Security Boot Method, Device and Electronic Device of Operating System

Abstract

The present application provides a secure boot method, apparatus, and electronic device for an operating system. The secure boot method includes: after the operating system is powered on, obtaining a second key according to the initial data of the SRAM in the arithmetic acceleration unit; transmitting the first key in ciphertext form and the system boot code in ciphertext form obtained through secure boot settings from the CPU to the arithmetic acceleration unit; decrypting the first key in ciphertext form using the second key by means of a first decryption algorithm to obtain the first key in plaintext form; decrypting the system boot code in ciphertext form using the first key in plaintext form by means of a second decryption algorithm to obtain the system boot code in plaintext form and transmitting it to the CPU. The use of a general-purpose hardware arithmetic acceleration unit to implement the secure boot of the operating system eliminates the need for additional dedicated security hardware and offers better economy.

Description

Technical Field

[0001] This application relates to the technical field of cryptographic algorithms, and particularly to a secure boot method, device, electronic device, and computer-readable medium for an operating system. Background Art

[0002] During the startup process of a PC's operating system, there is a risk that the system startup code can be tampered with. To ensure the secure boot of the operating system, additional dedicated security hardware needs to be set up in the PC, such as SE (Security Element), TPM (Trusted Platform Module), etc. The process of secure boot through dedicated security hardware is as follows:

[0003] Use the security hardware to generate a key and store the key in the security hardware;

[0004] The CPU passes the system startup code in ciphertext form that needs to be decrypted into the security hardware;

[0005] The security hardware decrypts the system startup code in ciphertext form using the stored key to obtain the system startup code in plaintext form;

[0006] The security hardware passes the system startup code in plaintext form back to the CPU;

[0007] The CPU loads and runs the system startup code to complete the system startup.

[0008] In the above process, due to the limited performance of the security hardware, it can only perform encryption and decryption processing on a small amount of system startup code, and the processing speed is slow. In addition, security hardware is often not a standard configuration of a PC, and has great limitations in terms of economy and technical versatility. Summary of the Invention

[0009] This application aims to provide a secure boot method for an operating system that can achieve secure boot of the operating system without dedicated security hardware.

[0010] According to the first aspect of this application, there is provided a secure boot method for an operating system, including:

[0011] After the operating system is powered on, obtain a second key in the arithmetic acceleration unit according to the initial data of its SRAM;

[0012] The arithmetic acceleration unit obtains the first key in ciphertext form and the system startup code in ciphertext form from the CPU;

[0013] In the arithmetic acceleration unit, use the first decryption algorithm to decrypt the first key in ciphertext form using the second key to obtain the first key in plaintext form;

[0014] In the operation acceleration unit, the second decryption algorithm is used to decrypt the encrypted system startup code with the first key in plaintext form to obtain the system startup code in plaintext form and transmit it to the CPU.

[0015] According to some embodiments of the present application, the operation acceleration unit includes: a GPU or an AI chip.

[0016] According to some embodiments of the present application, obtaining the second key according to the initial data of the SRAM in the operation acceleration unit includes:

[0017] Using the Fuzzy Extractor algorithm to extract the second key from the initial data of the SRAM.

[0018] According to some embodiments of the present application, the secure startup method further includes:

[0019] After obtaining the second key, initialize the SRAM and clear the initial data of the SRAM after power-on.

[0020] According to some embodiments of the present application, the first decryption algorithm and the second decryption algorithm include:

[0021] One of the DES algorithm, the post-quantum cryptography algorithm, and the fully homomorphic cryptography algorithm.

[0022] According to some embodiments of the present application, the secure startup method further includes:

[0023] At the factory, after the operating system is powered on, obtain the second key in the operation acceleration unit;

[0024] In the operation acceleration unit, use the first encryption algorithm to encrypt the first key in plaintext form with the second key to obtain the first key in ciphertext form and transmit it to the CPU for local storage;

[0025] In the operation acceleration unit, use the second encryption algorithm to encrypt the system startup code with the first key in plaintext form to obtain the system startup code in ciphertext form and transmit it to the CPU for local storage.

[0026] According to some embodiments of the present application, the first encryption algorithm and the second encryption algorithm include:

[0027] One of the AES algorithm, the post-quantum cryptography algorithm, and the fully homomorphic cryptography algorithm.

[0028] According to some embodiments of the present application, the secure startup method further includes:

[0029] After the system startup code is transmitted to the CPU, the first key and the second key in plaintext form in the arithmetic acceleration unit are destroyed.

[0030] According to a second aspect of the present application, there is provided a secure startup device for an operating system, including:

[0031] A key generation module, configured to obtain a second key in the arithmetic acceleration unit according to the initial data of its SRAM after the operating system is powered on;

[0032] A data transmission module, configured to obtain the first key in ciphertext form and the system startup code in ciphertext form from the CPU in the arithmetic acceleration unit;

[0033] A first decryption module, configured to decrypt the first key in ciphertext form with the second key using a first decryption algorithm in the arithmetic acceleration unit to obtain the first key in plaintext form;

[0034] A second decryption module, configured to decrypt the system startup code in ciphertext form with the first key in plaintext form using a second decryption algorithm in the arithmetic acceleration unit to obtain the system startup code in plaintext form and transmit it to the CPU.

[0035] According to some embodiments of the present application, the secure startup device further includes:

[0036] A startup setting module, configured to obtain the system startup code in ciphertext form and the first key in ciphertext form in the arithmetic acceleration unit.

[0037] According to some embodiments of the present application, the startup setting module includes:

[0038] A first encryption module, configured to encrypt the first key in plaintext form with the second key using a first encryption algorithm in the arithmetic acceleration unit to obtain the first key in ciphertext form and transmit it to the CPU for local storage;

[0039] A second encryption module, configured to encrypt the system startup code with the first key in plaintext form using a second encryption algorithm to obtain the system startup code in ciphertext form and transmit it to the CPU for local storage.

[0040] According to a third aspect of the present application, there is provided an electronic device, including:

[0041] One or more central processing units;

[0042] One or more arithmetic acceleration units;

[0043] A first storage device and a second storage device are respectively used to store one or more programs; when the one or more programs are respectively executed by the one or more processors and the GPU, the one or more central processing units and the arithmetic acceleration units implement the above-mentioned secure boot method.

[0044] According to a fourth aspect of the present application, there is provided a computer-readable medium having a computer program stored thereon, and when the program is executed by a processor, the above-mentioned secure boot method is implemented.

[0045] The secure boot method of the operating system provided by the present application can produce the following beneficial effects:

[0046] Utilize general-purpose hardware, such as a GPU, to implement the secure boot of the operating system, without the need for additional dedicated security hardware, and has better economy and versatility;

[0047] Since the computing power of the GPU is much stronger than that of dedicated security hardware, the encryption and decryption speeds in the secure boot method are faster, more system startup codes can be processed, and a faster and more secure secure boot solution can be realized.

[0048] It should be understood that the above general description and the following detailed description are only exemplary and do not limit the present application. Description of the Drawings

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application.

[0050] Figure 1 Shows a flowchart of a secure boot method according to an exemplary embodiment of the present application.

[0051] Figure 2 Shows a flowchart of a secure boot method according to another exemplary embodiment of the present application.

[0052] Figure 3 Shows a block diagram of the composition of a secure boot device according to an exemplary embodiment of the present application.

[0053] Figure 4 Shows a block diagram of the composition of a secure boot device according to another exemplary embodiment of the present application.

[0054] Figure 5 Shows a block diagram of the composition of a secure boot electronic device according to an exemplary embodiment of the present application. Detailed Embodiments

[0055] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. These embodiments are provided so that this application will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. Like reference numerals refer to like or similar parts throughout the figures, and thus their repetitive description will be omitted.

[0056] In addition, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of the embodiments of this application. However, those skilled in the art will realize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be used. In other instances, well-known methods, devices, implementations, or operations are not shown or described in detail to avoid obscuring aspects of this application.

[0057] Those skilled in the art can understand that the accompanying drawings are only schematic diagrams of example embodiments and may not be to scale. The modules or processes in the drawings are not necessarily essential for implementing this application, and thus cannot be used to limit the protection scope of this application.

[0058] General-purpose computing on graphics processing units (GPGPU) technology is a technology that uses a graphics processing unit (GPU) for processing graphics tasks to compute general computing tasks that were originally processed by a central processing unit (CPU). Due to the powerful parallel processing capabilities and programmable pipelines of modern graphics processing units (GPUs), instruction stream processors can process non-graphic data. Especially when the computational volume of data processing is much larger than the need for data scheduling and transmission, GPGPU significantly outperforms traditional CPU applications in terms of performance. GPGPU technology has been widely used in the implementation of cryptographic algorithms. Many traditional cryptographic algorithms such as DES, AES, etc., as well as advanced post-quantum cryptographic algorithms and fully homomorphic cryptographic algorithms, choose to use GPGPU technology to achieve acceleration. Existing GPGPU programming languages include OpenGL, CUDA, and OpenCL, etc. The general program execution process is to transfer data from the CPU to the GPU, process the data in the GPU, and then transfer the processing results from the GPU back to the CPU. Since the main program of a PC runs in the CPU, the process of GPU data processing and intermediate results cannot be directly accessed. Therefore, compared with the CPU, the GPU can be regarded as a secure execution environment.

[0059] The Physical Unclonable Function (PUF for short) is a hardware security technology. It is an unclonable physical change that occurs naturally during the semiconductor manufacturing process and serves as a "digital fingerprint" for the unique identity of semiconductor devices such as microprocessors. In cryptography, the basic benefits of using the Physical Unclonable Function are its "uniqueness" and "unpredictability". The initial data in the GPU SRAM after power-on is a type of PUF. For different GPU chips, the initial data stored in the SRAM after power-on and before initialization is different. Stable random data can be extracted from it through the FE (Fuzzy Extractor) algorithm. The extracted random data is unique for different GPU chips and cannot be obtained after the GPU SRAM is initialized. It is necessary to power on again and run the FE algorithm before initialization to obtain it.

[0060] Therefore, in the secure boot method of the operating system provided in this application, the random data extracted from the initial data of the GPU SRAM through the FE (Fuzzy Extractor) algorithm is used as the secure boot key, enabling the secure system of the operating system without the need for additional dedicated security hardware. In addition, the secure boot method provided in this application is not limited to PC machines. Any terminal with a CPU and a GPU processor can adopt the secure boot method for secure boot.

[0061] In the secure boot method of the operating system provided in this application, it is not limited to the GPU. Any computing acceleration unit with SRAM and good computing performance can implement the secure boot method. In this article, taking a PC machine and a GPU as examples, the technical solutions of this application are described in combination with the accompanying drawings.

[0062] Figure 1 Shows a flowchart of the secure boot method according to an exemplary embodiment of the present application.

[0063] According to a first aspect of the present application, a secure boot method for an operating system is provided. As Figure 1 shown, the secure boot method includes:

[0064] In step S110, after the operating system is powered on, a second key is obtained in the GPU based on the initial data of the GPU SRAM.

[0065] After the operating system is powered on, the initial data of the GPU SRAM is a kind of PUF. For different GPU chips, the initial data stored in the SRAM after power-on and before initialization is different. Stable random data can be extracted from it through the FE (Fuzzy Extractor) algorithm. The extracted random data is unique for different GPU chips and cannot be obtained after the GPU SRAM is initialized. It needs to be powered on again and obtained by running the FE algorithm before initialization.

[0066] Therefore, the random data extracted from the initial data of the GPU SRAM through the FE (Fuzzy Extractor) algorithm is used as the second key for secure boot, and the security system of the operating system can be realized without additional dedicated security hardware.

[0067] In step S120, the GPU obtains the first key in ciphertext form and the system boot code in ciphertext form from the CPU.

[0068] When using the secure boot method provided in this application, the PC needs to be pre-set at the factory. During the pre-setting process, the system boot code to be encrypted and the first key used to encrypt or decrypt the system boot code are transmitted to the GPU.

[0069] After the operating system is powered on, the second key is obtained in the GPU according to the initial data of the GPU SRAM. In the GPU, the first encryption algorithm is used to encrypt the first key with the second key to obtain the first key in ciphertext form. Then, the second encryption algorithm is used to encrypt the system boot code with the first key in plaintext form to obtain the system boot code in ciphertext form. The first key in ciphertext form and the system boot code in ciphertext form are transmitted to the CPU for local storage, and the secure boot setting can be completed. The first encryption algorithm and the second encryption algorithm can be one of the AES algorithm, the post-quantum cryptography algorithm, and the fully homomorphic cryptography algorithm. The first encryption algorithm and the second encryption algorithm can be the same or different.

[0070] During each boot process, after the operating system is powered on, the first key in ciphertext form and the system boot code in ciphertext form stored locally are transmitted to the GPU for performing the secure boot process.

[0071] In step S130, in the GPU, the first key in ciphertext form is decrypted using the second key with the first decryption algorithm to obtain the first key in plaintext form. After the first key in ciphertext form is transmitted to the GPU, the first decryption algorithm and the second key can be used to decrypt the first key to obtain the first key in plaintext form. According to some embodiments of the application, the first decryption algorithm can be one of the DES algorithm, the post-quantum cryptography algorithm, and the fully homomorphic cryptography algorithm.

[0072] In step S140, in the GPU, the system startup code in ciphertext form is decrypted using the first key in plaintext form with the second decryption algorithm to obtain the system startup code in plaintext form and transmit it to the CPU.

[0073] After the system startup code in ciphertext form is transmitted to the GPU, the second decryption algorithm and the first key in plaintext form can be used to decrypt the startup code to obtain the startup code in plaintext form. According to some embodiments of the application, the first decryption algorithm can be one of the DES algorithm, the post-quantum cryptography algorithm, and the fully homomorphic cryptography algorithm. The first decryption algorithm and the second decryption algorithm can be the same or different.

[0074] The system startup code is transmitted from the GPU to the CPU. The CPU loads and runs the system startup code to complete the secure startup of the operating system.

[0075] Figure 2 The flowchart of the secure startup method according to another exemplary embodiment of the present application is shown.

[0076] According to another embodiment of the present application, as Figure 2 shown, the secure startup method further includes:

[0077] In step S150, after obtaining the second key, the GPU SRAM is initialized to clear the initial data in the SRAM after power-on. After the GPU SRAM is initialized, the initial data in it is destroyed. The second key can only be obtained after the next power-on of the operating system and before the initialization of the GPU SRAM, thereby ensuring the security of the second key. In addition, due to the characteristics of the Fuzzy Extractor algorithm, it can be ensured that for the same GPU, the random data extracted each time after power-on is consistent, that is, the second password extracted each time is consistent.

[0078] According to some embodiments of the present application, the initialization of the GPU SRAM can be performed either during the secure startup process or after the secure startup is completed.

[0079] In step S160, after completing the secure startup, the first key and the second key in plaintext form in the GPU are destroyed.

[0080] Figure 3 Shows a block diagram of the composition of a secure boot device according to an exemplary embodiment of the present application.

[0081] According to a second aspect of the present application, a secure boot device 300 for an operating system is provided. As Figure 3 shown, the secure boot device 300 includes: a key generation module 310, a data transmission module 320, a first decryption module 330, and a second decryption module 340.

[0082] The key generation module 310 is configured to obtain a second key in the GPU according to the initial data of the GPU SRAM after the operating system is powered on.

[0083] After the operating system is powered on, the initial data of the GPU SRAM is a kind of PUF. For different GPU chips, the initial data stored in their SRAM after power-on and before initialization is different. Stable random data can be extracted from it through the FE (Fuzzy Extractor) algorithm. The extracted random data is unique for different GPU chips and cannot be obtained after the GPU SRAM is initialized. It is necessary to power on again and run the FE algorithm before initialization to obtain it. Therefore, the random data extracted from the initial data of the GPU SRAM through the FE (Fuzzy Extractor) algorithm can be used as the second key for secure boot.

[0084] The data transmission module 320 is configured to enable the GPU to obtain the first key in ciphertext form and the system boot code in ciphertext form from the CPU.

[0085] The first key and the system boot code are locally stored in the CPU. Through pre-setting, the system boot code in ciphertext form and the first key in ciphertext form can be obtained and stored locally. The system boot code in ciphertext form can be decrypted using the first key. The key of the first key in ciphertext form can be decrypted using the second key.

[0086] During the secure boot process, the system boot code in ciphertext form and the first key in ciphertext form are transmitted to the GPU for decryption.

[0087] The first decryption module 330 is configured to decrypt the first key in ciphertext form using the second key in the GPU by using a first decryption algorithm to obtain the first key in plaintext form.

[0088] The second decryption module 340 is configured to decrypt the system boot code in ciphertext form using the first key in plaintext form by using a second decryption algorithm to obtain the system boot code in plaintext form and transmit it to the CPU.

[0089] Figure 4 Shows a block diagram of the composition of a secure boot device according to another exemplary embodiment of the present application.

[0090] According to another embodiment of the present application, as Figure 4 shown, the secure boot device 300 may further include a boot setting module 350, configured to obtain a system boot code in ciphertext form and a first key in ciphertext form in the GPU.

[0091] The secure boot setting is similar to the factory setting of a PC. During the secure boot setting process, first, the system boot code to be encrypted and the first key in plaintext form for encrypting or decrypting the system boot code are transmitted to the GPU. In the GPU, the first key in plaintext is encrypted using the second key by a first encryption algorithm to obtain the first key in ciphertext form. Then, the system boot code in plaintext is encrypted using the first key in plaintext by a second encryption algorithm to obtain the system boot code in ciphertext form. The first key in ciphertext form and the system boot code in ciphertext form are transmitted to the CPU for local storage, and thus the secure boot setting is completed.

[0092] Figure 5 Shows a block diagram of a secure boot electronic device according to an exemplary embodiment of the present application.

[0093] The present application also provides a secure boot electronic device 700 for an operating system. Figure 5 The shown electronic device 700 is only an example and should not impose any limitation on the functions and usage scope of the embodiments of the present application.

[0094] As Figure 5 shown, the electronic device 700 is presented in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one central processing unit 710, at least one first storage unit 720, at least one operation acceleration unit 730, at least one second storage unit 740, a bus 770 connecting different system components, etc. Data communication is performed between the central processing unit 710 and the operation acceleration unit 730.

[0095] The first storage unit 720 stores program codes, which can be executed by the central processing unit 710, so that the central processing unit 710 executes the methods according to the embodiments of the present application described in this specification.

[0096] The first storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202, and may further include a read-only storage unit (ROM) 7203.

[0097] The first storage unit 720 may further include a program / utility 7204 having a set (at least one) of program modules 7205. Such program modules 7205 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment.

[0098] The second storage unit 740 stores program code that can be executed by the operation acceleration unit 730, so that the operation acceleration unit 730 executes the methods according to the embodiments of the present application described in this specification.

[0099] The second storage unit 740 includes SRAM and may further include a program / utility 7402 having a set (at least one) of program modules 7403. Such program modules 7403 include, but are not limited to, one or more application programs, other program modules, and program data.

[0100] The bus 770 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus structures.

[0101] The electronic device 700 may also communicate with one or more external devices 7001 (such as a touch screen, keyboard, pointing device, Bluetooth device, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or may communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (such as a router, modem, etc.). Such communication may be through the input / output (I / O) interface 750. Moreover, the electronic device 700 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through the network adapter 760. The network adapter 760 may communicate with other modules of the electronic device 700 through the bus 770. It should be understood that although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0102] The present application also provides a computer-readable medium having a computer program stored thereon, and when the program is executed by a processor, the above-mentioned secure boot method is implemented.

[0103] The secure boot method of the operating system provided by this application utilizes the PUF characteristics of the GPU after power-on and before initialization, as well as the powerful processing ability of the GPU, to achieve the secure boot of the operating system through the GPU, without the need for additional dedicated security hardware, and has better economy and versatility; since the computing power of the GPU is far stronger than that of dedicated security hardware, the encryption and decryption speeds in the secure boot method are faster, more system startup codes can be processed, and a faster and more secure secure boot solution can be achieved.

[0104] It should be noted that each embodiment described above with reference to the accompanying drawings is only used to illustrate this application rather than limit the scope of this application. Those of ordinary skill in the art should understand that any modification or equivalent replacement made to this application without departing from the spirit and scope of this application should be covered within the scope of this application. In addition, unless otherwise indicated in the context, words in the singular form include the plural form, and vice versa. Additionally, unless otherwise specified, all or part of any embodiment can be used in combination with all or part of any other embodiment.

Claims

1. A secure boot method for an operating system, characterized in that Including: After the operating system is powered on, a second key is obtained from the initial data of its SRAM in the arithmetic acceleration unit; The arithmetic acceleration unit obtains the first key in ciphertext form and the system startup code in ciphertext form from the CPU; In the arithmetic acceleration unit, the first decryption algorithm is used to decrypt the first key in ciphertext form with the second key to obtain the first key in plaintext form; In the arithmetic acceleration unit, the second decryption algorithm is used to decrypt the system startup code in ciphertext form with the first key in plaintext form to obtain the system startup code in plaintext form and transmit it to the CPU; And In the arithmetic acceleration unit, the first encryption algorithm is used to encrypt the first key in plaintext form with the second key to obtain the first key in ciphertext form and transmit it to the CPU for local storage; In the arithmetic acceleration unit, the second encryption algorithm is used to encrypt the system startup code with the first key in plaintext form to obtain the system startup code in ciphertext form and transmit it to the CPU for local storage.

2. The security startup method according to claim 1, wherein The arithmetic acceleration unit includes: GPU or AI chip.

3. The secure boot method according to claim 2, characterized in that Obtaining the second key from the initial data of its SRAM in the arithmetic acceleration unit includes: Using the Fuzzy Extractor algorithm to extract the second key from the initial data of the SRAM.

4. The secure boot method according to claim 1, wherein Also including: After obtaining the second key, initialize the SRAM and clear the initial data of the SRAM after power-on.

5. The secure boot method according to claim 1, wherein The first decryption algorithm and the second decryption algorithm include: One of the DES algorithm, post-quantum cryptography algorithm, and fully homomorphic cryptography algorithm.

6. The secure boot method according to claim 1, wherein The first encryption algorithm and the second encryption algorithm include: One of the AES algorithm, post-quantum cryptography algorithm, and fully homomorphic cryptography algorithm.

7. The secure boot method according to claim 1, wherein Also including: After the system startup code is transmitted to the CPU, destroy the first key in plaintext form and the second key in the arithmetic acceleration unit.

8. A security startup device for an operating system, characterized in that, Including: A key generation module, which is used to obtain a second key from the initial data of its SRAM in the arithmetic acceleration unit after the operating system is powered on; A data transmission module, which is used for the arithmetic acceleration unit to obtain the first key in ciphertext form and the system startup code in ciphertext form from the CPU; A first decryption module, which is used to decrypt the first key in ciphertext form with the second key in the arithmetic acceleration unit using the first decryption algorithm to obtain the first key in plaintext form; A second decryption module, which is used to decrypt the system startup code in ciphertext form with the first key in plaintext form in the arithmetic acceleration unit using the second decryption algorithm to obtain the system startup code in plaintext form and transmit it to the CPU; A first encryption module, which is used to encrypt the first key in plaintext form with the second key in the arithmetic acceleration unit using the first encryption algorithm to obtain the first key in ciphertext form and transmit it to the CPU for local storage; A second encryption module, which is used to encrypt the system startup code with the first key in plaintext form using the second encryption algorithm to obtain the system startup code in ciphertext form and transmit it to the CPU for local storage.

9. The safety startup device according to claim 8, characterized in that, It further includes: A startup setting module, configured to obtain a system startup code in ciphertext form and a first key in ciphertext form in the arithmetic acceleration unit.

10. An electronic device, characterized in that, It includes: One or more central processing units; One or more arithmetic acceleration units; A first storage device and a second storage device, respectively used to store one or more programs; When the one or more programs are respectively executed by the one or more central processing units and arithmetic acceleration units, the one or more central processing units and arithmetic acceleration units implement the secure startup method according to any one of claims 1-7.

11. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the central processing unit, it implements the secure startup method according to any one of claims 1-7.

Images