Device tree encryption and decryption, signature method, terminal and storage medium
By performing hybrid encryption and signature processing on device tree information, the security issues caused by plaintext storage of device tree information are resolved, ensuring the security and integrity of device tree information and guaranteeing the normal startup of the system.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANDONG YUNHAI GUOCHUANG CLOUD COMPUTING EQUIP IND INNOVATION CENT CO LTD
- Filing Date
- 2022-10-28
- Publication Date
- 2026-07-21
AI Technical Summary
The device tree is stored in plain ASCII format, which poses security risks, exposes hardware architecture information, and causes devices to fail to boot due to abnormal DTB data.
A hybrid encryption algorithm combining symmetric and asymmetric methods is used to encrypt the public key information of the firmware creation program. The private key is used to encrypt the device tree information and calculate a signature, which is then filled into the starting address of the device tree partition DTB data. A parser is added to the BootLoader and Kernel for parsing.
This improves the security and data integrity of the device tree, ensuring the reliability of device tree information and the normal startup of the system.
Smart Images
Figure CN115859318B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data structure technology, and in particular to device tree encryption and decryption, signature methods, terminals, and storage media. Background Technology
[0002] The device tree, originating from OpenFirmware (OF), is a data structure for describing hardware. It consists of a series of named nodes and properties, and nodes themselves can contain child nodes. A property is essentially a pair of name and value. The information that can be described in a device tree includes: The number and type of CPUs; Memory base address and size; Buses and bridges; Interrupt controller and interrupt usage; GPIO controller and GPIO usage; Clock controller and clock usage.
[0003] Essentially, it draws a tree diagram of the CPU, bus, and devices on a circuit board. The Bootloader passes this tree to the kernel, which then recognizes it and expands it to include devices such as platform_device, i2c_client, and spi_device in the Linux kernel. The memory, IRQs, and other resources used by these devices are also passed to the kernel, which then binds these resources to the corresponding devices.
[0004] Compared to traditional methods that hard-compile board-level hardware information into the Linux kernel, using a device tree reduces kernel code redundancy and lowers the time and manpower costs associated with device tree maintenance. However, while device trees offer convenience in terms of efficiency, they also introduce some security issues: The device tree is stored in plain ASCII text, which may be maliciously obtained, resulting in the leakage of information related to the system hardware architecture (such as CPU, memory, bus and bridge, clock, etc.). Device trees have high requirements for storage stability. Once anomalies such as byte jumps or byte reversals occur, it may cause DTB data corruption, and the BootLoader or Kernel will be unable to obtain hardware information normally, resulting in the device failing to start normally. Summary of the Invention
[0005] To address the technical problems existing in the prior art, the present invention provides a device tree encryption / decryption and signature method, a terminal, and a storage medium.
[0006] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions: In a first aspect, in one embodiment of the present invention, a device tree encryption / decryption and signature method is provided, the method comprising the following steps: A firmware creation program that includes BootLoader, Kernel, RootFS, and OtherFS; Specifically, a hybrid encryption algorithm combining symmetric and asymmetric encryption is used to encrypt the public key information of the firmware creation program; The device tree information is encrypted and a signature is calculated using the private key of the firmware creation program. The public key information and the signature information are then filled into the starting address of the device tree partition DTB data in the form of DTH information. The BootLoader and Kernel parse the device tree information through a parser to obtain DTB information.
[0007] As a further aspect of the present invention, the firmware creation program includes creating a firmware image file; When creating a firmware image file, DTH information is added at the beginning of the DTB partition data section for parsing by the BootLoader and Kernel during runtime.
[0008] As a further aspect of the present invention, the BootLoader and Kernel have an interface for parsing DTH information.
[0009] As a further aspect of the present invention, the DTH information includes the header information, signature, and end field of the DTH; The header information of DTH includes: field identifier, starting position, size, and verification information.
[0010] As a further aspect of the present invention, the firmware creation program includes DTH_HEADER, which is used to describe the composition structure of the encrypted DTB information.
[0011] As a further aspect of the present invention, the firmware creation program includes an FMH firmware program generation tool, which is used to merge BootLoader, Kernel, DTB, and OtherFS into a firmware image file containing FMH data format.
[0012] As a further aspect of the present invention, the main processing flow of the FMH firmware generation tool is as follows: Perform validity verification on the image file; Fill the FMH header information according to the contents of the image file; Generate the binary information of the partition corresponding to the image file; Repeat the above three steps to package multiple image files into a single firmware image file.
[0013] As a further aspect of the present invention, both the BootLoader and Kernel include a DTB information parsing module, which is used to provide necessary information for the BootLoader / Kernel runtime, and to obtain and construct the device tree.
[0014] Secondly, in another embodiment provided by the present invention, a terminal is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor loads and executes the computer program to implement the steps of device tree encryption / decryption and signature methods.
[0015] Thirdly, in another embodiment of the present invention, a storage medium is provided storing a computer program, which, when loaded and executed by a processor, implements the steps of the device tree encryption / decryption and signature method.
[0016] The technical solution provided by this invention has the following beneficial effects: This invention provides a device tree encryption / decryption and signing method, a terminal, and a storage medium. When creating the DTB partition firmware program, this invention uses a hybrid encryption algorithm combining symmetric and asymmetric encryption to encrypt the public key information of the firmware creation program. The private key of the firmware creation program is then used to encrypt the device tree information and calculate the signature information. This information is then filled into the starting address of the device tree partition DTB data in the form of a DTH (containing public key, signature, size, etc.). Simultaneously, parsing programs are added to the BootLoader and Kernel to parse and obtain the DTB information. By using a hybrid encryption algorithm combining symmetric and asymmetric encryption, the security of the DTB data is improved; by adding a DTB information signing mechanism, the integrity of the DTB data is ensured; and by using a backup mechanism, the reliability of the data is improved.
[0017] These or other aspects of the invention will become more apparent from the following description of embodiments. It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.
[0019] Figure 1 This is a flowchart of a device tree encryption / decryption and signature method according to an embodiment of the present invention; Figure 2 This is a firmware creation program generation process according to an embodiment of the present invention; Figure 3 This is the process of Bootloader / Kernel obtaining DTB information in the device tree encryption / decryption and signing method of one embodiment of the present invention; Figure 4 This is the DTB partition generation process of the FMH firmware program generation tool in the device tree encryption / decryption and signing method of one embodiment of the present invention; Figure 5 This is an example of the DTB partition parsing process of the FMH firmware program generation tool in the device tree encryption / decryption and signing method of an embodiment of the present invention; Figure 6 This is a structural diagram of a terminal according to an embodiment of the present invention; Figure 7 This diagram illustrates the current state of firmware generation using existing technologies.
[0020] In the diagram: Processor-401, Communication Interface-402, Memory-403, Communication Bus-404. Detailed Implementation
[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0022] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.
[0023] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0024] Specifically, the embodiments of the present invention will be further described below with reference to the accompanying drawings.
[0025] Please see Figure 1 , Figure 1 This is a flowchart of a device tree encryption / decryption and signature method provided in an embodiment of the present invention, such as... Figure 1 As shown, the device tree encryption / decryption and signature method includes steps S10 to S30.
[0026] S10. A firmware creation program that includes BootLoader, Kernel, RootFs and OtherFs; Specifically, a hybrid encryption algorithm combining symmetric and asymmetric encryption is used to encrypt the public key information of the firmware creation program.
[0027] In this embodiment of the invention, the firmware creation program refers to a complete program running on an ARM processor to ensure the system functions properly.
[0028] In this embodiment of the invention, the BootLoader is a bootloader that runs before the Kernel program and is used to boot the Kernel program. The BootLoader reads the firmware program from a specified partition of the FLASH into memory and then jumps to run the firmware program.
[0029] S20. The device tree information is encrypted using the private key of the firmware creation program, and the signature information is calculated. The public key information and the signature information are then filled into the starting address of the device tree partition DTB data in the form of DTH information.
[0030] S30, BootLoader, and Kernel parse the device tree information through a parsing program to obtain DTB information. Specifically, as follows... Figure 3 As shown.
[0031] Please see Figure 2 The firmware creation program includes creating a firmware image file.
[0032] Specifically, when creating the firmware image file, DTH information is added at the beginning of the DTB partition data section for parsing by the BootLoader and Kernel during runtime. This adds a device tree information processing mechanism.
[0033] In this embodiment of the invention, the BootLoader and Kernel have a DTH information parsing interface. When the BootLoader and Kernel are running, they parse and obtain the device tree information through this interface and send it to the relevant interface module for normal system operation.
[0034] In this embodiment of the invention, the DTH information includes the DTH header information, signature, and end field.
[0035] The header information of the DTH includes: field identifier, starting position, size, and checksum.
[0036] In this embodiment of the invention, the BootLoader and Kernel parse the device tree information through a parsing program to obtain DTB information, including: BootLoader / Kernel startup; Hardware initialization and automatic partition recognition; Determine whether DTB information has been obtained; if so, send the DTB information to the relevant interface. If not, partition the device tree; DTH_HEADER information identification, obtaining relevant field information; Key and DTB information acquisition; Verify the DTB signature information; After the DTB signature information is successfully verified, the device tree is constructed and the DTB information is passed to the relevant interfaces; DTB information retrieval complete.
[0037] In this embodiment of the invention, the firmware creation program includes a DTH_HEADER, which describes the structure of the encrypted DTB information; that is, it describes the organization of device tree encryption / decryption and signature-related parameter information, and is used by the BootLoader / Kernel to parse and construct the device tree. The table below describes the data format of the DTH described by the DTH_HEADER.
[0038] Table 1 DTH_HEADER Data Format
[0039] In this embodiment of the invention, the firmware creation program includes an FMH firmware generation tool, which is used to merge BootLoader, Kernel, DTB, and OtherFS into a single firmware image file containing FMH data format. The DTH identification interface is a device tree information acquisition interface added to the original BootLoader / Kernel program.
[0040] The main processing flow of the FMH firmware generation tool is as follows: Perform validity verification on the image file; Fill the FMH header information according to the contents of the image file; Generate the binary information of the partition corresponding to the image file; Repeat the above three steps to package multiple image files into a single firmware image file.
[0041] In embodiments of the present invention, the DTB partition information processing modules in the BootLoader and Kernel require the following special processing in addition to the above steps: The public key information of the FMH firmware packaging program is encrypted using a hybrid encryption algorithm that combines symmetric and asymmetric encryption. The DTB information is encrypted using the private key of the FMH firmware packaging program; Calculate the DTH header collation and generate signature information, then fill in the DTH header information; The above DTH information is packaged into the device tree partition data section of the FMH image file to complete the DTB partition data filling.
[0042] The detailed processing flow of device tree partition data packaging is as follows: Figure 4 As shown.
[0043] In embodiments of the present invention, both the BootLoader and Kernel include a DTB information parsing module. This module provides necessary information for the BootLoader / Kernel runtime, acquires and constructs the device tree, and its main processing flow is the reverse of the firmware packaging process. During the initial loading and running phase of the firmware image file, the DTB partition entry information is obtained by parsing the FMH image file. DTB information is obtained based on the DTH_HEADER, and the relevant information is decoded to obtain the original DTB information. The DTB information is backed up, and the BootLoader / Kernel DTB loading identifier is updated. During non-initial loading and running phases of the firmware image file, the backed-up DTB information is verified and sent to the relevant interface. The workflow of the DTB information parsing module is as follows: Figure 5 As shown.
[0044] This invention improves the security of DTB data by using a hybrid encryption algorithm that combines symmetric and asymmetric encryption; ensures the integrity of DTB data by adding a DTB information signature mechanism; and improves the reliability of data by using a backup mechanism.
[0045] It should be understood that although the above description follows a certain order, these steps are not necessarily executed in that order. Unless otherwise expressly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, some steps in this embodiment may include multiple steps or multiple stages, which are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be performed alternately or in turn with other steps or at least a portion of the steps or stages in other steps.
[0046] In one embodiment, see Figure 6 As shown, an embodiment of the present invention also provides a terminal, including a processor 401, a communication interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communication interface 402 and the memory 403 communicate with each other through the communication bus 404.
[0047] Memory 403 is used to store computer programs; Processor 401, when executing a computer program stored in memory 403, executes the device tree encryption / decryption and signature method described above. When executing instructions, the processor implements the steps in the above method embodiments: S10. A firmware creation program that includes BootLoader, Kernel, RootFs and OtherFs; Specifically, a hybrid encryption algorithm combining symmetric and asymmetric encryption is used to encrypt the public key information of the firmware creation program.
[0048] In this embodiment of the invention, the firmware creation program refers to a complete program running on an ARM processor to ensure the system functions properly.
[0049] In this embodiment of the invention, the BootLoader is a bootloader that runs before the Kernel program and is used to boot the Kernel program. The BootLoader reads the firmware program from a specified partition of the FLASH into memory and then jumps to run the firmware program.
[0050] S20. The device tree information is encrypted using the private key of the firmware creation program, and the signature information is calculated. The public key information and the signature information are then filled into the starting address of the device tree partition DTB data in the form of DTH information.
[0051] S30, BootLoader, and Kernel parse the device tree information through a parsing program to obtain DTB information. Specifically, as follows... Figure 3 As shown.
[0052] Please see Figure 2 The firmware creation program includes creating a firmware image file.
[0053] Specifically, when creating the firmware image file, DTH information is added at the beginning of the DTB partition data section for parsing by the BootLoader and Kernel during runtime. This adds a device tree information processing mechanism.
[0054] In this embodiment of the invention, the BootLoader and Kernel have a DTH information parsing interface. When the BootLoader and Kernel are running, they parse and obtain the device tree information through this interface and send it to the relevant interface module for normal system operation.
[0055] In this embodiment of the invention, the DTH information includes the DTH header information, signature, and end field.
[0056] The header information of the DTH includes: field identifier, starting position, size, and checksum.
[0057] In this embodiment of the invention, the BootLoader and Kernel parse the device tree information through a parsing program to obtain DTB information, including: BootLoader / Kernel startup; Hardware initialization and automatic partition recognition; Determine whether DTB information has been obtained; if so, send the DTB information to the relevant interface. If not, partition the device tree; DTH_HEADER information identification, obtaining relevant field information; Key and DTB information acquisition; Verify the DTB signature information; After the DTB signature information is successfully verified, the device tree is constructed and the DTB information is passed to the relevant interfaces; DTB information retrieval complete.
[0058] In this embodiment of the invention, the firmware creation program includes a DTH_HEADER, which describes the structure of the encrypted DTB information; that is, it describes the organization of device tree encryption / decryption and signature-related parameter information, and is used by the BootLoader / Kernel to parse and construct the device tree. The table below describes the data format of the DTH described by the DTH_HEADER.
[0059] Table 1 DTH_HEADER Data Format
[0060] In this embodiment of the invention, the firmware creation program includes an FMH firmware generation tool, which is used to merge BootLoader, Kernel, DTB, and OtherFS into a single firmware image file containing FMH data format. The DTH identification interface is a device tree information acquisition interface added to the original BootLoader / Kernel program.
[0061] The main processing flow of the FMH firmware generation tool is as follows: Perform validity verification on the image file; Fill the FMH header information according to the contents of the image file; Generate the binary information of the partition corresponding to the image file; Repeat the above three steps to package multiple image files into a single firmware image file.
[0062] In embodiments of the present invention, the DTB partition information processing modules in the BootLoader and Kernel require the following special processing in addition to the above steps: The public key information of the FMH firmware packaging program is encrypted using a hybrid encryption algorithm that combines symmetric and asymmetric encryption. The DTB information is encrypted using the private key of the FMH firmware packaging program; Calculate the DTH header collation and generate signature information, then fill in the DTH header information; The above DTH information is packaged into the device tree partition data section of the FMH image file to complete the DTB partition data filling.
[0063] The detailed processing flow of device tree partition data packaging is as follows: Figure 4 As shown.
[0064] In embodiments of the present invention, both the BootLoader and Kernel include a DTB information parsing module. This module provides necessary information for the BootLoader / Kernel runtime, acquires and constructs the device tree, and its main processing flow is the reverse of the firmware packaging process. During the initial loading and running phase of the firmware image file, the DTB partition entry information is obtained by parsing the FMH image file. DTB information is obtained based on the DTH_HEADER, and the relevant information is decoded to obtain the original DTB information. The DTB information is backed up, and the BootLoader / Kernel DTB loading identifier is updated. During non-initial loading and running phases of the firmware image file, the backed-up DTB information is verified and sent to the relevant interface. The workflow of the DTB information parsing module is as follows: Figure 5 As shown.
[0065] This invention improves the security of DTB data by using a hybrid encryption algorithm that combines symmetric and asymmetric encryption; ensures the integrity of DTB data by adding a DTB information signature mechanism; and improves the reliability of data by using a backup mechanism.
[0066] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.
[0067] The communication interface is used for communication between the aforementioned terminal and other devices.
[0068] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.
[0069] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0070] The terminal includes user equipment and network equipment. The user equipment includes, but is not limited to, computers, smartphones, and PDAs. The network equipment includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing, which is a type of distributed computing consisting of a super virtual computer composed of a group of loosely coupled computers. The terminal can operate independently to implement this invention, or it can connect to a network and interact with other terminals on the network to implement this invention. The network in which the terminal is located includes, but is not limited to, the Internet, wide area network (WAN), metropolitan area network (MAN), local area network (LAN), and VPN network.
[0071] The terminal includes user equipment and network equipment. The user equipment includes, but is not limited to, computers, smartphones, and PDAs. The network equipment includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing, which is a type of distributed computing consisting of a super virtual computer composed of a group of loosely coupled computers. The terminal can operate independently to implement this invention, or it can connect to a network and interact with other terminals on the network to implement this invention. The network in which the terminal is located includes, but is not limited to, the Internet, wide area network (WAN), metropolitan area network (MAN), local area network (LAN), and VPN network.
[0072] It should also be understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0073] In one embodiment of the present invention, a storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps in the above-described method embodiments: S10. A firmware creation program that includes BootLoader, Kernel, RootFs and OtherFs; Specifically, a hybrid encryption algorithm combining symmetric and asymmetric encryption is used to encrypt the public key information of the firmware creation program.
[0074] In this embodiment of the invention, the firmware creation program refers to a complete program running on an ARM processor to ensure the system functions properly.
[0075] In this embodiment of the invention, the BootLoader is a bootloader that runs before the Kernel program and is used to boot the Kernel program. The BootLoader reads the firmware program from a specified partition of the FLASH into memory and then jumps to run the firmware program.
[0076] S20. The device tree information is encrypted using the private key of the firmware creation program, and the signature information is calculated. The public key information and the signature information are then filled into the starting address of the device tree partition DTB data in the form of DTH information.
[0077] S30, BootLoader, and Kernel parse the device tree information through a parsing program to obtain DTB information. Specifically, as follows... Figure 3 As shown.
[0078] Please see Figure 2 The firmware creation program includes creating a firmware image file.
[0079] Specifically, when creating the firmware image file, DTH information is added at the beginning of the DTB partition data section for parsing by the BootLoader and Kernel during runtime. This adds a device tree information processing mechanism.
[0080] In this embodiment of the invention, the BootLoader and Kernel have a DTH information parsing interface. When the BootLoader and Kernel are running, they parse and obtain the device tree information through this interface and send it to the relevant interface module for normal system operation.
[0081] In this embodiment of the invention, the DTH information includes the DTH header information, signature, and end field.
[0082] The header information of the DTH includes: field identifier, starting position, size, and checksum.
[0083] In this embodiment of the invention, the BootLoader and Kernel parse the device tree information through a parsing program to obtain DTB information, including: BootLoader / Kernel startup; Hardware initialization and automatic partition recognition; Determine whether DTB information has been obtained; if so, send the DTB information to the relevant interface. If not, partition the device tree; DTH_HEADER information identification, obtaining relevant field information; Key and DTB information acquisition; Verify the DTB signature information; After the DTB signature information is successfully verified, the device tree is constructed and the DTB information is passed to the relevant interfaces; DTB information retrieval complete.
[0084] In this embodiment of the invention, the firmware creation program includes a DTH_HEADER, which describes the structure of the encrypted DTB information; that is, it describes the organization of device tree encryption / decryption and signature-related parameter information, and is used by the BootLoader / Kernel to parse and construct the device tree. The table below describes the data format of the DTH described by the DTH_HEADER.
[0085] Table 1 DTH_HEADER Data Format
[0086] In this embodiment of the invention, the firmware creation program includes an FMH firmware generation tool, which is used to merge BootLoader, Kernel, DTB, and OtherFS into a single firmware image file containing FMH data format. The DTH identification interface is a device tree information acquisition interface added to the original BootLoader / Kernel program.
[0087] The main processing flow of the FMH firmware generation tool is as follows: Perform validity verification on the image file; Fill the FMH header information according to the contents of the image file; Generate the binary information of the partition corresponding to the image file; Repeat the above three steps to package multiple image files into a single firmware image file.
[0088] In embodiments of the present invention, the DTB partition information processing modules in the BootLoader and Kernel require the following special processing in addition to the above steps: The public key information of the FMH firmware packaging program is encrypted using a hybrid encryption algorithm that combines symmetric and asymmetric encryption. The DTB information is encrypted using the private key of the FMH firmware packaging program; Calculate the DTH header collation and generate signature information, then fill in the DTH header information; The above DTH information is packaged into the device tree partition data section of the FMH image file to complete the DTB partition data filling.
[0089] The detailed processing flow of device tree partition data packaging is as follows: Figure 4 As shown.
[0090] In embodiments of the present invention, both the BootLoader and Kernel include a DTB information parsing module. This module provides necessary information for the BootLoader / Kernel runtime, acquires and constructs the device tree, and its main processing flow is the reverse of the firmware packaging process. During the initial loading and running phase of the firmware image file, the DTB partition entry information is obtained by parsing the FMH image file. DTB information is obtained based on the DTH_HEADER, and the relevant information is decoded to obtain the original DTB information. The DTB information is backed up, and the BootLoader / Kernel DTB loading identifier is updated. During non-initial loading and running phases of the firmware image file, the backed-up DTB information is verified and sent to the relevant interface. The workflow of the DTB information parsing module is as follows: Figure 5 As shown.
[0091] This invention improves the security of DTB data by using a hybrid encryption algorithm that combines symmetric and asymmetric encryption; ensures the integrity of DTB data by adding a DTB information signature mechanism; and improves the reliability of data by using a backup mechanism.
[0092] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Furthermore, any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory.
[0093] It should be understood that, as used herein, the singular form "a" is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and / or" refers to any and all possible combinations of one or more of the associatedly listed items. The embodiment numbers disclosed above are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0094] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of different aspects of the invention exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.
Claims
1. A device tree encryption / decryption and signature method, characterized in that, The method includes: Create a firmware creation program that includes BootLoader, Kernel, RootFs, and OtherFs; create a firmware creation program that includes BootLoader, Kernel, RootFs, and OtherFs, including: building DTB partitions, verifying DTB image files, creating and opening empty binary files, filling DTB partition FMH header information, updating BootLoader / Kernel DTB loading flags, filling DTB_HEADER flags to $DTHSIG$, filling DTH major version to 1, filling DTH minorversion to 0, filling DTH Partition number to 2, filling Partition Description string1 to "public key", and filling Encoded Key offset to 0; Specifically, a hybrid encryption algorithm combining symmetric and asymmetric encryption is used to encrypt the public key information of the firmware creation program; The device tree information is encrypted and a signature is calculated using the private key of the firmware creation program. The public key information and the signature information are then filled into the starting address of the device tree partition DTB data in the form of DTH information. The BootLoader and Kernel parse the device tree information through a parser to obtain DTB information.
2. The device tree encryption / decryption and signature method as described in claim 1, characterized in that, A firmware creation program, which includes creating firmware image files; When creating a firmware image file, DTH information is added at the beginning of the DTB partition data section for parsing by the BootLoader and Kernel during runtime.
3. The device tree encryption / decryption and signature method as described in claim 1, characterized in that, The BootLoader and Kernel have interfaces for parsing DTH information.
4. The device tree encryption / decryption and signature method as described in claim 1, characterized in that, The DTH information includes the DTH header, signature, and end field; The header information of DTH includes: field identifier, starting position, size, and verification information.
5. The device tree encryption / decryption and signature method as described in claim 1, characterized in that, The firmware creation program includes DTH_HEADER, which is used to describe the structure of the encrypted DTB information.
6. The device tree encryption / decryption and signature method as described in claim 1, characterized in that, The firmware creation program includes an FMH firmware generation tool, which is used to merge BootLoader, Kernel, DTB, and OtherFS into a firmware image file containing FMH data format.
7. The device tree encryption / decryption and signature method as described in claim 6, characterized in that, The main processing flow of the FMH firmware generation tool is as follows: Perform validity verification on the image file; Fill the FMH header information according to the contents of the image file; Generate the binary information of the partition corresponding to the image file; Repeat the above three steps to package multiple image files into a single firmware image file.
8. The device tree encryption / decryption and signature method as described in any one of claims 1-7, characterized in that, Both the BootLoader and Kernel include a DTB information parsing module, which is used to provide necessary information for the BootLoader / Kernel runtime, and to obtain and construct the device tree.
9. A terminal, comprising a memory and a processor, the memory storing a computer program, wherein the processor loads and executes the computer program to implement the steps of the device tree encryption / decryption and signature method as described in any one of claims 1-7.
10. A storage medium storing a computer program, which, when loaded and executed by a processor, implements the steps of the device tree encryption / decryption and signature method as described in any one of claims 1-7.