signature length identification field are extracted for a first-level bitwise exclusive OR operation. The operation result is then subjected to a second-level logical AND operation with the preset hardware architecture feature code. The device model cyclic redundancy check value is then superimposed to form a composite checksum structure that is not symmetrically embedded in the firmware package.

3. A WiFi router online upgrade security verification method according to claim 2, characterized in that: Verify the tamper-proof structure. The specific operations include: After the device extracts the firmware copy, it triggers the verification coprocessor to generate a dynamic verification code. When the similarity between the composite verification structure and the dynamic verification code is lower than the preset dynamic safety threshold, the hardware-level fuse protection is activated: the power supply of the flash memory controller write channel is first cut off, and then the data partition to be verified in the transmission buffer is erased. At the same time, the dangerous operation event containing the complete firmware header hash value, verification failure position bitmap and clock stamp is recorded in the kernel audit log.

4. A WiFi router online upgrade security verification method according to claim 3, characterized in that: The signature data location and extraction process uses a dual verification architecture that resists address offsets. The specific operations are as follows: Before parsing the signature length identifier value L2, the device starts the digital signature pre-check module. This module calculates the theoretical storage area boundary address of the signature data based on the preset elliptic curve algorithm type and creates a restricted access sandbox area in the flash memory controller through reverse memory mapping technology. When performing a tail addressing operation, a two-stage positioning process is initiated simultaneously: the first stage reads the L2 identification value according to the offset calculation strategy of L2_exp+M. The second stage dynamically scans the characteristic header identifier of the digital signature Sign in the sandbox area through a cryptographic security pointer. The signature data copy channel is activated only when both the L2 value and the Sign characteristic header size check pass. A continuous verification mechanism is introduced in the signature extraction stage. The first 4 binary bits of the digital signature Sign are subjected to double protection by parity check and (7,4) Hamming code. The Hamming code check bit occupies a fixed 3-bit storage space. If a single-bit error is detected, it is corrected immediately. If multiple-bit errors exceeding the error correction capability limit are detected, the signature verification process is interrupted and the error vector register in the secure storage area is marked.

5. A WiFi router online upgrade security verification method according to claim 4, characterized in that: The specific content of the parallel segmented hashing strategy is as follows: The device initializes the dynamic block partitioning engine, which determines the optimal sub-block partitioning parameters based on the current amount of free memory, the number of processor cores, and the multiplication factor of the original firmware copy. It creates a multi-threaded computing array with a ring buffer topology, where each thread is bound to a dedicated processor core and connected to a dedicated memory pool via a high-speed interconnect bus. During the hash calculation startup phase, the main scheduler cuts the firmware data stream into multi-dimensional data slices based on cache line alignment and distributes them to worker threads. Each thread uses a pipeline mode to perform a three-stage hash pipeline operation: the first stage preprocessing performs bit rearrangement on the input data block, the second stage executes multiple rounds of hash compression function iterations, and the final stage generates a hash intermediate value summary with a timestamp; The global monitor detects thread status in real time and implements failover: when the calculation delay of a thread exceeds the dynamic response window, its task is immediately assigned to the adjacent computing unit within the same processor core to perform takeover operations, and at the same time, the cache area of ​​the abnormal thread is locked for memory error diagnosis scanning.

6. A WiFi router online upgrade security verification method according to claim 5, characterized in that: Perform pre-boot diagnostics and monitor kernel signals. The specific operations are as follows: In the initial stage of the device booting from the backup partition, the hierarchical diagnostic controller is started to execute the verification operation chain: the first-level hardware trusted root verification stage performs digital certificate chain verification on the kernel header and matches the signature policy matrix; the second-level wireless hardware self-test stage sends a customized diagnostic command sequence to the RF module while monitoring the signal spectrum integrity; the third-level file system static analysis stage initiates offline media scanning for key partitions to calculate double-end redundancy check values; each diagnostic level has an independent fuse mechanism: hardware verification failure will lock the boot decryption module, wireless anomalies will trigger the RF module power closed-loop control, and file system check errors will activate the bad block remapping engine; persistent faults at any level will trigger the diagnostic interrupt vector to be injected into the processor's non-maskable interrupt line. This pin is physically connected to the processor's non-maskable interrupt line, forcing a jump to the partition rollback microcode execution environment.

7. A WiFi router online upgrade security verification system, characterized in that: The system is applied to a WiFi router online upgrade security verification method according to any one of claims 1 to 6, comprising: The firmware package construction module is used to calculate the cryptographic hash value H1 of the original firmware, sign H1 with the manufacturer's private key using the elliptic curve algorithm, and generate a digital signature Sign; construct a structured firmware package, which includes an N-byte firmware length identification field, a continuous L1-byte original firmware data body, an M-byte signature length identification field, a continuous L2-byte digital signature Sign, and an anti-tampering verification structure; The firmware package verification module is used to read the first N bytes from the starting position of the firmware package and parse them into the firmware length value L1 after the router device obtains the firmware package through the encrypted transmission channel, and extract the consecutive L1 bytes starting from the Nth byte offset position as the original firmware copy; determine the signature length expected value L2_exp based on the preset elliptic curve algorithm type, verify the tamper-proof structure, read consecutive M bytes from the last L2_exp+M bytes at the end of the firmware package and parse them into the signature length identification value L2, if L2 is inconsistent with L2_exp, the process is terminated, otherwise, the consecutive L2 bytes are extracted from the last L2 bytes at the end of the firmware package as the signature data; use the preset public key to decrypt the signature data to obtain a reference hash value H1', ​​perform the same cryptographic hash operation as the cloud on the original firmware copy through a parallel segmented hash strategy, and obtain a local hash value H2; if and only if H1' completely matches H2 and the signature verification passes, the firmware is determined to be legal; The activation module is used to write the original firmware copy to the backup partition of the memory after verification, boot and start, perform pre-boot diagnosis, monitor kernel signals, and activate the backup partition if successful. If the timeout occurs, it will automatically roll back to the original partition and restart.

Images