Signature firmware upgrade method, device and computer readable medium

Abstract

The present invention discloses a signed firmware upgrade method, device and computer-readable medium, which signs the firmware to be upgraded, stores the signed firmware to be upgraded in a firmware upgrade package, and enters a firmware upgrade mode; passes a digital signature algorithm and public key parameters to a device tree in a memory through a bootloader firmware in the firmware to be upgraded, and passes a fuse mark and a lock mark to a command line parameter; if the fuse mark in the command line parameter indicates that the device is fused or the lock mark indicates that the device is locked, the signed firmware to be upgraded is verified and upgraded. Therefore, when the device is fused or locked, a signature verification is performed on the firmware to be upgraded to ensure that the firmware is upgraded only after the verification is passed, so as to avoid the situation where there is no signature or the signature is wrong after the firmware is upgraded, thereby ensuring that the device upgrade can be started normally and improving the reliability of the firmware upgrade.

Description

Technical Field

[0001] The present invention relates to the field of embedded technology, and in particular to a signed firmware upgrade method, device and computer-readable medium. Background Art

[0002] Currently, devices that support secure boot need to sign the firmware and verify the firmware during the boot process. However, the existing FOTA (Firmware Over-The-Air) firmware upgrade solution usually directly upgrades the signed firmware. In the case that the device hardware (such as the SoC chip) has been blown, if the firmware is not signed or the firmware uses the wrong key, resulting in an error in the signature, the device will not be able to boot after the upgrade. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a signed firmware upgrade method, device and computer-readable medium, which can improve the reliability of firmware upgrade.

[0004] In one aspect of the present invention, a signed firmware upgrade method is provided. The method includes the following steps: signing the firmware to be upgraded; storing the signed firmware to be upgraded in a firmware upgrade package and entering a firmware upgrade mode; passing the digital signature algorithm and public key parameters to the device tree in the memory through the bootloader firmware in the firmware to be upgraded, and passing the fuse mark and the lock mark to the command line parameters; if the fuse mark contained in the command line parameters indicates that the device is fused or the lock mark indicates that the device is locked, verifying the signed firmware to be upgraded in the firmware upgrade package; and upgrading the firmware to be upgraded that succeeds in the verification.

[0005] In another aspect of the present invention, a signed firmware upgrade device is provided, which includes a memory configured to store a computer program and a processor configured to execute the computer program to perform the above-mentioned signed firmware upgrade method.

[0006] In another aspect of the present invention, a computer-readable medium is provided, wherein a computer program is stored on the medium, and the computer program is executed by a processor to implement the above-mentioned signature firmware upgrade method.

[0007] The beneficial effects of the present invention are: signing the firmware to be upgraded, storing the signed firmware to be upgraded in a firmware upgrade package, and entering the firmware upgrade mode; passing the digital signature algorithm and public key parameters to the device tree in the memory through the bootloader firmware in the firmware to be upgraded, and passing the fuse mark and the lock mark to the command line parameter; if the fuse mark contained in the command line parameter indicates that the device is blown or the lock mark indicates that the device is locked, then verifying the signed firmware to be upgraded, and upgrading the firmware to be upgraded that succeeds the verification. Therefore, when the device is blown or locked, the signature verification is performed on the firmware to be upgraded to ensure that the firmware is upgraded only after the verification passes, which can avoid obtaining firmware without a signature or with an erroneous signature after the firmware upgrade, thereby ensuring that the device upgrade can be started normally and improving the reliability of the firmware upgrade. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 is a flowchart of a signed firmware upgrade method according to an embodiment of the present invention;

[0009] Figure 2 is a flowchart of a signed firmware upgrade method according to an embodiment of the present invention;

[0010] Figure 3 FIG. 4 is a block diagram of a signed firmware upgrade device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0011] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.

[0012] In the prior art, when the device hardware has been blown, if the firmware is not signed or a signature error is caused by using an incorrect key, the device will be unable to start after the upgrade.

[0013] In order to solve at least the above technical problems, the present disclosure provides a method for signing firmware upgrades. According to the present disclosure, the firmware to be upgraded is signed and stored in a firmware upgrade package before entering the firmware upgrade mode; the digital signature algorithm and public key parameters are passed to the device tree in the memory, and the fuse mark and lock mark are passed to the command line parameters; if the fuse mark in the command line parameter indicates that the device is blown or the lock mark indicates that the device is locked, the signed firmware to be upgraded is verified, and the firmware that succeeds the verification is upgraded. In this way, according to the embodiments of the present disclosure, it is possible to avoid firmware that is not signed or has an erroneous signature after the firmware upgrade, ensure that the device upgrade can be started normally, and improve the reliability of the firmware upgrade.

[0014] Hereinafter, the technical solution according to the present disclosure will be described with reference to specific embodiments and in conjunction with the accompanying drawings.

[0015] Figure 11 is a flowchart showing a signature firmware upgrade method 100 according to an embodiment of the present disclosure. Figure 1 The method 100 includes the following steps 102 to 108.

[0016] In step 102, the firmware to be upgraded is signed. In some embodiments, the firmware to be upgraded includes one or more of bootloader firmware, trusted operating system firmware, startup firmware, and upgrade mode firmware. In this way, the firmware to be upgraded includes at least one of the above firmware, which can improve the versatility of the firmware signature.

[0017] In some embodiments, the type tag of the head of the firmware to be upgraded is obtained, and the corresponding signature method is selected to sign each firmware in the firmware to be upgraded according to the firmware and the type tag included in the firmware to be upgraded. In this way, the signature method is determined according to the firmware and the type tag included in the firmware to be upgraded, thereby improving the flexibility of the signature.

[0018] In step 104, the signed firmware to be upgraded is stored in the firmware upgrade package, and the firmware upgrade mode is entered. In some embodiments, after the firmware upgrade package is obtained by the device, the device verifies the legitimacy of the firmware upgrade package. If the firmware upgrade package is legitimate, the device starts the firmware upgrade and the device is guided into the firmware upgrade mode.

[0019] In step 106, the digital signature algorithm and public key parameters are passed to the device tree in the memory through the boot program firmware in the firmware to be upgraded, and the fuse mark and the lock mark are passed to the command line parameters. In some embodiments, when the public key of each level of boot program firmware is legal, the boot program firmware of the current level that has passed the verification is used to pass the digital signature algorithm, public key parameters, fuse mark and lock mark to the next level of boot program firmware that has passed the verification, until it is passed to the last level of boot program firmware. In addition, the digital signature algorithm and public key parameters in the last level of boot program firmware are written into the device tree in the memory, and the fuse mark and the lock mark are written into the command line parameters. In this way, when the public key is legal and the boot programs at all levels have passed the verification, the digital signature algorithm, public key parameters, fuse mark and lock mark can be safely transmitted to ensure the security of the firmware signature.

[0020] In some embodiments, when verifying the legitimacy of the public key of each level of boot program firmware, it is necessary to extract the public key information in each level of boot program firmware and calculate its digital digest. If the calculation result is the same as the preset result, the public key is legal. In this way, the security of the firmware signature can be improved.

[0021] In some embodiments, the data in the device tree and the command line parameters are sent to the upgrade mode firmware in the firmware to be upgraded. If the upgrade mode firmware passes the verification, the upgrade mode firmware is guided to perform the firmware upgrade. In this way, the upgrade mode firmware can receive the digital signature algorithm, public key parameters, fuse mark and lock mark in the device tree and the command line parameters, which is convenient for subsequent firmware upgrades.

[0022] In step 108, when the fuse mark included in the command line parameter indicates that the device is blown or the lock mark indicates that the device is locked, the firmware to be upgraded after the signature in the firmware upgrade package is verified, and the firmware that succeeds the verification is upgraded. In some embodiments, if the fuse mark included in the command line parameter indicates that the device is not blown and the lock mark indicates that the device is not locked, the firmware to be upgraded is directly upgraded. In this way, it is possible to avoid obtaining firmware without a signature or with an erroneous signature after the firmware upgrade, thereby ensuring that the device upgrade can be started normally; at the same time, when the device is not blown, it is allowed to directly upgrade the legal upgrade package, thereby improving the reliability of the firmware upgrade.

[0023] In some embodiments, when the fuse mark in the command line parameter is true, the boot program firmware, trusted operating system firmware, startup firmware and upgrade mode firmware in the firmware upgrade package are checked in sequence. If all the checks are successful, the check result is marked as successful and the firmware is upgraded; otherwise, when the lock mark in the command line parameter is true, the startup firmware and upgrade mode firmware in the firmware upgrade package are checked in sequence. If all the checks are successful, the check result is marked as successful and the firmware is upgraded. In this way, the firmware can be checked in a targeted manner according to the fuse mark or the lock mark, thereby improving the verification efficiency.

[0024] In step 110, the firmware to be upgraded that has been successfully verified is upgraded.

[0025] In some embodiments, the firmware in the firmware upgrade package is stored in the form of a temporary file in the memory or a readable and writable file system partition, and the path where the temporary file is located is verified. In this way, asynchronous verification can be performed in the form of a temporary file, further improving the verification efficiency.

[0026] According to the embodiments of the present disclosure, through the signed firmware upgrade method, when the device is blown, the signature verification can be first performed on the firmware to be upgraded, and the upgrade is allowed only after the firmware verification is passed, thereby solving the problem that the device cannot be started after the upgrade due to upgrading the firmware without a signature or with an incorrect signature. At the same time, when the device is not blown, the legal upgrade package is allowed to be directly upgraded, improving the availability of the device and the efficiency of device development and debugging. In this way, the upgrade of the signed firmware is achieved, thereby improving the reliability of the firmware upgrade.

[0027] Hereinafter, application scenarios of the signed firmware upgrade method and device according to the embodiments of the present invention will be described by way of examples.

[0028] Figure 2 2 is a flowchart showing a method for updating a signed firmware according to an embodiment of the present invention, including steps 202 to 208.

[0029] In step 202, the firmware to be upgraded is signed. A pair of public and private keys is generated according to the selected digital signature algorithm, and the firmware binary file to be verified is signed. The firmware signature specifically includes signing one or more of the boot program firmware, the trusted operating system firmware, the startup firmware, and the upgrade mode firmware of the firmware to be upgraded.

[0030] When signing the bootloader firmware, the bootloader firmware can be divided into three types according to the magic number in the firmware header: type 1, type 2, and type 3. The bootloader firmware contains multiple levels of bootloader firmware, where the first level of bootloader firmware must be type 1.

[0031] For type one, the digital signature algorithm and public key parameter information are first written into a specific location of the firmware, and the signature mark (such as SignFlag) field in the firmware header is set to the signature mark. Then the entire firmware is signed with a private key, and the signature information is written to the end of the firmware.

[0032] For type 2, the last three parts of the firmware header are the message digest algorithm type field, the message digest field (such as hash), and a reserved area. The message digest field stores the message digest of all firmware header information before this field calculated according to the algorithm specified by the message digest algorithm type. The reserved area at the end of the header includes three aspects: firmware signature mark, digital signature information length, and digital signature information.

[0033] In the type 2 firmware signing process, the signature tag (such as SignFlag) field of the firmware header is first set to the signature tag, and the value of the digital signature information length field of the firmware header is set according to the digital signature algorithm type. Finally, the message digest field (such as hash) of the firmware header is signed using the private key, and the signature information is written into the digital signature information area of ​​the firmware header.

[0034] For type three, the firmware is in FIT format, and the FIT format firmware is signed according to the uboot FIT signature method.

[0035] When signing the trusted operating system firmware, the trusted operating system firmware can be divided into two types according to the magic number in the firmware header: type one and type two.

[0036] For type 1, the last three parts of the firmware header are the message digest algorithm type field, the message digest field (such as hash), and a reserved area. The message digest field stores the message digest of all firmware header information before this field calculated according to the algorithm specified by the message digest algorithm type. The reserved area at the end of the header includes three aspects: firmware signature mark, digital signature information length, and digital signature information.

[0037] During the type 1 firmware signing process, the signature tag (such as SignFlag) field of the firmware header is first set to the signature tag, and the value of the digital signature information length field of the firmware header is set according to the digital signature algorithm type. Finally, the message digest field (such as hash) of the firmware header is signed using the private key, and the signature information is written into the digital signature information area of ​​the firmware header.

[0038] For type 2, this type of firmware contains multiple sub-firmware (such as ATF firmware and TEE OS firmware), and its firmware layout is: basic header information + sub-firmware meta information + digital signature information + each sub-firmware binary data.

[0039] The "basic header information" includes the firmware signature tag, message digest algorithm type field, digital signature algorithm type field and digital signature information offset address field. The "sub-firmware meta information" includes the message digest and loading address of each sub-firmware.

[0040] During the type 2 firmware signing process, the signature tag (such as SignFlag) field of the firmware header is first set to the signature tag, and the message digest algorithm type field, digital signature algorithm type field, and digital signature information offset address field are set respectively. Then, the message digest of all information before the digital signature information offset address field (i.e., the "basic header information + sub-firmware meta information" in the firmware) is calculated according to the algorithm specified in the message digest algorithm type field, and finally the calculated message digest is signed with the private key, and the signature information is written to the location specified in the digital signature information offset address field.

[0041] When signing the boot firmware (such as boot.img), the boot firmware can be divided into two types according to the magic number in the firmware header: Android format and FIT format.

[0042] There are two signing methods for Android-formatted firmware: Method 1 and Method 2.

[0043] Method 1: Use standard Android Verity to sign the firmware.

[0044] Method 2: First, write the signature mark in a fixed position of the reserved field of the boot firmware header (such as BOOT HEADER), then take the field content (such as the id field) that changes every time the boot firmware header (such as BOOT HEADER) is compiled as the signed content, and finally use the private key to sign the signed content, and write the signature information to a fixed position of the reserved field of the boot firmware header (such as BOOT HEADER).

[0045] For FIT format: Sign the FIT format firmware according to the uboot FIT signature method.

[0046] When signing the upgrade mode firmware (such as recovery.img), the upgrade mode firmware can be divided into two types according to the magic number in the firmware header: Android format and FIT format.

[0047] There are two signing methods for Android-formatted firmware: Method 1 and Method 2.

[0048] Method 1: Use standard Android Verity to sign the firmware.

[0049] Method 2: First, write the signature mark in a fixed position of the reserved field of the boot firmware header (such as BOOT HEADER), then take the field content (such as the id field) that changes every time the boot firmware header (such as BOOT HEADER) is compiled as the signed content, and finally use the private key to sign the signed content, and write the signature information to a fixed position of the reserved field of the boot firmware header (such as BOOT HEADER).

[0050] For FIT format: Sign the FIT format firmware according to the uboot FIT signature method.

[0051] In step 204, the signed complete firmware to be upgraded is placed in a firmware upgrade package. After the device obtains the firmware upgrade package, the legitimacy of the upgrade package itself is verified. If the upgrade package is legitimate, the firmware upgrade is started and the device is guided into a firmware upgrade mode (such as recovery).

[0052] In step 206, the device starts, and the boot program passes the digital signature algorithm and public key parameters to the device tree in the memory, and passes the device fuse mark and device lock mark to the command line parameters.

[0053] Specifically, when the device starts, the SoC chip ROM firmware verifies the legitimacy of the public key information in the first-level boot program firmware in the storage medium, that is, first reads the public key information in the first-level boot program firmware to be booted, calculates the digital summary of the public key information, and compares it with the OTP or efuse in the device chip to verify the legitimacy of the public key. If the public key is legal, the first-level boot program firmware to be booted is verified, and after the verification passes, the first-level boot program is loaded and started.

[0054] The next-level boot program to be booted in the storage medium is verified in sequence. After the verification is passed, the digital signature algorithm and public key parameters contained in the first-level boot program firmware are passed to the last-level boot program (such as uboot) in sequence. The first-level boot program also passes the device's fuse mark to the last-level boot program.

[0055] In the last level boot program, write the digital signature algorithm and public key parameters passed by the first level boot program into the device tree (dtb) area in the memory, create relevant nodes, and pass the entire device tree area to the upgrade mode firmware (such as recovery). Write the fuse mark passed by the first level boot program into the command line parameter and pass it to the upgrade mode firmware (such as recovery). And read the lock mark of the device, write the mark into the command line parameter and pass it to the upgrade mode firmware (such as recovery). Verify the upgrade mode firmware in the storage medium to be booted, and after the verification passes, boot the upgrade mode firmware.

[0056] In step 208, in the firmware upgrade mode, the device fuse flag and the device lock flag in the command line parameters are first read. The device fuse flag (such as fuse.programmed) indicates that the fuse is blown if the flag exists and is true, otherwise it indicates that the fuse is not blown; the device lock flag indicates that the device is locked if the flag exists and is locked, otherwise it indicates that the device is not locked.

[0057] Determine whether the device is blown based on the device fuse mark. If the device is blown, execute the following step 210; if the device is not blown and is not locked, execute the firmware upgrade process to complete the upgrade of the device firmware; if the device is not blown but is in a locked state, execute the following steps 2082 to 2084.

[0058] In step 2082, the upgrade package is checked to see whether there is a boot firmware (such as boot.img).

[0059] If it does not exist, execute step 2084. If it does exist, extract the boot firmware (such as boot.img) from the upgrade package and store it in the form of a temporary file in the Memory (memory) or in a readable and writable file system partition. Then verify the path where the extracted temporary file is located. If the verification is successful, check whether there is an upgrade mode firmware. Otherwise, set the verification result mark as failure and execute step 212.

[0060] In step 2084, the upgrade package is checked to see if there is an upgrade mode firmware (such as recovery.img).

[0061] If it does not exist, set the verification result mark to success and execute step 212. If it does exist, extract the upgrade mode firmware (such as recovery.img) from the upgrade package and store it in the form of a temporary file in the memory or in a readable and writable file system partition. Then verify the path where the extracted temporary file is located. If the verification is successful, set the verification result mark to success, otherwise set the verification result mark to failure. After completing the verification result mark setting, execute step 212.

[0062] In step 210, the firmware binary file to be verified is extracted from the upgrade package to the memory or the readable and writable file system partition. The firmware binary file to be verified includes one or more of the boot program firmware, the trusted operating system firmware (such as TEE and ATF), the boot firmware (such as boot.img), and the upgrade mode firmware (such as recovery.img). Among them, the boot program can have multiple levels. If the boot program has multiple levels, the boot programs of each level will be extracted in sequence and verified, that is, the following steps 2102 to 2108 are executed.

[0063] In step 2102, the upgrade package is checked to see whether there is a boot program firmware.

[0064] If it does not exist, execute step 2104. If it does exist, extract the boot program firmware from the upgrade package and store it in the memory or in a readable and writable file system partition in the form of a temporary file. Then verify the path where the extracted temporary file is located. If the verification is successful, check whether the trusted operating system firmware exists. Otherwise, set the verification result mark as failure and execute step 212.

[0065] If there are multiple levels of boot programs, the boot program firmware of each level will be extracted from the firmware upgrade package in sequence and stored in the Memory or a readable and writable file system partition in the form of a temporary file. Then, the path where the extracted temporary file is located will be verified. If the verification is successful, the next level of boot program firmware verification will continue until all boot program firmware are successfully verified to see if there is a trusted operating system firmware. If the verification fails, the verification result mark is set to fail, and step 212 is executed.

[0066] In step 2104, the upgrade package is checked to see whether there is a trusted operating system firmware.

[0067] If not, execute step 2106. If it exists, extract the trusted operating system firmware from the upgrade package and store it in the form of a temporary file in the memory or in a readable and writable file system partition. Then verify the path where the extracted temporary file is located. If the verification is successful, check whether the startup firmware exists. Otherwise, set the verification result mark as failure and execute step 212.

[0068] In step 2106, the upgrade package is checked to see whether there is a boot firmware (such as boot.img).

[0069] If it does not exist, execute step 2108. If it does exist, extract the boot firmware (such as boot.img) from the upgrade package and store it in the form of a temporary file in the memory or in a readable and writable file system partition. Then verify the path where the extracted temporary file is located. If the verification is successful, check whether there is an upgrade mode firmware. Otherwise, set the verification result mark as failure and execute step 212.

[0070] In step 2108, the upgrade package is checked to see whether there is an upgrade mode firmware (such as recovery.img).

[0071] If it does not exist, set the verification result mark to success and execute step 212. If it does exist, extract the upgrade mode firmware (such as recovery.img) from the upgrade package and store it in the form of a temporary file in the Memory or in a readable and writable file system partition. Then verify the path where the extracted temporary file is located. If the verification is successful, set the verification result mark to success, otherwise set the verification result mark to failure. After completing the verification result mark setting, execute step 212.

[0072] In step 212, the verification result mark is read. If it is marked as failed, the firmware upgrade process is exited, prompting that the firmware verification is wrong and cannot be upgraded; if it is marked as successful, the firmware upgrade process is executed to complete the upgrade of the device firmware.

[0073] According to another aspect of the present invention, Figure 3 Schematic diagram of a signed firmware upgrade device 300 according to an embodiment of the present invention. Figure 3 The electronic device 300 includes a memory 302, a processor 304, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of the signature firmware upgrade method described above is implemented.

[0074] According to another aspect of the present invention, a computer-readable medium is provided, wherein a computer program is stored on the computer-readable medium, and the computer program is executed by a processor to implement the signature firmware upgrade method described above.

[0075] In summary, in the signature firmware upgrade method, device and computer-readable medium provided by the present invention, one or more of the boot program firmware, trusted operating system firmware, boot firmware and upgrade mode firmware contained in the firmware to be upgraded are signed for the firmware contained in the firmware to be upgraded. Since the firmware to be upgraded contains at least one of the above firmware, the versatility of the firmware signature can be improved. The signed firmware to be upgraded is stored in the firmware upgrade package, and the firmware upgrade mode is entered when the firmware upgrade package passes the legality check. In addition, the digital signature algorithm and public key parameters are passed to the device tree in the memory through the boot program, and the fuse mark and the lock mark are passed to the command line parameter. If the fuse mark contained in the command line parameter is true or the lock mark is true, the signed firmware to be upgraded in the firmware upgrade package is verified, and the firmware that succeeds in the verification is upgraded. If both the fuse mark and the lock mark are not true, the firmware to be upgraded is directly upgraded. Therefore, in the case of a device fuse, the firmware to be upgraded can be signed and verified to ensure that the firmware is upgraded only after the firmware verification passes, thereby avoiding firmware that is not signed or has an incorrect signature after the firmware upgrade, and ensuring that the device upgrade can be started normally. At the same time, if the device is not blown, legal upgrade packages are allowed to be directly upgraded, which improves the availability of the device, the efficiency of device development and debugging, and the reliability of firmware upgrades.

[0076] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A signed firmware upgrade method, characterized in that: include: Sign the firmware to be upgraded; The signed firmware to be upgraded is stored in the firmware upgrade package, and the firmware upgrade mode is entered; The digital signature algorithm and the public key parameters are passed to the device tree in the memory through the bootloader firmware in the firmware to be upgraded, and the fuse mark and the lock mark are passed to the command line parameters; If the blown mark contained in the command line parameter indicates that the device is blown or the locked mark indicates that the device is locked, verifying the signed firmware to be upgraded in the firmware upgrade package; as well as Upgrade the firmware that has been successfully verified. The method of passing the digital signature algorithm and the public key parameters to the device tree in the memory through the bootloader firmware in the firmware to be upgraded, and passing the fuse mark and the lock mark to the command line parameters includes: Verify the legitimacy of the public key of each level of boot program firmware. If the public key is legitimate, verify the boot program firmware of the current level; After the verification is passed, the current level boot program firmware is loaded, and the digital signature algorithm, the public key parameter, the fuse mark and the lock mark are passed to the next level boot program firmware that passes the verification, until they are passed to the last level boot program firmware; In the last level boot program firmware, the digital signature algorithm and the public key parameters are written into the device tree in the memory, and the fuse mark and the lock mark are written into the command line parameters.

2. The signature firmware upgrade method according to claim 1, characterized in that: Also includes: If the blown mark included in the command line parameter indicates that the device is not blown and the locked mark indicates that the device is not locked, the firmware to be upgraded is directly upgraded.

3. The signature firmware upgrade method according to claim 1, characterized in that: Entering the firmware upgrade mode includes: if the firmware upgrade package passes the legality check, entering the firmware upgrade mode.

4. The signature firmware upgrade method according to claim 1, characterized in that: Signing the firmware to be upgraded includes: signing one or more firmwares of the boot program firmware, the trusted operating system firmware, the startup firmware, and the upgrade mode firmware included in the firmware to be upgraded.

5. The signature firmware upgrade method according to claim 4, characterized in that: Signing the firmware to be upgraded includes: Obtaining a type tag of the header of the firmware to be upgraded; A corresponding signature mode is selected according to the firmware included in the firmware to be upgraded and the type tag, so as to sign each firmware in the firmware to be upgraded.

6. The signature firmware upgrade method according to claim 1, characterized in that: Verifying the legitimacy of the public key of each level of bootloader firmware includes: Extracting public key information in each level of boot program firmware and calculating a digital summary of the public key information; The calculation result is compared with the preset result. If the comparison result is the same, it means that the public key is legal. Otherwise, it means that the public key is illegal.

7. The signature firmware upgrade method according to claim 1, characterized in that: After the bootloader firmware in the firmware to be upgraded passes the digital signature algorithm and the public key parameters to the device tree in the memory and passes the fuse mark and the lock mark to the command line parameters, the method further includes: Sending the device tree and the data in the command line parameter to the upgrade mode firmware in the firmware to be upgraded; If the upgrade mode firmware passes the verification, the upgrade mode firmware is guided to perform firmware upgrade.

8. The signature firmware upgrade method according to claim 1, characterized in that: If the blown mark included in the command line parameter indicates that the device is blown or the locked mark indicates that the device is locked, then verifying the signed firmware to be upgraded in the firmware upgrade package includes: Determine whether the fuse flag included in the command line parameter is true; If true, the boot program firmware, trusted operating system firmware, boot firmware and upgrade mode firmware in the firmware upgrade package are verified in turn. If all verifications are successful, the verification results are marked as successful. If not all verifications are successful, the verification results are marked as failed and the firmware upgrade process is exited; If it is not true, when the lock mark contained in the command line parameter is true, the startup firmware and upgrade mode firmware in the firmware upgrade package are checked in turn. If all checks are successful, the check result is marked as successful. When the lock mark contained in the command line parameter is false, the firmware upgrade process is executed to complete the upgrade of the firmware to be upgraded.

9. The signature firmware upgrade method according to claim 1, characterized in that: Verifying the signed firmware to be upgraded in the firmware upgrade package includes: The firmware in the firmware upgrade package is stored in the form of a temporary file in the memory or a readable and writable file system partition, and the path where the temporary file is located is verified.

10. A signed firmware upgrade device, comprising: a memory configured to store a computer program; as well as A processor is configured to execute the computer program to perform the signed firmware upgrade method according to any one of claims 1 to 9.

11. A computer readable medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement the signed firmware upgrade method according to any one of claims 1 to 9.

Images