A chip secure startup method and device

Abstract

The present invention discloses a chip secure boot method and device, comprising: a security chip controller booting a BOOT program, successfully verifying security data in a security data storage area, and then successfully performing integrity and legitimacy verification on the BOOT program in the BOOT program storage area. The security chip controller then determines whether a COS program download password in a COS program storage area is correct. If so, the security chip controller downloads the COS program, clears the COS program download password, and resets the security chip. If not, the security chip controller verifies the integrity and legitimacy of the COS program in the COS program storage area. If the verification is successful, the security chip controller boots the COS program; if the verification fails, the security chip controller sets an error state. The present invention ensures chip boot security, thereby protecting hardware security, and ensures that the chip can execute legal updates and download COS programs.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method and device for securely starting a chip. Background Art

[0002] Security chips are the hardware cornerstone of information security. In existing technologies, the integrity of the boot program is usually verified during the startup process of the security chip. However, simply verifying the integrity of the boot program cannot ensure the security of the security chip, and there are security risks during the startup process of the security chip. In addition, allowing the security chip's COS program to be updated and downloaded multiple times without restrictions also poses security risks. Summary of the Invention

[0003] The present invention provides a method and a device to solve the above technical problems.

[0004] The present invention provides a chip secure startup method, the method comprising:

[0005] Step 1: After the security chip is powered on, the controller of the security chip starts the BOOT program;

[0006] Step 2: The controller of the security chip verifies the security data in the security data storage area and determines whether the verification is successful. If yes, execute step 3; if not, execute step 7;

[0007] Step 3: The controller of the security chip performs an integrity check on the BOOT program in the BOOT program storage area to determine whether the check result is successful. If yes, execute step 4; if not, execute step 7.

[0008] Step 4: The controller of the security chip performs a validity check on the BOOT program based on the security data to determine whether the verification result is successful. If so, execute step 5; if not, execute step 7.

[0009] Step 5: The controller of the security chip determines whether the COS program download password in the COS program storage area is correct. If so, the controller of the security chip downloads the COS program, clears the COS program download password, and controls the security chip to reset. If not, the controller of the security chip verifies the integrity of the COS program in the COS program storage area and determines whether the verification result is successful. If so, execute step 6; if not, execute step 7.

[0010] Step 6: The controller of the security chip performs a validity check on the COS program based on the security data to determine whether the verification result is successful. If so, the controller of the security chip boots the COS program; if not, proceed to step 7;

[0011] Step 7: The controller of the security chip sets an error state.

[0012] The present invention provides a device for securely starting a chip, the device comprising:

[0013] Power-on module, used to power on the security chip;

[0014] The startup module is used to start the BOOT program of the controller of the security chip after the power module is powered on;

[0015] A first verification module, configured for the controller of the security chip to verify the security data in the security data storage area;

[0016] A first judgment module is used to judge the verification result of the first verification module, and when the judgment result of the first judgment module is yes, trigger the second verification module; when the judgment result of the first judgment module is no, trigger the setting status module;

[0017] A second verification module, configured for the controller of the security chip to perform integrity verification on the BOOT program in the BOOT program storage area;

[0018] A second judgment module is used to judge the verification result of the second verification module, trigger the third verification module when the judgment result of the second judgment module is yes, and trigger the setting status module when the judgment result of the second judgment module is no;

[0019] A third verification module, used for the controller of the security chip to perform a legitimacy check on the BOOT program according to the security data;

[0020] a third judgment module, configured to judge the verification result of the third verification module, and trigger the fourth judgment module when the judgment result of the third judgment module is yes, and trigger the setting status module when the judgment result of the third judgment module is no;

[0021] a fourth judgment module, used for the controller of the security chip to judge whether the COS program download password in the COS program storage area is correct, and when the judgment result of the fourth judgment module is yes, triggering the download clear reset module; when the judgment result of the fourth judgment module is no, triggering the fourth verification module;

[0022] Download, clear and reset module, used for the controller of the security chip to download COS program, clear the COS program download password, and control the reset of the security chip;

[0023] A fourth verification module, used by the controller of the security chip to verify the integrity of the COS program in the COS program storage area;

[0024] a fifth judgment module, configured to judge the verification result of the fourth verification module, trigger the fifth verification module when the judgment result of the fifth judgment module is yes, and trigger the state setting module when the judgment result of the fifth judgment module is no;

[0025] A fifth verification module, configured for the controller of the security chip to perform a validity verification on the COS program based on the security data;

[0026] a sixth judgment module, configured to judge the verification result of the fifth verification module, and trigger the guidance module when the judgment result of the sixth judgment module is yes, and trigger the setting state module when the judgment result of the sixth judgment module is no;

[0027] Boot module, used for the controller of the security chip to boot the COS program;

[0028] The status setting module is used to set the error status of the controller of the safety chip.

[0029] The present invention also provides a computer-readable storage medium, comprising a computer program, which, when executed on a computer, enables the computer to execute the above-mentioned chip secure startup method.

[0030] The present invention also provides a security chip, which is coupled to a memory and is used to execute a computer program stored in the memory to perform the above chip security startup method.

[0031] Beneficial effects of the present invention: The present invention provides a method and device for secure chip startup, which ensures the security of chip startup, thereby protecting the security of hardware and ensuring that the chip executes legal updates and downloads COS programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of a chip secure boot method provided in the first embodiment of the present invention;

[0033] Figure 2 and Figure 3 A flowchart of a chip secure boot method provided in the second embodiment of the present invention;

[0034] Figure 4 This is a flowchart of another implementation method in which a controller of a security chip waits to receive an instruction from a host computer and then executes the instruction in a chip secure boot method provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0036] Example 1

[0037] This embodiment provides a chip secure startup method, such as Figure 1 As shown, the following steps are included:

[0038] Step 1: After the security chip is powered on, the controller of the security chip starts the BOOT program;

[0039] Step 2: The controller of the security chip verifies the security data in the secure data storage area and determines whether the verification is successful. If so, execute step 3; if not, execute step 7.

[0040] Step 3: The controller of the security chip performs an integrity check on the BOOT program in the BOOT program storage area to determine whether the check result is successful. If yes, execute step 4; if not, execute step 7.

[0041] Step 4: The controller of the security chip performs a validity check on the BOOT program based on the security data to determine whether the verification result is successful. If so, execute step 5; if not, execute step 7.

[0042] Step 5: The controller of the security chip determines whether the COS program download password in the COS program storage area is correct. If so, the controller of the security chip downloads the COS program, clears the COS program download password, and controls the security chip to reset. If not, the controller of the security chip verifies the integrity of the COS program in the COS program storage area and determines whether the verification result is successful. If so, execute step 6; if not, execute step 7.

[0043] Step 6: The controller of the security chip performs a validity check on the COS program based on the security data to determine whether the verification result is successful. If so, the controller of the security chip boots the COS program; if not, proceed to step 7;

[0044] Step 7: The controller of the security chip sets an error state.

[0045] In one possible implementation, step 3 specifically includes: the controller of the security chip controls the first computing module of the security chip to perform computing on the data of the BOOT program in the BOOT program storage area according to the first algorithm to obtain a second computing result, and determining whether the second computing result is the same as the hash value of the BOOT program in the security data. If so, the verification result is successful, and step 4 is executed; if not, the verification result is failed, and step 7 is executed;

[0046] Step 4 is specifically as follows: the controller of the security chip controls the second computing module of the security chip to use the second algorithm to perform a signature verification operation based on the second computing result, the BOOT program public key in the security data, and the BOOT program signature value, and determines whether the signature verification result is successful. If so, execute step 5; if not, execute step 7;

[0047] In step 5, the controller of the security chip verifies the integrity of the COS program and determines whether the verification is successful. If so, step 6 is executed. If not, step 7 is executed. Specifically:

[0048] The controller of the security chip controls the first operation module of the security chip to operate the COS program data in the COS program storage area according to the first algorithm to obtain a third operation result, and determines whether the third operation result is the same as the COS program hash value in the security data. If so, execute step 6; if not, execute step 7;

[0049] Step 6 is specifically as follows: the controller of the security chip controls the second operation module of the security chip to use the second algorithm to perform a signature verification operation based on the third operation result, the COS program public key in the security data, and the COS program signature value, and determines whether the signature verification result is successful. If so, the controller of the security chip boots the COS program; if not, executes step 7.

[0050] In one possible implementation, in step 5, the controller of the security chip downloads the COS program, clears the COS program download password, and controls the security chip reset, specifically including:

[0051] Step m1: The controller of the security chip waits to receive instructions sent by the host computer;

[0052] Step m2: The controller of the security chip determines the type of instruction received. If the instruction received is a COS program write instruction, step m3 is executed; if the instruction received is a COS program download password clear instruction, step m4 is executed; if the instruction received is a reset instruction, step m5 is executed;

[0053] Step m3, the controller of the security chip writes the COS program into the COS storage area according to the address in the COS program write instruction and the COS program data, and returns to step m1;

[0054] Step m4: The controller of the security chip clears the COS program download password in the preset location in the flash memory of the security chip, and returns to step m1;

[0055] In step m5, the controller of the security chip resets the security chip.

[0056] In a possible implementation, step m2 further includes: when the received instruction is an instruction to download the COS program public key, executing step m6;

[0057] In step m6, the controller of the security chip determines whether the COS program public key is stored in a predetermined location of the BOOT storage area of ​​the flash memory. If yes, the controller of the security chip reports an error and returns to step m1; if not, executes step m7;

[0058] In step m7, the controller of the security chip writes the COS program public key in the instruction to download the COS program public key into a predetermined location in the BOOT storage area, and returns to step m1.

[0059] In a possible implementation, before step 1, the method further includes:

[0060] Step 01: The controller of the security chip starts the temperature and voltage detection module;

[0061] The method further includes: when the temperature and voltage detection module determines that the temperature or voltage is abnormal, resetting the safety chip.

[0062] In a possible implementation, step m2 further includes:

[0063] When the instruction is an erase instruction, execute step m8;

[0064] When the instruction is a COS program hash value write instruction, execute step m9;

[0065] When the instruction is a COS program signature value writing instruction, execute step m10;

[0066] Step m8, the controller of the security chip erases the COS program in the COS storage area, the COS program hash value and the COS program signature value in the secure data storage area, and returns to step m1;

[0067] Step m9: The controller of the security chip writes the COS program hash value into the secure data storage area and returns to step m1;

[0068] In step m10, the controller of the security chip writes the COS program signature value into the secure data storage area and returns to step m1.

[0069] In a possible implementation, step 2, step 3, step 4, and step 6 are key steps, and the security data further includes preset key step execution sequence number check values ​​corresponding to each key step;

[0070] At least one key step is preceded by the following steps:

[0071] The controller of the security chip determines whether the current key step execution sequence number value is the same as the key step execution sequence number check value corresponding to the key step to be executed. If so, the key step to be executed is executed; if not, step 7 is executed.

[0072] In a possible implementation, the security data also includes an initial value of a key step execution sequence number;

[0073] After step 1, the method further includes: the controller of the security chip updates the initial value of the key step execution sequence number according to a predetermined rule to obtain the current key step execution sequence number value;

[0074] After the current key step is executed, the method further includes: after determining that the execution result of the current key step is successful, the controller of the security chip updates the execution sequence value of the current key step according to a predetermined rule as the execution sequence value of the current key step.

[0075] In a possible implementation, after executing the current key step, the method further includes: after determining that the execution result of the current key step is failure, the controller of the security chip sets the error state to a verification error value.

[0076] Example 2

[0077] This embodiment provides a chip secure startup method, such as Figure 2 and Figure 3 As shown, the following steps are included:

[0078] Step 201: Initialize the security chip after powering on;

[0079] Step 202: The controller of the security chip starts the BOOT program;

[0080] In this embodiment, before step 202, the following steps may also be included: the security chip controller starts the temperature and voltage detection module;

[0081] The method further includes: when the temperature and voltage detection module determines that the temperature and voltage are abnormal, resetting the safety chip and returning to step 201.

[0082] Step 203: The controller of the security chip reads the security data and the security data CRC check value in the flash memory, and verifies the security data according to the security data CRC check value to determine whether the verification result is successful. If so, step 204 is executed; if not, step 210 is executed.

[0083] In this embodiment, the flash memory includes a BOOT program storage area, a COS program storage area, and a secure data storage area, and the secure data and the security data CRC check value are stored in the secure data storage area.

[0084] In this embodiment, the security data includes the BOOT program public key, the BOOT program signature value, the BOOT program hash value, the COS program public key, the COS program signature value, the COS program hash value, and a preset COS program download verification code.

[0085] In this embodiment, the security data is set with access permissions, specifically:

[0086] The COS program does not have read or write permissions for security data;

[0087] The BOOT program has no read or write permissions for the BOOT program public key, BOOT program signature value, BOOT program hash value, and preset COS program download verification code in the security data, but has read and write permissions for the COS program public key, COS program signature value, and COS program hash value in the security data. The BOOT program has only one-time write permission for the COS program public key.

[0088] This step specifically includes: the controller of the security chip reads the security data and the security data CRC check value in the flash memory, performs a calculation on the security data according to the CRC algorithm to obtain a first calculation result, and determines whether the first calculation result is the same as the security data CRC check value. If so, the verification result is successful and step 204 is executed; if not, the verification result is failed and step 210 is executed;

[0089] In this embodiment, security data, security data CRC check value, BOOT program data and COS program data can be stored in ciphertext form. When operations are performed on security data, security data CRC check value, BOOT program data and COS program data, the controller of the security chip calls the chip's encryption and decryption module to use a preset encryption and decryption key to decrypt the data stored in ciphertext form before performing corresponding operations.

[0090] For example, in this step, the security data and the security data CRC check value may be a security data ciphertext and a security data CRC check value ciphertext, and the controller of the security chip reads the security data and the security data CRC check value in the flash memory, specifically including: the controller of the security chip reads the security data ciphertext and the security data CRC check value ciphertext in the flash memory, and calls the chip's encryption and decryption module to use a preset encryption and decryption key to decrypt the security data ciphertext and the security data CRC check value ciphertext to obtain the security data and the security data CRC check value.

[0091] Step 204: The controller of the security chip performs an integrity check on the BOOT program to determine whether the check result is successful. If so, step 205 is executed; if not, step 210 is executed.

[0092] This step is specifically as follows: the controller of the security chip controls the SM3 operation module of the security chip to operate the data of the BOOT program in the BOOT program storage area according to the SM3 algorithm to obtain a second operation result, and determines whether the second operation result is the same as the BOOT program hash value in the security data. If so, the verification result is successful and step 205 is executed; if not, the verification result is failed and step 210 is executed.

[0093] Step 205: The controller of the security chip performs a signature verification operation based on the BOOT program signature value in the security data to determine whether the signature verification result is successful. If so, step 206 is executed; if not, step 210 is executed.

[0094] This step specifically includes: the controller of the security chip controls the SM2 operation module of the security chip to use the SM2 algorithm to perform a signature verification operation based on the BOOT program public key in the security data, the second operation result, and the BOOT program signature value, and determines whether the signature verification result is successful. If so, execute step 206; if not, execute step 210;

[0095] Step 206: The controller of the security chip determines whether the COS program download password is correct. If so, step 211 is executed; if not, step 207 is executed.

[0096] The COS program download password in this step is the value of the preset position of the COS program storage area in the chip flash memory. This step is specifically as follows: the controller of the security chip reads the value of the preset position of the COS program storage area in the chip flash memory, and determines whether the read value is the same as the COS program download verification code preset in the secure data storage area. If so, execute step 211; if not, execute step 207; wherein, the preset COS program download verification code is written into the preset position of the secure data storage area in the chip flash memory when the chip leaves the factory.

[0097] In this embodiment, step 206 is specifically as follows: the controller of the security chip determines whether the COS program download password is correct, if so, executing step 206 ', if not, executing step 207;

[0098] In step 206 ′, the controller of the security chip determines again whether the COS program download password is correct. If so, step 211 is executed; if not, step 207 is executed.

[0099] In this embodiment, by determining twice whether the COS program download password is correct, the security chip can terminate its operation when it is attacked illegally during startup, thereby ensuring the security of the startup process of the security chip.

[0100] Step 207: The controller of the security chip verifies the integrity of the COS program and determines whether the verification is successful. If so, step 208 is executed; if not, step 210 is executed.

[0101] This step is specifically as follows: the controller of the security chip controls the SM3 operation module of the security chip to operate the data of the COS program according to the SM3 algorithm to obtain a third operation result, and determines whether the third operation result is the same as the COS program hash value in the security data. If so, execute step 208; if not, execute step 210.

[0102] In step 208 , the controller of the security chip performs a signature verification operation based on the COS program signature value in the security data to determine whether the signature verification result is successful. If so, step 209 is executed; if not, step 210 is executed.

[0103] This step specifically includes: the controller of the security chip controls the SM2 operation module of the security chip to use the SM2 algorithm to perform a signature verification operation based on the third operation result, the COS program public key in the security data, and the COS program signature value, and determines whether the signature verification result is successful. If so, execute step 209; if not, execute step 210;

[0104] Step 209: The controller of the security chip boots the COS program, and the process ends.

[0105] Step 210: The controller of the security chip controls the security chip to be in an error state;

[0106] Step 211: The controller of the security chip waits to receive instructions from the host computer;

[0107] In step 212, the controller of the security chip receives the instruction sent by the host computer and determines the type of instruction. When the instruction is an instruction to download the COS program public key, execute step 213; when the instruction is an erase instruction, execute step 217; when the instruction is an instruction to write the COS program, execute step 219; when the instruction is an instruction to write the COS program hash value, execute step 221; when the instruction is an instruction to write the COS program signature value, execute step 223; when the instruction is an instruction to verify the COS program, execute step 225; when the instruction is to clear the COS program download password, execute step 228; when the instruction is a reset instruction, execute step 230; when the instruction is an instruction to obtain the chip status, execute step 232.

[0108] Step 213: The controller of the security chip determines the current state of the security chip. If the current state is an error state, step 214 is executed; if the current state is a correct state, step 215 is executed.

[0109] Step 214: The controller of the security chip returns a response to the host computer, refusing to execute the instruction, and then returns to step 211;

[0110] Step 215: The controller of the security chip determines whether the COS public key is stored in the predetermined location of the BOOT storage area. If yes, the controller of the security chip reports an error and returns to step 211. If no, the process proceeds to step 216.

[0111] Step 216: The controller of the security chip writes the COS program public key in the COS program public key download instruction to a predetermined location in the secure data storage area, and then returns to step 211.

[0112] Step 217: The controller of the security chip determines the current state of the security chip. When the current state is a correct state, step 218 is executed. When the current state is an error state, step 214 is executed.

[0113] Step 218: The controller of the security chip erases the COS program in the COS storage area, the COS program hash value and the COS program signature value in the secure data storage area, and returns to step 211.

[0114] Step 219: The controller of the security chip determines the current state of the security chip. When the current state is a correct state, step 220 is executed. When the current state is an error state, step 214 is executed.

[0115] Step 220: The controller of the security chip writes the COS program into the COS storage area according to the address in the COS program write instruction and the COS program data, and then returns to step 211.

[0116] Step 221: The controller of the security chip determines the current state of the security chip. When the current state is a correct state, step 222 is executed. When the current state is an error state, step 214 is executed.

[0117] Step 222: The controller of the security chip writes the COS program hash value into the secure data storage area, and then returns to step 211.

[0118] Step 223: The controller of the security chip determines the current state of the security chip. When the current state is a correct state, step 224 is executed; when the current state is an error state, step 214 is executed.

[0119] Step 224: The controller of the security chip writes the COS program signature value into the secure data storage area, and then returns to step 211.

[0120] Step 225: The controller of the security chip determines the current state of the security chip. When the current state is a correct state, step 226 is executed. When the current state is an error state, step 214 is executed.

[0121] In step 226, the controller of the security chip reads the COS program in the COS storage area, verifies the integrity of the COS program, and determines whether the verification is successful. If so, step 227 is executed. If not, the controller of the security chip sends a response to the host computer indicating that the verification of the COS program has failed, and the process returns to step 211.

[0122] Step 227: The controller of the security chip sends a response to the host computer that the COS verification is successful, and the process returns to step 211.

[0123] Step 228: The controller of the security chip determines the current state of the security chip. When the current state is a correct state, step 229 is executed. When the current state is an error state, step 214 is executed.

[0124] Step 229 , the controller of the security chip clears the COS program download password in the predetermined location of the COS program area of ​​the chip flash memory, and returns to step 211 ;

[0125] Step 230: The controller of the security chip determines the current state of the security chip. When the current state is a correct state, step 231 is executed. When the current state is an error state, step 214 is executed.

[0126] Step 231: The controller of the security chip resets the security chip and executes step 201;

[0127] In step 232 , the controller of the security chip determines the current state of the security chip, returns a response of the current state of the security chip to the host computer, and then returns to step 211 .

[0128] In this embodiment, if Figure 4 As shown, steps 212 to 232 may also be replaced by steps N212 to N223:

[0129] Step N212: The controller of the security chip receives the instruction sent by the host computer;

[0130] In step N213, the controller of the security chip determines the current state of the security chip. If it is an error state, it determines the type of instruction. When the instruction is an instruction to obtain chip status, it executes step 214. When the instruction is not an instruction to obtain chip status, it executes step 215. If it is a correct state, it determines the type of instruction. When the instruction is an instruction to download the COS program public key, it executes step N216. When the instruction is an erase instruction, it executes step N218. When the instruction is an instruction to write the COS program, it executes step N219. When the instruction is an instruction to write the COS program hash value, it executes step N220. When the instruction is an instruction to write the COS program signature value, it executes step N221. When the instruction is an instruction to verify the COS program, it executes step N222. When the instruction is to clear the COS program download password, it executes step N224. When the instruction is a reset instruction, it executes step N225. When the instruction is an instruction to obtain chip status, it executes step N226.

[0131] In step N216, the controller of the security chip determines whether the COS public key is stored in the predetermined location of the BOOT storage area. If yes, step N217 is executed. If not, the controller of the security chip reports an error and returns to step 211.

[0132] In step N218, the controller of the security chip erases the COS program in the COS storage area, the COS program hash value and the COS program signature value in the secure data storage area, and returns to step 211;

[0133] Step N219, the controller of the security chip writes the COS program into the COS storage area according to the address in the COS program write instruction and the COS program data, and then returns to step 211;

[0134] Step N220 , the controller of the security chip writes the COS program hash value into the secure data storage area, and returns to step 211 ;

[0135] Step N221: The controller of the security chip writes the COS program signature value into the secure data storage area, and then returns to step 211.

[0136] In step N222, the controller of the security chip reads the COS program in the COS storage area, verifies the integrity of the COS program, and determines whether the verification is successful. If so, step 223 is executed. If not, the controller of the security chip sends a response to the host computer indicating that the verification of the COS program has failed, and the process returns to step 211.

[0137] In step N223, the controller of the security chip sends a response to the host computer that the COS verification is successful, and the process returns to step 211.

[0138] In step N224, the controller of the security chip clears the COS program download password in the predetermined location of the COS program area of ​​the chip flash memory, and returns to step 211;

[0139] In step N225, the controller of the security chip resets the security chip and executes step 201;

[0140] In step N226 , the controller of the security chip determines the current state of the security chip, returns a response of the current state of the security chip to the host computer, and then returns to step 211 .

[0141] In this embodiment, step 203, step 204, step 205, step 208, and step 209 are key steps, and the security data also includes the initial value of the key step execution sequence number and the current key step execution sequence number check value corresponding to each current key step;

[0142] After step 202, the method may further include: the controller of the security chip updates the initial value of the key step execution sequence number according to a predetermined rule to obtain the current key step execution sequence number value.

[0143] Before each key step, or before at least one key step, perform the following steps:

[0144] The controller of the security chip determines whether the current key step execution sequence number value is the same as the preset current key step execution sequence number check value. If so, the current key step is executed. If not, the controller of the security chip sets the error status flag to the attack error value and executes step 211.

[0145] After the key steps are successfully executed, the following steps are also included:

[0146] The controller of the security chip updates the current key step execution sequence number check value according to a predetermined rule and uses the obtained value as the current key step execution sequence number check value.

[0147] After the execution result of each key step is failure, each key step further includes: the controller of the security chip sets the error state flag to a verification error value, and then executes step 211.

[0148] In this embodiment, the predetermined rule may be performing an increment operation or a decrement operation according to a predetermined value.

[0149] For example, in this embodiment, the initial value of the key step execution sequence number is 0, the predetermined value is 1, and the predetermined rule is to perform an increment operation based on the predetermined value 1;

[0150] Key steps:

[0151] The current key step execution sequence number check value corresponding to step 203 is 1;

[0152] The current key step execution sequence number check value corresponding to step 204 is 2;

[0153] The current key step execution sequence number check value corresponding to step 205 is 3;

[0154] The current key step execution sequence number check value corresponding to step 208 is 4;

[0155] The current key step execution sequence number check value corresponding to step 209 is 5;

[0156] After step 202, the following steps may be further included: the controller of the security chip performs a sequential addition operation on the initial value 0 of the key step execution sequence number according to the predetermined value 1 to obtain a current key step execution sequence number value 1;

[0157] Before step 203, the process further includes: the controller of the security chip determines whether the current key step execution sequence number value is the same as the preset current key step execution sequence number check value 1; if so, executing step 203; if not, the controller of the security chip sets the error state flag to the attack error value, and executing step 211;

[0158] If the execution result of step 203 is successful, the following steps are further included:

[0159] The controller of the security chip adds the current key step execution sequence number value 1 to the current key step execution sequence number value 1 according to the predetermined value 1, and obtains the value 2 as the current key step execution sequence number value;

[0160] Before step 204, the following steps are also included:

[0161] The controller of the security chip determines whether the current key step execution sequence number value is the same as the preset current key step execution sequence number check value 2. If so, step 204 is executed. If not, the controller of the security chip sets the error state flag to the check error value and executes step 211.

[0162] If the execution result of step 204 is successful, the following steps are further included:

[0163] The controller of the security chip adds the current key step execution sequence number value 2 to the current key step execution sequence number value 1 according to the predetermined value 1 to obtain a value 3 as the current key step execution sequence number verification value;

[0164] Similarly, steps 205, 208 and 209 are executed and will not be repeated here.

[0165] In this embodiment, in step 232 , the response of the current state of the security chip is specifically: the response of the current state of the chip is an attack error value or a verification error value.

[0166] In this embodiment, by checking the sequence value of the current key step, the security chip can terminate the operation when it is attacked illegally during the startup process, thereby ensuring the security of the startup process of the security chip.

[0167] Example 3

[0168] This embodiment provides a device for securely booting a chip, including:

[0169] Power-on module, used to power on the security chip;

[0170] The startup module is used to start the BOOT program of the controller of the security chip after the power module is powered on;

[0171] A first verification module, configured for the controller of the security chip to verify the security data in the security data storage area;

[0172] A first judgment module is used to judge the verification result of the first verification module, and when the judgment result of the first judgment module is yes, trigger the second verification module; when the judgment result of the first judgment module is no, trigger the setting status module;

[0173] A second verification module, configured for the controller of the security chip to perform integrity verification on the BOOT program in the BOOT program storage area;

[0174] A second judgment module is used to judge the verification result of the second verification module, trigger the third verification module when the judgment result of the second judgment module is yes, and trigger the setting status module when the judgment result of the second judgment module is no;

[0175] A third verification module, configured to cause the controller of the security chip to perform a validity verification on the BOOT program according to the security data;

[0176] a third judgment module, configured to judge the verification result of the third verification module, and trigger the fourth judgment module when the judgment result of the third judgment module is yes, and trigger the setting status module when the judgment result of the third judgment module is no;

[0177] a fourth judgment module, used for the controller of the security chip to judge whether the COS program download password in the COS program storage area is correct, and when the judgment result of the fourth judgment module is yes, triggering the download clear reset module; when the judgment result of the fourth judgment module is no, triggering the fourth verification module;

[0178] Download clear reset module, used for the controller of the security chip to download the COS program, clear the COS program download password, and control the reset of the security chip;

[0179] A fourth verification module, used by the controller of the security chip to verify the integrity of the COS program in the COS program storage area;

[0180] a fifth judgment module, configured to judge the verification result of the fourth verification module, trigger the fifth verification module when the judgment result of the fifth judgment module is yes, and trigger the state setting module when the judgment result of the fifth judgment module is no;

[0181] a fifth verification module, configured for the controller of the security chip to perform a validity verification on the COS program according to the security data;

[0182] a sixth judgment module, configured to judge the verification result of the fifth verification module, and trigger the guidance module when the judgment result of the sixth judgment module is yes, and trigger the setting state module when the judgment result of the sixth judgment module is no;

[0183] Boot module, used for the controller of the security chip to boot the COS program;

[0184] The status setting module is used to set the error status of the controller of the safety chip.

[0185] In one possible implementation, the second verification module is specifically configured to control the controller of the security chip to control the first computing module of the security chip to perform computing on the data of the BOOT program in the BOOT program storage area according to the first algorithm to obtain a second computing result, and to determine whether the second computing result is identical to the hash value of the BOOT program in the security data to obtain a verification result;

[0186] A third verification module, specifically configured to control the controller of the security chip to control the second operation module of the security chip to use the second algorithm to perform a signature verification operation based on the second operation result, the BOOT program public key and the BOOT program signature value in the security data, and determine whether the signature verification result is successful;

[0187] a fourth verification module, specifically configured to control the controller of the security chip to control the first operation module of the security chip to perform an operation on the COS program data in the COS program storage area according to the first algorithm to obtain a third operation result, and determine whether the third operation result is identical to the COS program hash value in the security data to obtain a verification result;

[0188] The fifth verification module is specifically used by the controller of the security chip to control the second operation module of the security chip to use the second algorithm to perform a signature verification operation based on the third operation result, the COS program public key and the COS program signature value in the security data to obtain a verification result.

[0189] In a possible implementation, downloading the clearing and resetting module specifically includes:

[0190] Waiting receiving unit, the controller of the security chip waits to receive the instruction sent by the host computer;

[0191] The judgment execution unit is used to judge the type of instruction received by the waiting receiving unit. When the instruction received is a COS program write instruction, the controller of the security chip writes the COS program into the COS storage area according to the address in the COS program write instruction and the data of the COS program, thereby triggering the waiting receiving unit. When the instruction received is a COS program download password clear instruction, the controller of the security chip clears the COS program download password at a preset position in the flash memory of the security chip, thereby triggering the waiting receiving unit. When the instruction received is a reset instruction, the controller of the security chip resets the security chip.

[0192] In one possible embodiment, the judgment execution unit is also used to, when the instruction received is a COS program public key download instruction, the controller of the security chip determines whether the COS program public key is stored in the predetermined location of the BOOT storage area of ​​the flash memory. If so, the controller of the security chip reports an error and triggers the waiting receiving unit; if not, the controller of the security chip writes the COS program public key in the COS program public key download instruction into the predetermined location of the BOOT storage area and returns to waiting to receive instructions sent by the host computer.

[0193] In a possible implementation, the startup module is further used for the controller of the security chip to start the temperature and voltage detection module, wherein when the temperature and voltage detection module determines that the temperature or voltage is abnormal, the reset module is also used to reset the security chip.

[0194] In one possible implementation, the determination execution unit is further configured to, when the instruction is an erase instruction, cause the controller of the security chip to erase the COS program in the COS storage area, the COS program hash value, and the COS program signature value in the secure data storage area, thereby triggering the waiting receiving unit;

[0195] When the instruction is a COS program hash value write instruction, the controller of the security chip writes the COS program hash value into the secure data storage area, triggering the waiting receiving unit;

[0196] When the instruction is a COS program signature value writing instruction, the controller of the security chip writes the COS program signature value into the secure data storage area, triggering the waiting receiving unit.

[0197] In a possible implementation, the first verification module, the second verification module,

[0198] The third verification module and the fourth verification module are key modules, and the security data also includes preset key module execution sequence number verification values ​​corresponding to each key module;

[0199] The chip security startup device also includes a seventh judgment module, which is used to determine whether the current key step execution sequence number value is the same as the key step execution sequence number check value corresponding to the key step to be executed before at least one key module is executed. If so, the current key module is triggered; if not, the setting status module is triggered.

[0200] In one possible implementation, the security data further includes an initial value of the key step execution sequence number; the chip secure boot device further includes an update module configured to enable the controller of the security chip to update the initial value of the key step execution sequence number according to a predetermined rule to obtain a current key step execution sequence number value after the boot module executes an operation;

[0201] It is also used for the controller of the security chip to use the current key step execution sequence number value as the current key step execution sequence number value after the operation of the key module to be executed is successfully executed according to the predetermined rule.

[0202] In a possible implementation, after the operation of the key module to be executed fails, the state setting module is triggered, and the state setting module is specifically configured to set the error state to a verification error value.

[0203] In a possible implementation, the state setting module is triggered to specifically set the error state to an attack error value.

[0204] This embodiment further provides a computer-readable storage medium, comprising a computer program. When the computer program is run on a computer, the computer is caused to execute the above chip secure boot method.

[0205] This embodiment further provides a security chip, which is coupled to a memory and is used to execute a computer program stored in the memory to perform the above chip secure boot method.

[0206] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A chip secure boot method, characterized in that: The method comprises: Step 1: After the security chip is powered on, the controller of the security chip starts the BOOT program; Step 2: The controller of the security chip verifies the security data in the security data storage area and determines whether the verification is successful. If so, execute step 3; if not, execute step 7; Step 3, the controller of the security chip performs an integrity check on the BOOT program in the BOOT program storage area to determine whether the check result is successful. If yes, execute step 4; if not, execute step 7; Step 4: The controller of the security chip performs a validity check on the BOOT program according to the security data, and determines whether the verification result is successful. If yes, execute step 5; if not, execute step 7; Step 5: The controller of the security chip determines whether the COS program download password in the COS program storage area is correct. If so, it determines again whether the COS program download password is correct. If both determinations are correct, the controller of the security chip downloads the COS program, clears the COS program download password, and resets the security chip. Otherwise, the controller of the security chip verifies the integrity of the COS program in the COS program storage area and determines whether the verification result is successful. If so, it executes step 6; if not, it executes step 7. Step 6: The controller of the security chip performs a validity check on the COS program based on the security data to determine whether the verification result is successful. If so, the controller of the security chip boots the COS program; if not, proceed to step 7; Step 7: The controller of the security chip sets an error state; Specifically, the security data includes the BOOT program public key, BOOT program signature value, BOOT program hash value, COS program public key, COS program signature value, COS program hash value and a preset COS program download verification code; The COS program does not have read and write permissions for the security data; The BOOT program has no read and write permissions for the BOOT program public key, the BOOT program signature value, the BOOT program hash value and the preset COS program download verification code, but has read and write permissions for the COS program public key, the COS program signature value and the COS program hash value, wherein the BOOT program has only one-time write permission for the COS program public key.

2. The method according to claim 1, wherein: Step 3 specifically comprises: the controller of the security chip controls the first computing module of the security chip to compute the data of the BOOT program in the BOOT program storage area according to the first algorithm to obtain a second computing result, and determines whether the second computing result is the same as the hash value of the BOOT program in the security data; if so, the verification result is successful, and step 4 is executed; if not, the verification result is failed, and step 7 is executed; Step 4 specifically includes: the controller of the security chip controls the second computing module of the security chip to use the second algorithm to perform a signature verification operation based on the second computing result, the BOOT program public key in the security data, and the BOOT program signature value, and determines whether the signature verification result is successful. If so, execute step 5; if not, execute step 7; In step 5, the controller of the security chip verifies the integrity of the COS program and determines whether the verification is successful. If so, step 6 is executed; if not, step 7 is executed. Specifically, The controller of the security chip controls the first computing module of the security chip to perform computing on the COS program data in the COS program storage area according to the first algorithm to obtain a third computing result, and determines whether the third computing result is the same as the COS program hash value in the security data; if so, executing step 6; if not, executing step 7; Step 6 is as follows: The controller of the security chip controls the second operation module of the security chip to use the second algorithm to perform a signature verification operation based on the third operation result, the COS program public key in the security data, and the COS program signature value, and determines whether the signature verification result is successful. If so, the controller of the security chip boots the COS program; if not, executes step 7.

3. The method according to claim 1, wherein: In step 5, the controller of the security chip downloads the COS program, clears the COS program download password, and controls the security chip to reset, specifically including: Step m1: the controller of the security chip waits to receive an instruction sent by the host computer; Step m2: The controller of the security chip determines the type of instruction received. If the instruction received is a COS program write instruction, step m3 is executed; if the instruction received is a COS program download password clear instruction, step m4 is executed; if the instruction received is a reset instruction, step m5 is executed; Step m3, the controller of the security chip writes the COS program into the COS storage area according to the address in the COS program write instruction and the COS program data, and returns to step m1; Step m4: The controller of the security chip clears the COS program download password in the preset location in the flash memory of the security chip, and returns to step m1; In step m5, the controller of the security chip resets the security chip.

4. The method according to claim 3, wherein: The step m2 further includes: when the instruction received is an instruction to download the COS program public key, executing step m6; If not, execute step m7; Step m6, the controller of the security chip determines whether a predetermined location of the flash memory BOOT storage area stores a COS program public key. If so, the controller of the security chip reports an error and returns to step m1; if not, execute step m7; In step m7, the controller of the security chip writes the COS program public key in the instruction to download the COS program public key into a predetermined location in the BOOT storage area, and returns to step m1.

5. The method according to claim 1, wherein: The step 1 also includes: Step 01: The controller of the security chip starts the temperature and voltage detection module; The method further comprises: When the temperature and voltage detection module determines that the temperature or voltage is abnormal, the safety chip is reset.

6. The method according to claim 3, wherein: The step m2 further includes: When the instruction is an erase instruction, execute step m8; When the instruction is a COS program hash value write instruction, execute step m9; When the instruction is a COS program signature value writing instruction, execute step m10; Step m8, the controller of the security chip erases the COS program in the COS storage area, the COS program hash value and the COS program signature value in the secure data storage area, and returns to step m1; Step m9, the controller of the security chip writes the COS program hash value into the secure data storage area, and returns to step m1; In step m10, the controller of the security chip writes the COS program signature value into the secure data storage area, and returns to step m1.

7. The method according to claim 1, wherein: Step 2, step 3, step 4, and step 6 are key steps, and the security data also includes a preset key step execution sequence number check value corresponding to at least one of the key steps; Before at least one of the key steps is performed, the following steps are also included: The controller of the security chip determines whether the current key step execution sequence number value is the same as the key step execution sequence number check value corresponding to the key step to be executed. If so, the key step to be executed is executed; if not, step 7 is executed.

8. The method according to claim 7, wherein: The security data also includes the initial value of the key step execution sequence number; After step 1, the controller of the security chip also includes: updating the initial value of the key step execution sequence number according to a predetermined rule to obtain the current key step execution sequence number value; After executing the key step to be executed, the method further includes: if the execution is successful, the controller of the security chip updates the execution sequence number value of the current key step according to the predetermined rule as the execution sequence number value of the current key step.

9. The method according to claim 7, wherein: After executing the key steps to be executed, the method further includes: if the execution fails, the controller of the security chip sets the error state to a verification error value.

10. The method according to claim 9, wherein: The executing step 7 specifically includes: the controller of the security chip sets the error state to an attack error value.

11. A chip secure boot device, characterized in that: The device comprises: Power-on module, used to power on the security chip; A startup module, configured to enable the controller of the security chip to start a BOOT program after the power-on module is powered on; A first verification module, configured for the controller of the security chip to verify security data in the secure data storage area; a first judgment module, configured to judge the verification result of the first verification module, and trigger the second verification module when the judgment result of the first judgment module is yes, and trigger the state setting module when the judgment result of the first judgment module is no; The second verification module is used for the controller of the security chip to perform integrity verification on the BOOT program in the BOOT program storage area; a second judgment module, configured to judge the verification result of the second verification module, trigger the third verification module when the judgment result of the second judgment module is yes, and trigger the setting status module when the judgment result of the second judgment module is no; The third verification module is used for the controller of the security chip to perform a legitimacy check on the BOOT program according to the security data; a third judgment module, configured to judge the verification result of the third verification module, and trigger the fourth judgment module when the judgment result of the third judgment module is yes, and trigger the setting status module when the judgment result of the third judgment module is no; The fourth judgment module, used for the controller of the security chip to judge whether the COS program download password in the COS program storage area is correct, and if so, to judge whether the COS program download password is correct again. When both judgments are correct, the download clear reset module is triggered, otherwise the fourth verification module is triggered; The download clear reset module is used for the controller of the security chip to download the COS program, clear the COS program download password, and control the reset of the security chip; The fourth verification module is used by the controller of the security chip to verify the integrity of the COS program in the COS program storage area; a fifth judgment module, configured to judge the verification result of the fourth verification module, trigger the fifth verification module when the judgment result of the fifth judgment module is yes, and trigger the status setting module when the judgment result of the fifth judgment module is no; The fifth verification module is used for the controller of the security chip to perform a validity verification on the COS program according to the security data; a sixth judgment module, configured to judge the verification result of the fifth verification module, and trigger the guidance module when the judgment result of the sixth judgment module is yes, and trigger the setting state module when the judgment result of the sixth judgment module is no; The boot module is used for the controller of the security chip to boot the COS program; The state setting module is used to set the error state of the controller of the security chip; Specifically, the security data includes the BOOT program public key, BOOT program signature value, BOOT program hash value, COS program public key, COS program signature value, COS program hash value and a preset COS program download verification code; The COS program does not have read and write permissions for the security data; The BOOT program has no read and write permissions for the BOOT program public key, the BOOT program signature value, the BOOT program hash value and the preset COS program download verification code, but has read and write permissions for the COS program public key, the COS program signature value and the COS program hash value, wherein the BOOT program has only one-time write permission for the COS program public key.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium comprises a computer program, and when the computer program is run on a computer, the computer is caused to perform the method according to any one of claims 1 to 10.

13. A security chip, characterized in that: The chip is coupled to a memory and is configured to execute a computer program stored in the memory to perform the method according to any one of claims 1 to 10.

Images