Embedded Linux system security startup method based on forward and reverse signature verification of full startup process

Abstract

An embedded Linux system safe starting method based on full starting process forward and reverse signature verification is characterized in that forward and reverse signature verification operation is carried out on all starting steps including uboot-spl, uboot, a kernel, a file system starting script and safety management software in a starting process, and it is ensured that key starting files cannot be tampered. Meanwhile, in the starting process, signature information of the uboot-spl, the uboot and the kernel is recorded into a reserved memory, tracing of the starting process is carried out, it is ensured that the system is started through a correct starting link, and it is completely eradicated that forward signature verification is bypassed through the uboot-spl, the uboot and the kernel of an unauthorized partition. According to the method, the safe starting of the embedded Linux system is realized, and the normal operation of the system is ensured.

Description

Technical Field

[0001] The invention belongs to the field of system security and relates to an embedded Linux system security startup method based on full startup process forward and reverse signature verification. Background Art

[0002] The Linux system is a Unix-like operating system that is free to use and spread. It has the characteristics of open source, no copyright, and a large number of technical community users. Open source allows users to freely customize it, with high flexibility, powerful functions, and low cost. Open source also brings some security risks to the system.

[0003] In order to boot the system securely, the Chinese invention patent with patent number CN117648701B proposes a method for implementing a secure boot mechanism for an embedded operating system. The method ensures the secure management of the system by digitally signing the boot program U-boot, the kernel, and the security management software, and verifying the signature during the boot process.

[0004] However, the above solution also has huge security risks. The full boot process of embedded Linux includes: on-chip ROM firmware, uboot-spl, uboot, kernel, and file system. The on-chip ROM firmware is fixed at the factory and cannot be changed. In addition, the above solution ignores the security verification of uboot-spl. If uboot-spl is illegally tampered with, it will lead to the booting of illegal partitions of uboot and kernel. In this case, the system can also start normally. At the same time, the uboot and kernel reversely verified by the security management software are still in the legal partition and can be verified normally.

[0005] In order to solve the problem of uncontrollable system startup process, it is urgent to propose a secure startup method for embedded Linux system based on forward and reverse signature verification of the entire startup process. Summary of the invention

[0006] The purpose of the present invention is to solve the problem of uncontrollable system startup process, and propose a secure startup method for an embedded Linux system based on forward and reverse signature verification of the full startup process. The full startup process is subjected to forward and reverse signature verification operations to ensure that key startup files cannot be tampered with. At the same time, during the startup process, the signature information of uboot-spl, uboot, and the kernel is recorded in the reserved memory, and the startup process is traced to ensure that the system is started by the correct startup link, and to prevent the forward signature verification from being bypassed by unauthorized partitioned uboot-spl, uboot, and the kernel; the secure startup of the embedded Linux system is effectively solved, and the normal operation of the system is ensured.

[0007] The technical solution of the present invention is:

[0008] The present invention provides an embedded Linux system secure boot method based on full boot process forward and reverse signature verification, wherein the system is configured with three-level boot programs, wherein the first-level boot program is a chip ROM firmware, the second-level boot program is a boot program uboot-spl, and the third-level boot program is a boot program uboot; the boot method comprises the following steps:

[0009] S1. Run the chip ROM firmware and load the boot program uboot-spl;

[0010] S2, run the boot program uboot-spl, read the signature of the boot program uboot, write it to the first position of the reserved memory, and load the boot program uboot;

[0011] S3, run the boot program uboot, read the signatures of the boot program uboot-spl and the kernel, and write them into the second and third positions of the reserved memory, respectively verify the signatures of the boot program uboot-spl and the kernel, and continue to execute after the signatures are verified, otherwise stop the startup;

[0012] S4, run the kernel, and verify the signatures of the boot program uboot, the startup script in the file system, and the security management software based on the signature verification program in the kernel Ramdisk; continue to execute if the signature verification passes, otherwise stop the startup;

[0013] S5. Run the security management software, read the signature information of the boot program uboot-spl, the boot program uboot and the kernel, and perform reverse signature verification on the boot program uboot-spl, the boot program uboot and the kernel respectively;

[0014] At the same time, the signature information is compared with the signature information at the first position, the second position, and the third position respectively to backtrack the startup process;

[0015] After the signature verification passes and the signature information comparison results are consistent, continue execution and start the business software that has passed the signature verification, otherwise stop starting.

[0016] Furthermore, the first-level boot program ROM firmware is built-in when the chip is shipped out of the factory.

[0017] Furthermore, the end of the file of the boot program uboot-spl is padded with 0 until the last 1K byte of the storage partition stores the signature information; when reading the signature, the last 1K data of the boot program uboot-spl storage partition is read, which is the signature information;

[0018] The boot program uboot and the kernel are packaged in FIT format, and signature information is added at the end of the file. When reading the signature, the device tree parsing syntax is used to parse it to obtain the source file size and the location of the signature information.

[0019] Furthermore, the signature verification includes the following steps:

[0020] (1) Read the signature file and separate the original file content and the signature content;

[0021] (2) Transplant the SM3 algorithm and calculate the hash value of the original file content according to the SM3 algorithm;

[0022] (3) Send the signature content in step (1) and the hash value in step (2) to the security chip through the SPI bus for signature verification;

[0023] (4) Obtain the signature verification result based on the return value of the security chip.

[0024] Furthermore, the signature verification program in the kernel Ramdisk is located in the Ramdisk file system, and the Ramdisk and the kernel are packaged together into the same FIT image file, and the image file is signed;

[0025] When reading the signature, the device tree parsing syntax is used to parse and obtain the source file size and the location of the signature information.

[0026] Furthermore, S4 is specifically:

[0027] (1) Load the kernel Ramdisk file system and run the signature verification program;

[0028] (2) Verify the signature of the boot program uboot. If it passes, proceed to the next step, otherwise stop booting;

[0029] (3) Verify the signature of the startup script in the file system. If it passes, proceed to the next step. Otherwise, stop the startup.

[0030] (4) Verify the signature of the security management software in the file system. If it passes, proceed to the next step. Otherwise, stop the startup.

[0031] A computer device comprising: one or more processors;

[0032] The processor is used to store one or more programs;

[0033] When the one or more programs are executed by the one or more processors, the embedded Linux system secure startup method based on full startup process forward and reverse signature verification is implemented.

[0034] A computer-readable storage medium stores a computer program, which, when executed, implements the embedded Linux system secure startup method based on full startup process forward and reverse signature verification.

[0035] Beneficial effects of the present invention:

[0036] The secure boot method of the full boot process forward and reverse signature verification of the present invention can trace back the boot process, and compare the signature information of uboot-spl, uboot and kernel in the reserved memory to ensure that the entire system is started from the correct link, and eliminate the replacement of uboot-spl, uboot and kernel to start from an unauthorized link.

[0037] In the present invention, since the partition capacity for storing the boot program uboot-spl is very limited and complex encryption and decryption algorithms cannot be transplanted, the boot program uboot-spl itself does not perform signature verification; in order to verify the legitimacy of the boot program uboot-spl, signature information is added to it, and reverse signature verification of the boot program uboot-spl is performed in subsequent steps.

[0038] In the present invention, the signature verification program is placed in the Ramdisk file system, and the Ramdisk and the kernel are packaged together into the same FIT image, and the image is signed to ensure that the signature verification program in step S4 cannot be changed.

[0039] Other features and advantages of the present invention will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other objects, features and advantages of the present invention will become more apparent through a more detailed description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present invention.

[0041] Figure 1 This is the overall architecture diagram of the system security startup process of the present invention.

[0042] Figure 2 It is an implementation flow chart of starting the boot program uboot of the present invention.

[0043] Figure 3 This is a flowchart of the implementation of kernel startup of the present invention.

[0044] Figure 4 This is an implementation flow chart of the security management software startup of the present invention. DETAILED DESCRIPTION

[0045] The preferred embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0046] Example 1

[0047] Figure 1 The overall architecture diagram of the system security startup process of the present invention is shown.

[0048] like Figure 1 As shown, a secure boot method for an embedded Linux system based on forward and reverse signature verification of the full boot process, the system is configured with a three-level boot program, the first-level boot program is a chip ROM firmware, the second-level boot program is a boot program uboot-spl, and the third-level boot program is a boot program uboot; the boot method comprises the following steps:

[0049] S1. Run the chip ROM firmware and load the boot program uboot-spl;

[0050] S2, run the boot program uboot-spl, read the signature of the boot program uboot, write it to the first position of the reserved memory, and load the boot program uboot;

[0051] S3, run the boot program uboot, read the signatures of the boot program uboot-spl and the kernel, and write them into the second and third positions of the reserved memory, respectively verify the signatures of the boot program uboot-spl and the kernel, and continue to execute after the signatures are verified, otherwise stop the startup;

[0052] S4, run the kernel, and verify the signatures of the boot program uboot, the startup script in the file system, and the security management software based on the signature verification program in the kernel Ramdisk; continue to execute if the signature verification passes, otherwise stop the startup;

[0053] S5. Run the security management software, read the signature information of the boot program uboot-spl, the boot program uboot and the kernel, and perform reverse signature verification on the boot program uboot-spl, the boot program uboot and the kernel respectively;

[0054] At the same time, the signature information is compared with the signature information at the first position, the second position, and the third position respectively to backtrack the startup process;

[0055] After the signature verification passes and the signature information comparison results are consistent, continue execution and start the business software that has passed the signature verification, otherwise stop starting.

[0056] In this example, the ROM firmware is built-in at the chip factory and reads uboot-spl from the specified location. In theory, it will not cause security risks during startup, so security authentication is not performed on it in this example.

[0057] The uboot-spl file is small, so the size of the uboot-spl storage partition is also limited. The end of the uboot-spl file is padded with 0 until the last 1K byte of the storage partition, and then the signature information is stored. When reading the signature, the last 1K data of the uboot-spl partition is read, which is the signature information.

[0058] The boot program uboot and the kernel are packaged in FIT format, and signature information is added at the end of the file. When reading the signature, the device tree parsing syntax is used to parse it to obtain the source file size and the location of the signature information.

[0059] In step S2 of this example, since the capacity of the uboot-spl partition is very limited and complex encryption algorithms and device drivers cannot be transplanted, the signature verification is performed in uboot-spl, and the signature verification of uboot-spl is reversely verified in the subsequent uboot. The signature information of uboot is read and written to the specified location of the reserved memory for subsequent boot process backtracking.

[0060] In one example, if Figure 2 As shown, it is an implementation flow chart of booting the boot program uboot, step S3 includes:

[0061] S31, parse the uboot-spl partition, read uboot-spl and its signature respectively; in the uboot-spl partition structure, uboot-spl is stored in the partition header, and the last 512 bytes of space are reserved for storing signature information;

[0062] Write the uboot-spl signature to the specified location of the reserved memory for subsequent boot process backtracing;

[0063] S32, parsing the kernel partition, reading the kernel and its signature respectively; the kernel partition image is packaged in FIT (Flattened Image Tree) format and parsed in standard device tree parsing syntax, so as to determine the source file size and the location of the signature information;

[0064] Write the kernel signature to the specified location in the reserved memory for subsequent boot process backtracing

[0065] S33, transplant the national secret SM3 algorithm;

[0066] Use the SM3 algorithm to calculate the hash value of uboot-spl, and send it together with the uboot-spl signature through the SPI bus to the security chip for signature verification. If it passes, proceed to the next step, otherwise stop booting

[0067] Use the SM3 algorithm to calculate the kernel hash value and send it together with the kernel signature to the security chip through the SPI bus for signature verification. If it passes, proceed to the next step, otherwise stop starting;

[0068] S34. Load the kernel.

[0069] In one example, if Figure 3 As shown, it is an implementation flow chart of the kernel startup of the present invention, and step S4 includes:

[0070] S41, load the kernel Ramdisk file system and run the signature verification program therein;

[0071] S42, refer to the signature verification step in step S33 of this example, verify the signature of uboot, and proceed to the next step if it passes, otherwise stop booting;

[0072] S43. Continue to check the signature of the startup script in the root file system (usually rc.local). If it passes, proceed to the next step, otherwise stop the startup.

[0073] S44. Continue to verify the signature of the security management software in the root file system. If it passes, proceed to the next step, otherwise stop starting.

[0074] In one example, if Figure 4 As shown, it is an implementation flow chart of the security management software startup of the present invention, and step S5 includes:

[0075] S51, reverse signature verification of uboot-spl, uboot, and kernel;

[0076] S52, backtrack the boot process and compare the signatures of uboot-spl, uboot, and kernel written into the reserved memory in steps S2 and S3. If the comparison is successful, it proves that the boot link is safe and reliable, and the root file system is loaded; otherwise, the boot is stopped;

[0077] S53, after the root file system is loaded, the system startup script starts the security management software;

[0078] S54. The security management software verifies the signatures of other business software and starts the business software that has passed the signature verification.

[0079] Example 2

[0080] A computer device comprising: one or more processors;

[0081] The processor is used to store one or more programs;

[0082] When the one or more programs are executed by the one or more processors, the embedded Linux system secure startup method based on full startup process forward and reverse signature verification is implemented.

[0083] Example 3

[0084] A computer-readable storage medium stores a computer program, which, when executed, implements the embedded Linux system secure startup method based on full startup process forward and reverse signature verification.

[0085] The embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments.

Claims

1. A secure boot method for an embedded Linux system based on forward and reverse signature verification of the full boot process, characterized in that: The system is configured with three-level boot programs, the first-level boot program is the chip ROM firmware, the second-level boot program is the boot program uboot-spl, and the third-level boot program is the boot program uboot; the startup method comprises the following steps: S1. Run the chip ROM firmware and load the boot program uboot-spl; S2, run the boot program uboot-spl, read the signature of the boot program uboot, write it to the first position of the reserved memory, and load the boot program uboot; S3, run the boot program uboot, read the signatures of the boot program uboot-spl and the kernel, and write them into the second and third positions of the reserved memory, respectively verify the signatures of the boot program uboot-spl and the kernel, and continue to execute after the signatures are verified, otherwise stop the startup; S4, run the kernel, and verify the signatures of the boot program uboot, the startup script in the file system, and the security management software based on the signature verification program in the kernel Ramdisk; continue to execute if the signature verification passes, otherwise stop the startup; S5. Run the security management software, read the signature information of the boot program uboot-spl, the boot program uboot and the kernel, and perform reverse signature verification on the boot program uboot-spl, the boot program uboot and the kernel respectively; At the same time, the signature information is compared with the signature information at the first position, the second position, and the third position respectively to backtrack the startup process; After the signature verification passes and the signature information comparison results are consistent, continue execution and start the business software that has passed the signature verification, otherwise stop starting.

2. The method for secure booting of an embedded Linux system based on forward and reverse signature verification of the full boot process according to claim 1, characterized in that: The first-level boot program ROM firmware is built-in when the chip leaves the factory.

3. The method for secure booting of an embedded Linux system based on forward and reverse signature verification of the full boot process according to claim 1, characterized in that: The end of the boot program uboot-spl file is padded with 0 until the last 1K byte of the storage partition stores the signature information; when reading the signature, the last 1K data of the boot program uboot-spl storage partition is read, which is the signature information; The boot program uboot and the kernel are packaged in FIT format, and signature information is added at the end of the file. When reading the signature, the device tree parsing syntax is used to parse it to obtain the source file size and the location of the signature information.

4. The method for secure booting of an embedded Linux system based on forward and reverse signature verification of the full boot process according to claim 1 is characterized in that The signature verification process includes the following steps: (1) Read the signature file and separate the original file content and the signature content; (2) Transplant the SM3 algorithm and calculate the hash value of the original file content according to the SM3 algorithm; (3) Send the signature content in step (1) and the hash value in step (2) to the security chip through the SPI bus for signature verification; (4) Obtain the signature verification result based on the return value of the security chip.

5. The method for secure booting of an embedded Linux system based on forward and reverse signature verification of the full boot process according to claim 1 is characterized in that ； The signature verification program in the kernel Ramdisk is located in the Ramdisk file system. The Ramdisk and the kernel are packaged together into the same FIT image file, and the image file is signed; When reading the signature, the device tree parsing syntax is used to parse and obtain the source file size and the location of the signature information.

6. The method for secure booting of an embedded Linux system based on forward and reverse signature verification of the full boot process according to claim 1 is characterized in that S4 is specifically: (1) Load the kernel Ramdisk file system and run the signature verification program; (2) Verify the signature of the boot program uboot. If it passes, proceed to the next step, otherwise stop booting; (3) Verify the signature of the startup script in the file system. If it passes, proceed to the next step. Otherwise, stop the startup. (4) Verify the signature of the security management software in the file system. If it passes, proceed to the next step. Otherwise, stop the startup.

7. A computer device, characterized in that: include: one or more processors; The processor is used to store one or more programs; When the one or more programs are executed by the one or more processors, the embedded Linux system secure boot method based on full boot process forward and reverse signature verification as described in any one of claims 1 to 6 is implemented.

8. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed, the embedded Linux system secure startup method based on full startup process forward and reverse signature verification as described in any one of claims 1 to 6 is implemented.

Images