Terminal security protection method, device, equipment and medium based on star-shaped trust chain

Abstract

The present invention belongs to the field of embedded security, and discloses a terminal security protection method, device, equipment and medium based on a star-shaped trust chain; the method comprises: when the embedded system is started, the trusted root is measured by a first algorithm in a trusted platform module to obtain a new PCR measurement value; the decrypted standard value and the new PCR measurement value are compared: if the comparison is passed, the kernel continues to be started, if the comparison is not passed, the kernel startup process is interrupted; after the kernel is started, when loading the file system, the preset key information of the file system is measured by the first algorithm in the trusted platform module to obtain a new PCR value of the preset key information; the decrypted standard value of the preset key information and the PCR value of the new preset key information are compared, if the comparison is passed, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system. The present invention can greatly improve the private key security of the asymmetric cryptographic algorithm, and has a good application prospect.

Description

Technical Field

[0001] The present invention relates to the field of embedded security, and in particular to a mobile terminal security protection method and system based on a star-shaped trust chain. Background Art

[0002] The energy internet is composed of hundreds of millions of devices, machines, and systems connected at the energy production, transmission, and consumption ends. Among them, there are problems such as the difficulty of trusting IoT terminals and the inability to ensure the integrity of massive embedded terminals. At present, the existing solution to the security problem of terminal embedded systems is to introduce trusted computing technology, and its main idea is to establish a trusted root and a trust chain to ensure the integrity and security of the system. The traditional trusted boot process uses the trusted platform module (TPM) proposed by the Trusted Computing Program (TCG) to communicate with the embedded CPU. TPM is used as the trusted root, and the initial expected measurement value of the boot entity is stored in TPM. When the entity is started, it is loaded into the memory. By comparing the consistency of the initial expected measurement value and the current calculated value, it is determined whether the boot process can continue safely. However, due to the low computing power of the TPM chip and the lack of active control capabilities, and the processor scheduling capabilities in the embedded system are often relatively weak, complex scheduling and allocation cannot be performed, and it is difficult to control the measurement and expansion process of the entire trust chain; in addition, embedded devices are very strict with cost control, and most of them do not have a trusted platform module. Therefore, this type of method has great limitations for embedded systems. Summary of the invention

[0003] The purpose of the present invention is to provide a terminal security protection method, device, equipment and medium based on a star-shaped trust chain to solve the above technical problems. Taking into account the huge number of mobile terminals and the staggering cost of transformation, the present invention uses bootloader (uboot) as a trusted base without changing the existing mobile terminal hardware architecture; uses the PUF key (security encryption key) based on SRAM as a trusted root key; uses the SM3 and SM4 cryptographic algorithms implemented based on FPGA to make it a trusted measurement root for trusted startup; uses the on-chip storage area as a trusted storage root for trusted startup, and comprehensively forms a TPM module instead of directly using a productized TPM chip. The trusted startup process of the trusted mobile terminal of the star-shaped trust chain is: the boot program loads the operating system; performs integrity measurement on important files of the operating system; compares the integrity measurement value with the encrypted and saved measurement value, and if they are consistent, the operating system is started; if they are inconsistent, the system startup is terminated.

[0004] In order to solve the above security issues, the technical solution adopted by the present invention is:

[0005] In a first aspect, the present invention provides a terminal security protection method based on a star-shaped trust chain, comprising:

[0006] The embedded system starts up, measures the trusted root by the first algorithm, and obtains a new PCR measurement value; reads the encrypted standard value from the ROM, and decrypts it by using the second algorithm with the secure encryption key as the kernel key; compares the decrypted standard value with the new PCR measurement value: if the comparison passes, continues to start the kernel; if the comparison fails, interrupts the kernel startup process;

[0007] After the kernel is started, when loading the file system, the preset key information of the file system is measured by the first algorithm to obtain the PCR value of the new preset key information; the standard value of the encrypted preset key information is read from the ROM, and the secure encryption key is used as the kernel key for decryption by the second algorithm; the standard value of the decrypted preset key information is compared with the PCR value of the new preset key information, and if the comparison is successful, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system;

[0008] Wherein, the encrypted standard value and the security encryption key are obtained according to the components of the embedded system.

[0009] A further improvement of the present invention is that the acquisition of the security encryption key specifically includes the following steps:

[0010] Registration phase: The embedded system reads the boot loader, loads the system program, and initializes the peripheral hardware; the embedded system first reads a section of k bits of static random access memory initial value Seed-Value; the static random access memory initial value Seed-Value is encoded by BCH to generate n bits of standard BCH codeword; the embedded system also reads a section of n bits of static random access memory initial value Identified-Value; the n bits of standard BCH codeword and the static random access memory initial value Identified-Value are XORed to generate n bits of data Helper-Data, and the n bits of data Helper-Data are encrypted and stored in the non-volatile memory;

[0011] Verification phase: After the embedded system is powered on, read the n-bit noisy identification code NID with the same address and length as the initial value Identified-Value in the static random access memory during the registration phase; read the n-bit data Helper-Data stored in the non-volatile memory; perform an XOR operation on the n-bit noisy identification code NID and the n-bit data Helper-Data to obtain the n-bit BCH code with errors; perform a BCH decoding operation on the n-bit BCH code with errors. If the actual error is less than the designed error correction tolerance t, an n-bit standard BCH code is generated and the system authentication is successful. Otherwise, the BCH decoding fails. If the decoding is successful, perform an XOR operation on the n-bit standard BCH code generated by the decoding and the n-bit data Helper-Data to restore the n-bit initial value Identified-Value used in the system registration phase; compare the restored n-bit initial value Identified-Value with the initial value Identified-Value generated when the system is registered, and if they are the same, it is successful; the verification phase is completed and the system starts to operate normally;

[0012] Hash processing stage: After the verification is successful in the verification stage and the system is running normally, the first algorithm is used to perform hash operation on the nbits initial value Identified-Value restored in the verification stage to generate a secure encryption key.

[0013] A further improvement of the present invention is that in the step of reading the encrypted standard value from the ROM and decrypting it using the second algorithm with the security encryption key as the kernel key, the encrypted standard value is obtained by the following steps:

[0014] After the embedded system is powered on, when the kernel is loaded, the kernel is measured by the first algorithm to obtain the PCR measurement value of the kernel as the standard value for verification; the second algorithm is used, with the security encryption key as the kernel key, to encrypt the standard value for verification, store it in a non-volatile memory, and obtain the encrypted standard value.

[0015] A further improvement of the present invention is that in the step of reading the standard value of the encrypted preset key information from the ROM and decrypting it using the second algorithm with the security encryption key as the kernel key, the standard value of the encrypted preset key information is obtained by the following steps:

[0016] After the kernel is started, when the file system is loaded, the preset key information is measured by the first algorithm, and the obtained PCR measurement value is used as the standard value for verifying the preset key information; the second national secret algorithm is adopted, and the security encryption key is used as the kernel key to encrypt the standard value of the preset key information and store it in the non-volatile memory to obtain the standard value of the encrypted preset key information.

[0017] A further improvement of the present invention is that: the first algorithm is an SM3 algorithm; and the second algorithm is an SM4 algorithm.

[0018] In a second aspect, the present invention provides a terminal security protection device based on a star-shaped trust chain, comprising:

[0019] The kernel verification module is used to measure the kernel by the first algorithm after the embedded system is started to obtain a new PCR measurement value; read the encrypted standard value from the ROM, and decrypt it by using the second algorithm with the security encryption key as the kernel key; compare the decrypted standard value with the new PCR measurement value: if the comparison passes, continue to start the kernel, if the comparison fails, interrupt the kernel startup process;

[0020] The key information verification module is used to measure the preset key information of the file system by the first algorithm when loading the file system after the kernel is started, and obtain the PCR value of the new preset key information; read the standard value of the encrypted preset key information from the ROM, and decrypt it by the second algorithm with the security encryption key as the kernel key; compare the standard value of the decrypted preset key information with the PCR value of the new preset key information, if the comparison is passed, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system;

[0021] Wherein, the encrypted standard value and the security encryption key are obtained according to the components of the embedded system.

[0022] A further improvement of the present invention is that the acquisition of the security encryption key used in the kernel verification module and the key information verification module specifically includes the following steps:

[0023] Registration phase: The embedded system reads the boot loader, loads the system program, and initializes the peripheral hardware; the embedded system first reads a section of k bits of static random access memory initial value Seed-Value; the static random access memory initial value Seed-Value is encoded by BCH to generate n bits of standard BCH codeword; the embedded system also reads a section of n bits of static random access memory initial value Identified-Value; the n bits of standard BCH codeword and the static random access memory initial value Identified-Value are XORed to generate n bits of data Helper-Data, and the n bits of data Helper-Data are encrypted and stored in the non-volatile memory;

[0024] Verification phase: After the embedded system is powered on, read the n-bit noisy identification code NID with the same address and length as the initial value Identified-Value in the static random access memory during the registration phase; read the n-bit data Helper-Data stored in the non-volatile memory; perform an XOR operation on the n-bit noisy identification code NID and the n-bit data Helper-Data to obtain the n-bit BCH code with errors; perform a BCH decoding operation on the n-bit BCH code with errors. If the actual error is less than the designed error correction tolerance t, an n-bit standard BCH code is generated and the system authentication is successful. Otherwise, the BCH decoding fails. If the decoding is successful, perform an XOR operation on the n-bit standard BCH code generated by the decoding and the n-bit data Helper-Data to restore the n-bit initial value Identified-Value used in the system registration phase; compare the restored n-bit initial value Identified-Value with the initial value Identified-Value generated when the system is registered, and if they are the same, it is successful; the verification phase is completed and the system starts to operate normally;

[0025] Hash processing stage: After the verification is successful in the verification stage and the system is running normally, the first algorithm is used to perform hash operation on the nbits initial value Identified-Value restored in the verification stage to generate a secure encryption key.

[0026] A further improvement of the present invention is that the encrypted standard value in the kernel verification module is obtained by the following steps: after the embedded system is powered on, when the kernel is loaded, the kernel is measured by a first algorithm to obtain the PCR measurement value of the kernel as the standard value for verification; a second algorithm is used to encrypt the standard value for verification with a secure encryption key as the kernel key, and the encrypted standard value is stored in a non-volatile memory to obtain the encrypted standard value;

[0027] The standard value of the encrypted preset key information in the key information verification module is obtained by the following steps: after the kernel is started, when the file system is loaded, the preset key information is measured by the first algorithm, and the obtained PCR measurement value is used as the standard value for verifying the preset key information; the standard value of the preset key information is encrypted by the second national secret algorithm, with the security encryption key as the kernel key, and stored in the non-volatile memory to obtain the standard value of the encrypted preset key information;

[0028] Wherein, the encrypted standard value and the security encryption key are obtained according to the components of the embedded system.

[0029] In a third aspect, the present invention provides an electronic device, comprising a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the terminal security protection method based on the star-type trust chain.

[0030] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the terminal security protection method based on the star-type trust chain is implemented.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention provides a terminal security protection method, device, equipment and medium based on a star-shaped trust chain. By constructing a standard value of a star-shaped trust chain based on trusted hardware, trusted protection is provided for the startup of the terminal without changing the architecture of the mobile terminal, and files such as the kernel can be prevented from being tampered with, thereby effectively ensuring the security of the startup process at low cost and low complexity. The protection of the present invention is carried out step by step. During the startup of an embedded system, a new PCR measurement of the kernel is first performed, and the new PCR measurement is compared with a standard value to determine whether the kernel has been tampered with. After the kernel is started, the preset key information of the file system is further measured to obtain a new PCR value of the preset key information, and the PCR value of the new preset key information is compared with the standard value to determine whether the file system has been tampered with. The security protection of the embedded system is doubly guaranteed.

[0033] The present invention utilizes PUF technology to generate the root key of the trusted platform module TPM, thereby ensuring the security of the kernel of the trust chain, and encrypts and stores the private key based on PUF technology, thereby improving the security of the private key and effectively ensuring that the private key is difficult to be cracked and stolen by the outside, thereby causing the private key to be leaked.

[0034] Without changing the existing mobile terminal hardware architecture, the present invention uses the bootloader (uboot) as the trusted base; the PUF key based on SRAM as the kernel key; the cryptographic algorithm implemented based on FPGA is used as the trusted measurement root of trusted startup; the on-chip storage area is used as the trusted storage root of trusted startup, and a trusted platform module TPM is formed comprehensively.

[0035] The present invention utilizes the relevant technologies of trusted computing. First, the kernel is used at the hardware layer to ensure the credibility of the Internet of Things foundation in the energy Internet, and then the trust chain is extended to higher levels such as the kernel layer and the trusted component layer, so as to achieve the credibility of the overall execution environment of the terminal. The present invention specifically adopts two technologies, trusted startup and secure storage, to achieve the construction of a trusted terminal execution environment. Trusted startup means that after each power-on of the system, the calculated hash value is compared with the standard value layer by layer to achieve the secure startup of the device. Secure storage is for sensitive data stored in confidential terminals, using encryption and decryption algorithms such as the national secret algorithm, and proposing a corresponding key management mechanism to effectively ensure the security of sensitive data in confidential terminals.

[0036] The present invention uses the existing components and technologies of the embedded system to form a trusted storage root, a trusted measurement root, and a trusted root key without using the traditional productized external TPM chip to transform the embedded device, and finally forms a trusted platform module without changing the existing embedded system architecture, and uses the module to build a star-shaped trust chain. The star-shaped trust chain uses the trusted root key in the constructed trusted platform module as the trust root to ensure the trustworthiness of the trusted platform module, and then the trusted platform module measures the boot program, the kernel, and the preset key information, stores the measurement value, and reports the security operation, thereby completing the construction of the star-shaped trust chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0038] Figure 1 This is a star-shaped trust chain architecture diagram in the present invention.

[0039] Figure 2 It is a specific implementation diagram of the terminal security protection method based on the star-shaped trust chain in Example 1 of the present invention.

[0040] Figure 3 It is the BCH algorithm structure diagram of the present invention.

[0041] Figure 4 It is a flow chart of the present invention for generating encryption keys based on PUF.

[0042] Figure 5 It is an overall framework diagram of the terminal security protection method based on the star-shaped trust chain of the present invention.

[0043] Figure 6 This is a flow chart of a terminal security protection method based on a star-shaped trust chain in Embodiment 2 of the present invention;

[0044] Figure 7 This is a structural block diagram of a terminal security protection device based on a star-shaped trust chain according to the present invention;

[0045] Figure 8 The present invention is a structural block diagram of an electronic device. DETAILED DESCRIPTION

[0046] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0047] The following detailed description is an exemplary description, which is intended to provide further detailed description of the present invention. Unless otherwise specified, all technical terms used in the present invention have the same meaning as those generally understood by those skilled in the art to which the present invention belongs. The terms used in the present invention are only for describing specific embodiments, and are not intended to limit the exemplary embodiments according to the present invention.

[0048] The present invention uses a PUF (physical unclonable function) key as a trusted root, utilizes the power-on data of a random SRAM (static random access memory) area in an embedded device, and uses the PUF technology. The key used for encryption only exists inside the chip, and is generated through a "physical electronic fingerprint" when used, and is returned to the physical mode for storage after use. All initial PCR (program clock reference) values ​​are encrypted by an SM4 algorithm and stored in a ROM. Before loading a kernel, a bootloader verifies the integrity of the kernel through a TPM, first calls an SM3 algorithm to calculate the kernel's PCR value, and at the same time takes out a standard value from the ROM, decrypts it with a PUF key, and compares it with a measurement value. Then, the TPM reports the result to the bootloader. If the verification is successful, the bootloader loads the kernel. Similarly, before loading a file system, the kernel calculates the PCR value of a key file in the file system by calling an SM3 algorithm, takes out a standard value from the ROM, decrypts it, and compares it. The TPM then reports the result to the kernel. If the verification is successful, the kernel loads the file system, thereby forming a secure basic environment for trusted startup.

[0049] The security key generated by the PUF technology in the present invention is highly correlated with the embedded device hardware and can well resist physical attacks. The security key generated by the PUF uses the SM4 national encryption algorithm to encrypt the private key and store it in a non-volatile memory.

[0050] After the system is powered on, the bootloader measures the kernel through the SM3 algorithm in the TPM when loading the kernel, calls sm3 (input, len, output), and the output, that is, the PCR value, is used as the kernel summary, and the initially generated module measurement value that needs to be verified is used as the standard value for verification. The PUF key is used as the root key through the SM4 algorithm, and is encrypted and stored in the system's ROM. After that, the new measurement value is compared and checked with the standard value each time it is started, and the standard value is read from the ROM. After decryption, the cmp_pcr function is called to verify the measurement value: if the integrity verification passes, the kernel continues to be started. If the verification fails, it is considered that its integrity is destroyed and the code may be tampered with. It is necessary to prompt the user and interrupt the kernel startup process. After the kernel is started, when loading the file system, the key information of the file system is also measured through the SM3 algorithm in the TPM, and the standard value is read from the ROM and decrypted with the SM4 algorithm, and the cmp_pcr function is called to verify the measurement value. If successful, the file system is loaded.

[0051] The root key is crucial as a trusted root and is the starting point of the star-shaped trust chain of the present invention. PUF is selected as a tool to generate the root key because the root key generally needs to be encrypted and stored in a secure area. In order to save costs and enhance security, the physical unclonable function PUF is selected to generate the root key. The advantage of PUF is that there is no need to store the key, only the help data related to the key needs to be saved. The root key can be restored by starting the reconstruction function next time. Even if the help data is lost or stolen, the attacker cannot use it to restore the root key, and the security is greatly improved.

[0052] The specific method of secure storage of private keys using PUF technology is as follows: a set of SRAM data uniquely related to the embedded platform is extracted by utilizing the characteristic data of the SRAM after power-on on the embedded platform, a set of keys is generated based on hash processing of this set of data, and then this key is used to encrypt and store the private key using a symmetric encryption algorithm.

[0053] The SRMA-based PUF technology is divided into a registration phase and a verification phase. Only when the verification phase is passed can a reliable symmetric decryption key be generated and the private key be decrypted.

[0054] Based on SRAM PUF technology, the SRAM feature data after the embedded platform is powered on is collected to generate the encryption key of the symmetric encryption algorithm. It is mainly divided into three stages: registration stage, verification stage, and hash processing stage:

[0055] 1. In the registration phase, the embedded system reads the Bootloader, loads the system program, initializes the peripheral hardware, and then starts the SRAM PUF registration phase. In the registration phase:

[0056] (1) The embedded system first reads a k-bit SRAM initial value Seed-Value, which will be used to generate a standard fault-tolerant BCH code, which we call the seed value S (Seed-Value);

[0057] (2) The SRAM seed value is encoded by BCH to generate an n-bit standard BCH codeword with an error tolerance of t;

[0058] (3) In addition, a segment of n bits of SRAM initial value Identified-Value is read, which will be used to generate the unique key value of this SRAM, which we call the identification code ID (Identified-Value);

[0059] (4) Perform XOR processing on the n bits standard BCH codeword and the n bits identification code ID to generate n bits data Helper-Data, and save the n bits data Helper-Data in a non-volatile memory. The n bits data Helper-Data is used for key reconstruction to help the noisy identification code NID (Noised Identified-Value) recover the identification code ID, so it is called helper data HD (Helper-Data).

[0060] (5) The system registration phase is completed and the system begins to operate normally.

[0061] 2. In the verification phase, the embedded system reads the Bootloader, loads the system program, initializes the peripheral hardware, and then starts the SRAM PUF verification phase. In the verification phase:

[0062] (1) Read the identification code NID with noise at the same address n bits as the identification code ID;

[0063] (2) Reading n bits of help data HD stored in the non-volatile memory;

[0064] (3) Perform an XOR operation on the n-bit identification code NID with noise and the n-bit helper data HD to obtain the n-bit BCH code with errors;

[0065] (4) The n-bit BCH code with errors is subjected to BCH decoding. If the actual error is not greater than the designed error correction tolerance t, an n-bit standard BCH code is generated and the system authentication is successful. Otherwise, the BCH decoding fails and the program ends.

[0066] (5) If the decoding in step (4) is successful, the n bits of standard BCH code generated in step (4) is XORed with the n bits of helper data HD to recover the n bits of identification code ID used in the system registration phase;

[0067] (6) Compare the recovered n bits identification code ID with the identification code ID generated during system registration. If they are the same, success is achieved.

[0068] (7) The verification phase is completed and the system begins to operate normally.

[0069] 3. Hash processing stage: This stage will only be executed when the verification stage is completed normally. The n-bit identification code ID value generated in the verification stage is processed using the SM3 algorithm to generate a 256-bit secure encryption key.

[0070] Private key encrypted storage:

[0071] The private key is encrypted using the SM4 symmetric encryption algorithm using the encryption key generated by the encryption key generation module and is stored in a non-volatile memory.

[0072] Example 1

[0073] See also Figures 1 to 5 As shown, the present invention provides a mobile terminal security protection method based on a star-shaped trust chain, comprising the following steps:

[0074] S1. Generate secure encryption keys based on SRAM PUF:

[0075] Registration stage:

[0076] 1.1. The embedded system reads the Bootloader, loads the system program, initializes the peripheral hardware, and then starts the SRAM PUF system registration phase;

[0077] 1.2. The embedded system first reads a SRAM initial value Seed-Value of size k bits; the SRAM initial value Seed-Value is called the seed value S;

[0078] 1.3. Encode the SRAM seed value S through BCH to generate n bits of standard BCH codeword (BCH algorithm is as shown in the attached Figure 3 shown);

[0079] 1.4. The embedded system also reads a SRAM initial Identified-Value of n bits in size. The SRAM initial Identified-Value is called the identification code ID. The identification code ID will be used to generate the unique key value of this SRAM.

[0080] 1.5. XOR the n bits of standard BCH codeword with the n bits of identification code ID to generate n bits of data Helper-Data, encrypt the data Helper-Data and save it in a non-volatile memory. This n bits of data Helper-Data is used for key reconstruction to help the noisy identification code NID (Noised Identified-Value) recover the identification code ID, so it is called helper data HD (Helper-Data);

[0081] Verification phase:

[0082] 1.6. After the embedded system is powered on, read the n-bit noisy identification code NID with the same address and length as the identification code ID in the registration phase; read the n-bit helper data HD stored in the non-volatile memory; perform an XOR operation on the n-bit noisy identification code NID and the n-bit helper data HD to obtain the n-bit BCH code with errors; perform a BCH decoding operation on the n-bit BCH code with errors. If the actual error is less than the designed error correction tolerance t, an n-bit standard BCH code is generated and the system authentication is successful. Otherwise, the BCH decoding fails and the program ends; if the decoding is successful, perform an XOR operation on the n-bit standard BCH code generated by the decoding and the n-bit helper data HD to restore the n-bit identification code ID used in the system registration phase; compare the restored n-bit identification code ID with the identification code ID generated during system registration, and success is achieved if they are the same; the verification phase is completed and the system starts to operate normally;

[0083] Hash processing stage:

[0084] 1.7. This stage will only be executed if the verification stage is completed normally. The nbits identification code ID value generated in the verification stage is hashed using the SM3 algorithm to generate a 256-bit secure encryption key.

[0085] S2, secure key encryption private key generated based on PUF technology:

[0086] The secure encryption keys generated by PUF technology are highly correlated with the embedded device hardware and can effectively resist physical attacks.

[0087] After the embedded system is powered on, when the bootloader loads the kernel, it measures the kernel through the SM3 algorithm in the TPM and calls sm3(input, len, output). The output, i.e., the PCR measurement value, is used as the kernel summary, and the initially generated module measurement value that needs to be verified is used as the standard value for verification. The SM4 national secret algorithm is used, and the secure encryption key generated by the PUF is used as the kernel key. The standard value for verification is encrypted and stored in the non-volatile memory.

[0088] After the kernel is started, when the file system is loaded, the preset key information is measured through the SM3 algorithm in the TPM, and the standard value of the PCR measurement value is obtained for verification; the SM4 national secret algorithm is used, and the security encryption key generated by the PUF is used as the kernel key to encrypt the standard value of the preset key information and store it in the non-volatile memory.

[0089] S3, Safety Protection Certification:

[0090] Each time the embedded system starts, the kernel is measured by the SM3 algorithm in the TPM to obtain a new PCR measurement value; the embedded system reads the encrypted standard value from the ROM, decrypts it with the SM4 algorithm using the secure encryption key as the kernel key, and then calls the cmp_pcr function to compare the decrypted standard value with the new PCR measurement value: if the comparison passes, the kernel continues to start; if the comparison fails, it is considered that the kernel integrity is damaged and the code may be tampered with, and the user is prompted and the kernel startup process is interrupted;

[0091] After the kernel is started, when loading the file system, the preset key information of the file system is measured by the SM3 algorithm in the TPM to obtain the PCR value of the new preset key information; the standard value of the encrypted preset key information is read from the ROM, and the SM4 algorithm is used to decrypt it with the security encryption key as the kernel key, and then the cmp_pcr function is called to compare the standard value of the decrypted preset key information with the PCR value of the new preset key information. The TPM reports the comparison result to the kernel. If the comparison passes, the kernel loads the file system, thereby forming a secure basic environment for trusted startup; otherwise, the kernel interrupts loading the file system.

[0092] Example 2

[0093] See also Figure 6 As shown, the present invention provides a terminal security protection method based on a star-shaped trust chain, comprising:

[0094] S1, the embedded system starts, measures the kernel through the SM3 algorithm in the trusted platform module, and obtains a new PCR measurement value; reads the encrypted standard value from the ROM, and uses the SM4 algorithm to decrypt it with the security encryption key as the kernel key; compares the decrypted standard value with the new PCR measurement value: if the comparison passes, continues to start the kernel, if the comparison fails, interrupts the kernel startup process;

[0095] S2. After the kernel is started, when loading the file system, the preset key information of the file system is measured by the SM3 algorithm in the trusted platform module to obtain the PCR value of the new preset key information; the standard value of the encrypted preset key information is read from the ROM, and the SM4 algorithm is used to decrypt it with the security encryption key as the kernel key; the standard value of the decrypted preset key information is compared with the PCR value of the new preset key information. If the comparison is successful, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system.

[0096] In the embodiment of the present invention, the acquisition of the security encryption key specifically includes the following steps:

[0097] Registration phase: The embedded system reads the Bootloader, loads the system program, and initializes the peripheral hardware; the embedded system first reads a k-bit SRAM initial value Seed-Value; the SRAM initial value Seed-Value is encoded by BCH to generate an n-bit standard BCH codeword; the embedded system also reads an n-bit SRAM initial value Identified-Value; the n-bit standard BCH codeword is XORed with the SRAM initial value Identified-Value to generate n-bit data Helper-Data, and the n-bit data Helper-Data is encrypted and stored in the non-volatile memory;

[0098] Verification phase: After the embedded system is powered on, read the n-bit noisy identification code NID with the same address and length as the initial value Identified-Value of the SRAM in the registration phase; read the n-bit data Helper-Data stored in the non-volatile memory; perform an XOR operation on the n-bit noisy identification code NID and the n-bit data Helper-Data to obtain the n-bit BCH code with errors; perform a BCH decoding operation on the n-bit BCH code with errors. If the actual error is less than the designed error correction tolerance t, an n-bit standard BCH code is generated and the system authentication is successful. Otherwise, the BCH decoding fails; if the decoding is successful, perform an XOR operation on the n-bit standard BCH code generated by the decoding and the n-bit data Helper-Data to restore the n-bit initial value Identified-Value used in the system registration phase; compare the restored n-bit initial value Identified-Value with the initial value Identified-Value generated when the system is registered, and if they are the same, it is successful; the verification phase is completed and the system starts to operate normally;

[0099] Hash processing stage: After the verification is successful in the verification stage and the system is running normally, the nbits initial value Identified-Value recovered in the verification stage is hashed using the SM3 algorithm to generate a secure encryption key;

[0100] The encrypted standard value is obtained by the following steps: after the embedded system is powered on, when the kernel is loaded, the kernel is measured by the SM3 algorithm in the trusted platform module to obtain the PCR measurement value of the kernel as the standard value for verification; the SM4 algorithm is adopted, the secure encryption key is used as the kernel key, the standard value for verification is encrypted, and the encrypted standard value is stored in a non-volatile memory to obtain the encrypted standard value.

[0101] The standard value of the encrypted preset key information is obtained by the following steps: after the kernel is started, when the file system is loaded, the preset key information is measured by the SM3 algorithm in the trusted platform module, and the obtained PCR measurement value is used as the standard value for verifying the preset key information; the SM4 algorithm is used, the security encryption key is used as the kernel key, the standard value of the preset key information is encrypted, and stored in a non-volatile memory, so as to obtain the standard value of the encrypted preset key information.

[0102] Example 3

[0103] See also Figure 7 As shown, the present invention provides a terminal security protection device based on a star-shaped trust chain, comprising:

[0104] The kernel verification module is used to measure the kernel through the SM3 algorithm in the trusted platform module after the embedded system is started to obtain a new PCR measurement value; read the encrypted standard value from the ROM, and use the SM4 algorithm to decrypt it with the security encryption key as the kernel key; compare the decrypted standard value with the new PCR measurement value: if the comparison passes, continue to start the kernel, if the comparison fails, interrupt the kernel startup process;

[0105] The key information verification module is used to measure the preset key information of the file system through the SM3 algorithm in the trusted platform module when loading the file system after the kernel is started, and obtain the PCR value of the new preset key information; read the standard value of the encrypted preset key information from the ROM, and decrypt it with the SM4 algorithm using the security encryption key as the kernel key; compare the standard value of the decrypted preset key information with the PCR value of the new preset key information. If the comparison is successful, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system.

[0106] Example 4

[0107] See also Figure 8 As shown, the present invention also provides an electronic device 100; the electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0108] The memory 101 can be used to store the computer program 103, and the processor 102 implements the terminal security protection step based on the star trust chain described in Example 1 or 2 by running or executing the computer program stored in the memory 101, and calling the data stored in the memory 101. The memory 101 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data (such as audio data) created according to the use of the electronic device 100, etc. In addition, the memory 101 may include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0109] The at least one processor 102 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor, etc. The processor 102 is the control center of the electronic device 100, and uses various interfaces and lines to connect various parts of the entire electronic device 100.

[0110] The memory 101 in the electronic device 100 stores a plurality of instructions to implement terminal security protection based on a star-shaped trust chain, and the processor 102 can execute the plurality of instructions to implement:

[0111] The embedded system starts up, measures the kernel by the first algorithm in the trusted platform module, and obtains a new PCR measurement value; reads the encrypted standard value from the ROM, and uses the second algorithm to decrypt the encrypted value with the secure encryption key as the kernel key; compares the decrypted standard value with the new PCR measurement value: if the comparison passes, continues to start the kernel; if the comparison fails, interrupts the kernel startup process;

[0112] After the kernel is started, when loading the file system, the preset key information of the file system is measured by the first algorithm in the trusted platform module to obtain the PCR value of the new preset key information; the standard value of the encrypted preset key information is read from the ROM, and decrypted by the second algorithm with the security encryption key as the kernel key; the standard value of the decrypted preset key information and the PCR value of the new preset key information are compared, if the comparison is successful, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system.

[0113] Example 5

[0114] If the module / unit integrated in the electronic device 100 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0115] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A terminal security protection method based on a star-shaped trust chain, characterized in that: include: The embedded system starts up, measures the kernel using the first algorithm, and obtains a new PCR measurement value; Read the encrypted standard value from the ROM, and use the second algorithm to decrypt it with the security encryption key as the kernel key; compare the decrypted standard value with the new PCR measurement value: if the comparison passes, continue to start the kernel, if the comparison fails, interrupt the kernel startup process; After the kernel is started, when the file system is loaded, the preset key information of the file system is measured by the first algorithm to obtain a PCR value of the new preset key information; Read the standard value of the encrypted preset key information from the ROM, and decrypt it using the second algorithm with the security encryption key as the kernel key; The standard value of the decrypted preset key information is compared with the PCR value of the new preset key information. If the comparison is successful, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system; wherein the encrypted standard value and the secure encryption key are obtained according to the components of the embedded system; The acquisition of the security encryption key specifically includes the following steps: Registration phase: The embedded system reads the boot loader, loads the system program, and initializes the peripheral hardware; the embedded system first reads a segment of k bits of static random access memory initial value, called the initial value Seed-Value; the initial value Seed-Value is encoded by BCH to generate an n-bit standard BCH codeword; the embedded system also reads a segment of n bits of static random access memory initial value, called the initial value Identified-Value; the n-bits standard BCH codeword is XORed with the n-bit initial value Identified-Value to generate n-bit data Helper-Data, and the n-bit data Helper-Data is encrypted and stored in the non-volatile memory; Verification phase: After the embedded system is powered on, read the n-bit noisy identification code NID with the same address and length as the initial value Identified-Value in the static random access memory during the registration phase; read the n-bit data Helper-Data stored in the non-volatile memory; perform an XOR operation on the n-bit noisy identification code NID and the n-bit data Helper-Data to obtain the n-bit BCH code with errors; perform a BCH decoding operation on the n-bit BCH code with errors. If the actual error is less than the designed error correction tolerance t, an n-bit standard BCH code is generated and the system authentication is successful. Otherwise, the BCH decoding fails. If the decoding is successful, perform an XOR operation on the n-bit standard BCH code generated by the decoding and the n-bit data Helper-Data to restore the n-bit initial value Identified-Value used in the system registration phase; compare the restored n-bit initial value Identified-Value with the initial value Identified-Value generated when the system is registered, and if they are the same, it is successful; the verification phase is completed and the system starts to operate normally; Hash processing stage: After the verification is successful in the verification stage and the system is running normally, the first algorithm is used to perform hash operation on the n bits of the initial value Identified-Value recovered in the verification stage to generate a secure encryption key; The first algorithm is the SM3 algorithm; the second algorithm is the SM4 algorithm.

2. The terminal security protection method based on star-shaped trust chain according to claim 1 is characterized in that: In the step of reading the encrypted standard value from the ROM and decrypting it using the second algorithm with the security encryption key as the kernel key, the encrypted standard value is obtained by the following steps: After the embedded system is powered on, when the kernel is loaded, the kernel is measured by the first algorithm to obtain the PCR measurement value of the kernel as the standard value for verification; the second algorithm is used, with the security encryption key as the kernel key, to encrypt the standard value for verification, store it in a non-volatile memory, and obtain the encrypted standard value.

3. The terminal security protection method based on star-shaped trust chain according to claim 1 is characterized in that: In the step of reading the standard value of the encrypted preset key information from the ROM and decrypting it using the second algorithm with the security encryption key as the kernel key, the standard value of the encrypted preset key information is obtained by the following steps: After the kernel is started, when the file system is loaded, the preset key information is measured by the first algorithm, and the obtained PCR measurement value is used as the standard value for verifying the preset key information; The second national secret algorithm is adopted, with the security encryption key as the kernel key, to encrypt the standard value of the preset key information, store it in the non-volatile memory, and obtain the standard value of the encrypted preset key information.

4. The terminal security protection device based on the star-shaped trust chain is characterized in that: include: A kernel verification module, used for measuring the kernel by a first algorithm after the embedded system is started, to obtain a new PCR measurement value; Read the encrypted standard value from the ROM, and use the second algorithm to decrypt it with the security encryption key as the kernel key; compare the decrypted standard value with the new PCR measurement value: if the comparison passes, continue to start the kernel, if the comparison fails, interrupt the kernel startup process; The key information verification module is used to measure the preset key information of the file system by using the first algorithm when loading the file system after the kernel is started, so as to obtain a PCR value of the new preset key information; Read the standard value of the encrypted preset key information from the ROM, and decrypt it using the second algorithm with the security encryption key as the kernel key; The standard value of the decrypted preset key information is compared with the PCR value of the new preset key information. If the comparison is successful, the kernel loads the file system, otherwise the kernel interrupts the loading of the file system; wherein the encrypted standard value and the secure encryption key are obtained according to the components of the embedded system; The acquisition of the security encryption key used in the kernel verification module and the key information verification module specifically includes the following steps: Registration phase: The embedded system reads the boot loader, loads the system program, and initializes the peripheral hardware; the embedded system first reads a section of k bits of static random access memory initial value Seed-Value; the static random access memory initial value Seed-Value is encoded by BCH to generate n bits of standard BCH codeword; the embedded system also reads a section of n bits of static random access memory initial value Identified-Value; the n bits of standard BCH codeword and the static random access memory initial value Identified-Value are XORed to generate n bits of data Helper-Data, and the n bits of data Helper-Data are encrypted and stored in the non-volatile memory; Verification phase: After the embedded system is powered on, read the n-bit noisy identification code NID with the same address and length as the initial value Identified-Value in the static random access memory during the registration phase; read the n-bit data Helper-Data stored in the non-volatile memory; perform an XOR operation on the n-bit noisy identification code NID and the n-bit data Helper-Data to obtain the n-bit BCH code with errors; perform a BCH decoding operation on the n-bit BCH code with errors. If the actual error is less than the designed error correction tolerance t, an n-bit standard BCH code is generated and the system authentication is successful. Otherwise, the BCH decoding fails. If the decoding is successful, perform an XOR operation on the n-bit standard BCH code generated by the decoding and the n-bit data Helper-Data to restore the n-bit initial value Identified-Value used in the system registration phase; compare the restored n-bit initial value Identified-Value with the initial value Identified-Value generated when the system is registered, and if they are the same, it is successful; the verification phase is completed and the system starts to operate normally; Hash processing stage: After the verification is successful in the verification stage and the system is running normally, the first algorithm is used to perform hash operation on the n bits of the initial value Identified-Value recovered in the verification stage to generate a secure encryption key; The first algorithm is the SM3 algorithm; the second algorithm is the SM4 algorithm.

5. The terminal security protection device based on star-shaped trust chain according to claim 4 is characterized in that: The encrypted standard value in the kernel verification module is obtained by the following steps: after the embedded system is powered on, when the kernel is loaded, the kernel is measured by a first algorithm to obtain a PCR measurement value of the kernel as a standard value for verification; a second algorithm is used to encrypt the standard value for verification with a secure encryption key as the kernel key, and the encrypted standard value is stored in a non-volatile memory to obtain an encrypted standard value; The standard value of the encrypted preset key information in the key information verification module is obtained by the following steps: after the kernel is started, when the file system is loaded, the preset key information is measured by a first algorithm, and the obtained PCR measurement value is used as the standard value for verifying the preset key information; The second algorithm is adopted, and the security encryption key is used as the kernel key to encrypt the standard value of the preset key information, store it in the non-volatile memory, and obtain the encrypted standard value of the preset key information.

6. An electronic device, characterized in that: It comprises a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement a terminal security protection method based on a star-shaped trust chain as described in any one of claims 1 to 3.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by the processor, it implements the terminal security protection method based on the star trust chain as described in any one of claims 1 to 3.

Images