Router online upgrading system based on credibility measurement

Abstract

The application provides a router online upgrading system based on credibility measurement, which is composed of a network management device and a plurality of routers, the network management device is used for providing a required credible software package and remote issuing instruction of the router, and is internally provided with a credible module; each router comprises a main control board and a plurality of single boards, and is provided with an independent credible module and a storage device, the main control board is provided with a device software management module, downloads the credible software package and performs software package verification; the software upgrading instruction is issued to each single board, and upgrading results of the single boards are collected and reported; each single board is provided with a single board software management module, and credible software updating and activation of the single board are realized; the credible module is used for credible calculation and verification; and the storage device is divided into two partitions, a main area in which current software runs and a standby area. The application guarantees high safety and high reliability requirements of online upgrading of the whole network router, and is suitable for evolution and maintenance demand scene of an endogenous security communication network.

Description

Technical Field

[0001] This invention relates to the field of network communication, and in particular to an online router upgrade system based on trust metrics. Background Technology

[0002] Routers, as crucial network nodes, significantly impact the security and reliability of the entire network. Router hardware is expensive, and with increased functionality, performance, and bug fixes, online program upgrades are inevitable. These upgrades include hardware programs (FPGAs), operating system kernels, and various functional module software. As embedded systems, routers can effectively prevent virus intrusion and Trojan injection using trusted measurement technology. However, trusted measurement relies on RTM (root of trust for measurement), a piece of code that cannot be easily modified and is trusted by users. Therefore, reliable online upgrades on routers with trusted measurement capabilities present a challenge. Currently, the industry lacks a method for online upgrades of routers supporting trusted measurement.

[0003] Common equipment upgrade methods in the industry have the following drawbacks: 1) Existing trusted computer upgrade methods only support single-system upgrades, with limited software types, and cannot support router upgrades with multiple boards and multiple systems; 2) The upgrade process lacks sufficient protection, making it easy for Trojan viruses to be implanted during the process; 3) Services may be interrupted during the program update process, and if the core router experiences a service interruption, it will cause the entire network to be paralyzed; 4) Traditional router embedded devices require reserved dedicated upgrade interfaces, such as serial ports, for upgrades. This traditional upgrade method is cumbersome and prone to errors, and in some remote areas, dedicated maintenance personnel are required to carry out on-site upgrades, which is inconvenient and costly. Summary of the Invention

[0004] To address the problems existing in the prior art, an online router upgrade system based on trust metrics is provided to solve various problems during the router upgrade process.

[0005] The technical solution adopted in this invention is as follows: an online router upgrade system based on trust metrics, consisting of a network management device and multiple routers, with the multiple routers located in the same intrinsically secure communication network:

[0006] Network management devices are used to provide routers with trusted software packages and remotely issue software package download or update instructions; they have built-in trusted modules.

[0007] Each router includes a main control board and multiple single boards. Each main control board and multiple single boards are equipped with an independent trusted module and storage device. The main control board is equipped with a device software management module, and each single board is equipped with a single board software management module.

[0008] The device software management module is used to download trusted software packages and perform package verification; it is responsible for issuing software upgrade instructions to each board and collecting and reporting the upgrade results of each board.

[0009] The single-board software management module enables trusted software updates and activation for various types of single boards.

[0010] Trusted modules are used for trusted computing and verification.

[0011] The storage device is divided into two partitions: the partition where the current software is running is the primary partition, and the other partition is the backup partition.

[0012] Furthermore, the trusted software package consists of two parts: HEAD and DATA. HEAD stores six fields: the version number of the software package, the length of HEAD, the applicable device type, the length of the entire software package, and the trusted metrics of HEAD and DATA. DATA is divided into packages according to different board types and different kernel types. Each board type contains a CPU package and an FPGA package, and each kernel type contains a kernel package. Each package contains a trusted program and a list of trusted metrics.

[0013] Furthermore, the calculation process for the HEAD and DATA trust metrics is as follows: First, the DATA is packaged, then the HEAD is encapsulated. During encapsulation, the DATA trust value is directly calculated and filled into the DATA trust metric in the HEAD. The HEAD trust metric field in the HEAD is set to zero, and then the HEAD trust metric is calculated and filled into the corresponding field.

[0014] Furthermore, trusted programs are encrypted when creating trusted software packages and decrypted when the router updates its software; unencrypted trusted programs are hashed to obtain hash values, which are then used as the trusted metrics for those programs; and a series of trusted metrics obtained by hashing all trusted programs are stored in a trusted metrics list.

[0015] Furthermore, before downloading the software package, the device software management module first performs trusted authentication with the network management device through the certificate, signature, signature verification, and hash value calculation functions provided by the trusted module.

[0016] Furthermore, after receiving the trusted software package download instruction, the device software management module verifies whether the version number of the software package to be downloaded is the same as that of the local software package. If they are different, the download begins. After successful download, the trusted software package is verified. If the verification passes, a download success message is uploaded to the network management device, and the trusted software package is stored in the storage device of the main control board. Otherwise, a download failure message is returned.

[0017] Furthermore, the verification process is as follows:

[0018] Step 1: Unpack the trusted software package to obtain the fields in HEAD and DATA;

[0019] Step 2: Perform version rule verification, device type matching verification, and HEAD length and overall package length verification based on the content of each field in HEAD;

[0020] Step 3: Set the HEAD trust metric field in the HEAD of the trusted software package to zero, then calculate the HEAD trust metric. Compare the calculated result with the HEAD trust metric before setting it to zero for trust verification. If the verification is consistent, calculate the trust metric of the DATA of the trusted software package and compare it with the DATA trust metric stored in HEAD for verification.

[0021] Furthermore, the single-board software management module implements the trusted software update process for various types of single boards as follows: After receiving the software update instruction, it checks whether the corresponding single-board software needs to be updated. If so, it downloads the required single-board program package and kernel program package to the backup area in the storage device. In the backup area, the program package is decrypted and its integrity is verified. After successful verification, the trusted measurement value carried by the program package is written to the backup area of ​​the single board's storage device, completing the software update and returning the update result.

[0022] Furthermore, the specific process of decryption and integrity verification is as follows: the trusted program is decrypted through the trusted module, and then the trusted program is calculated one by one through the trusted module. The calculated trusted hash is compared and verified with the trusted metric list one by one. If all the comparisons are consistent, the verification is successful.

[0023] Furthermore, the network management device sends a software activation message to all routers. After receiving the software activation message, the routers send activation instructions to each board after a delay of T1. After receiving the activation instructions, each board restarts after a delay of T2 to complete the activation. During the board activation process, the boot partition needs to be reset. That is, if the current boot partition indicates the primary partition, the boot partition indication will be changed to the backup partition during activation. T1 is set according to the time of the router that received the software activation message last, and T2 is set according to the time of the board that received the activation instructions last.

[0024] Compared with existing technologies, the beneficial effects of adopting the above technical solution are as follows:

[0025] (1) The trusted software package structure supports online upgrades of routers with multiple boards and multiple systems, and supports upgrades of various software types such as FPGA programs, operating systems, and application software.

[0026] (2) Integrate the trusted module into the router, and use the trusted card for integrity verification of the software package. This effectively utilizes the router's trusted measurement advantage, preventing the injection of viruses and Trojans during the entire upgrade process, and maintaining the router's overall trusted environment after the upgrade.

[0027] (3) By utilizing the primary / backup area switching mechanism of the storage device, the communication services of the entire intrinsically secure communication network are not interrupted during the program update process, and the upgrade process is safe and reliable.

[0028] (3) The entire network routers can be upgraded online by remotely controlling the network management system. The upgrade site does not require professional technicians to maintain it on-site, which reduces the cost of network upgrade and maintenance. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the router online upgrade system supporting trusted metrics proposed in this invention.

[0030] Figure 2 This is a schematic diagram of the trusted software package model proposed in this invention.

[0031] Figure 3 This is a schematic diagram of an online router upgrade network based on a trusted module proposed in this invention.

[0032] Figure 4 This is a schematic diagram of the router startup based on trust metrics proposed in this invention.

[0033] Figure 5 This is a schematic diagram of address space allocation in one embodiment of the present invention.

[0034] Figure 6 This is a schematic diagram of user-reserved address space allocation in one embodiment of the present invention.

[0035] Figure 7 This is a flowchart illustrating the online upgrade process that supports trust metrics, as proposed in this invention.

[0036] Figure 8 This is a flowchart of the trusted software package download process proposed in this invention.

[0037] Figure 9 This is a flowchart of the trusted software package update process proposed in this invention. Detailed Implementation

[0038] The embodiments of this application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar modules or modules having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. Rather, the embodiments of this application include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.

[0039] In intrinsically secure communication networks, the trusted measurement function of router systems can effectively prevent virus intrusion and Trojan injection, while online upgrades are also crucial for improving the overall network maintainability. This embodiment proposes an online router upgrade system that supports trusted measurement, mainly addressing the following issues:

[0040] (1) Solve the problem of how routers can support online upgrades of multiple boards and multiple systems. Each board needs to support upgrades of various software types, such as hardware program FPGA, operating system kernel, and software of various functional modules.

[0041] (2) Solve the problem of how to effectively prevent virus intrusion and Trojan injection during the online upgrade process of the router, and ensure that the online upgrade process is safe and reliable.

[0042] (3) Solve the problem of communication interruption during the online upgrade of the router, and ensure that the current communication service is not affected by any upgrade failure. Only allow a short communication interruption and quick recovery when the device is restarted after a successful upgrade.

[0043] (4) To solve the problem of high maintenance costs caused by the need for dedicated personnel to perform on-site maintenance for router upgrades, it is necessary to support remote online upgrades.

[0044] Specifically, such as Figure 1 As shown, an online router upgrade system based on trust metrics consists of a network management device and multiple routers, all located within the same intrinsically secure communication network.

[0045] Network management devices are used to provide routers with trusted software packages and remotely issue software package download or update instructions; they have built-in trusted modules.

[0046] Each router includes a main control board and multiple single boards. Each main control board and multiple single boards are equipped with an independent trusted module and storage device. The main control board is equipped with a device software management module, and each single board is equipped with a single board software management module.

[0047] The device software management module is used to download trusted software packages and perform package verification; it is responsible for issuing software upgrade instructions to each board and collecting and reporting the upgrade results of each board.

[0048] The single-board software management module enables trusted software updates and activation for various types of single boards.

[0049] Trusted modules are used for trusted computing and verification.

[0050] The storage device is divided into two partitions: the partition where the current software is running is the primary partition, and the other partition is the backup partition.

[0051] It also includes a log management module for storing logs generated during the router upgrade process.

[0052] In this system, the entire feasible online upgrade consists of three parts: trusted software package download, trusted software update, and trusted software activation. Its core components are the device software management module and the single-board software management module. The device software management module is primarily responsible for managing trusted software collected by the router, including trusted software package management, whole-machine trusted software update management, and whole-machine trusted software activation management. It is responsible for issuing software upgrade instructions to each single board and collecting and reporting the upgrade results of each single board. The single-board software management module implements trusted software update and trusted software activation functions for various types of single boards. The trusted measurement in this system is mainly achieved through a trusted module integrated into the router as a built-in RTM. The trusted module provides trusted computing functions, and the storage device is used to store software programs and corresponding trusted measurement values ​​for trusted verification.

[0053] Online upgrades require a trusted software package, and the creation of such a package is crucial for supporting online upgrade functionality with trusted metrics. Therefore, this embodiment proposes a method for creating a trusted software package. Intrinsically secure communication networks typically contain multiple router models, and different software packages are created for each model. A unified model is as follows: Figure 2 As shown.

[0054] A trusted software package consists of two parts: HEAD and DATA. HEAD contains six fields: SP_VESION, HEAD_LEN, DEV_TYPE, TOTEL_LEN, HEAD_CHECK_SUM, and DATA_CHECK_SUM. SP_VESION is the package version number, used to distinguish different versions; HEAD_LEN is the length of the HEAD section of the package; DEV_TYPE is the device type, used to distinguish different router models; TOTEL_LEN is the total length of the package; HEAD_CHECK_SUM is the trust metric for the HEAD section of the package; and DATA_CHECK_SUM is the trust metric for the DATA section of the package.

[0055] It should be noted that the calculation method of HEAD_CHECK_SUM is as follows: First, the DATA part is packaged, and then the HEAD is encapsulated. When encapsulating the HEAD, the DATA_CHECK_SUM is calculated first and filled into the HEAD. The HEAD_CHECK_SUM field is set to zero. Then, the HEAD_CHECK_SUM is calculated through a reliable method and filled into the corresponding position.

[0056] The DATA section of the trusted software package is mainly divided into packages according to different board types and kernel types. Since different boards may use the same kernel, to avoid wasting package space, the kernel is packaged separately. The packages include three categories: CPU packages, FPGA packages, and kernel packages. Therefore, each board type contains a CPU package and an FPGA package, and each kernel type contains a kernel package. Each package contains two parts: trusted programs and a list of trusted metrics.

[0057] In this embodiment, the packaging device for creating trusted software packages is equipped with the same trusted module as the router, and the installation program can be directly executed on the router without a secondary installation process. The trusted program is encrypted using the trusted module during packaging and decrypted using the trusted module during unpacking.

[0058] The Trusted Metrics List is a hash value calculated by a trusted module for unencrypted programs. This calculation process is called Trusted Metrics, and the calculated hash value is the Trusted Metrics value of the program. Trusted Metrics requires Trusted Metrics to be performed on all programs, and the series of Trusted Metrics values ​​calculated are recorded in the Trusted Metrics List.

[0059] The trusted measurement list serves two main purposes: firstly, it provides static protection by performing trusted verification on the decrypted program during the upgrade process to ensure that no Trojans or viruses are injected during the upgrade; secondly, it provides dynamic protection by performing real-time verification during the device or program startup process after the upgrade to ensure that no Trojans or viruses are injected during device operation.

[0060] After the trusted software package is created, the network management device obtains the package via secure media such as CD-ROMs, and then sends it to various routers in the secure communication network according to different device types. The sending process is as follows: Figure 3 As shown.

[0061] Before downloading a trusted software package, the router needs to perform trusted authentication with the network management device. In this embodiment, the trusted module's certificate, signature, signature verification, and hash calculation functions are directly used to perform trusted authentication between devices. After successful authentication, the router begins the process of downloading the trusted software package.

[0062] After receiving the trusted software package download instruction, the device software management module in the router verifies whether the version number of the software package to be downloaded is the same as that of the local software package. If they are different, the download begins. After successful download, the trusted software package is verified. If the verification passes, a download success message is uploaded to the network management device, and the trusted software package is stored in the backup storage area of ​​the main control board. Otherwise, a download failure message is returned.

[0063] In this embodiment, the verification process for trusted software packages is as follows:

[0064] Step 1: The software management module unpacks the trusted software package to obtain the fields in HEAD and DATA;

[0065] Step 2: Perform version rule verification based on SP_VESION in the HEAD section, match and verify the actual device type based on DEV_TYPE, and perform length verification based on HEAD_LEN and TOTAL_LEN;

[0066] Step 3: Set HEAD_CHECK_SUM in the trusted package HEAD to 0. Calculate the trust metric value of the HEAD part and perform a trust verification with the calculated result and HEAD_CHECK_SUM before setting it to zero. After successful verification, calculate the trust metric value of the DATA part of the trusted package and perform a trust verification with DATA_CHECK_SUM.

[0067] After successful trust verification, the DATA portion is stored in a storage device such as NAND FLASH or CF, which contains a list of trusted CPUs, kernels, FPGA programs, and trust metrics for each board of the entire device.

[0068] After the trusted software package is downloaded, the single-board software management module executes the trusted software update process. After receiving the software update instruction, the single-board software management module checks whether the corresponding single-board software needs to be updated. If so, it downloads the required single-board program package and kernel program package to the backup area in the storage device. In the backup area, the program package is decrypted and its integrity is verified. After successful verification, the trusted measurement value carried by the program package is written to the backup area of ​​each single-board storage device, completing the software update and returning the update result.

[0069] During the update process, each board downloads the corresponding board program package and kernel software package based on its board type and kernel type. The board program package includes CPU and FPGA program packages. In this embodiment, the storage device is initially divided into area A and area B. If the current software is running in area A, then area A is the primary area and area B is the backup area. The upgrade program is then downloaded to area B, and vice versa. The program update requires decryption via a trusted module. After decryption, the trusted module performs trusted hash calculations on each program item. The calculated trusted values ​​are compared and verified against a trusted metric list. Only if all comparisons are successful is the software update considered successful.

[0070] To more clearly explain the primary / backup failover mechanism of trusted storage devices, let's first explain the router startup logic based on trust metrics, such as... Figure 4 As shown, the trust measurement uses the feasible module as the root of trust and measures upwards during hardware startup. This embodiment uses the online upgrade mechanism of PMON supporting trust measurement as an example. For instance, if the size of the SPI FLASHI on the motherboard is 2MB and one page is 64KB, this patent allocates the top page to PMON and user-accessible data space. The remaining space for storing the PMON's BIN file is allocated as follows: Figure 5 As shown, the data format of the user-reserved address space is: starting from the user's starting address (0x40000000-1 page size + 1) (actually 2*1024*1024-64*1024+1), from... Figure 6 As can be seen, the value of buf

[200] is the base address, and 256 consecutive bytes are allocated at the beginning. For PMON, different bytes are needed for the user-defined functions to be started. Among them, buf

[200] is used to define the boot partition, indicating whether to start from area A or area B. Taking a trust metric value of 32 bytes as an example, buf[201~328] stores the trust metric values ​​of the kernel and FPGA in areas A and B. After PMON determines the boot partition through the boot analysis instruction, it reads the corresponding kernel and FPGA files in the specified partition of the storage device and calculates the trust metric value. After the trust verification is successful, the corresponding file is started.

[0071] The final step in the single-board software update process requires reading the corresponding trusted metric value from the updated trusted metric list and writing it to the corresponding A / B area space of the SPIFLASH. For example, if the current boot partition indicator points to area A, the updated trusted metric value must be written to area B. The trusted storage primary / backup failover mechanism ensures that the software update process does not affect the operation of the primary area program, thus not affecting current business operations, and communication services remain uninterrupted throughout the entire software update process. Even in the event of software update failure, storage device malfunction, or other events, it can be repaired or upgraded again in real time.

[0072] After the trusted software update is complete, it needs to be activated. The key to trusted software activation is ensuring that all routers and all circuit boards within the entire intrinsically secure communication network are activated and restarted simultaneously. Otherwise, premature restarts of critical nodes or switching boards will prevent subsequent activation messages from reaching other devices or boards. If only some devices or boards are successfully upgraded, incompatibility due to interfaces or protocols can cause the entire network to crash. Therefore, it is necessary to ensure that the trusted software activation notification message sent by the network management device reaches all routers. If one router reports a failure or timeout, an activation cancellation message needs to be sent to all routers in the network to prevent premature upgrades. Due to the delay in the trusted activation message transmission, after receiving the software activation message, the router needs to delay for T1 before sending activation instructions to each board, and each board also needs to delay for T2 before restarting after receiving the software activation message.

[0073] The T1 setting ensures all routers restart together. Otherwise, if some intermediate communication routers (such as the core router) activate and restart first, other routers may not receive the activation instruction message. T1 is determined by the time the last router to receive the message, such as setting it to 10 seconds. The T2 setting ensures all boards restart together. Otherwise, if some intermediate communication boards (such as switching boards) activate and restart first, other boards may not receive the activation instruction message. T2 is determined by the time the last board to receive the message, such as setting it to 5 seconds.

[0074] The trusted activation process for a single board requires resetting the boot partition indicator. For example, if the current boot partition indicator for the SPIFLASH is zone A, it needs to be changed to zone B during activation. After the boot partition indicator is successfully updated, the single board restarts, indicating successful trusted software activation. The trusted device startup process has been described in the router startup diagram based on trusted metrics mentioned earlier. After the device starts up, it performs real-time security protection based on the new trusted metric list. If files are tampered with or implanted, they will be blocked to prevent virus and Trojan intrusion.

[0075] This embodiment provides a further overall description of the software download, update, and activation process for the aforementioned router online system, such as... Figure 7 As shown, the process includes the following:

[0076] Step 1: Create a trusted software package;

[0077] Step 2: Import the trusted software package into the network management device and send it to each router in the intrinsically secure communication network according to the device type;

[0078] Step 3: After receiving the configuration message from the gateway device, the router performs a trusted verification with the network management device. If the verification is successful, the trusted software package is downloaded, and the download information is returned.

[0079] Step 4: The network management device sends a software upgrade command to the router, and the router decompresses the downloaded trusted software package to the upgrade path;

[0080] Step 5: Check if the software on the router's internal boards needs to be updated. If so, download the corresponding trusted program from the upgrade path to the backup storage area for updating, and return the update result.

[0081] Step 6: The network management device sends an activation message. After receiving the activation message, the router sends an activation instruction to each board after a delay of T1. After receiving the activation message, each board restarts after a delay of T2 to complete the activation.

[0082] like Figure 8 As shown, the download process for the three trusted software packages is as follows:

[0083] Step 3.1: The router receives the trusted software package download instruction issued by the network management device, and determines whether the version number of the trusted software package is the same as that of the local software package. If they are the same, proceed to step 3.4; otherwise, proceed to step 3.2.

[0084] Step 3.2: Download the trusted software package according to the download instruction, and determine whether the download is complete. If yes, proceed to step 3.3; otherwise, proceed to step 3.5.

[0085] Step 3.3: Verify the trusted software package. If the verification passes, proceed to step 3.4; otherwise, proceed to step 3.5.

[0086] Step 3.4: Report a successful download message to the network management device;

[0087] Step 3.5: Report the download failure message to the network management device.

[0088] like Figure 9 As shown, step 4 includes the following sub-steps:

[0089] Step 5.1: After receiving the software upgrade command, the router checks whether the board software needs to be updated. If so, proceed to step 5.2; otherwise, proceed to step 5.7.

[0090] Step 5.2: Download the required single-board program package or kernel program package from the upgrade path and determine whether the download was successful. If yes, proceed to step 5.3; otherwise, proceed to step 5.6.

[0091] Step 5.3: Update the downloaded program package to the backup storage area and determine whether the update was successful. If it was, proceed to step 5.4; otherwise, proceed to step 5.6.

[0092] Step 5.4: Decrypt the program package in the backup area of ​​the memory and perform integrity verification. If the verification is successful, proceed to step 5.5; otherwise, proceed to step 5.6.

[0093] Step 5.5: Write the FPGA / KERNEL trust metric value to the hardware backup area. If the software update result is successful, proceed to step 5.7.

[0094] Step 5.6: The software update failed. Proceed to step 5.7.

[0095] Step 5.7: Return the single-board software update result.

[0096] The online upgrade system and method proposed in this invention significantly improve the maintenance capabilities of routers based on inherent security, ensuring the high security and high reliability requirements of online upgrades for all routers in the network, and is suitable for the evolution and maintenance needs of inherently secure communication networks.

[0097] It should be noted that, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "set" and "connection" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances. The accompanying drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0098] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A router online upgrade system based on trust metrics, characterized in that, It consists of a network management device and multiple routers, all of which are located within the same intrinsically secure communication network. The network management device provides the router with trusted software packages and remotely issues download or update commands for these packages. It has a built-in trusted module. The trusted software package consists of two parts: HEAD and DATA. HEAD stores six fields: the package version number, HEAD length, applicable device type, total package length, HEAD trusted metric value, and DATA trusted metric value. DATA is divided into packages according to different board types and kernel types. Each board type contains CPU and FPGA packages, and each kernel type contains one kernel package. Each package contains a trusted program and a trusted metric list. The trusted program is encrypted using the trusted module during packaging and decrypted using the trusted module during unpacking. The unencrypted trusted program is hashed to obtain a hash value, which serves as the program's trusted metric value. A series of trusted metric values ​​obtained by hashing all trusted programs are stored in the trusted metric list. Each router includes a main control board and multiple single boards. Each main control board and multiple single boards are equipped with an independent trusted module and storage device. The main control board is equipped with a device software management module, and each single board is equipped with a single board software management module. The device software management module is used to download trusted software packages and verify them. The software upgrade instructions are issued to each board, and the upgrade results of each board are collected and reported. After receiving the trusted software package download instruction, the device software management module verifies whether the version number of the trusted software package to be downloaded is the same as the version number of the local trusted software package. If they are different, the download begins. After successful download, the trusted software package is verified. If the verification passes, a download success message is uploaded to the network management device, and the trusted software package is stored in the backup area of ​​the main control board's storage device. Otherwise, a download failure message is returned. The single-board software management module enables trusted software updates and activation for various types of single boards. The trusted software update process for various types of single boards implemented by the single-board software management module is as follows: After receiving the software upgrade instruction from the device software management module, it checks whether the corresponding single-board software needs to be updated. If so, it downloads the required single-board program package and kernel program package from the backup area of ​​the main control board's storage device to the backup area of ​​the single board's storage device. In the backup area, the trusted module decrypts and verifies the integrity of the program package. After successful verification, the trusted measurement value carried by the program package is written to the backup area of ​​the single board's storage device, completing the software update and returning the update result. Trusted modules are used for trusted computing and verification. The storage device is divided into two partitions: the partition where the current software is running is the primary partition, and the other partition is the backup partition.

2. The router online upgrade system based on trust metrics according to claim 1, characterized in that, The calculation process for HEAD and DATA trust metrics is as follows: First, complete the DATA packaging, then encapsulate HEAD. During encapsulation, directly calculate the DATA trust value and fill it into the DATA trust value field in HEAD. Set the HEAD trust value field in HEAD to zero, then calculate the HEAD trust value and fill it into the corresponding field.

3. The router online upgrade system based on trust metric as described in claim 1, characterized in that, Before downloading the software package, the device software management module first performs trusted authentication with the network management device through the certificate, signature, signature verification, and hash value calculation functions provided by the trusted module.

4. The router online upgrade system based on trust metrics according to claim 1, characterized in that, The verification process is as follows: Step 1: Unpack the trusted software package to obtain the fields in HEAD and DATA; Step 2: Perform version rule verification, device type matching verification, and HEAD length and overall package length verification based on the content of each field in HEAD; Step 3: Set the HEAD trust metric field in the HEAD of the trusted software package to zero, then calculate the HEAD trust metric. Compare the calculated result with the HEAD trust metric before setting it to zero for trust verification. If the verification is consistent, calculate the trust metric of the DATA of the trusted software package and compare it with the DATA trust metric stored in HEAD for verification.

5. The router online upgrade system based on trust metrics according to claim 1, characterized in that, The specific process of decryption and integrity verification is as follows: the trusted program is decrypted through the trusted module, and then the trusted program is calculated one by one through the trusted module. The calculated trusted hash is compared and verified with the trusted metric list one by one. If all the comparisons are consistent, the verification is successful.

6. The router online upgrade system based on trust metric according to claim 1, characterized in that, The network management device sends a software activation message to all routers. After receiving the software activation message, the routers send activation instructions to each board after a delay of T1. After receiving the activation instructions, each board restarts after a delay of T2 to complete the activation. During the single-board activation process, the boot partition needs to be reset. That is, if the current boot partition indicates the primary partition, the boot partition indication will be changed to the backup partition during activation. T1 is set according to the router time that received the software activation message last, and T2 is set according to the single-board time that received the activation instruction last.

Images