A secure boot method for an embedded device

Abstract

This invention relates to a secure boot method for embedded devices, belonging to the field of embedded systems. The embedded device software boot scheme of this invention prioritizes the main area program upon each power-on restart. After power-on, the device first performs hardware and software initialization, then checks the main area program authentication code. If the check is successful, the main area program overwrites the backup area program, and the main area program starts. If the main area program check fails, the backup area program authentication code is checked. If the backup area program check is successful, the backup area program overwrites the main area program; if the overwriting is successful, the main area program starts. If the overwriting fails, the backup area program starts. If both the main area program and the backup program check fail, error messages are printed on the debug serial port, awaiting user-injected new programs. This invention employs a main / backup area software mechanism, an integrity verification mechanism, and a main / backup area repair mechanism to ensure the security and stability of embedded device software boot.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of embedded devices, and relates to a secure boot method of an embedded device, in particular to a secure boot mechanism for preventing loss and tampering of main and backup area software. BACKGROUND

[0002] With the development of big data, cloud computing, the Internet of Things and other technologies, embedded devices are widely used in people's life, study and work, bringing great convenience to human society. Under this trend, people gradually pay attention to the stability of embedded devices. At present, some researches discuss the main and backup area boot scheme design based on two pieces of NorFlash, two pieces of NandFlash or one piece of NandFlash and one piece of NorFlash hardware architecture, but the current research has not involved the backup recovery mechanism after the loss of main or backup area software, and the security protection mechanism after the tampering of main or backup area software, resulting in the risk that the embedded device software cannot be repaired after the loss or tampering of main or backup area programs, so it is necessary to design a secure boot scheme for embedded device software. SUMMARY

[0003] (I) Technical problem to be solved

[0004] The technical problem to be solved by the application is how to provide a secure boot method of an embedded device to solve the problem that the current research has not involved the backup recovery mechanism after the loss of main or backup area software, and the security protection mechanism after the tampering of main or backup area software, resulting in the risk that the embedded device software cannot be repaired after the loss or tampering of main or backup area programs.

[0005] (II) Technical scheme

[0006] In order to solve the above technical problem, the application provides a secure boot method of an embedded device, which comprises the following steps:

[0007] Step 1: detecting the integrity of the main area program of the embedded device; reading the main area program and the authentication code Mm from the storage chip of the embedded device, calculating the authentication code Mm' of the main area program through an authentication algorithm; if the calculated authentication code Mm' of the main area program is consistent with the authentication code Mm of the main area program, the main area program meets the integrity requirement, and step 2 is executed; if the comparison result of the authentication code Mm and the authentication code Mm' is inconsistent, step 4 is executed;

[0008] Step 2: detecting the integrity of the backup area program of the embedded device, comparing the main area program and the authentication code Mm with the backup area program and the authentication code Mb read from the storage chip of the embedded device, if the comparison is consistent, starting the main area program, and the current embedded device boot is successful, otherwise step 3 is executed;

[0009] Step three, read the main area program from the embedded device memory chip, write into the storage space of the backup area in turn, write successfully, start the main area program; write fails, start the backup area program, end the process;

[0010] Step four, detect the integrity of the embedded device backup area program; read the backup area program and authentication code Mb from the embedded device memory chip, calculate the authentication code Mb' of the backup area program through the authentication algorithm; if the calculated authentication code Mb' of the backup area program is consistent with the authentication code Mb carried by the backup area program, the backup area program meets the integrity requirement, execute step five; if the comparison of the authentication code Mb and the authentication code Mb' is inconsistent, execute step six;

[0011] Step five, read the backup area program from the embedded device memory chip, write into the storage space of the main area in turn, write successfully, start the main area program; write fails, start the backup area program;

[0012] Step six, the main area and the backup area of the embedded device fail to check, print failure information, and wait for the user to update the program.

[0013] Further, the step one further comprises: the main area program and the backup area program authentication calculation process.

[0014] Further, the authentication calculation process is: through the hash password algorithm and the authentication key, the authentication code Mm of the main area program is calculated, and the authentication code Mm is stored behind the main area program in the embedded device memory chip; through the hash password algorithm and the authentication key, the authentication code Mb of the backup area software is calculated, and the authentication code Mb is stored behind the backup area program in the embedded device memory chip.

[0015] Further, the integrity verification process of the step one is: read the main area program from the embedded device, calculate the authentication code Mm' of the main area program through the hash password algorithm and the authentication key, read the authentication code Mm behind the main area program, compare the read authentication code Mm and the authentication code Mm', compare consistent, integrity verification succeeds, otherwise, integrity verification fails.

[0016] Further, the integrity verification process of the step four is: read the backup area program from the embedded device, calculate the authentication code Mb' of the backup area program through the hash password algorithm and the authentication key, read the authentication code Mb behind the backup area program, compare the read authentication code Mb' and the authentication code Mb, compare consistent, integrity verification succeeds, otherwise, integrity verification fails.

[0017] Further, if the main area program or the backup area program is tampered, the tampered information is obtained through the integrity verification result.

[0018] Further, the step two, reading the main area program and authentication code Mm and the backup area program and authentication code Mb from the embedded device storage chip for comparison includes: reading the main area program and authentication code Mm and the backup area program and authentication code Mb from the embedded device storage chip for bit-by-bit comparison.

[0019] Further, the step three, reading the embedded main area program from the storage chip and writing it into the storage space where the backup area program is located, to complete the operation of repairing the backup area program.

[0020] Further, the step five, reading the embedded backup area program from the storage chip and writing it into the storage space where the main area program is located, to complete the operation of repairing the main area program.

[0021] Further, after each power-on restart of the embedded device, the main area program is started preferentially, after the device is powered on, hardware initialization and software initialization are firstly performed, then the main area program authentication code is detected, if the detection is successful, the main area program is used to overwrite the backup area program, and the main area program is started; if the main area program detection fails, the backup area program authentication code is detected, if the backup area program detection is successful, the backup area program is used to overwrite the main area program, if the overwriting is successful, the main area program is started, if the overwriting fails, the backup area program is started; if both the main area program and the backup area program fail to be detected, error information is printed through a debugging serial port, and the user is waited for to inject a new program.

[0022] (Three) beneficial effects

[0023] The present application provides a safe starting method of an embedded device, and provides a safe starting scheme of an embedded device, which adopts a main-backup area software mechanism, an integrity verification mechanism and a main-backup area software repairing mechanism. The main-backup area software mechanism guarantees the stability of the software of the embedded device; the integrity verification mechanism guarantees the anti-tampering property of the software of the embedded device; and the main-backup area software repairing mechanism guarantees the anti-loss property of the software of the embedded device, thereby guaranteeing the safety and stability of the software starting of the embedded device. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 The present application provides a safe starting method of an embedded device, and provides a safe starting scheme of an embedded device, which adopts a main-backup area software mechanism, an integrity verification mechanism and a main-backup area software repairing mechanism. The main-backup area software mechanism guarantees the stability of the software of the embedded device; the integrity verification mechanism guarantees the anti-tampering property of the software of the embedded device; and the main-backup area software repairing mechanism guarantees the anti-loss property of the software of the embedded device, thereby guaranteeing the safety and stability of the software starting of the embedded device. DETAILED DESCRIPTION

[0025] In order to make the purpose, content and advantages of the present application clearer, the specific implementation manner of the present application is described in further detail below in combination with the drawings and examples.

[0026] In order to solve the above technical problems, the present application provides a safe starting scheme of an embedded device, which is applied to an embedded device and includes the following steps:

[0027] Step one, detecting the integrity of the main area program of the embedded device; reading the main area program and authentication code Mm from the storage chip of the embedded device, calculating the authentication code Mm' of the main area program through the authentication algorithm; if the calculated authentication code Mm' of the main area program is consistent with the authentication code Mm carried by the main area program, the main area program meets the integrity requirement, and step two is executed; if the comparison result of the authentication code Mm and the authentication code Mm' is inconsistent, step four is executed;

[0028] Step two, detecting the integrity of the standby area program of the embedded device, comparing the main area program and the authentication code Mm and the standby area program and the authentication code Mb read from the storage chip of the embedded device, if the comparison is consistent, starting the main area program, and the current embedded device startup is successful, otherwise step three is executed;

[0029] Step three, reading the main area program from the storage chip of the embedded device, writing into the storage space of the standby area in sequence, writing successfully, starting the main area program; writing fails, starting the standby area program, and ending the process;

[0030] Step four, detecting the integrity of the standby area program of the embedded device; reading the standby area program and authentication code Mb from the storage chip of the embedded device, calculating the authentication code Mb' of the standby area program through the authentication algorithm; if the calculated authentication code Mb' of the standby area program is consistent with the authentication code Mb carried by the standby area program, the standby area program meets the integrity requirement, and step five is executed; if the comparison result of the authentication code Mb and the authentication code Mb' is inconsistent, step six is executed;

[0031] Step five, reading the standby area program from the storage chip of the embedded device, writing into the storage space of the main area in sequence, writing successfully, starting the main area program; writing fails, starting the standby area program;

[0032] Step six, the main area and the standby area of the embedded device fail to pass the verification, printing failure information, and waiting for the user to update the program.

[0033] The step one further comprises: the authentication calculation process of the main area program and the standby area program is that the authentication code Mm of the main area program is calculated through the hash password algorithm and the authentication key, the authentication code Mm is added behind the main area program and stored in the storage chip of the embedded device; the authentication code Mb of the standby area program is calculated through the hash password algorithm and the authentication key, the authentication code Mb is added behind the standby area program and stored in the storage chip of the embedded device.

[0034] The integrity verification process of the step one is that the main area program is read from the embedded device, the authentication code Mm' of the main area program is calculated through the hash password algorithm and the authentication key, the authentication code Mm is read from behind the main area program, the read authentication code Mm and the authentication code Mm' are compared, if the comparison is consistent, the integrity verification is successful, otherwise the integrity verification fails.

[0035] The integrity verification process in step four is as follows: read the backup program from the embedded device, calculate the authentication code Mb' of the backup program using a hash cryptography algorithm and an authentication key, read the authentication code Mb from the backup program, compare the read authentication code Mb' with the authentication code Mb, if they match, the integrity verification is successful; otherwise, the integrity verification fails.

[0036] Furthermore, if the primary or backup program is tampered with, the tampered information can be obtained through the integrity verification results.

[0037] Furthermore, in step two, comparing the main area program and authentication code Mm and the backup area program and authentication code Mb read from the embedded device's storage chip includes: comparing the main area program and authentication code Mm with the backup area program and authentication code Mb bit by bit.

[0038] Furthermore, in step three, the embedded master program is read from the storage chip and simultaneously written into the storage space where the backup program is located, thus completing the operation of repairing the backup program.

[0039] Furthermore, in step five, the embedded backup program is read from the storage chip and simultaneously written into the storage space where the main program is located, thus completing the operation of repairing the main program.

[0040] like Figure 1 As shown, the embedded device software boot scheme prioritizes starting the main program upon each power-on restart. After power-on, the device first performs hardware and software initialization, then checks the main program authentication code. If successful, the main program overwrites the backup program and starts the main program. If the main program fails to boot, the backup program authentication code is checked. If successful, the backup program overwrites the main program and starts the main program. If overwriting fails, the backup program starts. If both the main and backup programs fail to boot, error messages are printed on the debug serial port, awaiting user-injected new programs.

[0041] This invention proposes a secure boot scheme for embedded devices, employing a primary / backup area software mechanism, an integrity verification mechanism, and a primary / backup area repair mechanism. The primary / backup area software mechanism ensures the stability of the embedded device software; the integrity verification mechanism ensures the tamper-proof nature of the embedded device software; and the primary / backup area software repair mechanism ensures the anti-loss nature of the embedded device software, thereby guaranteeing the secure and stable boot of the embedded device software.

[0042] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method of secure booting of an embedded device, characterized in that, The method comprises the following steps: Step one, detecting the integrity of the main area program of the embedded device; Read the main area program and the authentication code Mm from the storage chip of the embedded device, calculate the authentication code Mm' of the main area program through the authentication algorithm; if the calculated authentication code Mm' of the main area program is consistent with the authentication code Mm carried by the main area program, the main area program meets the integrity requirement, and step two is executed; if the comparison result of the authentication code Mm and the authentication code Mm' is inconsistent, step four is executed; Step two, detecting the integrity of the backup area program of the embedded device, comparing the main area program and the authentication code Mm and the backup area program and the authentication code Mb read from the storage chip of the embedded device, if the comparison is consistent, starting the main area program, and the current embedded device startup is successful, otherwise, step three is executed; Step three, reading the main area program from the storage chip of the embedded device, and sequentially writing the main area program into the storage space of the backup area, if the writing is successful, starting the main area program, otherwise, starting the backup area program, and ending the process; Step four, detecting the integrity of the backup area program of the embedded device; Read the backup area program and the authentication code Mb from the storage chip of the embedded device, and calculate the authentication code Mb' of the backup area program through the authentication algorithm; If the calculated authentication code Mb' of the backup area program is consistent with the authentication code Mb carried by the backup area program, the backup area program meets the integrity requirement, and step five is executed; if the comparison result of the authentication code Mb and the authentication code Mb' is inconsistent, step six is executed; Step five, reading the backup area program from the storage chip of the embedded device, and sequentially writing the backup area program into the storage space of the main area, if the writing is successful, starting the main area program, otherwise, starting the backup area program; Step six, the main area and the backup area of the embedded device fail to pass the verification, printing failure information, and waiting for the user to update the program. The step one further comprises an authentication calculation process of the main area program and the backup area program.

2. The secure boot method of the embedded device according to claim 1, wherein, The authentication calculation process is that the authentication code Mm of the main area program is calculated through a hash password algorithm and an authentication key, the authentication code Mm is added behind the main area program and stored in the storage chip of the embedded device; the authentication code Mb of the backup area program is calculated through the hash password algorithm and the authentication key, and the authentication code Mb is added behind the backup area program and stored in the storage chip of the embedded device.

3. The secure boot method of an embedded device according to claim 2, wherein, The integrity verification process of the step one is that the main area program is read from the embedded device, the authentication code Mm' of the main area program is calculated through the hash password algorithm and the authentication key, the authentication code Mm is read from behind the main area program, the read authentication code Mm and the authentication code Mm' are compared, if the comparison is consistent, the integrity verification is successful, otherwise, the integrity verification fails.

4. The secure boot method of an embedded device according to Claim 3, wherein, The integrity verification process of the step four is that the backup area program is read from the embedded device, the authentication code Mb' of the backup area program is calculated through the hash password algorithm and the authentication key, the authentication code Mb is read from behind the backup area program, the read authentication code Mb' and the authentication code Mb are compared, if the comparison is consistent, the integrity verification is successful, otherwise, the integrity verification fails.

5. The secure boot method of the embedded device according to claim 3, wherein, If the main area program or the backup area program is tampered, the tampered information is obtained through the integrity verification result.

6. The secure boot method of an embedded device according to claim 4 or 5, wherein, ​ 7. The secure boot method of the embedded device according to claim 1, wherein, The step two comprises: reading the main area program and authentication code Mm and the backup area program and authentication code Mb from the embedded device storage chip and comparing them bit by bit.

8. The secure boot method of the embedded device according to claim 7, wherein, The step three comprises: reading the embedded main area program from the storage chip and writing it into the storage space where the backup area program is located, thereby completing the operation of repairing the backup area program.

9. The secure boot method of the embedded device according to claim 7, wherein, The step five comprises: reading the embedded backup area program from the storage chip and writing it into the storage space where the main area program is located, thereby completing the operation of repairing the main area program.

10. The method of secure boot of an embedded device according to claim 8 or 9, wherein, After each power-on restart of the embedded device, the main area program is started preferentially. After the device is powered on, hardware initialization and software initialization are performed first, then the authentication code of the main area program is detected, the main area program is overwritten with the backup area program if the detection is successful, and the main area program is started. If the detection of the main area program fails, the authentication code of the backup area program is detected, the backup area program is overwritten with the main area program if the detection is successful, the main area program is started if the overwriting is successful, and the backup area program is started if the overwriting fails. If the detection of both the main area program and the backup area program fails, error information is printed through a debugging serial port, and the user is waited for to inject a new program.

Images