Safe starting control method and device, equipment and storage medium

Abstract

The invention belongs to the technical field of intelligent control, and discloses a secure startup control method and device, equipment and a storage medium, and two independent Flash memories are arranged to store a basic operating system and a complete operating system respectively, so that physical isolation is realized, and an attack chain is blocked. When it is detected that the electronic device is powered on, power is only supplied to the first Flash memory, and after the basic operating system is loaded and operated, power supply to the first Flash memory is cut off, and power is supplied to the second Flash memory; according to the method, the complete operating system is mounted to the memory disk, and after the complete operating system runs, the power supply of the second Flash memory is cut off, so that the first Flash memory can be immediately powered off after the basic operating system is started and runs, the second Flash memory is dynamically switched to, and attack surfaces are reduced; and meanwhile, a memory disk mounting mode is adopted, so that the continuous read-write dependence on the Flash memory can be reduced, the memory resources are optimized, and the reliability and the safety of an operation system are further improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent control, and particularly relates to a safe starting control method and device, equipment and a storage medium. BACKGROUND

[0002] Embedded devices, especially Internet of Things terminals, industrial controllers and critical infrastructure components, have very high requirements for the reliability and security of system startup. At present, such devices generally use a single Flash memory as the only startup and storage medium, and the operating system kernel, application programs and key data are all stored in this medium.

[0003] However, the single Flash memory solution has a single point of failure risk, and if the storage medium is damaged, the system will be completely paralyzed. Moreover, in this single Flash memory architecture, the entire software system is stored in the same writable medium, and the security attack surface is concentrated. Once the attacker breaks through the system protection, he can perform persistent malicious tampering on any link of the startup chain, such as the boot program and the kernel image. After that, no matter how many times the system restarts, the malicious code will be loaded and executed, and the device will be completely compromised.

[0004] It can be seen that the existing single Flash memory solution has the problems of single point of failure risk and concentrated security attack surface, resulting in insufficient reliability and security of the running system. SUMMARY

[0005] In view of the above defects, the purpose of the present application is to provide a safe starting control method and device, equipment and storage medium, which can improve the reliability and security of the running system.

[0006] The first aspect of the present application discloses a safe starting control method, which is applied to an electronic device, the electronic device comprising a first Flash memory, a second Flash memory, a power module and a controller; the controller is connected to the power module, the first Flash memory and the second Flash memory respectively, and the power module is connected to the first Flash memory and the second Flash memory respectively; the method comprises: When it is detected that the electronic device is powered on, the power module is controlled to supply power only to the first Flash memory; loading and running a basic operating system from the first Flash memory; After the basic operating system is running, the power module is controlled to cut off the power supply of the first Flash memory; the power module is controlled to supply power to the second Flash memory; The complete operating system stored in the second Flash memory is mounted to the memory disk, and a path mapping table is established. The path mapping table is used to map the original root path of the complete operating system to the path corresponding to the mount point of the memory disk. After the complete operating system is running, the power module is controlled to cut off the power supply to the second Flash memory.

[0007] In some embodiments, after controlling the power module to supply power to the second Flash memory and before mounting the complete operating system stored in the second Flash memory to the memory disk, the method further includes: The integrity of the verification index structure stored in the second Flash memory is verified using a hardware root of trust. The verification index structure is used to record the sub-signature information of multiple software components and the dependencies between software components in the complete operating system image stored in the second Flash memory. The verification index structure is signed with a public key protected by the hardware root of trust. Based on the context information of this launch, the corresponding target software components are identified from the verification index structure that has passed integrity verification, forming a set of key components. The sub-signature information of the target software components in the set of key components is verified, and after the sub-signature information of each target software component is verified, the operation of mounting the complete operating system stored in the second Flash memory to the memory disk is triggered.

[0008] In some embodiments, mounting the complete operating system stored in the second Flash memory to the memory disk includes: Read and decompress the base layer of the complete operating system from the second Flash memory and mount it to the first partition of the memory disk; While the base layer is running, the extended layer of the complete operating system is read from the second Flash memory and decompressed and mounted to the second partition of the memory disk in parallel. The application layer of the complete operating system is decompressed on demand and only decompressed from the second Flash memory and mounted to the third partition of the memory disk when the corresponding application is invoked.

[0009] In some embodiments, after the control power module cuts off the power supply to the second Flash memory, the method further includes: Predict the predicted access time of the second Flash memory; Calculate the confidence score for the predicted access time point; If the confidence score reaches a preset threshold, the power supply time is set according to the predicted access time point; When the power supply time is reached at the current moment, the control power module temporarily supplies power to the second Flash memory; Calculate the access activity index value for the second Flash memory; When the access activity index value exceeds the dynamic threshold, the temporary power supply to the second Flash memory is cut off.

[0010] In some embodiments, after the control power module temporarily supplies power to the second Flash memory, the method further includes: Real-time monitoring of the current power supply current waveform of the second Flash memory; The current power supply current waveform is compared with the reference power supply current waveform in the behavioral fingerprint database to calculate the power consumption deviation. Real-time recording of access behavior data to the second Flash memory; analysis of the access behavior data to generate a current behavior fingerprint; The similarity between the current behavioral fingerprint and the baseline behavioral fingerprint in the behavioral fingerprint database is calculated to obtain the behavioral fingerprint similarity. When the power consumption deviation exceeds the first threshold and the behavioral fingerprint similarity is lower than the second threshold, the second Flash memory is determined to be in an abnormal state. An abnormal alarm is triggered when the duration of the abnormal state exceeds the set duration.

[0011] A second aspect of this invention discloses a safe boot control device, which is applied to an electronic device. The electronic device includes a first Flash memory, a second Flash memory, a power module, and a controller. The controller is connected to the power module, the first Flash memory, and the second Flash memory, respectively, and the power module is connected to the first Flash memory and the second Flash memory, respectively. The device includes: The first power supply unit is used to control the power module to supply power only to the first Flash memory when the electronic device is detected to be powered on. The first loading unit is used to load and run the basic operating system from the first Flash memory; The first power-off unit is used to control the power module to cut off the power supply to the first Flash memory after the basic operating system is running; The second power supply unit is used to control the power module to supply power to the second Flash memory; The second loading unit is used to load the complete operating system stored in the second Flash memory to the memory disk; A mapping unit is used to establish a path mapping table, which is used to map the original root path of the complete operating system to the path corresponding to the mount point of the memory disk. The second power-off unit is used to control the power module to cut off the power supply to the second Flash memory after the complete operating system is running.

[0012] In some embodiments, the apparatus further includes: The first verification unit is used to perform integrity verification on the verification index structure stored in the second Flash memory using a hardware root of trust after the second power supply unit controls the power module to supply power to the second Flash memory and before the second loading unit mounts the complete operating system stored in the second Flash memory to the memory disk; the verification index structure is used to record the sub-signature information of multiple software components and the dependencies between software components in the complete operating system image stored in the second Flash memory, and the verification index structure is signed with a public key protected by a hardware root of trust; The selection unit is used to determine the corresponding target software components to form a key component set from the verification index structure that has passed integrity verification, based on the context information of this startup. The second verification unit is used to verify the sub-signature information of the target software components in the set of key components, and after the sub-signature information of each target software component is verified, it triggers the second loading unit to perform the operation of mounting the complete operating system stored in the second Flash memory to the memory disk.

[0013] In some embodiments, the apparatus further includes: The prediction unit is used to predict the predicted access time of the second Flash memory after the power supply module is cut off by the second power-off unit. A confidence calculation unit is used to calculate the confidence score for the predicted access time point; A setting unit is used to set the power supply time according to the predicted access time point when the confidence score reaches a preset threshold. The third power supply unit is used to control the power supply module to temporarily supply power to the second Flash memory when the current time reaches the power supply time. The index calculation unit is used to calculate the access activity index value of the second Flash memory; The third power-off unit is used to cut off the temporary power supply to the second Flash memory when the access activity index value exceeds the dynamic threshold.

[0014] A third aspect of the present invention discloses an electronic device, including a memory storing executable program code and a processor coupled to the memory; the processor calls the executable program code stored in the memory to execute the secure boot control method disclosed in the first aspect.

[0015] A fourth aspect of the present invention discloses a computer-readable storage medium storing a computer program, wherein the computer program causes a computer to execute the secure boot control method disclosed in the first aspect.

[0016] Compared with existing technologies, the advantages of this invention lie in achieving physical isolation and blocking attack chains by setting up two independent Flash memories to store the basic operating system and the complete operating system respectively. Furthermore, when the electronic device is detected to be powered on, power is supplied only to the first Flash memory. After the basic operating system is loaded and running, the power supply to the first Flash memory is cut off, and power is supplied to the second Flash memory. The complete operating system is mounted to a memory disk, and after the complete operating system is running, the power supply to the second Flash memory is cut off. This allows for immediate power-off of the first Flash memory after the basic operating system starts running, dynamically switching to the second Flash memory and reducing the attack surface. Simultaneously, the memory disk mounting method reduces the dependence on continuous read / write operations to the Flash memory, optimizes memory resources, and thus improves the reliability and security of the operating system. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. The accompanying drawings described below only show some specific examples of the present invention and constitute a part of the specification with the specific embodiments, used to explain the technical solutions, principles and effects of the present invention.

[0018] Unless otherwise specified or defined, the same reference numerals in different figures represent the same or similar technical features, and different reference numerals may be used to represent the same or similar technical features.

[0019] Figure 1 This is a flowchart of a safe startup control method disclosed in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a safe start control device disclosed in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present invention.

[0020] Explanation of reference numerals in the attached figures: 201, First power supply unit; 202, First loading unit; 203, First power-off unit; 204, Second power supply unit; 205, Second loading unit; 206, Mapping unit; 207, Second power-off unit; 301, Memory; 302, Processor. Detailed Implementation

[0021] To facilitate understanding of the present invention, specific embodiments of the invention will be described in more detail below with reference to the accompanying drawings. The described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0022] Unless otherwise specified or defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art. When combined with the technical solutions of the invention in a real-world scenario, all technical and scientific terms used herein may also have meanings corresponding to the purpose of achieving the technical solutions of the invention. The terms "first," "second," etc., used herein are merely for distinguishing names and do not represent a specific number or order. The term "and / or," as used herein, includes any and all combinations of one or more of the associated listed items.

[0023] It should be noted that the terms "comprising" and "having" and any variations thereof in the embodiments of the present invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products, or devices.

[0024] This invention discloses a secure startup control method. The method can be executed by embedded electronic devices such as IoT terminals or industrial controllers, or by portable electronic devices such as computers, laptops, or tablets, or by a secure startup control device embedded within an electronic device. This invention does not limit the specific implementation of this method. In this embodiment, an electronic device is used as an example for illustration.

[0025] The electronic device includes a first Flash memory, a second Flash memory, a power supply module, and a controller. The controller is connected to the power supply module, the first Flash memory, and the second Flash memory, and the power supply module is connected to both the first Flash memory and the second Flash memory. Both the first Flash memory and the second Flash memory are non-volatile memories. The first Flash memory stores the basic operating system, and the second Flash memory stores the complete operating system.

[0026] In this embodiment of the invention, the first Flash memory is specifically configured as an SPI NOR memory with a minimized kernel size of <2MB; the second Flash memory is specifically configured as a NAND memory with a capacity of ≥32MB. A relay is configured for each Flash memory, and the relays are connected between the power module and the Flash memory. By controlling the switching state of the relays, the power module can supply power to or de-energize the Flash memory.

[0027] Please see Figure 1 The above-mentioned safe startup control method includes the following steps 110-160: 110. When the electronic device is detected to be powered on, the control power module supplies power only to the first Flash memory.

[0028] 120. Load and run the basic operating system from the first Flash memory.

[0029] Specifically, the basic operating system can be the bootloader that enables hardware startup.

[0030] 130. After the basic operating system is running, the control power module cuts off the power supply to the first Flash memory.

[0031] The response time for cutting off the power supply to the first Flash memory is less than 10ms.

[0032] 140. Control the power supply module to supply power to the second Flash memory.

[0033] More preferably, before switching to the full operating system, that is, after executing step 140 and before executing step 150, dynamic priority verification can also be performed, which may specifically include the following steps 141-144 (not shown): 141. Use a hardware root of trust to perform integrity verification on the verification index structure stored in the second flash memory; wherein, the verification index structure is used to record the sub-signature information of multiple software components in the complete operating system image stored in the second flash memory and the dependency relationship between the software components, and the verification index structure is signed with a public key protected by the hardware root of trust.

[0034] It should be noted that during system construction or updates, a digital signature, such as Sig_Full, is generated not only for the complete operating system image stored in the second Flash memory, but also for its internal software components, such as the kernel, security drivers, and initialization processes. Independent sub-signatures with versioning and dependency relationships are generated, such as Sig_Kernel and Sig_Driver, forming a lightweight verification index structure. This verification index structure is stored in the second Flash memory and is a public key signature protected by a hardware root of trust.

[0035] 142. Based on the context information of this startup, determine the corresponding target software components to form the key component set from the verification index structure that has passed integrity verification.

[0036] The context information for this startup refers to information related to the previous operation, such as whether an abnormal shutdown was detected, whether this startup is in recovery mode, and whether this startup originated from a low-power wake-up. This context information is related to the set of key components used in this verification. For example, a normal startup might only require verifying target software components such as the kernel and initialization processes; recovery mode, however, requires verifying the recovery toolset.

[0037] 143. Verify the sub-signature information of the target software component in the key component set.

[0038] 144. Once the sub-signature information of each target software component has been verified, proceed to step 150.

[0039] Before switching to the full operating system, instead of immediately verifying all the contents of the full operating system in the second flash memory, the integrity of the verification index structure read from the second flash memory is verified first. Then, the key component set is dynamically determined according to the context of this boot, and digital signature verification is performed only on this key component set. Once the key component set is verified, step 150 is executed.

[0040] By using dynamic priority verification, the necessary verification workload is minimized. Verifying only critical component sets reduces verification time, allowing the core system parts to load and run quickly, achieving rapid startup. This not only completes verification, enhancing system security and reliability, but also improves startup efficiency.

[0041] Moreover, the verification index and sub-signature can accurately point to the verification results of specific software components, enabling precise fault location. For example, if the graphics card driver signature is invalid, it can be determined that the graphics card is faulty, rather than the general operating system is damaged, which greatly facilitates fault diagnosis and location.

[0042] Furthermore, by using context awareness, different verification sets are selected based on the startup context, avoiding the loading of unnecessary code that may be maliciously exploited in sensitive modes, thus reducing the attack surface.

[0043] 150. Mount the complete operating system stored in the second Flash memory to the memory disk and establish a path mapping table. This path mapping table is used to map the original root path of the complete operating system to the path corresponding to the mount point of the memory disk.

[0044] The complete operating system stored in the second flash memory is mounted to the memory disk to boot and run the complete operating system.

[0045] Preferably, the system files of the complete operating system are divided into a base layer, an extension layer, and an application layer, which are compressed and stored in a second Flash memory, and can be compressed using different compression ratios. The base layer contains the core components of the operating system and is compressed using a low first compression ratio; the extension layer contains application support libraries and is compressed using a medium second compression ratio; the application layer contains application programs and data files and is compressed using a high third compression ratio. The first compression ratio is lower than the second compression ratio, and the second compression ratio is lower than the third compression ratio.

[0046] Correspondingly, the RAM disk can be configured as tmpfs. Under the running operating system, create RAM disk partitions, including independent first, second, and third partitions.

[0047] In step 150, the complete operating system stored in the second Flash memory is mounted to the memory disk, which may specifically include the following steps 1501-1503 (not shown): 1501. Read and decompress the base layer of the complete operating system from the second Flash memory and mount it to the first partition of the memory disk.

[0048] 1502. While the base layer is running, the extended layer of the complete operating system is read from the second Flash memory and decompressed and mounted to the second partition of the memory disk.

[0049] 1503. Delayed decompression of the application layer of the complete operating system on demand, decompressing it from the second Flash memory and mounting it to the third partition of the memory disk only when the corresponding application is invoked.

[0050] Specifically, file access can be monitored through a background service. When an application requests access to an application-layer target file in the full operating system, the access is redirected to the corresponding mount point in the third partition of the tmpfs memory disk through a path mapping table. If the requested application-layer target file is not located at the corresponding mount point in the third partition of the tmpfs memory disk, the application-layer target file is loaded from the second flash memory to the third partition of the tmpfs memory disk as needed, and then provided to the application.

[0051] During system operation, modifications to files in the tmpfs memory disk are temporarily stored in the tmpfs memory disk, and the modifications are written back to the second Flash memory when preset conditions are met.

[0052] Alternatively, the memory usage of the RAM disk can be monitored in real time. When the memory usage exceeds a specified threshold, system files accessed less frequently than specified in the RAM disk can be recompressed and temporarily stored in a second Flash memory.

[0053] In this invention, by employing layered compression and dynamic decompression, after the basic operating system boots, the complete operating system files stored in the second Flash memory are loaded onto the TMPFS memory disk on demand. This optimizes the memory disk and achieves a balance between on-demand decompression and fast boot. Furthermore, path mapping allows applications to access the data transparently, improving access speed while reducing direct read / write operations to the second Flash memory, thereby reducing Flash access frequency and extending Flash memory lifespan. Since the data resides in memory and is lost upon power failure, security is also enhanced.

[0054] 160. After the complete operating system is running, the control power module cuts off the power supply to the second Flash memory.

[0055] Furthermore, after the full operating system boots up and before the power supply module cuts off power to the second Flash memory, digital signature verification can be performed on the sub-signature information of the remaining unverified software components in the second Flash memory within a protected execution environment, such as a separate, protected security coprocessor or dedicated kernel thread. Before verification is complete, access requests to the unverified area will be suspended or redirected until the area is verified. Thus, by delaying the verification of non-critical software components after the full operating system boots up, concentrated occupation and peak consumption of Central Processing Unit (CPU) resources can be avoided, resulting in a smoother boot process.

[0056] Furthermore, after verification, the verification result is encrypted and signed, then written to a hardware secure storage area accessible to trusted code in subsequent stages. Once the complete operating system has taken full control, it can read the verification result from this hardware secure storage area and decide whether to enable all functions, such as network and external devices, or trigger a security remediation process. This ensures that the security status during the boot phase is known to the operating system in subsequent stages, achieving secure storage and trusted transmission of the verification result.

[0057] As an optional implementation, after performing step 160, the following steps (not shown) 161-166 may also be performed: 161. Predict the predicted access time of the second Flash memory.

[0058] Optionally, step 161 includes the following steps S11 to S15 (not shown): S11. Obtain historical access data of the second Flash memory, which includes access timestamp sequence, access address sequence and access type.

[0059] S12. Extract time features from the access timestamp sequence to obtain a time feature vector.

[0060] Temporal feature extraction can be achieved by combining Long Short-Term Memory (LSTM) networks with Transformer self-attention mechanisms.

[0061] S13. Extract spatial features from the access address sequence to obtain spatial feature vectors.

[0062] Spatial feature extraction uses graph neural networks (GNNs) to model the spatial relationships between storage addresses.

[0063] S14. Multimodal fusion of the temporal feature vector and the spatial feature vector is performed to obtain the fused feature vector.

[0064] The multimodal fusion mechanism employs a gated fusion mechanism and a cross-attention module. Specifically, it includes: calculating the fusion weights of temporal and spatial feature vectors using a gated fusion mechanism; performing weighted fusion of the temporal and spatial feature vectors based on these weights; inputting the weighted fusion result into the cross-attention module to enhance the temporal and spatial features; and outputting the enhanced fused feature vector. By considering both temporal series features and spatial locality features simultaneously, the multimodal fusion mechanism can more comprehensively capture the inherent patterns of access patterns and improve prediction accuracy.

[0065] S15. Input the fused feature vector into the prediction model and predict the access time point within the future predetermined time window.

[0066] 162. Calculate the confidence score for the predicted access time point.

[0067] It can model the distribution of historical prediction errors to calculate confidence scores for predicted access times. Through the prediction confidence evaluation mechanism, it can identify prediction uncertainties, avoid performance degradation caused by erroneous predictions, and achieve intelligent optimization.

[0068] 163. If the confidence score reaches the preset threshold, the power supply time is set according to the predicted access time.

[0069] Optionally, when the confidence scores for multiple consecutive predicted access time points fall below a preset threshold, the prediction model can be retrained or switched to a conservative prediction strategy. During retraining, the prediction strategy can be dynamically adjusted based on the system's operating status, including CPU load, memory usage, and current task type.

[0070] 164. When the power supply time is reached at the current time, the control power module temporarily supplies power to the second Flash memory.

[0071] Optionally, after performing step 164, the following steps S21 to S26 (not shown) can also be performed: S21. Monitor the current power supply current waveform of the second Flash memory in real time.

[0072] S22. Compare the collected current power supply current waveform with the reference power supply current waveform in the behavioral fingerprint database, and calculate the power consumption deviation.

[0073] S23. Record access behavior data to the second Flash memory in real time, and analyze the access behavior data to generate the current behavior fingerprint.

[0074] The access behavior data includes at least the access address sequence, access frequency, and time pattern.

[0075] A behavioral fingerprint database can be preset, which stores the reference power supply current waveform and reference behavioral fingerprint of the second Flash memory.

[0076] S24. Calculate the similarity between the current behavioral fingerprint and the baseline behavioral fingerprint in the behavioral fingerprint database to obtain the behavioral fingerprint similarity.

[0077] S25. When the power consumption deviation exceeds the first threshold and the behavioral fingerprint similarity is lower than the second threshold, the second Flash memory is determined to be in an abnormal state.

[0078] S26. When the duration of the abnormal state exceeds the set duration, an abnormal alarm is triggered.

[0079] Furthermore, when an abnormal alarm is triggered, the power supply to the second Flash memory can be cut off, and an encrypted abnormal log can be generated and stored.

[0080] By using both access behavior fingerprinting and power consumption mode verification, the accuracy of Flash access anomaly detection can be improved, and the ability to identify potential attacks in real time can be enhanced.

[0081] 165. Calculate the access activity index value for the second Flash memory.

[0082] It should be noted that the current idle time can be calculated as an access activity indicator. The current idle time refers to the time elapsed from the completion of the last valid read or write operation on the second Flash memory to the current moment. Specifically, the current idle time is the duration recorded from the end time of the last I / O operation until the current moment. If the current idle time is too long, it can be determined that the second Flash memory has entered a prolonged idle state, and it is safe to power off.

[0083] However, considering that in practical applications, a single current idle time may not be sufficient to stably characterize the memory access activity index, it is preferable to consider all factors and calculate a comprehensive access interval as the access activity index. Specifically, step 165 preferably includes the following steps S31 to S33 (not shown): S31. Obtain the access time sequence within the first time window from the access behavior data of the second Flash memory, and calculate the first access interval based on the access time sequence within the first time window.

[0084] The access time series includes each access time point; the first access interval is calculated based on the access time series within the first time window, specifically including: calculating the decay weight of each access time point in the access time series within the first time window based on the time decay factor, and then calculating the first access interval based on the decay weight and the time interval between each access time point and the current time.

[0085] Let the access time series be: {t1, t2, ..., t...} N} , t N The most recent access; therefore, the specific calculation formula for the first access interval is as follows (1): Δt = [Σ(a i *W i * (T now - T i ))] / Σ(ai *W i (1) Among them, W i W is the access weight for the i-th visit. i =τ*(T now - T i Accesses closer to the current time have a higher weight, τ is the time decay factor, 0 < τ < 1, and τ = 0.8 is recommended; T i Let T be the time when the i-th access occurs, i.e., the i-th access time point; now The current time; a i This is an adjustment factor for the access weight; the default value is 'a'. i =1, important access can be set to a i >1; Σ is the sign for summing all access times within the time window, where i ranges from 1 to N, and N is the number of accesses within the time window.

[0086] S32. Obtain the access time sequence within the second time window from the access behavior data of the second Flash memory, and calculate the second access interval based on the access time sequence within the second time window.

[0087] In this invention, both the first and second time windows are the most recent time windows, with the current time as the endpoint. The second time window is longer than the first time window and includes the first time window. For example, the first time window can be set to the past hour, while the second time window can be set to the past day. It is understood that the calculation method for the second access interval is the same as that for the first access interval, and will not be elaborated upon here.

[0088] S33. Based on the current idle time of the second Flash memory, the first access interval, and the second access interval, a weighted calculation is performed to obtain the comprehensive access interval of the second Flash memory, and the comprehensive access interval is used as the access activity index value.

[0089] During the calculation, different weighting coefficients α, β, and γ are assigned to the current idle time of the second Flash memory, the first access interval, and the second access interval, respectively, and then the weighted sums are calculated. Where α + β + γ = 1, it is recommended that the values ​​be α = 0.7, β = 0.2, and γ = 0.1; or α = 0.3, β = 0.3, and γ = 0.4; or α = 0.5, β = 0.3, and γ = 0.2.

[0090] 166. When the access activity index value exceeds the dynamic threshold, cut off the temporary power supply to the second Flash memory.

[0091] The dynamic threshold is dynamically calculated based on at least one of the following factors: the operating temperature of the second Flash memory, the remaining power of the system, the current load of the system, and the access frequency of the second Flash memory within a preset historical time window.

[0092] Understandably, the higher the operating temperature, the smaller the dynamic threshold should be, meaning faster power-off, to prevent the second Flash memory from being powered on for a long time under high temperature, which could accelerate aging or cause thermal safety issues. When the current system load is low, it can be assumed that the access demand will also be low in the future, and the dynamic threshold can be appropriately reduced to actively save power. The lower the remaining power of the system, the smaller the dynamic threshold should be to more actively cut off the power supply to unnecessary components and extend the device's battery life.

[0093] Specifically, the calculation of the dynamic threshold may include the following steps S41-S44 (not shown): S41. Obtain the access time sequence within a preset historical time window from the historical access data of the second Flash memory, and calculate the average access interval within the preset historical time window.

[0094] It should be noted that, unlike the first and second time windows, the preset historical time window refers to a certain historical period in the past and is not connected to the current moment.

[0095] The formula for calculating the average access interval is shown in equation (2) below: Δt avg = (t N - t1) / (N - 1)(2) Where, Δt avg t represents the average access interval within the historical time window. N t1 represents the time of the last access within the time window, t1 represents the time of the first access within the time window, and N represents the number of accesses within the time window.

[0096] S42. Calculate the basic threshold based on the current idle time of the second Flash memory and the average access interval within the preset historical time window.

[0097] Specifically, the formula for calculating the basic threshold is shown in equation (3) below: T base =λ*ΔT idle + (1-λ) *Δt avg (3) Among them, T base The base threshold is λ, which is a scene coefficient that can be preset by developers, for example, 0.6. Its value can be adjusted according to different scenes. ΔT idle This represents the current free time.

[0098] S43. Based on the current operating temperature of the electronic device, the remaining power of the system, and the current load of the system, calculate the temperature compensation factor, power compensation factor, and load compensation factor respectively.

[0099] The temperature compensation factor is calculated based on the current operating temperature, as shown in equation (4) below: f Temp = 1 + k temp * (T current - T nominal ) / T range (4) Among them, T current The current temperature of the second Flash memory; T nominal The rated operating temperature, such as 25℃; T range The operating temperature range difference is the difference between the upper and lower limits of the operating temperature range. For example, if the operating temperature range is [-40℃, 85℃], then the operating temperature range difference is 85℃ - (-40℃) = 125℃. temp The temperature sensitivity coefficient is recommended to be set to 0.5~2.0.

[0100] The power compensation factor is calculated based on the remaining power of the system, as shown in equation (5) below: f Power = 1+ k power * (1- B remain / B full (5) Among them, B remain B represents the remaining battery power. full The battery capacity when fully charged; k power The power sensitivity coefficient is recommended to be set to 0.5~1.5.

[0101] The load compensation factor is calculated based on the current system load, as shown in equation (6) below: f Load = 1+k load * (1- R idle (6) Among them, R idle The system idle ratio refers to the CPU utilization rate of the current system load; k load The load sensitivity factor is recommended to be set to 0.2~0.8.

[0102] S44. Adjust the basic threshold according to the temperature compensation factor, power compensation factor and load compensation factor to obtain the dynamic threshold.

[0103] The dynamic threshold is calculated as shown in equation (7): T dy = T base * f Temp *f Power *f Load (7) Among them, T dy For dynamic threshold, T base Based on the threshold, f Temp f Power and f Load These are the temperature compensation factor, the power compensation factor, and the load compensation factor, respectively.

[0104] By using temperature sensing, power sensing, and load sensing to adaptively set dynamic thresholds for Flash memory power management, device battery life can be extended and the thermal attack surface reduced.

[0105] In summary, by implementing this embodiment of the invention, physical isolation is achieved by setting up two independent Flash memories to store the basic operating system and the complete operating system, respectively, thus blocking the attack chain. Furthermore, the first Flash memory is immediately powered off after the basic operating system starts running, dynamically switching to the second Flash memory to reduce the attack surface. Simultaneously, the use of a memory disk mounting method reduces the reliance on continuous read / write operations to the Flash memory, optimizes memory resources, and thereby improves the reliability and security of the operating system.

[0106] Compared to a single-Flash boot scheme, the attack surface is reduced by 70%, and the power-down mechanism can defend against voltage spike attacks. In addition, dual-Flash redundancy increases the mean time between failures (MTBF) to 100,000 hours, significantly enhancing reliability.

[0107] like Figure 2 As shown, this embodiment of the invention discloses a safe startup control device, which is applied to an electronic device. The electronic device includes a first Flash memory, a second Flash memory, a power module, and a controller. The controller is connected to the power module, the first Flash memory, and the second Flash memory, and the power module is connected to the first Flash memory and the second Flash memory. The device includes a first power supply unit 201, a first loading unit 202, a first power-off unit 203, a second power supply unit 204, a second loading unit 205, a mapping unit 206, and a second power-off unit 207. The first power supply unit 201 is used to control the power supply module to supply power only to the first Flash memory when the electronic device is detected to be powered on. The first loading unit 202 is used to load and run the basic operating system from the first Flash memory; The first power-off unit 203 is used to control the power module to cut off the power supply to the first Flash memory after the basic operating system is running. The second power supply unit 204 is used to control the power supply module to supply power to the second Flash memory; The second loading unit 205 is used to load the complete operating system stored in the second Flash memory to the memory disk; The mapping unit 206 is used to establish a path mapping table, which is used to map the original root path of the complete operating system to the path corresponding to the mount point of the memory disk. The second power-off unit 207 is used to control the power module to cut off the power supply to the second Flash memory after the complete operating system is running.

[0108] Optionally, the device may also include the following units not shown: The first verification unit is used to perform integrity verification on the verification index structure stored in the second Flash memory after the second power supply unit 204 controls the power module to supply power to the second Flash memory and before the second loading unit 205 mounts the complete operating system stored in the second Flash memory to the memory disk. The verification index structure is used to record the sub-signature information of multiple software components in the complete operating system image stored in the second Flash memory and the dependency relationship between the software components. The verification index structure is signed with a public key protected by the hardware trust root. The selection unit is used to determine the corresponding target software components to form a key component set from the verification index structure that has passed integrity verification, based on the context information of this startup. The second verification unit is used to verify the sub-signature information of the target software components in the key component set, and after the sub-signature information of each target software component is verified, it triggers the second loading unit 205 to perform the operation of mounting the complete operating system stored in the second Flash memory to the memory disk.

[0109] Furthermore, the second loading unit 205 is specifically used to read and decompress the base layer of the complete operating system from the second Flash memory and mount it to the first partition of the memory disk; while the base layer is running, it reads and decompresses the extension layer of the complete operating system from the second Flash memory and mounts it to the second partition of the memory disk in parallel; and decompresses the application layer of the complete operating system on demand, only decompressing it from the second Flash memory and mounting it to the third partition of the memory disk when the corresponding application is called.

[0110] Optionally, the device may also include the following units not shown: The prediction unit is used to predict the predicted access time of the second Flash memory after the second power-off unit 207 controls the power supply module to cut off the power supply to the second Flash memory. The confidence calculation unit is used to calculate the confidence score for the predicted access time point; The setting unit is used to set the power supply time based on the predicted access time when the confidence score reaches a preset threshold. The third power supply unit is used to control the power supply module to temporarily supply power to the second Flash memory when the current time reaches the power supply time. The index calculation unit is used to calculate the index value of access activity to the second Flash memory; The third power-off unit is used to cut off the temporary power supply to the second Flash memory when the access activity index value exceeds the dynamic threshold.

[0111] Further optionally, the device may also include the following units not shown: The monitoring unit is used to monitor the current power supply current waveform of the second Flash memory in real time after the third power supply unit controls the power supply module to temporarily supply power to the second Flash memory. The power consumption calculation unit is used to compare the collected current power supply current waveform with the reference power supply current waveform in the behavioral fingerprint database to calculate the power consumption deviation. The analysis unit is used to record access behavior data of the second Flash memory in real time, and analyze the access behavior data to generate the current behavior fingerprint; The matching unit is used to calculate the similarity between the current behavioral fingerprint and the baseline behavioral fingerprint in the behavioral fingerprint database to obtain the behavioral fingerprint similarity. The determination unit is used to determine that the second Flash memory is in an abnormal state when the power consumption deviation exceeds the first threshold and the behavioral fingerprint similarity is lower than the second threshold. The alarm unit is used to trigger an abnormal alarm when the duration of the abnormal state exceeds a set time.

[0112] Further optionally, the above prediction unit includes the following sub-units not shown: The acquisition subunit is used to acquire historical access data of the second Flash memory, which includes an access timestamp sequence, an access address sequence, and an access type. The first feature extraction subunit is used to extract time features from the access timestamp sequence to obtain a time feature vector. The second feature extraction subunit is used to extract spatial features from the access address sequence to obtain a spatial feature vector. The feature fusion subunit is used to perform multimodal fusion of temporal feature vectors and spatial feature vectors to obtain a fused feature vector; The prediction subunit is used to input the fused feature vector into the prediction model and predict the access time point within a predetermined future time window.

[0113] Further optionally, the above-mentioned indicator calculation unit includes the following sub-units (not shown): The first calculation subunit is used to obtain the access time sequence within the first time window from the access behavior data of the second Flash memory, and calculate the first access interval based on the access time sequence within the first time window. The second calculation subunit is used to obtain the access time sequence within the second time window from the access behavior data of the second Flash memory, and calculate the second access interval based on the access time sequence within the second time window. The comprehensive subunit is used to calculate the comprehensive access interval of the second Flash memory based on the current idle time of the second Flash memory, the first access interval, and the second access interval, and use the comprehensive access interval as the access activity index value.

[0114] Optionally, the above-described apparatus may further include the following units not shown: The acquisition unit is used to acquire the access time sequence within a preset historical time window from the historical access data of the second Flash memory, and calculate the average access interval within the preset historical time window. The threshold calculation unit is used to calculate the basic threshold based on the current idle time of the second Flash memory and the average access interval within a preset historical time window. The compensation unit is used to calculate the temperature compensation factor, power compensation factor and load compensation factor based on the current operating temperature of the electronic device, the remaining power of the system and the current load of the system, respectively. The threshold adjustment unit is used to adjust the basic threshold according to the temperature compensation factor, power compensation factor and load compensation factor to obtain the dynamic threshold; The transmission unit is used to transmit the dynamic threshold to the third power-off unit.

[0115] like Figure 3 As shown, an embodiment of the present invention discloses an electronic device, including a memory 301 storing executable program code and a processor 302 coupled to the memory 301; The processor 302 calls the executable program code stored in the memory 301 to execute the secure boot control method described in the above embodiments.

[0116] This invention also discloses a computer-readable storage medium storing a computer program that causes a computer to execute the secure boot control method described in the above embodiments.

[0117] Those skilled in the art will understand that some or all of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. This program can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compactdisc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0118] The purpose of the above embodiments is to reproduce and derive the technical solution of the present invention by way of example, and to fully describe the technical solution, purpose and effect of the present invention. The purpose is to enable the public to have a more thorough and comprehensive understanding of the disclosure of the present invention, and not to limit the scope of protection of the present invention.

[0119] The above embodiments are not an exhaustive list based on the present invention, and there may be many other embodiments not listed. Any substitutions and improvements made without departing from the concept of the present invention are within the protection scope of the present invention.

Claims

1. A safe start control method, characterized in that, The method is applied to an electronic device, which includes a first Flash memory, a second Flash memory, a power module, and a controller; the controller is connected to the power module, the first Flash memory, and the second Flash memory, and the power module is connected to the first Flash memory and the second Flash memory. The method includes: When the power-on of the electronic device is detected, the power module is controlled to supply power only to the first Flash memory; Load and run the basic operating system from the first Flash memory; After the basic operating system is running, the power module is controlled to cut off the power supply to the first Flash memory; The power module is controlled to supply power to the second Flash memory; The complete operating system stored in the second Flash memory is mounted to the memory disk, and a path mapping table is established. The path mapping table is used to map the original root path of the complete operating system to the path corresponding to the mount point of the memory disk. After the complete operating system is running, the power module is controlled to cut off the power supply to the second Flash memory.

2. The safe start control method according to claim 1, characterized in that, After controlling the power module to supply power to the second Flash memory, and before mounting the complete operating system stored in the second Flash memory to the memory disk, the method further includes: The integrity of the verification index structure stored in the second Flash memory is verified using a hardware root of trust. The verification index structure is used to record the sub-signature information of multiple software components and the dependencies between software components in the complete operating system image stored in the second Flash memory. The verification index structure is signed with a public key protected by the hardware root of trust. Based on the context information of this launch, the corresponding target software components are identified from the verification index structure that has passed integrity verification, forming a set of key components. The sub-signature information of the target software components in the set of key components is verified, and after the sub-signature information of each target software component is verified, the operation of mounting the complete operating system stored in the second Flash memory to the memory disk is triggered.

3. The safe start control method according to claim 2, characterized in that, Mounting the complete operating system stored in the second Flash memory to the memory disk includes: Read and decompress the base layer of the complete operating system from the second Flash memory and mount it to the first partition of the memory disk; While the base layer is running, the extended layer of the complete operating system is read from the second Flash memory and decompressed and mounted to the second partition of the memory disk in parallel. The application layer of the complete operating system is decompressed on demand and only decompressed from the second Flash memory and mounted to the third partition of the memory disk when the corresponding application is invoked.

4. The safe start control method according to any one of claims 1 to 3, characterized in that, After the power supply module cuts off the power supply to the second Flash memory, the method further includes: Predict the predicted access time of the second Flash memory; Calculate the confidence score for the predicted access time point; If the confidence score reaches a preset threshold, the power supply time is set according to the predicted access time point; When the power supply time is reached at the current moment, the control power module temporarily supplies power to the second Flash memory; Calculate the access activity index value for the second Flash memory; When the access activity index value exceeds the dynamic threshold, the temporary power supply to the second Flash memory is cut off.

5. The safe start control method according to claim 4, characterized in that, After the control power module temporarily supplies power to the second Flash memory, the method further includes: Real-time monitoring of the current power supply current waveform of the second Flash memory; The current power supply current waveform is compared with the reference power supply current waveform in the behavioral fingerprint database to calculate the power consumption deviation. Real-time recording of access behavior data to the second Flash memory; analysis of the access behavior data to generate a current behavior fingerprint; The similarity between the current behavioral fingerprint and the baseline behavioral fingerprint in the behavioral fingerprint database is calculated to obtain the behavioral fingerprint similarity. When the power consumption deviation exceeds the first threshold and the behavioral fingerprint similarity is lower than the second threshold, the second Flash memory is determined to be in an abnormal state. An abnormal alarm is triggered when the duration of the abnormal state exceeds the set duration.

6. A safety start control device, characterized in that, The device is applied to an electronic device, which includes a first Flash memory, a second Flash memory, a power module, and a controller; the controller is connected to the power module, the first Flash memory, and the second Flash memory, and the power module is connected to the first Flash memory and the second Flash memory. The device includes: The first power supply unit is used to control the power module to supply power only to the first Flash memory when the electronic device is detected to be powered on. The first loading unit is used to load and run the basic operating system from the first Flash memory; The first power-off unit is used to control the power module to cut off the power supply to the first Flash memory after the basic operating system is running; The second power supply unit is used to control the power module to supply power to the second Flash memory; The second loading unit is used to load the complete operating system stored in the second Flash memory to the memory disk; A mapping unit is used to establish a path mapping table, which is used to map the original root path of the complete operating system to the path corresponding to the mount point of the memory disk. The second power-off unit is used to control the power module to cut off the power supply to the second Flash memory after the complete operating system is running.

7. The safe start control device according to claim 6, characterized in that, Also includes: The first verification unit is used to perform integrity verification on the verification index structure stored in the second flash memory using a hardware root of trust after the second power supply unit controls the power module to supply power to the second flash memory and before the second loading unit mounts the complete operating system stored in the second flash memory to the memory disk. The verification index structure is used to record the sub-signature information of multiple software components and the dependencies between software components in the complete operating system image stored in the second Flash memory, and the verification index structure is signed with a public key protected by a hardware root of trust. The selection unit is used to determine the corresponding target software components to form a key component set from the verification index structure that has passed integrity verification, based on the context information of this startup. The second verification unit is used to verify the sub-signature information of the target software components in the set of key components, and after the sub-signature information of each target software component is verified, it triggers the second loading unit to perform the operation of mounting the complete operating system stored in the second Flash memory to the memory disk.

8. The safety start control device according to claim 6 or 7, characterized in that, Also includes: The prediction unit is used to predict the predicted access time of the second Flash memory after the power supply module is cut off by the second power-off unit. A confidence calculation unit is used to calculate the confidence score for the predicted access time point; A setting unit is used to set the power supply time according to the predicted access time point when the confidence score reaches a preset threshold. The third power supply unit is used to control the power supply module to temporarily supply power to the second Flash memory when the current time reaches the power supply time. The index calculation unit is used to calculate the access activity index value of the second Flash memory; The third power-off unit is used to cut off the temporary power supply to the second Flash memory when the access activity index value exceeds the dynamic threshold.

9. An electronic device, characterized in that, It includes a memory storing executable program code and a processor coupled to the memory; the processor calls the executable program code stored in the memory to execute the secure boot control method according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program causes the computer to perform the secure boot control method according to any one of claims 1 to 5.

Images