Internet of Things system and secure startup method thereof

Abstract

The present application relates to an Internet of Things system and a secure boot method thereof. The Internet of Things system includes a main system and multiple subsystems. The main system includes an application processor, a security processor, and an application flash. Each subsystem includes a BOOT partition and an application partition. After being started, the security processor verifies the application flash and starts the application processor after determining that the verification of the application flash is successful. After being started, the application processor powers on the multiple subsystems respectively. After powering on, the BOOT partition sends application partition data of the application partition to the application processor. The application processor verifies the received application partition data and determines that the Internet of Things system has been securely booted when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to a preset verification time. While achieving secure booting of the Internet of Things system, the cost of the Internet of Things system is reduced.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an Internet of Things system and a secure startup method thereof. Background Art

[0002] With the advancement of technology, the Internet of Things (IoT) has become ubiquitous in every household. Unlike traditional internet and mobile internet devices, IoT devices are often resource-constrained and lack high computing power. This makes traditional internet security protocols ineffective for direct application to IoT devices, which typically interact with the outside world through various data channels. In these scenarios, attackers can more easily compromise and tamper with IoT device programs through remote attacks. Ensuring the security of IoT devices to prevent remote tampering is a pressing issue. Furthermore, complex IoT systems comprised of multiple subsystems face the challenge of balancing cost and secure boot. Summary of the Invention

[0003] In view of this, an Internet of Things system and a secure startup method thereof are proposed.

[0004] In a first aspect, an embodiment of the present application provides an Internet of Things system, comprising a main system and multiple subsystems, wherein the main system comprises an application processor, a security processor, and an application flash, and each subsystem comprises a BOOT partition and an application partition.

[0005] The security processor is configured to verify the application flash after being started according to the detected power-on operation, and start the application processor after determining that the verification of the application flash is successful;

[0006] The application processor is configured to power on the multiple subsystems respectively after being started;

[0007] The BOOT partition is used to send the application partition data of the application partition to the application processor after power-on;

[0008] The application processor is further configured to verify the received application partition data, and determine that the Internet of Things system is securely started when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to a preset verification time.

[0009] The Internet of Things system provided by the first aspect is low-cost and can ensure the secure startup of the main system and each subsystem in the Internet of Things system, and can effectively prevent remote tampering, destruction and other attacks against the Internet of Things system.

[0010] According to the first aspect, in a first possible implementation of the system,

[0011] The BOOT partition is further configured to send a verification request to the application processor before sending the application partition data, and after receiving a permission response from the application processor to the verification request, send the application partition data to the application processor, thereby ensuring that the main system can verify the subsystem.

[0012] According to the first aspect, in a second possible implementation of the system,

[0013] The application processor is further configured to, when determining that one or more of the multiple subsystems meet the power-off condition, power off the subsystems meeting the power-off condition.

[0014] The power-off conditions include at least one of the following: failure to receive a verification request from a powered-on subsystem, failure to receive application partition data from a powered-on subsystem, failure to verify the application partition data, or the time between powering on the multiple subsystems and the current moment exceeding a preset verification time and failure to complete verification of the application partition data. Thus, if a subsystem meets the power-off conditions, it can be determined to be under attack, and timely power-off is crucial to ensure the security of the entire IoT system.

[0015] According to the first aspect, in a third possible implementation of the system,

[0016] The application processor is further configured to send a verification calculation request to the security processor based on the received application partition data;

[0017] The security processor is further configured to calculate a calculation verification code of the application partition data based on the verification calculation request and a stored encryption key, and send the calculation verification code to the application processor;

[0018] The application processor is further configured to compare the calculated check code with a stored standard check code to obtain a check result.

[0019] Wherein, when the calculated verification code and the standard verification code are different, it is determined that the verification of the application partition data has failed; when the calculated verification code and the standard verification code are the same, it is determined that the verification of the application partition data has succeeded.

[0020] According to the first aspect, in a fourth possible implementation of the system, the main system further includes a first timeout timer,

[0021] The application processor is further configured to, upon determining that the multiple subsystems have been powered on, start the first timeout timer and set the timeout duration of the first timeout timer to the preset verification duration, so as to determine that the IoT system has been securely booted if verification of the application partition data is successful and the first timeout timer has not expired. This simplifies the secure booting of the entire IoT system.

[0022] According to the first aspect, in a fifth possible implementation of the system, the subsystem further includes a second timeout timer,

[0023] The BOOT partition is further configured to start the second timeout timer upon determining that the application partition data has been sent, and to start the application partition upon determining that the second timeout timer has expired and the subsystem in which it resides is powered on. This ensures that unattacked subsystems can start the application partition in a timely manner, meeting the normal usage requirements of the IoT system.

[0024] According to the third possible implementation manner, in a sixth possible implementation manner of the system, the security processor is further configured to perform at least one of the following operations:

[0025] In the production stage, a first verification code is generated based on a preset encryption key and application partition data of each subsystem, and the first verification code is stored as the standard verification code, so as to ensure the security of the encryption key;

[0026] After the IoT system is securely booted, if it is detected that the IoT system has completed an update, a second verification code is generated based on a preset encryption key and the updated application partition data of each subsystem, and the second verification code is stored as a new standard verification code to ensure the subsequent secure boot of the IoT system;

[0027] After the IoT system is securely booted, if an encryption key update request is detected and authenticated, the stored encryption key is updated based on the encryption key update request. This prevents attacks during the encryption key update process, ensuring the subsequent IoT system boot is secure.

[0028] According to a sixth possible implementation manner, in a seventh possible implementation manner of the system, the Internet of Things system further includes:

[0029] The communication module is connected to the main system and interconnected with the cloud through a network, so that the Internet of Things system can be updated by connecting the communication module to the cloud.

[0030] In a second aspect, an embodiment of the present application provides a secure startup method for an Internet of Things system, the method being applied to the main system in the first aspect or any possible implementation of the first aspect, the method comprising:

[0031] When a power-on operation is detected, starting the security processor and verifying the application flash using the security processor;

[0032] After determining that verification of the application flash is successful, starting the application processor, and using the application processor to power on the multiple subsystems respectively, so that the powered-on subsystems send application partition data to the application processor;

[0033] The application partition data from the subsystem is verified, and when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to the preset verification time, it is determined that the Internet of Things system is safely started.

[0034] The secure startup method for the Internet of Things system provided by the second aspect is low-cost and can ensure the secure startup of the main system and each subsystem in the Internet of Things system, and can effectively prevent remote tampering, destruction and other attacks against the Internet of Things system.

[0035] According to the second aspect, in a first possible implementation of the method, verifying the application partition data from the subsystem includes:

[0036] controlling the security processor to generate a calculation check code for the application partition data according to the stored encryption key;

[0037] Controlling the application processor to compare the calculated check code with a stored standard check code to obtain a check result,

[0038] Wherein, when the calculated verification code and the standard verification code are different, it is determined that the verification of the application partition data has failed; when the calculated verification code and the standard verification code are the same, it is determined that the verification of the application partition data has succeeded.

[0039] According to the second aspect, in a second possible implementation manner of the method, the method further includes:

[0040] When it is determined that one or more of the plurality of subsystems meet the power-off condition, powering off the subsystems meeting the power-off condition,

[0041] The power-off conditions include at least one of the following: failure to receive a verification request from a powered-on subsystem, failure to receive application partition data from a powered-on subsystem, failure to verify the application partition data, or the time from powering on the multiple subsystems to the current moment exceeding a verification time threshold and failure to complete verification of the application partition data. Thus, if a subsystem meets the power-off conditions, it can be determined to be under attack, and timely power-off is crucial to ensure the security of the entire IoT system.

[0042] According to the second aspect, in a third possible implementation manner of the method, the method further includes:

[0043] When it is determined that the plurality of subsystems have been powered on respectively, a first timeout timer of the main system is started, and a timeout duration of the first timeout timer is set to the preset verification duration;

[0044] Among them, when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to the preset verification time, it is determined that the Internet of Things system is safely started, including: when it is determined that the verification of the application partition data is successful and the first timeout timer has not ended, it is determined that the Internet of Things system is safely started.

[0045] According to the second aspect, in a fourth possible implementation manner of the method, the method further includes at least one of the following operations:

[0046] During the production phase, the security processor is controlled to generate a first verification code based on a preset encryption key and application partition data of each subsystem, and the first verification code is stored as the standard verification code;

[0047] After the IoT system is securely started, when the security processor detects that the IoT system has completed updating, generating a second verification code according to a preset encryption key and updated application partition data of each subsystem, and storing the second verification code as a new standard verification code;

[0048] When an encryption key update request is detected after the Internet of Things system is securely started and the encryption key update request passes authentication, the stored encryption key is updated according to the encryption key update request.

[0049] According to a third aspect, an embodiment of the present application provides a secure startup method for an Internet of Things system, the method being applied to the subsystem in the first aspect or any possible implementation of the first aspect, the method comprising:

[0050] After the BOOT partition determines that the subsystem is powered on, a verification request is sent to the application processor;

[0051] After receiving the permission response from the application processor, sending application partition data of the application partition to the application processor, so that the application processor verifies the subsystem according to the application partition data;

[0052] When it is determined that the time length from the time when the application partition data is sent to the current time length is greater than or equal to the waiting verification time length and the subsystem is in a powered-on state, the application partition is started.

[0053] According to the third aspect, in a first possible implementation manner of the method, the method further includes:

[0054] After sending the application partition data, starting a second timeout timer of the subsystem;

[0055] When it is determined that the time from the time when the application partition data is sent to the current time is greater than or equal to the waiting verification time and the subsystem is in a powered-on state, starting the application partition includes:

[0056] When the second timeout timer expires and the subsystem is in a powered-on state, the application partition is started.

[0057] In a fourth aspect, an embodiment of the present application provides a terminal device comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the secure startup method of the Internet of Things system of the above-mentioned second aspect or one or more of the multiple possible implementation methods of the second aspect when executing the instructions.

[0058] In a fifth aspect, an embodiment of the present application provides a terminal device comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the secure startup method of the Internet of Things system in the above-mentioned third aspect or the first implementation manner of the third aspect when executing the instructions.

[0059] In a sixth aspect, an embodiment of the present application provides a computer program product, comprising a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in an electronic device, the processor in the electronic device executes the secure startup method of the Internet of Things system of the above-mentioned second aspect or one or more of the multiple possible implementations of the second aspect.

[0060] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in an electronic device, the processor in the electronic device executes the secure startup method of the Internet of Things system in the above-mentioned third aspect or the first implementation manner of the third aspect.

[0061] These and other aspects of the present application will become more readily apparent from the following description of the embodiment(s). BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the application and, together with the description, serve to explain the principles of the application.

[0063] Figure 1 、 Figure 2 A schematic structural diagram of an Internet of Things system according to an embodiment of the present application is shown.

[0064] Figure 3 A schematic diagram illustrating a flow chart of a secure startup method for an Internet of Things system according to an embodiment of the present application is shown.

[0065] Figure 4 A schematic diagram illustrating a flow chart of a secure startup method for an Internet of Things system according to an embodiment of the present application is shown.

[0066] Figure 5 A schematic diagram illustrating a flow chart of a secure startup method for an Internet of Things system according to an embodiment of the present application is shown.

[0067] Figure 6 A schematic diagram illustrating a flow chart of a secure startup method for an Internet of Things system according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0068] Various exemplary embodiments, features, and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.

[0069] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0070] In addition, numerous specific details are provided in the detailed description below to better illustrate the present application. Those skilled in the art will appreciate that the present application can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main purpose of the present application.

[0071] With the increasing use of information technology, the need for interconnected vehicles, and between vehicles and people, is becoming increasingly urgent. More and more vehicles are being connected to the Internet of Vehicles (IoV) system. The IoV system primarily consists of four components: the in-vehicle infotainment (IVI), the telematics box (TBox), a mobile app (application), and a server. The IVI is primarily used for audio and video entertainment and vehicle information display, providing multimedia, web pages, and navigation functions. The TBox communicates with the server and mobile app, enabling interaction between the IVI and the internet. The mobile app enables vehicle information display and control. It's worth noting that the mobile app here is just an example; other user devices with vehicle control capabilities can also be used, including but not limited to tablets and smart car keys. The server, primarily a TSP (telematics service provider), provides multimedia information, navigation, and other in-vehicle services.

[0072] CAN (Controller Area Network), a widely used internal automotive communication protocol, is one of the most popular automotive bus protocols internationally. CAN is primarily used for collaboration among the vehicle's distributed system, the ECU (electronic control unit), to implement higher-level functions. The ECU, also known as the onboard computer, is a dedicated automotive microcomputer controller that controls the operation of components such as the engine through various sensors. Similar to a conventional computer, an ECU includes a processor (CPU), memory (ROM and RAM), input / output (I / O), and digital / analog interfaces.

[0073] The TBox can communicate with the vehicle's CAN bus to obtain vehicle status information and upload it to a TSP server. It can also receive commands from the TSP server and transmit execution results, allowing remote control capabilities to be extended to mobile apps, smart car keys, and more. The TBox can deeply read the vehicle's CAN bus data and proprietary protocols and transmit this data to a server via the GPRS (General Packet Radio Service) network. The TBox can also provide vehicle condition reports, driving reports, fuel consumption statistics, fault alerts, violation inquiries, location tracking, driving behavior, security and anti-theft services, reservation services, remote vehicle locating, and mobile phone control of vehicle doors, windows, lights, locks, horn, hazard lights, folding mirrors, sunroof, and monitoring of central control warnings and airbag status. The TBox not only collects and uploads data, but also acts as an in-vehicle gateway, connecting to the vehicle's body network (CAN bus), the in-vehicle network (via Bluetooth, Wi-Fi, 3G / 4G, etc.), and the external network (via a virtual gateway for V2V and V2X). Among them, Wi-Fi is the abbreviation of wireless fidelity, 3G is the abbreviation of 3rd generation mobile communication technology, 4G is the abbreviation of 4th generation mobile communication technology, V2V is the abbreviation of vehicle to vehicle, and V2X is the abbreviation of vehicle to everything.

[0074] In related technologies, to achieve secure booting of IoT systems, two approaches exist: one is to configure a security processor for both the main system and multiple subsystems, and the other is to configure a security processor only for the main system. The former ensures secure booting of the entire IoT system, but is prohibitively expensive. The latter, while cost-effective, does not provide secure booting capabilities for the subsystems, exposing the entire IoT system to significant security risks. This application provides an IoT system comprising a main system and multiple subsystems, which reduces the cost of the IoT system while achieving secure booting.

[0075] Figure 1 、 Figure 2 FIG. 1 shows a schematic diagram of the structure of an Internet of Things system according to an embodiment of the present application. Figure 1 、 Figure 2 As shown, the IoT system includes a main system 1 and multiple subsystems 2. The main system 1 includes an application processor 11, a security processor 12 and an application flash 13, and each subsystem 2 includes a BOOT partition 21 and an application partition 22.

[0076] The security processor 12 is configured to verify the application flash 13 after being started according to the detected power-on operation, and start the application processor 11 after determining that the verification of the application flash 13 is successful.

[0077] The application processor 11 is configured to power on each of the multiple subsystems 2 after being started.

[0078] The BOOT partition 21 is used to send application partition data of the application partition 22 to the application processor 11 after power-on.

[0079] The application processor 11 is also used to verify the received application partition data. When it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems 2 to the current moment is less than or equal to the preset verification time, it is determined that the Internet of Things system is safely started.

[0080] The Internet of Things system provided by the embodiments of the present application is low-cost and can ensure the secure startup of the main system and each subsystem in the Internet of Things system, and can effectively prevent attacks such as remote tampering and destruction against the Internet of Things system.

[0081] In an embodiment of the present application, a corresponding preset verification duration can be set for each subsystem based on the duration required for the verification process of each subsystem. The preset verification durations for different subsystems can be the same or different. Alternatively, the longest duration required for the verification process can be determined as the preset verification duration based on the duration required for the verification process in multiple subsystems. Those skilled in the art can set the preset verification duration based on actual needs, and this application does not impose any restrictions on this.

[0082] In the embodiments of the present application, the main system and multiple subsystems can be connected via hardwires, such as by utilizing a Universal Asynchronous Receiver / Transmitter (UART), Serial Peripheral Interface (SPI), I2C bus (Inter-Integrated Circuit), Ethernet, or the like integrated in the main system and subsystems to connect the main system and subsystems. This can further improve the security of the IoT system.

[0083] In an embodiment of the present application, the application processor in the main system is used to implement various application functions, the security processor is used to implement secure booting of the main system, and the application flash is used to store application data corresponding to each application function. The application partition in the subsystem is used to implement the application function of the subsystem and stores application partition data corresponding to the application function. The BOOT partition may include a boot program used to enable the subsystem, which can be locked by a one-time password (OTP, also known as a "one-time password" refers to a password that can only be used once) to ensure the reliability of verification requests issued by the BOOT partition and the application partition data, and to prevent remote tampering, destruction, and other attacks against the IoT system.

[0084] In the embodiments of the present application, the main system may be a chip with security encryption functions as described in the SHE (Security Hardware Extension) specification, and may be a chip such as a microcontroller unit (MCU) with a hardware security module (HSM). The HSM may be the security processor described in the present application. The subsystem may be a chip such as an MCU without an HSM. Those skilled in the art may configure the main system and subsystem according to actual needs, and this application does not impose any restrictions on this.

[0085] In an embodiment of the present application, the physical network system can be applied to a T-BOX device. The main system can be interconnected with ECUs (Electronic Control Unit, also known as "driving computer", "on-board computer", etc.) installed in other vehicles through the CAN bus, and the subsystem can perform time calibration of the entire Internet of Things system through a clock chip (Real-Time Clock, abbreviated as RTC).

[0086] In one possible implementation, Figure 2 As shown, a power switch 4 may be provided between the power source 3 and each subsystem 2 , so that the application processor 11 can power on and off the subsystem by controlling the on and off of the power switch 4 .

[0087] In one possible implementation, the BOOT partition 21 is further configured to send a verification request to the application processor 11 before sending the application partition data, and after receiving a permission response from the application processor 11 to the verification request, send the application partition data to the application processor 11, thereby ensuring that the main system can verify the subsystem.

[0088] In one possible implementation, the application processor 11 is further configured to, upon determining that one or more of the multiple subsystems 2 meet a power-off condition, power off the subsystem 1 that meets the power-off condition. The power-off condition may include at least one of the following: failure to receive a verification request from the powered-on subsystem, failure to receive application partition data from the powered-on subsystem, failure to verify the application partition data, or the time from powering on the multiple subsystems to the current moment exceeding a preset verification time and failure to complete verification of the application partition data. In this way, when a subsystem meets the power-off condition, it can be determined to be under attack, and timely powering off can ensure the security of the entire IoT system.

[0089] In this implementation, the time length from power-on for the multiple subsystems to the current moment is greater than the preset verification time length and the verification of the application partition data has not been completed may include: the application partition data has been fully received but the time length from power-on for the multiple subsystems to the current moment is greater than the preset verification time length, the application partition data has been fully received but the entire verification process has not been completed and the time length from power-on for the multiple subsystems to the current moment is greater than the preset verification time length, only part of the application partition data has been received and the verification cannot be completed, etc.

[0090] In one possible implementation, the application processor 11 is further configured to issue a verification calculation request to the security processor 12 based on the received application partition data; the security processor 12 is further configured to calculate a calculation verification code for the application partition data based on a stored encryption key based on the verification calculation request, and send the calculation verification code to the application processor 11; the application processor 11 is further configured to compare the calculation verification code with a stored standard verification code to obtain a verification result. If the calculation verification code and the standard verification code are different, it is determined that the verification of the application partition data has failed; if the calculation verification code and the standard verification code are the same, it is determined that the verification of the application partition data has succeeded.

[0091] In this implementation, the standard checksum can be stored in the application flash or the secure flash corresponding to the security processor. The security processor 12 can generate a calculated checksum for the application partition data based on the encryption key stored in the secure flash. This encryption key is generated by the security processor or the main system during the production process and pre-set to the secure flash via the production line host computer, ensuring the secure boot of the IoT system.

[0092] In one possible implementation, the main system 1 may further include a first timeout timer. The application processor 11 is further configured to, upon determining that the multiple subsystems 2 have been powered on, start the first timeout timer and set the timeout duration of the first timeout timer to the preset verification duration. This allows the IoT system to be securely booted if verification of the application partition data is successful and the first timeout timer has not expired. This simplifies secure booting of the entire IoT system.

[0093] In one possible implementation, subsystem 2 may further include a second timeout timer. The BOOT partition 21 is further configured to start the second timeout timer upon determining that the application partition data has been sent. Furthermore, upon determining that the second timeout timer has expired and the subsystem is powered on, the BOOT partition 21 starts the application partition. This ensures that unattacked subsystems can promptly start the application partition, meeting the normal usage requirements of the IoT system.

[0094] In a possible implementation, the security processor 12 is further configured to generate a first verification code based on a preset encryption key and application partition data of each subsystem 2 during the production phase, and store the first verification code as the standard verification code.

[0095] In this implementation, encryption keys are preset during the production phase of the main system or security processor. They can be generated using encryption methods such as AES (Advanced Encryption Standard, also known as Rijndael, a block cipher adopted by the US federal government). Furthermore, the encryption keys are stored in the security processor's corresponding secure flash memory to ensure their security.

[0096] In one possible implementation, the security processor 12 is further used to generate a second verification code based on a preset encryption key and the updated application partition data of each subsystem after the IoT system is securely started and detects that the IoT system has completed the update, and store the second verification code as a new standard verification code.

[0097] In this implementation, since the first verification code generated during the production phase is generated based on the application partition data of each subsystem during the production phase, if the application partition data of its subsystems changes after the IoT system is updated, the standard verification code needs to be updated to ensure the subsequent secure startup of the IoT system. Furthermore, to further ensure the secure startup of the IoT system, the security processor can be configured to generate the standard verification code only during the production phase based on a generation request sent after the production line enable control security processor is started. At any other stage, the security processor will no longer respond to generation requests issued by any device and will only automatically update the standard verification code after the IoT system is updated.

[0098] In a possible implementation, the security processor 12 is further configured to, when an encryption key update request is detected after the IoT system is securely started and the encryption key update request passes authentication, update the stored encryption key according to the encryption key update request.

[0099] In this implementation, the encryption key update request can come from an external device outside the Internet of Things system. The authentication method for the encryption key update request can be set in advance. The updated encryption key can be generated by the security processor according to a preset encryption key generation method, or it can be an encryption key directly carried in the encryption key update request. This application does not impose any restrictions on this. In this way, updating the encryption key only after the authentication is passed can ensure that the encryption key update process will not be attacked, and ensure the security of the subsequent startup of the Internet of Things system. For example, the encryption key update request sent by the external device can be set to carry the encryption key stored by the current security processor. When the "encryption key carried by the encryption key update request" is the same as the encryption key stored in the security processor 12, it is determined that the authentication for the encryption key update request is passed, and then a new encryption key is generated based on the preset encryption key generation method and stored.

[0100] In one possible implementation, Figure 2 As shown, the Internet of Things system may further include: a communication module 5, which is connected to the main system 1 and interconnected with the cloud through a network, so that the Internet of Things system can be updated by connecting to the cloud through the communication module.

[0101] In this implementation, the communication module 5 and the main system 1 can be connected via a near-field physical link. The physical link may include UART, SPI, USB, Ethernet, etc., and this application does not limit this. The communication module 5 is interconnected with the cloud through the network. The cloud can refer to a storage device for data required to update the IoT system.

[0102] In one possible implementation, the IoT system can also be connected to mobile phones, computers, car computers and other devices without being connected to the communication module, and directly use the physical link between the device and the cloud to establish a secure virtual channel, and then realize the upgrade of the IoT system through the virtual channel.

[0103] Figure 3 A flow chart of a secure boot method for an Internet of Things system according to an embodiment of the present application is shown. The method can be applied to the above-mentioned Internet of Things system, and includes steps S101 to S116.

[0104] After detecting a power-on operation, main system 1 activates the security processor. After activation, security processor 12 verifies the application flash (S101). Upon successful verification, main system 1 activates application processor 11 (S102). Application processor 11 then controls power switches 4 of each subsystem 2 to turn on, enabling power supply 3 to supply power to each subsystem 2, thereby powering up each subsystem 2 (S103). Furthermore, after confirming that multiple subsystems 2 have been powered on, application processor 11 activates a first timeout timer and sets its timeout duration to the preset verification duration.

[0105] After subsystem 2 is powered on, it starts BOOT partition 21 (S104). BOOT partition 21 sends a verification request to application processor 12 (S105). After receiving a permission response from application processor 12 regarding the verification request (S106), BOOT partition 21 sends the application partition data of application partition 22 in subsystem 2 to application processor 12 (S107). Furthermore, after BOOT partition 21 determines that it has sent all the application partition data to application processor 12, it starts a second timeout timer (S108). When it determines that the second timeout timer has expired and subsystem 2 is still powered on, it starts application partition 22 (S116).

[0106] After receiving the application partition data, the application processor 12 sends a verification calculation request to the security processor (S109). After receiving the verification calculation request, the security processor 12 generates a calculation verification code corresponding to the application partition data based on a preset encryption key (stored in the secure flash) (S109') and sends the calculation verification code to the application processor 11 (S110).

[0107] After receiving the calculated check code, the application processor 11 obtains the stored standard check code from the secure flash or application flash. The calculated check code and the standard check code are compared to obtain a comparison result (S111). Then, based on the comparison result, it is determined whether the check of the application partition data is successful (S112). In the case that the check of the application partition data is successful (the calculated check code and the standard check code are the same), it is determined that the Internet of Things system is safely started (S114), and the first timeout timer is directly turned off. In the case that the check of the application partition data fails (the calculated check code and the standard check code are different), the power switch 4 corresponding to the subsystem 2 that failed the check is controlled to be disconnected, so as to realize power-off of the subsystem 2 that failed the check (S113).

[0108] In addition, the application processor 11 is also used to perform detection after starting the first timeout timer. If the application partition data or verification request sent by the subsystem is still not received when the first timeout timer ends, or the application partition data is received but the verification process is not completed, it is also determined that the corresponding subsystem verification has failed, and the power switch 4 corresponding to the subsystem 2 that failed the verification is controlled to be disconnected, so as to realize power-off of the subsystem 2 that failed the verification (S113).

[0109] The secure startup method for the Internet of Things system provided in the embodiments of the present application is low-cost and can ensure the secure startup of the main system and each subsystem in the Internet of Things system, and can effectively prevent attacks such as remote tampering and destruction against the Internet of Things system.

[0110] Figure 4 A flow chart of a secure boot method for an IoT system according to an embodiment of the present application is shown. The method can be applied to the aforementioned IoT system, the method being applied to the production phase of the IoT system, and the method can include steps S201 to S210.

[0111] During the production phase of the IoT system, the production line host computer 6 generates a random key for the IoT system in advance, and writes the random key (that is, the encryption key described elsewhere in this document) into the secure flash of the main system 1 (S201). Using the key randomly generated by the production line host computer as the encryption key is more conducive to ensuring the secure startup of the IoT system. After the main system 1 determines that the random key has been written, it sends a report of successful writing to the production line host computer 6 (S202). The production line host computer 6 enables the startup of the security processor 12 and sends a request for the generation of a standard check code to the security processor 12 (S203). After being enabled to start and receiving the request for the generation of the standard check code, the security processor 12 itself or controls the application processor 11 to request the subsystem for application partition data (S204).

[0112] In response to the request of the main system 1, the subsystem 2 sends the application partition data to the main system 1 (S205). The security processor 12 generates a first verification code based on the encryption key and the application partition data, and stores it as a standard verification code in the security flash (S206), and then sends a success report to the production line host computer 6 that the standard verification code has been generated and stored (S207). After determining that the main system 1 has successfully generated and stored the standard verification code, the production line host computer 6 sends an instruction to prohibit responding to the generation request to the security processor 12 (S208). After receiving the instruction to stop responding to the generation request, the security processor 12 no longer responds to any instruction requesting to generate the standard verification code (S209), and returns the result to the production line host computer 6, so that the production line host computer 6 determines that the main system will no longer respond to the generation request to prevent the standard verification code from being tampered with.

[0113] Figure 5 The flowchart of the secure startup method of the Internet of Things system according to an embodiment of the present application is shown. The method can be applied to the main system of the above-mentioned Internet of Things system, such as Figure 5 As shown, the method includes steps S51 to S53.

[0114] In step S51, when a power-on operation is detected, the security processor is started and the application flash is verified using the security processor.

[0115] In step S52, after determining that the verification of the application flash is successful, the application processor is started, and the application processor is used to power on the multiple subsystems respectively, so that the powered-on subsystems send application partition data to the application processor.

[0116] In step S53, when the application partition data from the subsystem is verified and it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to the preset verification time, it is determined that the Internet of Things system is safely started.

[0117] The secure startup method for the Internet of Things system provided in the embodiments of the present application is low-cost and can ensure the secure startup of the main system and each subsystem in the Internet of Things system, and can effectively prevent attacks such as remote tampering and destruction against the Internet of Things system.

[0118] In one possible implementation, verifying the application partition data from the subsystem may include:

[0119] controlling the security processor to generate a calculation check code for the application partition data according to the stored encryption key;

[0120] Controlling the application processor to compare the calculated check code with a stored standard check code to obtain a check result,

[0121] Wherein, when the calculated verification code and the standard verification code are different, it is determined that the verification of the application partition data has failed; when the calculated verification code and the standard verification code are the same, it is determined that the verification of the application partition data has succeeded.

[0122] In a possible implementation, the method may further include:

[0123] When it is determined that one or more of the plurality of subsystems meet the power-off condition, powering off the subsystems meeting the power-off condition,

[0124] The power-off conditions include at least one of the following: failure to receive a verification request sent by the powered-on subsystem, failure to receive application partition data sent by the powered-on subsystem, failure to verify the application partition data, and the time from powering on the multiple subsystems to the current moment is greater than a verification time threshold and verification of the application partition data is not completed.

[0125] In a possible implementation, the method may further include:

[0126] When it is determined that the plurality of subsystems have been powered on respectively, a first timeout timer of the main system is started, and a timeout duration of the first timeout timer is set to the preset verification duration;

[0127] Among them, when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to the preset verification time, it is determined that the Internet of Things system is safely started, including: when it is determined that the verification of the application partition data is successful and the first timeout timer has not ended, it is determined that the Internet of Things system is safely started.

[0128] In a possible implementation, the method may further include:

[0129] Controlling the security processor to generate a first verification code based on a preset encryption key and application partition data of each subsystem during the production phase, and storing the first verification code as the standard verification code; or

[0130] After the Internet of Things system is securely started, when the security processor detects that the Internet of Things system has completed the update, a second verification code is generated according to a preset encryption key and the updated application partition data of each subsystem, and the second verification code is stored as a new standard verification code.

[0131] In an embodiment of the present application, a terminal device is also provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the above-mentioned method applied to the main system when executing the instructions.

[0132] Figure 6 The flowchart of the secure startup method of the Internet of Things system according to an embodiment of the present application is shown. The method can be applied to the subsystems in the above-mentioned Internet of Things system, such as Figure 6 As shown, the method includes steps S61 to S63.

[0133] In step S61, after the BOOT partition determines that the subsystem is powered on, a verification request is sent to the application processor;

[0134] In step S62, after receiving the permission response from the application processor, the application partition data of the application partition is sent to the application processor, so that the application processor verifies the subsystem according to the application partition data;

[0135] In step S63, when it is determined that the time length from the time when the application partition data is sent to the current time is greater than or equal to the waiting verification time length and the subsystem is in a powered-on state, the application partition is started.

[0136] The secure startup method for the Internet of Things system provided in the embodiments of the present application is low-cost and can ensure the secure startup of the main system and each subsystem in the Internet of Things system, and can effectively prevent attacks such as remote tampering and destruction against the Internet of Things system.

[0137] In a possible implementation, the method may further include:

[0138] After sending the application partition data, starting a second timeout timer of the subsystem;

[0139] When it is determined that the time from the time when the application partition data is sent to the current time is greater than or equal to the waiting verification time, and the subsystem is in a powered-on state, starting the application partition includes:

[0140] When the second timeout timer expires and the subsystem is in a powered-on state, the application partition is started.

[0141] In an embodiment of the present application, a terminal device is also provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the above-mentioned method applied to the subsystem when executing the instructions.

[0142] An embodiment of the present application provides a non-volatile computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the method applied to the main system and / or subsystem is implemented.

[0143] An embodiment of the present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0144] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof.

[0145] The computer-readable program instructions or codes described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0146] The computer program instructions for performing the operations of the present application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, by utilizing the state information of computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions, thereby implementing various aspects of the present application.

[0147] Various aspects of the present application are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0148] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0149] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0150] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, systems, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a part for a module, program segment or instruction, and the part for the module, program segment or instruction comprises one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be performed substantially in parallel, and they can sometimes also be performed in the opposite order, depending on the function involved.

[0151] It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented by hardware that performs the corresponding function or action (such as a circuit or ASIC (Application Specific Integrated Circuit)), or can be implemented by a combination of hardware and software, such as firmware.

[0152] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0153] The embodiments of the present application have been described above. The above description is illustrative and not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to the technology in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. An Internet of Things system, characterized in that: The Internet of Things system includes a main system and multiple subsystems. The main system includes an application processor, a security processor and an application flash. Each subsystem includes a BOOT partition and an application partition. The security processor is configured to verify the application flash after being activated according to the detected power-on operation, and to activate the application processor after determining that the verification of the application flash is successful, wherein the application flash is used to store application data corresponding to each application function; The application processor is configured to power on the multiple subsystems respectively after being started; The BOOT partition is used to send the application partition data of the application partition to the application processor after power-on; The application processor is further configured to verify the received application partition data, and determine that the Internet of Things system is securely started when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to a preset verification time.

2. The system according to claim 1, wherein: The BOOT partition is further configured to send a verification request to the application processor before sending the application partition data, and send the application partition data to the application processor after receiving a permission response from the application processor to the verification request.

3. The system according to claim 1, wherein: The application processor is further configured to, when determining that one or more of the multiple subsystems meet the power-off condition, power off the subsystems meeting the power-off condition. The power-off conditions include at least one of the following: failure to receive a verification request sent by the powered-on subsystem, failure to receive application partition data sent by the powered-on subsystem, failure to verify the application partition data, and the time from powering on the multiple subsystems to the current moment is greater than a preset verification time and failure to complete the verification of the application partition data.

4. The system according to claim 1, wherein: The application processor is further configured to send a verification calculation request to the security processor based on the received application partition data; The security processor is further configured to calculate a calculation verification code of the application partition data based on the verification calculation request and a stored encryption key, and send the calculation verification code to the application processor; The application processor is further configured to compare the calculated check code with a stored standard check code to obtain a check result. Wherein, when the calculated verification code and the standard verification code are different, it is determined that the verification of the application partition data has failed; when the calculated verification code and the standard verification code are the same, it is determined that the verification of the application partition data has succeeded.

5. The system according to claim 1, wherein: The main system also includes a first timeout timer, The application processor is further configured to, upon determining that the multiple subsystems have been powered on respectively, start the first timeout timer and set the timeout duration of the first timeout timer to the preset verification duration, so as to determine that the Internet of Things system is securely started when it is determined that the verification of the application partition data is successful and the first timeout timer has not expired.

6. The system according to claim 1, wherein: The subsystem further includes a second timeout timer, The BOOT partition is further configured to start the second timeout timer when it is determined that the sending of the application partition data is completed, and start the application partition when it is determined that the second timeout timer has expired and the subsystem is in a powered-on state.

7. The system according to claim 4, wherein: The security processor is further configured to perform at least one of the following operations: generating a first verification code based on a preset encryption key and application partition data of each subsystem during the production phase, and storing the first verification code as the standard verification code; After the IoT system is securely started, if it is detected that the IoT system has completed an update, a second verification code is generated according to a preset encryption key and the updated application partition data of each subsystem, and the second verification code is stored as a new standard verification code; When an encryption key update request is detected after the Internet of Things system is securely started and the encryption key update request passes authentication, the stored encryption key is updated according to the encryption key update request.

8. The system according to claim 7, characterized in that The Internet of Things system also includes: The communication module is connected to the main system and interconnected with the cloud through a network, so that the Internet of Things system can be updated by connecting the communication module to the cloud.

9. A secure startup method for an Internet of Things system, characterized in that: The method is applied to the main system according to any one of claims 1 to 8, and the method includes: When a power-on operation is detected, starting the security processor and verifying the application flash using the security processor; After determining that verification of the application flash is successful, starting the application processor, and using the application processor to power on the multiple subsystems respectively, so that the powered-on subsystems send application partition data to the application processor; The application partition data from the subsystem is verified, and when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to the preset verification time, it is determined that the Internet of Things system is safely started.

10. The method according to claim 9, characterized in that Verify the application partition data from the subsystem, including: controlling the security processor to generate a calculation check code for the application partition data according to the stored encryption key; Controlling the application processor to compare the calculated check code with a stored standard check code to obtain a check result, Wherein, when the calculated verification code and the standard verification code are different, it is determined that the verification of the application partition data has failed; when the calculated verification code and the standard verification code are the same, it is determined that the verification of the application partition data has succeeded.

11. The method according to claim 9, characterized in that The method further comprises: When it is determined that one or more of the plurality of subsystems meet the power-off condition, powering off the subsystems meeting the power-off condition, The power-off conditions include at least one of the following: failure to receive a verification request sent by the powered-on subsystem, failure to receive application partition data sent by the powered-on subsystem, failure to verify the application partition data, and the time from powering on the multiple subsystems to the current moment is greater than a verification time threshold and verification of the application partition data is not completed.

12. The method according to claim 9, characterized in that The method further comprises: When it is determined that the plurality of subsystems have been powered on respectively, a first timeout timer of the main system is started, and a timeout duration of the first timeout timer is set to the preset verification duration; Among them, when it is determined that the verification of the application partition data is successful and the time from powering on the multiple subsystems to the current moment is less than or equal to the preset verification time, it is determined that the Internet of Things system is safely started, including: when it is determined that the verification of the application partition data is successful and the first timeout timer has not ended, it is determined that the Internet of Things system is safely started.

13. The method according to claim 10, characterized in that The method further includes at least one of the following operations: During the production phase, the security processor is controlled to generate a first verification code based on a preset encryption key and application partition data of each subsystem, and the first verification code is stored as the standard verification code; After the IoT system is securely started, when the security processor detects that the IoT system has completed updating, generating a second verification code according to a preset encryption key and updated application partition data of each subsystem, and storing the second verification code as a new standard verification code; When an encryption key update request is detected after the Internet of Things system is securely started and the encryption key update request passes authentication, the stored encryption key is updated according to the encryption key update request.

14. A secure startup method for an Internet of Things system, characterized in that: The method is applied to the subsystem according to any one of claims 1 to 8, and the method includes: After the BOOT partition determines that the subsystem is powered on, a verification request is sent to the application processor; After receiving the permission response from the application processor, sending application partition data of the application partition to the application processor, so that the application processor verifies the subsystem according to the application partition data; When it is determined that the time length from the time when the application partition data is sent to the current time length is greater than or equal to the waiting verification time length and the subsystem is in a powered-on state, the application partition is started.

15. The method according to claim 14, characterized in that The method further comprises: After sending the application partition data, starting a second timeout timer of the subsystem; When it is determined that the time from the time when the application partition data is sent to the current time is greater than or equal to the waiting verification time and the subsystem is in a powered-on state, starting the application partition includes: When the second timeout timer expires and the subsystem is in a powered-on state, the application partition is started.

16. A terminal device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the method of any one of claims 9 to 13, or implement the method of claim 14 or 15 when executing the instructions.

17. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 9 to 13 is implemented, or the method according to any one of claims 14 or 15 is implemented.

Images