Linux system based on RISC-V architecture and integrated with PENGLAI trusted execution environment and building method of Linux system

Abstract

The invention discloses a Linux system integrating a PENGLAI trusted execution environment based on an RISC-V framework and a building method of the Linux system. The Linux system comprises a software part and a hardware part. The software part covers a user side application, a Linux operating system and an Enclave SDK (Software Development Kit); the hardware part adopts an SoC chip; burning the bit stream of the SoC onto the development board, and transmitting the OpenSBI bootstrap program into the development board through a Uart serial port and loading the OpenSBI bootstrap program; entering a U-Boot configuration interface to configure an IP (Internet Protocol) of the development board by using a command line so as to start a TFTP (Thin File Transfer Protocol) service; the Linux mirror image file is transmitted into the development board and loaded, and a Linux terminal is entered; a driving program and a main program of the PENGLAI trusted execution environment are introduced, and environment building is completed. The method is suitable for scenes with high system security and credibility requirements, and provides protection of the whole system life cycle, such as secure starting, secure storage and secure operation.

Description

Technical Field

[0001] The present invention relates to the field of computer system security and trusted execution environment, and in particular to a Linux system integrating a PENGLAI trusted execution environment based on a RISC-V architecture and a construction method thereof. Background Art

[0002] In the field of chip instruction set architecture, X86 and ARM have long occupied a dominant position, and almost all mobile and PC chips are designed using these two architectures. However, with the promotion of open source code and the continuous development of the RISC-V ecosystem, RISC-V has received widespread attention. RISC-V is an open source instruction set architecture (ISA) based on the Reduced Instruction Set Computer (RISC), jointly developed by researchers at the University of California, Berkeley and industrial partners. The design goal of RISC-V is to provide a flexible, scalable, high-performance, and low-power processor architecture that can be used in various fields, such as embedded systems, servers, high-performance computing, etc.

[0003] RocketChip is an open source SoC (System-on-Chip) design platform developed by the University of California, Berkeley, Stanford University, Google and other institutions. RocketChip is based on the RISC-V instruction set architecture and provides a flexible and scalable SoC design platform that can be used to build high-performance, low-power processor chips. RocketChip provides a rich IP (Intellectual Property) library, including processor cores, memory controllers, bus interfaces, peripherals, etc. Users can choose different IP combinations according to their needs to build a SoC design that suits their application scenarios. At the same time, RocketChip also provides a complete SoC design tool chain and simulation environment to facilitate user development and testing.

[0004] PENGLAI is a new TEE (Trusted Execution Environment) security system based on RISC-V architecture, which was developed by the Institute of Parallel and Distributed Systems of Shanghai Jiao Tong University and Pingbo Information Technology. PENGLAI can be adapted to any RISC-V architecture chip, and can be applied to the fields of IoT and edge computing, as well as cloud computing, to build a whole system life cycle protection from secure boot, secure storage, and secure operation to ensure system security. Unlike existing systems, PENGLAI extends the existing RISC-V hardware primitives and supports the scalability of isolated environments through software and hardware collaboration. In order to achieve the universality of the software trusted base, the PENGLAI architecture designs a layer of "security primitive" interface between the secure monitor and the specific hardware primitives. The management logic of the trusted environment instance will be implemented on this general interface without having to worry about the specific hardware isolation and protection mechanism.

[0005] In the field of computer systems, porting the Linux operating system to different hardware platforms has become a common requirement. However, due to the differences in the architecture and characteristics of different hardware platforms, corresponding porting and customization are required. Existing porting solutions often only consider the functions and performance of the operating system, while ignoring security issues. This makes the ported system vulnerable to various malicious attacks, such as buffer overflow, code injection, etc., which can lead to security issues such as system crashes, data leaks, or control. Summary of the invention

[0006] In order to solve the problem that the traditional transplantation scheme of Linux operating system to hardware platform cannot provide sufficient security guarantee and is vulnerable to malicious attacks, the present invention provides a Linux system integrating PENGLAI trusted execution environment based on RISC-V architecture and its construction method; it not only includes the functions and performance of traditional Linux operating system, but also can protect the system from various malicious attacks, and prevent security threats such as unauthorized access and data leakage.

[0007] To achieve the above object, the present invention provides a method for building a Linux system based on RISC-V architecture and integrating PENGLAI trusted execution environment, comprising: Prepare the software and hardware parts of the system. The software part includes user-side applications, Linux operating system, and Enclave SDK for building a trusted execution environment. The Linux operating system includes OpenSBI, U-Boot, and Linux image files. The hardware part is a SoC chip that supports the RocketChip platform, including chip IP core, AXI bus protocol, Ethernet network port, Uart peripherals, and DDR4 memory. Burn the bitstream of the SoC chip to the development board, transfer the OpenSBI boot program to the development board through the Uart serial port and load it; after OpenSBI is loaded, use U-Boot as the payload of OpenSBI, enter the U-Boot configuration interface, and use the command line to configure the IP of the development board to enable the TFTP service; transfer the Linux image file to the development board through the TFTP service and load it, and enter the Linux terminal of the development board after loading; then transfer the driver and main program of the PENGLAI trusted execution environment through the TFTP service to complete the environment construction.

[0008] Furthermore, the Linux image file includes a Linux kernel, a root file system and a device tree file.

[0009] Furthermore, the RISC-V tool chain is used to compile OpenSBI, U-Boot, Linux kernel and root file system, where the device tree file is compiled into a binary format by the compilation tool, and the device tree file in the Linux kernel image is used to describe the system hardware architecture.

[0010] Furthermore, U-Boot is compiled as the payload of OpenSBI to generate binary files, and Buildroot is used to generate the root file system.

[0011] Further, entering the U-Boot configuration interface and using a command line to configure the IP of the development board to enable the TFTP service includes: configuring a TFTP server in the host; entering the U-Boot configuration interface and using a command line to configure the IP address, subnet mask, default gateway and TFTP server IP address of the development board to enable the TFTP service.

[0012] Furthermore, configuring the TFTP server in the host specifically includes: installing the TFTP server in the host, editing the configuration file of the TFTP server, and modifying the configuration parameters therein to configure the TFTP server; after the modification is completed, restarting the TFTP server to make the configuration take effect.

[0013] Furthermore, the IP addresses of the host and the development board are in the same network segment.

[0014] To achieve the above purpose, the present invention also provides a Linux system based on RISC-V architecture and integrated with PENGLAI trusted execution environment, which is built by the above-mentioned building method; the system includes: The SOC module designed based on the RocketChip platform is used to provide the hardware basic environment; A tailored Linux kernel module used to provide an operating system environment to run user software programs; OpenSBI module with PENGLAI to support RISC-V instruction architecture and provide a trusted execution environment.

[0015] To achieve the above-mentioned purpose, the present invention also provides an electronic device, including a memory and a processor, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-mentioned method of building a Linux system based on the RISC-V architecture and integrating the PENGLAI trusted execution environment.

[0016] To achieve the above objectives, the present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method for building a Linux system based on the RISC-V architecture and integrating the PENGLAI trusted execution environment is implemented.

[0017] The beneficial effects of the present invention include: 1. The present invention designs a Linux system that integrates the PENGLAI trusted execution environment on a SOC based on the RISC-V instruction architecture, adopts a software and hardware combination method, transplants the Linux operating system and improves the security and reliability of the system; 2. The present invention transplants the Linux operating system on RocketChip. RocketChip is an open source RISC-V processor SoC with high customizability and scalability. The present invention fully utilizes the advantages of the RISC-V architecture and provides the system with higher flexibility and freedom; 3. The present invention integrates the PENGLAI trusted execution environment, realizes the complete protection of the system kernel and user space applications, can effectively prevent malicious attacks and data leakage, and improves the security and reliability of the system; 4. The present invention can be widely used in various fields, such as cloud computing, network security, etc. As a solution based on RISC-V architecture, it not only provides a highly customizable hardware platform, but also provides users with a secure and reliable computing environment. This integration method reflects the flexibility and security of the RISC-V architecture and provides users with a more reliable and trustworthy computing platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0019] Figure 1 It is a diagram of the software and hardware structure of the present invention; Figure 2 A network communication configuration diagram of the present invention; Figure 3 A flowchart for executing the system of the present invention; Figure 4 It is a schematic diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0020] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0021] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0022] It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0023] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0024] The present invention provides a method for building a Linux system based on a RISC-V architecture and integrating a PENGLAI trusted execution environment, comprising: 1. The architecture of the Linux system based on RISC-V architecture integrated with PENGLAI trusted execution environment designed by the present invention is as follows Figure 1 As shown. The system consists of two parts: software and hardware. The software part includes the Linux OS (Operate System) operating system, the Enclave SDK for building a trusted execution environment, and the user-side Applocation (application). The operating system side mainly includes OpenSBI (Open Source Supervisor Binary Interface), U-Boot (Universal Boot Loader) and Linux image files; the hardware part is a SoC (System of Chip) that supports the RocketChip platform, including the chip IP (intellectualpropert) core Core, AXI (Advanced eXtensible Interface) bus protocol, Ethernet network port, Uart peripherals (Universal Asynchronous Receiver / Transmitter) and DDR4 (Double-Data-Rate Fourth) memory.

[0025] 2. Plug the development board into the power cord, and connect it to the computer via the Uart serial port and Ethernet interface. Configure the computer's local IP address to ensure that it can be connected to the development board via Ethernet later.

[0026] 3. The overall construction process is as follows Figure 3 As shown, open the file burning software vivado and burn the prepared Soc binary file (SOC bin) into the development board.

[0027] 4. After burning, transfer the OpenSBI bootloader with PENGLAI through the Uart serial port and load it.

[0028] 5. After loading is complete, use U-Boot as the payload of OpenSBI to enter the U-boot configuration interface. Next, you need to pass in the Linux image file. Because the file is large, you need to transfer the file through TFTP (Trivial File Transfer Protocol).

[0029] The Linux image file includes the Linux kernel, the root file system (Root File System) and the device tree file.

[0030] Furthermore, the RISC-V tool chain is used to compile OpenSBI, U-Boot, Linux kernel and root file system, where the device tree file is compiled into binary format by the compilation tool, and the device tree file in the Linux kernel image is used to describe the system hardware architecture. U-Boot is compiled as the payload of OpenSBI to generate a binary file, and Buildroot is used to generate the root file system.

[0031] 6. Configure the TFTP server in the host: Install the TFTP server, then edit the configuration file of the TFTP server and modify the configuration parameters to configure the TFTP server. After the modification is completed, you need to restart the TFTP server for the configuration to take effect. Copy the files to be shared on the TFTP server to the root directory of the TFTP server, and start the TFTP server to start providing services.

[0032] 7. Enter the U-Boot configuration interface and use the command line to configure the IP address, subnet mask, default gateway and TFTP server IP address of the development board to enable the TFTP service. Figure 2 As shown, Figure 2 The Windows 10 host computer + virtual Ubuntu system is used. The Windows 10 host and the virtual machine are connected through a virtual network card. The IP address can be found in Figure 2 You can also set it yourself. It should be noted that you must ensure that the IP addresses of the host, virtual machine, and development board are in the same network segment.

[0033] 8. After configuring the TFTP server, transfer the Linux image file to the development board through TFTP and load it. After loading is complete, you will enter the Linux terminal of the development board.

[0034] Furthermore, the development board is configured in the Linux open source code, and the Linux kernel image is compiled using the tool chain; the Linux kernel source code is used as the compilation path, and the kernel module penglai.ko is compiled using the tool chain in the open source code of the PENGLAI trusted execution environment.

[0035] 9. Finally, the driver (penglai.ko) and host program (host prime) of the PENGLAI trusted execution environment to be run are transferred through TFTP, thus completing the construction of the Linux system integrating the PENGLAI trusted execution environment on the SOC based on the RISC-V instruction architecture.

[0036] 10. Run the routines officially provided by PENGLAI to verify the correctness of the built system.

[0037] The present invention also provides a Linux system based on RISC-V architecture and integrated with PENGLAI trusted execution environment, which is constructed by using the above construction method; the system comprises: The SOC module designed based on the RocketChip platform is used to provide the hardware basic environment; A tailored Linux kernel module that provides an operating system environment to run user software programs; The OpenSBI module with PENGLAI is used to support the RISC-V instruction architecture and provide a trusted execution environment. This part is the core of the software function.

[0038] For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The system embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application. A person of ordinary skill in the art can understand and implement it without creative work.

[0039] Corresponding to the aforementioned embodiment of the method for building a Linux system based on the RISC-V architecture integrated with the PENGLAI trusted execution environment, the embodiment of the present application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the aforementioned method for building a Linux system based on the RISC-V architecture integrated with the PENGLAI trusted execution environment. Figure 4 As shown, a hardware structure diagram of any device with data processing capability is provided for the method of building a Linux system based on the RISC-V architecture integrated with the PENGLAI trusted execution environment provided in the embodiment of the present application, except Figure 4 In addition to the processor, memory, DMA controller, disk, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiment is located may also include other hardware, which will not be described in detail, generally based on the actual functions of the device with data processing capabilities.

[0040] Corresponding to the aforementioned embodiment of the method for building a Linux system based on the RISC-V architecture integrating the PENGLAI trusted execution environment, an embodiment of the present invention further provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the method for building a Linux system based on the RISC-V architecture integrating the PENGLAI trusted execution environment in the above embodiment.

[0041] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit of any device with data processing capability and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0042] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0043] The above embodiments are only used to illustrate the design ideas and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design ideas disclosed by the present invention are within the protection scope of the present invention.

Claims

1. A method for building a Linux system based on RISC-V architecture and integrated with PENGLAI trusted execution environment, characterized in that: include: Prepare the software and hardware parts of the system. The software part includes user-side applications, Linux operating system, and Enclave SDK for building a trusted execution environment. The Linux operating system includes OpenSBI, U-Boot, and Linux image files. The hardware part is a SoC chip that supports the RocketChip platform, including chip IP core, AXI bus protocol, Ethernet network port, Uart peripherals, and DDR4 memory. Burn the bitstream of the SoC chip to the development board, transfer the OpenSBI bootloader to the development board through the Uart serial port and load it; After OpenSBI is loaded, use U-Boot as the payload of OpenSBI, enter the U-Boot configuration interface, and use the command line to configure the IP of the development board to enable the TFTP service; transfer the Linux image file to the development board through the TFTP service and load it. After loading, enter the Linux terminal of the development board; then transfer the driver and main program of the PENGLAI trusted execution environment through the TFTP service to complete the environment construction.

2. The method for building a Linux system based on RISC-V architecture integrated with PENGLAI trusted execution environment according to claim 1, characterized in that: The Linux image file includes a Linux kernel, a root file system and a device tree file.

3. The method for building a Linux system based on RISC-V architecture integrated with PENGLAI trusted execution environment according to claim 2, characterized in that: Use the RISC-V tool chain to compile OpenSBI, U-Boot, Linux kernel and root file system. The device tree file is compiled into binary format by the compilation tool. The device tree file in the Linux kernel image is used to describe the system hardware architecture.

4. The method for building a Linux system based on RISC-V architecture integrated with PENGLAI trusted execution environment according to claim 2, characterized in that: Compile U-Boot as a payload for OpenSBI to generate a binary file and use Buildroot to generate the root file system.

5. The method for building a Linux system based on RISC-V architecture integrated with PENGLAI trusted execution environment according to claim 1, characterized in that: The step of entering the U-Boot configuration interface and configuring the IP of the development board with a command line to enable the TFTP service includes: configuring a TFTP server in the host; entering the U-Boot configuration interface and configuring the IP address, subnet mask, default gateway and IP address of the TFTP server with a command line to enable the TFTP service.

6. The method for building a Linux system based on RISC-V architecture integrated with PENGLAI trusted execution environment according to claim 5, characterized in that: To configure the TFTP server in the host, install the TFTP server in the host, edit the configuration file of the TFTP server, modify the configuration parameters to configure the TFTP server; after the modification, restart the TFTP server to make the configuration take effect.

7. The method for building a Linux system based on RISC-V architecture integrated with PENGLAI trusted execution environment according to claim 5, characterized in that: The IP addresses of the host and development board are in the same network segment.

8. A Linux system based on RISC-V architecture and integrated with PENGLAI trusted execution environment, characterized in that: The system is constructed by the construction method according to any one of claims 1 to 7; the system comprises: The SOC module designed based on the RocketChip platform is used to provide the hardware basic environment; A tailored Linux kernel module used to provide an operating system environment to run user software programs; OpenSBI module with PENGLAI to support RISC-V instruction architecture and provide a trusted execution environment.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the method for building a Linux system based on the RISC-V architecture and integrating the PENGLAI trusted execution environment as described in any one of claims 1 to 7 above.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, the method for building a Linux system based on the RISC-V architecture and integrating the PENGLAI trusted execution environment as described in any one of claims 1 to 7 is implemented.

Images