A secure startup method and system for an industrial control intelligent terminal

Abstract

The present invention provides a secure startup method and system for an industrial control intelligent terminal, comprising: starting an embedded universal boot program of the industrial control intelligent terminal, and reading file signature information of an operating system kernel through the embedded universal boot program; performing legitimacy verification on the operating system kernel according to the file signature information of the operating system kernel; when the legitimacy verification of the operating system kernel passes, starting a security daemon and performing legitimacy verification on it; when the legitimacy verification of the security daemon passes, reading file signature information of the embedded universal boot program, and performing legitimacy verification on the embedded universal boot program; when the legitimacy verification of the embedded universal boot program passes, the industrial control intelligent terminal completes secure startup; the present application is conducive to ensuring secure and legal startup of the industrial control intelligent terminal by setting security verification of the embedded universal boot program, the operating system kernel and the security daemon when the industrial control intelligent terminal is started.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control intelligent terminals, and in particular to a safe startup method and system for an industrial control intelligent terminal. Background Art

[0002] At present, the smart terminal industry is not only an important part of the real economy, but also a key element of development. It is undoubtedly of practical significance to focus on the development of the terminal industry and promote the high-quality aggregation of smart terminals and the enhancement of industrial value. In the digital age, smart terminals play an important role as application carriers, digital portals, and commercial realization. With the continuous development and growth of the smart terminal market, its application areas are no longer limited to the mass consumer market. Smart terminals are widely used in infrastructure fields such as industry, agriculture, environment, transportation, logistics, and security.

[0003] Taking the intelligent terminal in the field of industrial automation control as an example (also known as industrial control intelligent terminal), the industrial control intelligent terminal is generally composed of underlying hardware, embedded operating system and various applications (APP), which can realize the basic functions of mobile communication, carry various business applications (APP), and can be applied to specific industrial scenarios, so as to realize the automation control of all links of industrial production. Among them, embedded operating system technology plays a key role. It is a complex technology that integrates computer hardware and software, sensor technology, integrated circuit technology, and electronic application technology. After decades of evolution, intelligent terminal products characterized by embedded operating systems can be seen everywhere, from smart wearable devices around people to aerospace satellite systems. Embedded operating systems are playing a vital role. Industrial control intelligent terminals are different from personal consumer intelligent terminals such as smart phones and tablets. They generally use industrial-grade chips with multi-core ARM architecture and tailored embedded Linux and other operating systems, instead of using current consumer-grade chips and Android systems of smart phones. The purpose is to enable the terminal to better adapt to the harsh working environment in the field of industrial production and complete industrial production tasks quickly and efficiently.

[0004] Since industrial control intelligent terminals are used in specific industrial production control fields, and the number of industrial control intelligent terminals required in different industries is different, industrial control intelligent terminals are not as large in number and mature in application as smartphones equipped with the Android system, nor do they have a complete set of security testing and certification solutions like the Android system. The product maturity and security are not enough. This leads to the fact that industrial control intelligent terminals, in addition to security verification in system login and user authentication, do not implement strict security certification processes in terms of secure startup, such as the embedded universal boot program (U-BOOT) and the operating system kernel (Kernel). Usually, only the cyclic redundancy check algorithm (CRC algorithm) is used to verify the integrity of the executable program, resulting in the security of existing industrial control intelligent terminals being threatened at startup. Summary of the invention

[0005] In order to solve the problem that the existing industrial control intelligent terminal does not have a security verification process in startup, resulting in the security of the industrial control intelligent terminal being threatened when it is started, the present invention proposes a secure startup method for the industrial control intelligent terminal, including:

[0006] Starting the embedded universal boot program of the industrial control intelligent terminal, and reading the file signature information of the operating system kernel through the embedded universal boot program;

[0007] Performing legitimacy verification on the operating system kernel according to the file signature information of the operating system kernel;

[0008] When the legitimacy verification of the operating system kernel is passed, the security daemon process is started and the legitimacy verification of the security daemon process is performed;

[0009] When the legitimacy verification of the security daemon passes, the file signature information of the embedded universal boot program is read by the security daemon to verify the legitimacy of the embedded universal boot program; when the legitimacy verification of the embedded universal boot program passes, the industrial control intelligent terminal completes secure startup.

[0010] Optionally, after the legitimacy verification of the operating system kernel is passed, starting a security daemon process and performing legitimacy verification on the security daemon process includes:

[0011] When the legitimacy verification of the operating system kernel is passed, the operating system is started, and the security daemon process is started following the operating system;

[0012] The file signature information of the security daemon process is obtained, and the legitimacy of the security daemon process is verified according to the file signature information of the security daemon process.

[0013] Optionally, the performing legitimacy verification on the operating system kernel according to the file signature information of the operating system kernel includes:

[0014] According to the file signature information of the operating system kernel, the legitimacy of the file signature information of the operating system kernel is verified by calling the national secret algorithm in the external security encryption chip;

[0015] Wherein, the security encryption chip stores a key certificate.

[0016] Optionally, the verifying the legitimacy of the embedded universal boot program includes:

[0017] According to the file signature information of the embedded universal boot program, the legitimacy of the embedded universal boot program is verified by calling the national secret algorithm in the security encryption chip.

[0018] Optionally, the security encryption chip is connected to the system-level chip in the industrial control intelligent terminal via a serial peripheral interface.

[0019] Optionally, the security encryption chip and the system-level chip communicate with each other using a private communication protocol of the serial peripheral interface;

[0020] The frame format of the private communication protocol of the serial peripheral interface includes: frame header, data length, command field, data content, frame tail and CRC32 check.

[0021] Optionally, the starting of the embedded universal boot program of the industrial control intelligent terminal includes:

[0022] Starting the secondary program loader of the industrial control intelligent terminal;

[0023] Reading the embedded universal boot program through the secondary program loader, and storing the embedded universal boot program in the off-chip random access memory running memory of the industrial control intelligent terminal;

[0024] The embedded universal boot program is started in the off-chip random access memory running memory.

[0025] Optionally, the operating system kernel includes the following startup process:

[0026] Loading the operating system kernel into the off-chip random access memory running memory through the embedded universal boot program;

[0027] The operating system kernel is started in the off-chip random access memory running memory.

[0028] Based on the same inventive concept, the present invention also provides a secure startup system for an industrial control intelligent terminal, comprising:

[0029] A boot program startup module is used to start the embedded universal boot program of the industrial control intelligent terminal and read the file signature information of the operating system kernel through the embedded universal boot program;

[0030] A system kernel verification module, used to verify the legitimacy of the operating system kernel according to the file signature information of the operating system kernel;

[0031] A daemon process verification module, used to start a security daemon process and perform a legitimacy verification on the security daemon process after the legitimacy verification of the operating system kernel is passed;

[0032] The boot program verification module is used to read the file signature information of the embedded universal boot program through the security daemon process after the legitimacy verification of the security daemon process is passed, and to verify the legitimacy of the embedded universal boot program; when the legitimacy verification of the embedded universal boot program is passed, the industrial control intelligent terminal completes the secure startup.

[0033] Optionally, the daemon process verification module includes:

[0034] A process starting unit, used to start the operating system after the legitimacy verification of the operating system kernel is passed, and start the security daemon process following the operating system;

[0035] The process verification unit is used to obtain the file signature information of the security daemon process and verify the legitimacy of the security daemon process according to the file signature information of the security daemon process.

[0036] Optionally, the system kernel verification module is specifically used to:

[0037] According to the file signature information of the operating system kernel, the legitimacy of the file signature information of the operating system kernel is verified by calling the national secret algorithm in the external security encryption chip;

[0038] Wherein, the security encryption chip stores a key certificate.

[0039] Optionally, the boot program verification module verifies the legitimacy of the embedded universal boot program, including:

[0040] According to the file signature information of the embedded universal boot program, the legitimacy of the embedded universal boot program is verified by calling the national secret algorithm in the security encryption chip.

[0041] Optionally, the security encryption chip in the boot program verification module is connected to the system-level chip in the industrial control intelligent terminal via a serial peripheral interface.

[0042] Optionally, the security encryption chip in the boot program verification module and the system-level chip communicate with each other using a private communication protocol of the serial peripheral interface;

[0043] The frame format of the private communication protocol of the serial peripheral interface includes: frame header, data length, command field, data content, frame tail and CRC32 check.

[0044] Optionally, the boot program startup module includes:

[0045] A loader startup unit, used to start the secondary program loader of the industrial control intelligent terminal;

[0046] A program reading unit, used for reading the embedded universal boot program through the secondary program loader, and storing the embedded universal boot program in the off-chip random access memory running memory of the industrial control intelligent terminal;

[0047] A program startup unit is used to start the embedded universal boot program in the off-chip random access memory running memory.

[0048] Optionally, the boot program startup module further includes:

[0049] A kernel loading unit, used for loading the operating system kernel into the off-chip random access memory running memory through the embedded universal boot program;

[0050] A kernel startup unit is used to start the operating system kernel in the off-chip random access memory running memory.

[0051] In yet another aspect, the present invention further provides a computer device, comprising: one or more processors;

[0052] A memory for storing one or more programs;

[0053] When the one or more programs are executed by the one or more processors, the aforementioned secure startup method for an industrial control intelligent terminal is implemented.

[0054] On the other hand, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed, a secure startup system for an industrial control intelligent terminal as described above is implemented.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] The present invention provides a secure startup method and system for an industrial control intelligent terminal, comprising: starting an embedded universal boot program of the industrial control intelligent terminal, and reading file signature information of an operating system kernel through the embedded universal boot program; performing legitimacy verification on the operating system kernel according to the file signature information of the operating system kernel; when the legitimacy verification of the operating system kernel passes, starting a security daemon process, and performing legitimacy verification on the security daemon process; when the legitimacy verification of the security daemon process passes, reading file signature information of the embedded universal boot program through the security daemon process, and performing legitimacy verification on the embedded universal boot program; when the legitimacy verification of the embedded universal boot program passes, the industrial control intelligent terminal completes secure startup; in terms of secure startup of the industrial control intelligent terminal, the present application sets a security verification process of an embedded universal boot program, an operating system kernel and a security daemon process, which is beneficial to ensuring the security of the industrial control intelligent terminal at startup. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A schematic diagram of a process flow of a secure startup method for an industrial control intelligent terminal provided by the present invention;

[0058] Figure 2 This is a schematic diagram of the startup process of an industrial control intelligent terminal based on the ARM architecture and equipped with an embedded Linux operating system;

[0059] Figure 3 A schematic diagram of the overall architecture of security verification of a secure startup method for an industrial control intelligent terminal provided by the present invention;

[0060] Figure 4 A schematic diagram of a safety closed-loop verification scheme in a safety startup method for an industrial control intelligent terminal provided by the present invention;

[0061] Figure 5 A schematic diagram of the implementation process of a safety closed-loop verification scheme in a safety startup method for an industrial control intelligent terminal provided by the present invention;

[0062] Figure 6 A schematic diagram of a secure boot solution for a personal consumer smart terminal using the Android system as an example;

[0063] Figure 7 This is a schematic diagram of the overall startup of an industrial control intelligent terminal based on the ARM architecture and equipped with an embedded Linux operating system;

[0064] Figure 8 Schematic diagram of the CRC algorithm verification process for industrial control intelligent terminals based on ARM architecture and equipped with embedded Linux operating system;

[0065] Fig. 9A connection diagram of SPI communication in a secure startup method for an industrial control intelligent terminal provided by the present invention;

[0066] Fig.10 A schematic diagram of the structure of a secure startup system for an industrial control intelligent terminal provided by the present invention;

[0067] Fig.11 The present invention provides a schematic structural diagram of an electronic device. DETAILED DESCRIPTION

[0068] The present invention provides a secure startup method and system for an industrial control intelligent terminal. The specific implementation manner of the present invention is further described in detail below with reference to the accompanying drawings.

[0069] Embodiment 1:

[0070] The present invention provides a safe startup method for an industrial control intelligent terminal, the flow chart is as follows Figure 1 As shown, including:

[0071] Step 1: Start the embedded universal boot program of the industrial control intelligent terminal, and read the file signature information of the operating system kernel through the embedded universal boot program;

[0072] Step 2: Verify the legitimacy of the operating system kernel based on the file signature information of the operating system kernel;

[0073] Step 3: After the legitimacy verification of the operating system kernel is passed, the security daemon is started and the legitimacy of the security daemon is verified;

[0074] Step 4: When the legitimacy verification of the security daemon passes, the file signature information of the embedded universal boot program is read through the security daemon to verify the legitimacy of the embedded universal boot program; when the legitimacy verification of the embedded universal boot program passes, the industrial control intelligent terminal completes the secure startup.

[0075] Industrial control intelligent terminals refer to intelligent terminals in the field of industrial automation control. Generally, industrial control intelligent terminals are different from personal consumer intelligent terminals such as smartphones and tablets. Personal consumer intelligent terminals use consumer-grade chips and operating systems such as Android, while industrial control intelligent terminals mostly use industrial-grade chips with multi-core Advanced RISCMachine (ARM) architecture and tailored operating systems such as embedded Linux. The purpose is to better adapt to the harsh working environment in the field of industrial production and complete industrial production tasks quickly and efficiently.

[0076] In the process of starting up the existing industrial control intelligent terminal, in addition to security verification in terms of system login and user authentication, in terms of secure startup, for example, a strict security authentication process is not implemented in the embedded universal boot program or the operating system kernel. Usually, only the Cyclic Redundancy Check (CRC) algorithm is used to verify the integrity of the executable program. This verification method cannot effectively prevent the startup of illegal third-party systems, resulting in certain security risks and other problems, which can easily cause losses in industrial production. Based on this, the secure startup method for the industrial control intelligent terminal provided by the present invention first starts the embedded universal boot program during the verification process, and then starts and verifies the operating system kernel and the security daemon process in sequence, and finally verifies the embedded universal boot program that is started first, so as to realize the security verification of the operating system kernel, the security daemon process and the embedded universal boot program in the industrial control intelligent terminal, and can form an effective security closed-loop verification. Compared with the existing startup process, the secure closed-loop verification process of the present invention can make up for the shortcomings of not performing security authentication or adopting a one-way chain verification scheme like Android (i.e., CRC verification), and can also make up for the problem of insufficient security of international public algorithms such as RSA and MD5. Therefore, it can improve the security of industrial control intelligent terminals and reduce or avoid possible safety hazards and losses in industrial production.

[0077] For example, the embedded universal boot program may be a boot loader (Universal Boot Loader, U-BOOT) mainly used for embedded systems, the operating system kernel may be a kernel (Kernel), and the file signature information may include: file information and signature information.

[0078] In one implementation, the process of starting the embedded universal boot program (U-BOOT) of the industrial control intelligent terminal in the above step 1 may include:

[0079] Start the program loader of the industrial control intelligent terminal;

[0080] The embedded universal boot program (U-BOOT) is read through the program loader, and the embedded universal boot program (U-BOOT) is stored in the off-chip random access memory (RAM) memory running memory of the industrial control intelligent terminal;

[0081] Start the embedded universal bootloader (U-BOOT) in the off-chip random access (RAM) memory running memory.

[0082] For example, the program loader mentioned above may be a secondary program loader (SPL).

[0083] In this implementation, the above operating system kernel may include the following startup process:

[0084] The operating system kernel is loaded into the off-chip random access (RAM) memory running memory through the embedded universal boot program (U-BOOT);

[0085] Start the operating system kernel (Kernel) in the off-chip random access (RAM) memory running memory; in this implementation, the present invention quickly loads U-BOOT into RAM through SPL, which can execute subsequent boot steps faster. Loading U-BOOT and Kernel into RAM for operation can not only improve the execution speed, but also improve the startup speed and flexibility of the industrial control intelligent terminal, while ensuring the security of the operating system and enhancing the functionality and adaptability of the terminal. When the Kernel is started, the Kernel's file signature information is read from the off-chip flash memory (Flash) through U-BOOT; for example, the Kernel's file signature information may include the Kernel's kernel file information and signature information, wherein the kernel file information may include: kernel image (Kernel Image), device tree binary (Device Tree Blob, DTB) and initial random access disk (Initial RAM Disk, InitRD); the signature information may include: digital signature, signature certificate and checksum;

[0086] In one implementation, the process of verifying the legitimacy of the operating system kernel according to the file signature information of the operating system kernel in step 2 may include:

[0087] According to the file signature information of the operating system kernel (Kernel), the legality of the file signature information of the operating system kernel (Kernel) is verified by calling the national secret algorithm in the external security encryption chip;

[0088] In this implementation, the above-mentioned security encryption chip (also referred to as security encryption IC) stores a key certificate. The present invention stores the public key certificate and integrates the national secret algorithm through an external security encryption IC, and stores the key certificate in the security encryption IC to ensure the security of the public key certificate inside the security encryption IC, prevent the key certificate from being obtained by others, and have higher confidentiality and security (some national secret algorithms are not open to the public, and only exist in the chip as IP cores (Intellectual Property Core), which has extremely high security), thereby realizing security authentication such as U-BOOT, Kernel and App, and ensuring the safe and legal startup of industrial control intelligent terminals.

[0089] In one implementation, in the above step 3, after the legitimacy verification of the operating system kernel is passed, the process of starting the security daemon process and performing legitimacy verification on the security daemon process may include:

[0090] When the legitimacy of the operating system kernel (Kernel) is verified, the operating system (such as Linux) is started, and the security daemon (App) is started along with the operating system;

[0091] Obtain the file signature information of the security daemon (App), and verify the legitimacy of the security daemon (App) according to the file signature information of the security daemon (App); the file signature information of the security daemon (App) may include: file information and signature information of the security daemon; wherein the file information of the security daemon may include: public key certificate, file hash value and certificate chain; the signature information of the security daemon may include: digital signature, signature algorithm, signature timestamp and signer information. For example, the legitimacy verification process of the security daemon may include: extracting the file signature information from the security daemon (App), verifying the validity of the signature with the pre-installed public key certificate, calculating the hash value of the security daemon (App), and comparing it with the hash value in the signature information to ensure that the file has not been tampered with; checking the signature timestamp to ensure that the signature is within the validity period; verifying the certificate chain to ensure that the signature comes from a trustworthy source. If all verification steps are passed, the terminal starts and allows the security daemon (App) to run. Otherwise, the terminal will refuse to start the process to prevent unauthorized applications or malware from running. This method can ensure that only authorized security daemon (App) can run on the terminal, thereby improving the security of the system.

[0092] In this implementation, the above-mentioned security daemon is an application program running in the background. It automatically starts with the system when the system is booted and shuts down when the system is shut down, similar to the Windows background service process. The security daemon in the present invention is mainly used for U-BOOT security authentication, other user App security authentication, user App behavior security monitoring, etc. When the security daemon starts with the system, its primary task is to verify the U-BOOT file and signature, thereby completing the closed-loop security verification process and effectively ensuring the security of the entire startup link. After the verification is completed, the industrial control intelligent terminal starts, and the security daemon runs in the background to authenticate the legitimacy of the signatures of other user-type apps and monitor other user-type apps to prevent other user apps from performing unsafe behavior operations.

[0093] In one implementation, the process of verifying the legitimacy of the embedded universal boot program in step 4 above may include:

[0094] According to the file signature information of the embedded universal boot program (U-BOOT), the security encryption of the embedded universal boot program (U-BOOT) is verified for legitimacy by calling the national secret algorithm in the security encryption IC; for example, the file signature information of the embedded universal boot program (U-BOOT) may include: the file information and signature information of U-BOOT; wherein, the file information of U-BOOT may include: hash summary and timestamp; the signature information of U-BOOT may include: digital signature and signature algorithm; when verifying U-BOOT, the security encryption IC uses the public key stored in it to decrypt the digital signature, recalculate the hash summary of the image, and then compare the two. If it matches, it proves that the image has not been tampered with and comes from a trusted entity. In addition, the security encryption IC also checks the validity of the public key certificate to ensure that the signer is trusted. This mechanism is particularly important in the Internet of Things (IoT), industrial control and other environments with high security requirements, because it can prevent unauthorized firmware updates and malicious code injection.

[0095] In this implementation, the above-mentioned security encryption IC is connected to the system-on-chip (SoC) in the industrial control intelligent terminal through a serial peripheral interface (SPI). During the communication process through SPI, the master device dynamically adjusts the communication rate according to the amount of data, and selects a suitable rate to complete the communication work quickly and stably, which is conducive to improving communication efficiency; for example, the above-mentioned security encryption IC and SoC communicate using the SPI private communication protocol; Figure 2As shown, in this example, the system-level chip is connected to the security encryption chip through the serial peripheral interface (SPI), the multi-core advanced reduced instruction set computer (ARM core) is the master device connected to the serial peripheral interface, and the security encryption chip is the slave device connected to the serial peripheral interface; the security encryption chip integrates national secret algorithms (such as SM1, SM2, SM3, SM4 and other algorithms); the security encryption chip also includes: static random access memory (Static Random Access Memory, SRAM) and read-only memory (Read-Only Memory, ROM), the ROM stores the initial boot code (called ROM CODE), the key certificate is stored in the security encryption IC, the security encryption IC and the SoC read through the SPI private communication protocol, which can ensure the security of the key and prevent it from being obtained by a third party. The SoC also communicates with an external storage (Storage), which stores the signature information of the security daemon process (Signed App) and the signature information of the operating system kernel (Signed In the present invention, the dynamic frequency transmission mechanism of SPI communication is adopted to dynamically adjust the communication rate according to the amount of data during data transmission, thereby improving the communication efficiency: for example, when a large amount of data (such as more than 1kB) is transmitted, in order to improve the transmission efficiency, the master device configures the serial clock (SerialClock, SCLK) to 20MHz to quickly complete the data transmission; when a small amount of data (such as less than 1kB) is transmitted, in order to improve the transmission quality, the master device configures the SCLK to less than 10MHz to accurately complete the data transmission.

[0096] For example, as shown in Table 1, the frame format of the above-mentioned SPI private communication protocol may include: frame header, data length, command field, data content, frame tail and CRC32 check, and the specific contents are as follows:

[0097] Table 1 SPI private communication protocol frame format

[0098]

[0099] This frame format design ensures the integrity and consistency of the data, the CRC32 check enhances the error detection capability, and the fixed frame header and frame footer simplify the identification and parsing process of the data frame. In addition, specifying the encryption algorithm through the command field helps to increase the security of data transmission.

[0100] Aiming at the problem that the existing industrial control intelligent terminal does not have a security verification process in startup, which leads to the security threat when the industrial control intelligent terminal is started, the present invention proposes a security startup method for the industrial control intelligent terminal. After the on-chip ROM CODE of the SoC is started, an embedded universal boot program (U-BOOT) is loaded and run; after the embedded universal boot program is started, the signature information of the operating system kernel (Kernel) file in the off-chip flash memory is read, and the legitimacy of the kernel is verified by calling the national secret algorithm of the security encryption chip. After the kernel verification is successful, the operating system is started; after the operating system is started, a security daemon process that follows the system startup is loaded; after the security daemon process is started, the legitimacy of the security daemon process is verified. When the legitimacy verification of the security daemon process is passed, the file signature information of the embedded universal boot program in the off-chip flash memory is read, and the legitimacy of the embedded universal boot program is verified by calling the national secret algorithm of the security encryption chip; finally, the following is formed. Figure 3-Figure 4 The safety closed-loop verification scheme shown is helpful to ensure the safety of the industrial control intelligent terminal when it is started through the technical solution of the present invention.

[0101] Embodiment 2:

[0102] It can be seen from the content of Example 1 that the industrial control intelligent terminal and the personal consumer intelligent terminal are significantly different in terms of operating system architecture and usage purpose. In detail, the comparison between the industrial control intelligent terminal and the personal consumer intelligent terminal is shown in Table 2:

[0103] Table 2 Comparison between industrial control intelligent terminals and personal consumer intelligent terminals

[0104]

[0105] From the contents in Table 2, it can be seen that there are obvious differences between industrial control intelligent terminals and personal consumer intelligent terminals in terms of operating temperature, service life, chip level, operating system and performance characteristics. In addition, the basic idea of ​​secure booting of personal consumer smart terminals is generally a multi-layer chain verification mechanism from the initial boot code (ROM CODE) in the read-only memory (ROM) to the software image (Images). In this mechanism, a RSA public key (RSA Public Key) is used uniformly to complete the security verification, and the current level of RSA public key has been used as part of its own firmware, and the security verification is completed by the previous level loader (Loader), thereby ensuring the security of the public key; ROM CODE uses a hash function to verify the integrity of the base station controller (Base Station Controller, BSC), and uses the RSA algorithm (RSA algorithm) to verify the integrity of the secondary program loader (SPL); then the secondary program loader (SPL) will verify the embedded universal boot program (U-BOOT); finally, U-BOOT verifies the operating system kernel (Kernel), modem (Modem) and digital signal processor (Digital Signal Processor, DSP), etc., all boot images (BOOT Images) will be encrypted by the private key of the RSA algorithm and loaded into the mobile phone during the production stage. The RSA public key of each software image file is stored in the image signed by the private key of the previous level, and the calculated BSC hash value and the first-level public key are stored in the one-time programmable module (such as OTP or EFUSE: One-Time Programmable (OTP); Electrically Erasable Programmable Read-Only Memory (EFUSE)) inside the system-level chip (SoC) to prevent it from being modified. The above RSA algorithm is an asymmetric encryption algorithm. Unlike the symmetric encryption algorithm, the RSA algorithm has two different keys, one is the public key and the other is the private key. The OTP / EFUSE area is extremely precious and has a small space. This part of the area is special and can only be written once. After writing, it can never be modified again. Therefore, storing the public key in OTP can well ensure that it cannot be modified, which is the basis of chain security.

[0106] Take the Android system in personal consumer terminals as an example. Figure 5As shown in the figure, its architecture mainly includes two parts: system-on-chip (SoC) and off-chip flash memory (Flash). In the system-on-chip, it includes: multi-core advanced reduced instruction set computer (ARM core): the core processor of the system-on-chip, responsible for performing most computing tasks; security engine in the system-on-chip (Secure Engine in SoC): used to handle security-related tasks, such as encryption and decryption, key management, etc.; 64-bit unique identifier (64bit Unique Identifier, 64b UID), used to identify the device manufacturer; 160-bit hash value (160b Hash), used for data integrity check; reserved 32-bit area (32b free), which can be used for function expansion; RSA decryption engine (RSA Decryption Engine): a hardware module used to perform RSA decryption operations; hash function stored in read-only memory (Hash function in ROM): used for data integrity check. In the off-chip flash memory (Flash), the signature information of the digital signal processor (Signed DSP) can be used to verify whether the data stored in the off-chip flash memory (Flash) is complete and ensure that the signals of the signed data type have not been tampered with or damaged; the signature information of the modem (Signed Modem) is used to ensure the integrity and security of the modem's firmware or software; the signature information of the kernel (Signed Kernel) can be used to ensure the integrity of the kernel code; the signature information of the embedded universal boot program (Signed U-BOOT), which is an embedded universal boot program that can be used to load the operating system; the signature information of the secondary program loader (Signed SPL) can be used to load a larger boot loader. The network boot loader header (NBLHeader in SPL) of the secondary program loader is used to boot the operating system. In this Android system architecture, the security verification steps between the SoC through the security engine and the off-chip Flash memory are as follows:

[0107] ① The 64b UID and 160bHash in the security engine are used to verify the identity and data integrity of the SoC.

[0108] ② The RSA decryption engine in the security engine is used to decrypt data in the off-chip Flash storage.

[0109] ③ Ensure the integrity of Signed SPL, Signed U-BOOT and Signed Kernel in off-chip Flash storage through RSA verification and Hash verification.

[0110] Although the Android system can ensure safe startup through the multi-layer chain verification mechanism mentioned above, it still has the following shortcomings:

[0111] 1) The OTP / EFUSE burning process is crucial for secure boot. Errors and failed burning will cause the SoC to no longer be able to start the boot program, so this process requires extremely strict requirements.

[0112] 2) If the manufacturer's RSA private key is leaked, it will be disastrous and the entire chain verification foundation will no longer exist.

[0113] 3) The RSA public key is packaged together with the Image file and stored in the off-chip Flash memory. It may be read and used by a third party from the storage area. Although the public key is only used to verify the signature, with the development of technology, there is no guarantee that the public key will not be exploited. For example, the MD5 algorithm (MD5 Message-Digest Algorithm) is a widely used cryptographic hash function. It was made public in 1992. At that time, it was once considered a very secure algorithm and was widely used at home and abroad. However, with the continuous development of technology, with the current computer performance, it only takes a few seconds to crack the collision resistance of MD5. Therefore, MD5 is gradually abandoned. At present, MD5 is mostly used in relatively safe and closed environments with low security requirements.

[0114] Unlike the Android system, existing industrial control intelligent terminals are generally based on the ARM architecture and equipped with an embedded Linux operating system, such as Figure 6 As shown in the figure, the boot process is a process that grows from small to large and from simple to complex. The boot process generally includes: power on - read-only memory boot program (ROM BOOT) - embedded universal boot program (U-BOOT) - Linux operating system - application. For example, Figure 7 As shown in the figure, the first part is the ARM architecture system-on-chip (SoC); the second part is the program storage space, that is, the off-chip flash memory; the third part is the program running space, that is, the off-chip random access (RAM) running memory, which specifically includes:

[0115] 0) After power-on, the read-only memory (ROM) boot code (ROM CODE) starts to execute, initialize the clock, turn off the watchdog, turn off the cache (Cache), turn off the interrupt, etc., determine the boot device according to the status of a specific pin (Bootstrap Pin), and initialize the peripherals;

[0116] 1) Use the peripheral driver to read the secondary program loader (SPL) from the memory;

[0117] 2) SPL is read into static random access memory (SRAM) for execution. At this point, control is transferred to SPL;

[0118] 3) SPL initializes the off-chip random access (RAM) memory;

[0119] 4) SPL reads the embedded universal boot program (U-BOOT) from the off-chip flash memory and puts it into the off-chip random access (RAM) memory running memory;

[0120] 5) Jump to the off-chip random access (RAM) memory to run the memory and execute U-BOOT;

[0121] 6) U-BOOT loads the kernel into the off-chip RAM memory, jumps and starts the kernel;

[0122] Among them, the above-mentioned initial boot code (ROM CODE) is a section of code solidified in the chip by the processor manufacturer and cannot be modified by the user, while SPL and U-BOOT are generated when the user compiles U-BOOT and are copied by the user to the program storage space (i.e., the off-chip Flash memory).

[0123] For example, the read-only memory boot program (ROM BOOT) is also called the read-only memory boot code (ROMCODE). It is a piece of code that is fixed into the ROM inside the chip by the processor manufacturer and cannot be modified by the user. Its function is to initialize the processor, identify the boot loader (the most common bootloader is U-BOOT, and U-BOOT is used to replace Bootloader in the following text) to the on-chip RAM (usually SRAM, the larger the capacity, the higher the cost, so in order to control costs, processor manufacturers generally integrate smaller capacity such as 64K, 128K, etc. inside the chip), and finally jump to execute the Bootloader. For multi-core ARM architecture SoC chips, after power-on, the chip will directly start executing the boot program (usually assembly code) from the on-chip read-only memory (ROM), initialize the chip registers, start core 0, and wait for core 0 to wake up other cores (core 1, core 2...) through interrupts or events after the kernel starts normally. That is to say, after the chip is powered on, only core 0 and some circuits such as ROM and RAM on the chip can work normally. The external RAM (i.e. External RAM, such as SDRAM / DDR, etc.) and external Flash (i.e. External Flash, such as eMMC / NAND / OneNand / SD Card, etc.) have not been initialized, so they cannot be used normally. Among them, SDRAM is Synchronous Dynamic Random Access Memory, DDR stands for Double Data Rate, eMMC stands for embedded MultiMediaCard, NAND stands for NAND Flash Memory; OneNand is the full name of One-NAND Flash Memory, which is a non-volatile memory; SD card is the full name of Secure Digital Card, which is a storage device based on semiconductor flash memory.

[0124] When loading U-BOOT, the ROM CODE has different ways of loading U-BOOT depending on the size of the on-chip RAM:

[0125] 1) Large-capacity on-chip RAM (such as 512K) can load all U-BOOT codes into the on-chip RAM at one time, and then jump and execute U-BOOT.

[0126] 2) Small-capacity on-chip RAM (such as 64K, 128K) cannot load all U-BOOT codes into the on-chip RAM at one time for execution. Generally, U-BOOT is loaded in segments. At this time, SPL came into being. SPL (Secondary Program Loader) is the first stage code of U-BOOT. ROM CODE jumps and executes SPL after loading SPL. SPL is a very small executable program generated by U-BOOT source code. It is a stage before starting U-BOOT and must be loaded from the boot source (eMMC / NAND, etc.) into the on-chip RAM for execution. SPL has very few functions. Its main responsibility is to initialize the minimum system such as clock, off-chip RAM (such as SDRAM / DDR, etc.), and then move the U-BOOT program to the off-chip RAM, jump and execute the U-BOOT program.

[0127] For example, the above-mentioned embedded universal boot program (U-BOOT) is the full name of Universal Boot Loader, which is an open source project that complies with the General Public License (GPL). U-BOOT not only supports the booting of embedded Linux systems, but also supports embedded operating systems such as VxWorks and LynxOS. U-BOOT supports many commonly used series of processors such as ARM, x86, PowerPC, MIPS, XScale, etc. This is exactly the development goal of the U-BOOT project, that is, to support as many embedded processors and embedded operating systems as possible. At present, U-BOOT has the most complete support for Linux. At present, many embedded developers who are interested in open source open source boot loader (BOOT Loader) porting are in full swing to continuously expand and deepen the porting work of various series of embedded processors to support the loading and booting of more embedded operating systems. The features of U-BOOT include:

[0128] ① Open source;

[0129] ② Support multiple embedded operating system kernels, such as Linux, VxWorks, LynxOS, etc.;

[0130] ③ Support multiple processor series, such as ARM, x86, PowerPC, MIPS, XScale and other architectures;

[0131] ④Higher reliability and stability;

[0132] ⑤ Highly flexible function settings, suitable for U-BOOT debugging, different boot requirements of operating systems, product release, etc.;

[0133] ⑥ Rich device driver source code, such as serial port, Ethernet, synchronous dynamic random access memory (SDRAM), flash memory (FLASH), liquid crystal display (LCD), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), real-time clock (RTC), keyboard, etc.;

[0134] Since industrial control smart terminals are not as numerous and mature as personal consumer smart terminals equipped with Android systems, nor do they have a complete set of security testing and certification solutions like the Android system, some industrial control smart terminals have not implemented strict security certification processes in terms of secure startup, such as U-BOOT and Kernel, except for security verification in system login and user authentication. Usually, only the Cyclic Redundancy Check (CRC) algorithm is used to verify the integrity of executable programs, such as Figure 8 As shown in the figure, the existing industrial control intelligent terminal security verification process includes: starting the read-only memory boot program (ROM BOOT) and the universal boot program (U-BOOT), using the cyclic redundancy check (CRC) algorithm to verify the integrity of the Linux operating system kernel (Kernel), when the operating system kernel integrity verification is passed, start the Linux operating system, and determine whether the system login authentication is successful. If successful, start the security daemon (App) and determine whether the user login authentication is successful. When the user login authentication is successful, run the task. During the security verification process, the Kernel is usually made into a uImage (a file format) file, which consists of a uImage Header (header information) and a Kernel image. The uImage is a kernel image that has been exchanged with the kernel header information. This header information is a boot information block that contains information such as the target architecture, operating system, kernel size, load address, entry address, CRC checksum, etc. Take the header information structure in the kernel code shown below as an example:

[0135] Typedef struct image_header{

[0136] __be32 ih_magic;

[0137] __be32 ih_hcrc;

[0138] __be32 ih_time;

[0139] __be32 ih_size;

[0140] __be32 ih_load;

[0141] __be32 ih_ep;

[0142] __be32 ih_dcrc;

[0143] uint8_t ih_os;

[0144] uint8_t ih_arch;

[0145] uint8_t ih_type;

[0146] uint8_t ih_comp;

[0147] uint8_t ih_name[IH_NMLEN];

[0148] }

[0149] The name of the header information structure is image_header. ih_magic is defined to represent the image magic number of the header information structure, and 0x27051956 is used as the header start value. ih_hcrc is defined to represent the CRC checksum of the entire 64-byte header. Checksum), define ih_time to indicate the timestamp of the created image, define ih_size to indicate the size of the image; define ih_load to indicate the kernel loading address, define ih_ep to indicate the entry point address, define ih_dcrc to indicate the CRC checksum of the entire uImage file, define ih_os to indicate the operating system code, define ih_arch to indicate the chip type, define ih_type to indicate the image type, define ih_comp to indicate the compression type, define ih_name[IH_NMLEN] to indicate the 32-byte file name, the above ih_magic, ih_hcrc, ih_time, ih_size, ih_load, ih_ep, ih_dcrc are all 32-bit integer types (__be32), ih_os, ih_arch, ih_type, ih_comp and ih_name[IH_NMLEN] are all unsigned 8-bit integer types (uint8_t), U-BOOT When starting the kernel, the header information will be read, parsed and output to the command line. After U-BOOT verifies the integrity of the header and kernel image, it will load and start the Linux kernel from the entry address contained in the header information through the embedded universal boot program. After CRC algorithm verification, the verification output result is as follows:

[0150] ## Booting Kernel from Legacy Image at 8000fc0…;

[0151] Image Name:Arago / 3.2.0-psp04.06.00.08.sdk / a

[0152] Image Type: ARM Linux Kernel Image (uncompressed)

[0153] Data Size: 3163616 Bytes = 3 MiB

[0154] Load Address: 80008000

[0155] Entry Point: 80008000

[0156] Verifying Checksum ... OK

[0157] OK

[0158] Starting Kernel…

[0159] Uncompressing Linux... done, booting the Kernel.

[0160] According to the displayed verification output results, Booting Kernel from Legacy Image at8000fc0 means that U-boot is loading the kernel from address 0x8000fc0; Image Name: Arago / 3.2.0-psp04.06.00.08.sdk / a means that the name of the uImage file is Arago / 3.2.0-psp04.06.00.08.sdk / a; Image Type: ARM Linux Kernel Image (uncompressed) means that the kernel type is ARM Linux kernel and is not compressed; Data Size: 3163616 Bytes = 3 MiB means that the kernel size is 3MB; Load Address: 80008000 means that the kernel will be loaded at address 0x80008000; EntryPoint: 80008000 means that the kernel entry point is also 0x80008000; Verifying Checksum ... OK means U-BOOT is verifying the CRC checksum of the uImage header, and the result is OK; XIPKernel Image ... OK means U-BOOT confirms that the kernel is in XIP (Execute In Place) mode, which means that the kernel can be executed in place without decompression; Starting Kernel means starting the kernel; Uncompressing Linux... done, booting the Kernel means that if the kernel is compressed, the decompression process will be displayed here, but in this case, the kernel is uncompressed, so it goes directly to the boot process; The verification output result displayed above is the structure of the uImage file, which is mainly divided into two parts, namely uImage header and KernelImage; uImage header means that the uImage header contains information about the kernel; Kernel Image represents the actual kernel image, and "OK" represents the result of the CRC check, indicating that U-BOOT successfully verified the checksum of the uImage header and confirmed the integrity of the data. The CRC algorithm is mainly used to detect errors in the data transmission process. It does not provide strong security protection. A malicious attacker may be able to modify the firmware or kernel without being detected by CRC, especially when the details of the CRC algorithm are mastered. The CRC check can be bypassed through carefully constructed data packets. And without strict legitimacy verification, any link in the supply chain may become a target of attack. Malicious entities can insert malicious code during the manufacturing, distribution or update process, and the CRC check may not be able to detect such tampering.In summary, the existing industrial control intelligent terminals only perform CRC algorithm to verify the integrity of the executable program when starting, which cannot effectively prevent the startup of illegal third-party systems, or use Android one-way chain verification and international public algorithms such as RSA and MD5, and the public key certificate is packaged in a mirror file and stored in an off-chip Flash memory, which has certain security risks and other problems, and is likely to cause losses in industrial production. Therefore, in order to solve the security startup problem of existing industrial control intelligent terminals, the present invention sets security verification of embedded universal boot program, operating system kernel and security daemon process in the security startup of industrial control intelligent terminals to ensure the safe and legal startup of industrial control intelligent terminals. The specific process may include:

[0161] ① After U-BOOT starts, it verifies the signature of the Linux Kernel. After successful verification, it starts the Linux system;

[0162] ② After the Linux Kernel is started, the signature of the security daemon is verified. After successful verification, the security daemon is started;

[0163] ③ After the security daemon is started, it reads the file signature information of U-BOOT in the external memory and verifies that U-BOOT has successfully completed the closed-loop legitimacy verification process. Then, the security daemon runs in the background for security monitoring.

[0164] Among them, in the process of U-BOOT legitimacy verification, according to the file signature information of U-BOOT, the legitimacy of U-BOOT is verified by calling the national secret algorithm in the security encryption IC, and the security encryption IC communicates with the SoC in the industrial control intelligent terminal through the SPI private communication protocol. SPI is one of the most widely used interfaces between microcontrollers (MCU) and peripheral ICs (such as sensors, analog-to-digital converters, digital-to-analog converters, static random access memory, etc.). SPI is a synchronous, full-duplex, master-slave interface, and the master device and the slave device can transmit data at the same time. Fig. 9As shown, the SPI interface generally adopts a 4-wire type: a serial clock line (SCLK), a master input / slave output data line (MISO), a master output / slave input data line (MOSI), and a low-level effective slave select line (SS / CS). SPI does not define a speed limit. The master device changes the communication rate with the slave device by controlling the frequency of SCLK, which is usually in the range of several M / bps to tens of M / bps. This rate is suitable for most common SPI peripherals, such as electrically erasable programmable read-only memory (EEPROM), flash memory (Flash), etc. In the present invention, by adopting the dynamic frequency transmission mechanism of SPI communication, the communication rate can be dynamically adjusted according to the amount of data during the data transmission process, thereby improving the communication efficiency: for example, in the case of large amounts of data (such as more than 1kB) transmission, in order to improve the transmission efficiency, the master device configures SCLK to 20MHz to quickly complete the data transmission; when a small amount of data (such as less than 1kB) is transmitted, in order to improve the transmission quality, the master device configures SCLK to less than 10MHz to accurately complete the data transmission.

[0165] After the legitimacy verification of the security daemon passes, the industrial control intelligent terminal starts. When the legitimacy verification of U-BOOT passes, the industrial control intelligent terminal completes the security startup and formally enters the business work. The security daemon in the present invention exists in the entire system life cycle. In addition to completing the security closed-loop verification at startup, it usually runs independently in the background and can also verify and monitor other user APPs, thereby ensuring the security and legitimacy of other user APPs. The present invention adds a security daemon APP, which starts with the system when the machine is turned on, verifies the legitimacy of U-BOOT, and forms an effective security closed-loop verification process, which is conducive to ensuring the overall security of the industrial control intelligent terminal from the system to the application, making up for the lack of security authentication or adopting a one-way chain authentication scheme like Android, and can also make up for the problem of insufficient security of international public algorithms such as RSA and MD5, thereby realizing security authentication of U-BOOT, Kernel and APP, and ensuring the security of the industrial control intelligent terminal to enter formal business work.

[0166] Embodiment 3:

[0167] The present invention based on the same inventive concept also provides a safe startup system for an industrial control intelligent terminal, the structural composition diagram is shown in FIG. Fig.10 As shown, including:

[0168] The boot program startup module is used to start the embedded universal boot program of the industrial control intelligent terminal and read the file signature information of the operating system kernel through the embedded universal boot program;

[0169] The system kernel verification module is used to verify the legitimacy of the operating system kernel based on the file signature information of the operating system kernel;

[0170] The daemon verification module is used to start the security daemon after the legitimacy verification of the operating system kernel passes, and to verify the legitimacy of the security daemon;

[0171] The boot program verification module is used to read the file signature information of the embedded universal boot program through the security daemon process after the legitimacy verification of the security daemon process is passed, and verify the legitimacy of the embedded universal boot program; when the legitimacy verification of the embedded universal boot program is passed, the industrial control intelligent terminal completes the secure startup.

[0172] In a possible implementation, the boot program startup module may include:

[0173] A loader startup unit, used to start the secondary program loader of the industrial control intelligent terminal;

[0174] A program reading unit, used for reading the embedded universal boot program through the secondary program loader, and storing the embedded universal boot program in the off-chip random access memory running memory of the industrial control intelligent terminal;

[0175] A program startup unit, used for starting an embedded universal boot program in an off-chip random access memory running memory;

[0176] The signature reading unit is used to read the file signature information of the operating system kernel through the embedded universal boot program.

[0177] In a possible implementation, the boot program startup module may further include:

[0178] A kernel loading unit, used for loading the operating system kernel into the off-chip random access memory running memory through the embedded universal boot program;

[0179] The kernel startup unit is used to start the operating system kernel in the off-chip random access memory running memory.

[0180] In a possible implementation, the system kernel verification module may be used to:

[0181] According to the file signature information of the operating system kernel, the legality of the file signature information of the operating system kernel is verified by calling the national secret algorithm in the external security encryption chip;

[0182] Among them, the key certificate is stored in the security encryption chip.

[0183] In a possible implementation, the daemon process verification module may include:

[0184] The process startup unit is used to start the operating system after the legitimacy verification of the operating system kernel is passed, and start the security daemon process following the operating system;

[0185] The process verification unit is used to obtain the file signature information of the security daemon process and verify the legitimacy of the security daemon process based on the file signature information of the security daemon process.

[0186] In a possible implementation, the bootstrap verification module may be used to:

[0187] According to the file signature information of the embedded universal boot program, the legitimacy of the embedded universal boot program is verified by calling the national secret algorithm in the security encryption chip.

[0188] For example, the security encryption chip in the above boot program verification module is connected to the system-level chip in the industrial control intelligent terminal through a serial peripheral interface.

[0189] For example, the security encryption chip in the boot program verification module and the system-level chip communicate with each other using a private communication protocol of a serial peripheral interface;

[0190] For example, the frame format of the proprietary communication protocol of the serial peripheral interface includes: a frame header, a data length, a command field, data content, a frame tail, and a CRC32 check.

[0191] Embodiment 4:

[0192] like Fig.11 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0193] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement the corresponding method flow or corresponding functions, so as to implement the steps of a secure startup method for an industrial control intelligent terminal in the above-mentioned embodiment.

[0194] Embodiment 5:

[0195] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in electronic devices and extended storage media supported by electronic devices. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a secure startup method for an industrial control intelligent terminal in the above embodiment.

[0196] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0197] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0198] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0199] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0200] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims to be approved.

Claims

1. A secure startup method for an industrial control intelligent terminal, characterized in that: include: Starting the embedded universal boot program of the industrial control intelligent terminal, and reading the file signature information of the operating system kernel through the embedded universal boot program; Performing legitimacy verification on the operating system kernel according to the file signature information of the operating system kernel; When the legitimacy verification of the operating system kernel is passed, the security daemon process is started and the legitimacy verification of the security daemon process is performed; When the legitimacy verification of the security daemon passes, the file signature information of the embedded universal boot program is read by the security daemon to verify the legitimacy of the embedded universal boot program; When the legitimacy verification of the embedded universal boot program is passed, the industrial control intelligent terminal completes the secure startup; Wherein, when the legitimacy verification of the operating system kernel is passed, starting the security daemon process and performing legitimacy verification on the security daemon process includes: When the legitimacy verification of the operating system kernel is passed, the operating system is started, and the security daemon process is started following the operating system; Obtaining file signature information of the security daemon process, and verifying the legitimacy of the security daemon process according to the file signature information of the security daemon process; The step of verifying the legitimacy of the operating system kernel according to the file signature information of the operating system kernel includes: According to the file signature information of the operating system kernel, the legitimacy of the file signature information of the operating system kernel is verified by calling the national secret algorithm in the external security encryption chip; Wherein, the security encryption chip stores a key certificate; The embedded universal boot program for starting the industrial control intelligent terminal includes: Starting the secondary program loader of the industrial control intelligent terminal; Reading the embedded universal boot program through the secondary program loader, and storing the embedded universal boot program in the off-chip random access memory running memory of the industrial control intelligent terminal; The embedded universal boot program is started in the off-chip random access memory running memory.

2. The method according to claim 1, characterized in that The legitimacy verification of the embedded universal boot program includes: According to the file signature information of the embedded universal boot program, the legitimacy of the embedded universal boot program is verified by calling the national secret algorithm in the security encryption chip.

3. The method according to claim 1 or 2, characterized in that The security encryption chip is connected to the system-level chip in the industrial control intelligent terminal through a serial peripheral interface.

4. The method according to claim 3, characterized in that The security encryption chip and the system-level chip communicate with each other using the private communication protocol of the serial peripheral interface; The frame format of the private communication protocol of the serial peripheral interface includes: frame header, data length, command field, data content, frame tail and CRC32 check.

5. The method according to claim 1, characterized in that The operating system kernel includes the following startup process: Loading the operating system kernel into the off-chip random access memory running memory through the embedded universal boot program; The operating system kernel is started in the off-chip random access memory running memory.

6. A secure boot system for an industrial control intelligent terminal, characterized in that: include: Boot program startup module: used to start the embedded universal boot program of the industrial control intelligent terminal, and read the file signature information of the operating system kernel through the embedded universal boot program; A system kernel verification module, used to verify the legitimacy of the operating system kernel according to the file signature information of the operating system kernel; A daemon process verification module, used to start a security daemon process and perform a legitimacy verification on the security daemon process after the legitimacy verification of the operating system kernel is passed; A boot program verification module, used to read the file signature information of the embedded universal boot program through the security daemon process to verify the legitimacy of the embedded universal boot program after the legitimacy verification of the security daemon process is passed; When the legitimacy verification of the embedded universal boot program is passed, the industrial control intelligent terminal completes the secure startup; The daemon process verification module comprises: A process starting unit, used to start the operating system after the legitimacy verification of the operating system kernel is passed, and start the security daemon process following the operating system; A process verification unit, used to obtain the file signature information of the security daemon process and verify the legitimacy of the security daemon process according to the file signature information of the security daemon process; The system kernel verification module is specifically used for: According to the file signature information of the operating system kernel, the legitimacy of the file signature information of the operating system kernel is verified by calling the national secret algorithm in the external security encryption chip; Wherein, the security encryption chip stores a key certificate; The boot program startup module includes: A loader startup unit, used to start the secondary program loader of the industrial control intelligent terminal; A program reading unit, used for reading the embedded universal boot program through the secondary program loader, and storing the embedded universal boot program in the off-chip random access memory running memory of the industrial control intelligent terminal; A program startup unit is used to start the embedded universal boot program in the off-chip random access memory running memory.

7. An electronic device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, a secure startup method for an industrial control intelligent terminal as described in any one of claims 1 to 5 is implemented.

8. A computing device readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, a safe startup method for an industrial control intelligent terminal as described in any one of claims 1 to 5 is implemented.

Images