An embedded Linux system security starting method based on forward and reverse signature verification of full starting process

Abstract

A kind of embedded Linux system security starting method based on full starting procedure forward and reverse signature verification, in starting procedure, including uboot-spl, uboot, kernel, file system starting script, security management software, all starting steps are carried out forward and reverse signature verification operation, ensure that key starting file is not tampered with.Simultaneously, in starting process, the signature information of uboot-spl, uboot, kernel is recorded in reserved memory, the trace of starting process is implemented, ensure that the system is started by correct starting link, prevent bypassing forward signature verification by unauthorized uboot-spl, uboot, kernel in partition.The present application solves the security starting of embedded Linux system, ensures the normal operation of system.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of system security, and relates to an embedded Linux system security starting method based on forward and reverse signature verification of a full starting process. BACKGROUND

[0002] Linux system is a Unix-like operating system that can be used and spread freely, has the characteristics of open source code, no copyright, and a large number of technical community users, and the open source code enables users to freely tailor, has high flexibility, powerful functions and low cost. While being open source, the system also has some security risks.

[0003] In order to safely boot the system, a Chinese invention patent with the patent number CN117648701B proposes an embedded operating system security starting mechanism implementation method, which verifies the signature in the starting process by digitally signing the boot program U-boot, the kernel and the security management software to ensure the security management of the system.

[0004] However, the above-mentioned scheme also has huge security risks. The full starting process of the embedded Linux includes: chip on-die ROM firmware, uboot-spl, uboot, kernel and file system. The chip on-die ROM firmware is factory-fixed and cannot be changed. In addition, the above-mentioned scheme ignores the security verification of uboot-spl. If uboot-spl is illegally tampered with, it will lead to booting of illegal uboot and kernel in a partition. In this case, the system can also start normally, and the uboot and kernel verified by the reverse verification of the security management software are still in the legal partition and can pass the verification normally.

[0005] In order to solve the problem of uncontrollable system starting process, an embedded Linux system security starting method based on forward and reverse signature verification of a full starting process is urgently needed. SUMMARY

[0006] The purpose of the present application is to solve the problem of uncontrollable system starting process, and an embedded Linux system security starting method based on forward and reverse signature verification of a full starting process is proposed. The full starting process is subjected to forward and reverse signature verification operations to ensure that the key starting files cannot be tampered with. At the same time, the signature information of uboot-spl, uboot and kernel is recorded in the reserved memory during the starting process to trace the starting process and ensure that the system is started by the correct starting link, and the uboot-spl, uboot and kernel in the unauthorized partition are prevented from bypassing the forward signature verification. The security starting of the embedded Linux system is effectively solved, and the normal operation of the system is ensured.

[0007] The technical scheme of the present application is:

[0008] The application provides a security starting method of an embedded Linux system based on forward and reverse signature verification of a full starting procedure, wherein the system is configured with three starting programs, a first starting program is a chip ROM firmware, a second starting program is a starting program uboot-spl, and a third starting program is a starting program uboot; the starting method comprises the following steps:

[0009] S1, running the chip ROM firmware to load the starting program uboot-spl;

[0010] S2, running the starting program uboot-spl to read the signature of the starting program uboot and write the signature into a first position of a reserved memory, and loading the starting program uboot;

[0011] S3, running the starting program uboot to read the signatures of the starting program uboot-spl and the kernel and write the signatures into a second position and a third position of the reserved memory, respectively verifying the signatures of the starting program uboot-spl and the kernel, and continuing the execution after the verification, otherwise stopping the starting;

[0012] S4, running the kernel to verify the signatures of the starting program uboot, the starting script in the file system and the security management software based on a signature verification program in the kernel Ramdisk; continuing the execution after the verification, otherwise stopping the starting;

[0013] S5, running the security management software to read the signature information of the starting program uboot-spl, the starting program uboot and the kernel, and respectively verifying the signatures of the starting program uboot-spl, the starting program uboot and the kernel;

[0014] Meanwhile, the signature information is compared with the signature information in the first position, the second position and the third position to trace back the starting procedure;

[0015] Continuing the execution after the verification and the consistent comparison result, starting the business software after the verification, otherwise stopping the starting.

[0016] Further, the first starting program ROM firmware is built-in in the chip.

[0017] Further, the starting program uboot-spl is filled with 0 at the end of the file until the last 1K byte position of the storage partition stores the signature information; when reading the signature, the last 1K data of the storage partition of the starting program uboot-spl is read, which is the signature information;

[0018] The boot program uboot and the kernel are packaged in FIT format, and signature information is added at the end of the file; when reading the signature, the device tree parsing syntax is used for parsing to obtain the source file size and the position of the signature information.

[0019] Further, the signature verification includes the following steps:

[0020] (1) reading the signature file, separating the original file content and the signature content;

[0021] (2) transplanting the SM3 national secret algorithm, calculating the hash value of the original file content according to the SM3 national secret algorithm;

[0022] (3) sending the signature content in step (1) and the hash value in step (2) to the security chip through the SPI bus for signature verification;

[0023] (4) obtaining the signature verification result according to the return value of the security chip.

[0024] Further, the signature verification program in the kernel Ramdisk is located in the Ramdisk file system, the Ramdisk and the kernel are packaged into the same FIT image file, and the image file is signed;

[0025] When reading the signature, the device tree parsing syntax is used for parsing to obtain the source file size and the position of the signature information.

[0026] Further, the S4 is specifically:

[0027] (1) loading the kernel Ramdisk file system and running the signature verification program;

[0028] (2) verifying the boot program uboot, and if passed, the next step is performed, otherwise the startup is stopped;

[0029] (3) verifying the startup script in the file system, and if passed, the next step is performed, otherwise the startup is stopped;

[0030] (4) verifying the security management software in the file system, and if passed, the next step is performed, otherwise the startup is stopped.

[0031] A computer device, comprising: one or more processors;

[0032] The processor is configured to store one or more programs;

[0033] When the one or more programs are executed by the one or more processors, the embedded Linux system security startup method based on the full startup flow forward and reverse signature verification is implemented.

[0034] A computer readable storage medium, which has a computer program stored thereon, the computer program, when executed, implements the security booting method of the embedded Linux system based on the forward and reverse signature verification of the full booting process.

[0035] Advantages of the present application:

[0036] The security booting method of the full booting process based on the forward and reverse signature verification can trace back the booting process, compare the signature information of uboot-spl, uboot and kernel in the reserved memory, and ensure that the whole system is booted from the correct link, and prevent uboot-spl, uboot and kernel from being replaced to boot from an unauthorized link.

[0037] In the present application, the partition capacity of the storage boot program uboot-spl is limited, and complex encryption and decryption algorithms cannot be transplanted, and the boot program uboot-spl itself does not perform signature verification; in order to verify the legality of the boot program uboot-spl, signature information is added to it, and the reverse signature verification of the boot program uboot-spl is performed in the subsequent step.

[0038] In the present application, the signature verification program is placed in the Ramdisk file system, the Ramdisk and the kernel are packaged into the same FIT image, and the image is signed to ensure that the signature verification program in step S4 cannot be changed.

[0039] Other features and advantages of the present application will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0040] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which like reference characters refer to like parts throughout the several views, and wherein:

[0041] Figure 1 It is a system security booting process overall architecture diagram of the present application.

[0042] Figure 2 It is a boot program uboot booting implementation flowchart of the present application.

[0043] Figure 3 It is a kernel booting implementation flowchart of the present application.

[0044] Figure 4 It is a security management software booting implementation flowchart of the present application. DETAILED DESCRIPTION

[0045] The preferred embodiments of the present application will be described in more detail below with reference to the accompanying drawings. While the preferred embodiments of the present application are shown in the drawings, it is understood that the present application can be carried out in various forms and should not be limited by the embodiments set forth herein.

[0046] Example 1

[0047] Figure 1 The overall architecture of the system security boot flow of the present application is shown.

[0048] As shown in Figure 1 , a security boot method for an embedded Linux system based on forward and reverse signature verification of the entire boot flow, the system is configured with three levels of boot programs, the first level boot program is a chip ROM firmware, the second level boot program is a boot program uboot-spl, and the third level boot program is a boot program uboot; the boot method comprises the following steps:

[0049] S1, running the chip ROM firmware, loading the boot program uboot-spl;

[0050] S2, running the boot program uboot-spl, reading the signature of the boot program uboot and writing it to the first location of the reserved memory, loading the boot program uboot;

[0051] S3, running the boot program uboot, reading the signatures of the boot program uboot-spl and the kernel and writing them to the second and third locations of the reserved memory, respectively, verifying the signatures of the boot program uboot-spl and the kernel, and if both are passed, continuing to execute, otherwise stopping the boot;

[0052] S4, running the kernel, based on the signature verification program in the kernel Ramdisk, verifying the signatures of the boot program uboot, the startup script in the file system, and the security management software; if all are passed, continuing to execute, otherwise stopping the boot;

[0053] S5, running the security management software, reading the signature information of the boot program uboot-spl, the boot program uboot and the kernel, and respectively verifying the signatures of the boot program uboot-spl, the boot program uboot and the kernel in reverse;

[0054] At the same time, the signature information is compared with the signature information in the first, second and third locations to trace back the boot flow;

[0055] If all the signatures are passed and the signature information comparison results are consistent, continue to execute, start the business software whose signature verification is passed, otherwise stop the boot.

[0056] In the present example, the ROM firmware is built-in to the chip at the factory, and the uboot-spl is read from a specified location, which theoretically does not cause a security risk in starting, so the present example does not perform security authentication work.

[0057] The uboot-spl file is small, and the uboot-spl storage partition size is also limited. A 0 operation is performed on the end of the uboot-spl file, until the last 1K byte position of the storage partition, and then the signature information is stored. When the signature is read, the last 1K data of the uboot-spl partition is read, which is the signature information.

[0058] The boot program uboot and the kernel are both packaged in FIT format, and signature information is added at the end of the file. When the signature is read, the device tree parsing syntax is used for parsing to obtain the source file size and the position of the signature information.

[0059] In step S2 of the present example, because the uboot-spl partition capacity is very limited, complex encryption algorithms and device drivers cannot be transplanted, so the signature verification is performed in the uboot-spl, and the signature verification of the uboot-spl is performed in the reverse direction in the subsequent uboot. The signature information of the uboot is read and written to a specified location of the reserved memory, which is used for subsequent startup process backtracking.

[0060] In one example, as shown in FIG. 3, which is an implementation flowchart of the boot program uboot startup, step S3 includes: Figure 2

[0061] S31, parse the uboot-spl partition, and read the uboot-spl and its signature respectively; in the uboot-spl partition structure, the uboot-spl is stored in the head of the partition, and the last 512 bytes of space are reserved for storing signature information;

[0062] Write the uboot-spl signature to a specified location of the reserved memory, which is used for subsequent startup process backtracking;

[0063] S32, parse the kernel partition, and read the kernel and its signature respectively; the kernel partition image is packaged in FIT (Flattened Image Tree) format, and is parsed in a standard device tree parsing syntax, so that the source file size and the position of the signature information can be determined;

[0064] Write the signature of the kernel to a specified location of the reserved memory, which is used for subsequent startup process backtracking

[0065] S33, transplant the national SM3 algorithm;

[0066] ​Using SM3 algorithm, the hash value of uboot-spl is calculated, and the hash value and the signature of uboot-spl are sent to the security chip through the SPI bus for signature verification, and the next operation is performed after the signature verification is passed, otherwise the startup is stopped

[0067] Using SM3 algorithm, the hash value of the kernel is calculated, and the hash value and the signature of the kernel are sent to the security chip through the SPI bus for signature verification, and the next operation is performed after the signature verification is passed, otherwise the startup is stopped

[0068] S34, load the kernel.

[0069] In one example, as shown in the implementation flowchart of the kernel startup of the application, Figure 3 Step S4 includes:

[0070] S41, load the kernel Ramdisk file system, and run the signature verification program therein;

[0071] S42, refer to the signature verification step in step S33 of the example, and perform signature verification on uboot, and the next operation is performed after the signature verification is passed, otherwise the startup is stopped

[0072] S43, continue to perform signature verification on the startup script (generally rc.local) in the root file system, and the next operation is performed after the signature verification is passed, otherwise the startup is stopped

[0073] S44, continue to perform signature verification on the security management software in the root file system, and the next operation is performed after the signature verification is passed, otherwise the startup is stopped.

[0074] In one example, as shown in the implementation flowchart of the security management software startup of the application, Figure 4 Step S5 includes:

[0075] S51, perform reverse signature verification on uboot-spl, uboot, and the kernel;

[0076] S52, perform startup process backtracking, and compare the signatures of uboot-spl, uboot, and the kernel written in the reserved memory in steps S2 and S3. If the comparison is passed, it is proved that the startup link is safe and reliable, and the root file system is loaded; otherwise, the startup is stopped

[0077] S53, after loading the root file system, the system startup script starts the security management software;

[0078] S54, the security management software verifies the signatures of other business software, and starts the business software whose signature verification is passed.

[0079] Example 2

[0080] A computer device, comprising: one or more processors;

[0081] the processor is configured to store one or more programs;

[0082] the one or more programs, when executed by the one or more processors, implement the secure boot method of embedded Linux system based on forward and reverse signature verification of full boot flow.

[0083] Example 3

[0084] A computer readable storage medium having stored thereon a computer program, the computer program, when executed, implementing the secure boot method of embedded Linux system based on forward and reverse signature verification of full boot flow.

[0085] Embodiments of the application have been described above, with the understanding that these descriptions are illustrative only, and are not restrictive in nature, and are not intended to limit the disclosed embodiments to the particular methodology, reagents, and implementations described. Many modifications and variations of the disclosed embodiments are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the claims and their equivalents,

Claims

1. A security booting method for an embedded Linux system based on a full booting procedure forward and reverse signature verification, characterized in that, The system is configured with three levels of boot programs, the first level boot program is a chip ROM firmware, the second level boot program is a boot program uboot-spl, and the third level boot program is a boot program uboot; the starting method comprises the following steps: S1, running the chip ROM firmware, loading the boot program uboot-spl; S2, running the boot program uboot-spl, reading the signature of the boot program uboot and writing it into the first position of the reserved memory, loading the boot program uboot; S3, running the boot program uboot, reading the signatures of the boot program uboot-spl and the kernel and writing them into the second and third positions of the reserved memory, respectively, signing the boot program uboot-spl and the kernel, and continuing to execute after passing the signature verification, otherwise stopping the start; S4, running the kernel, based on the signature verification program in the kernel Ramdisk, verifying the signatures of the boot program uboot, the startup script in the file system and the security management software; continuing to execute after passing the signature verification, otherwise stopping the start; S5, running the security management software, reading the signature information of the boot program uboot-spl, the boot program uboot and the kernel, and respectively performing reverse signature verification on the boot program uboot-spl, the boot program uboot and the kernel; At the same time, the signature information is compared with the signature information in the first position, the second position and the third position to trace back the starting process; After passing the signature verification and the signature information comparison result is consistent, continue to execute, start the business software that passes the signature verification, otherwise stop the start.

2. The security booting method of the embedded Linux system based on the full booting procedure forward and reverse signature verification according to claim 1, characterized in that, The first level boot program ROM firmware is built-in in the chip factory.

3. The embedded Linux system security starting method based on full starting process forward and reverse signature verification according to claim 1, characterized in that, The boot program uboot-spl is filled with 0 at the end of the file until the last 1K byte position of the storage partition stores the signature information; when reading the signature, the last 1K data of the boot program uboot-spl storage partition is read, which is the signature information; The boot program uboot and the kernel are packaged in FIT format, and the signature information is added at the end of the file; when reading the signature, the device tree parsing syntax is used for parsing to obtain the source file size and the position of the signature information.

4. The security booting method of the embedded Linux system based on the forward and reverse signature verification of the full booting procedure according to claim 1, characterized in that The signature verification comprises the following steps: (1) reading the signature file, separating the original file content and the signature content; (2) transplanting the SM3 national encryption algorithm to calculate the hash value of the original file content according to the SM3 national encryption algorithm; (3) sending the signature content in step (1) and the hash value in step (2) to the security chip through the SPI bus for signature verification; (4) obtaining the signature verification result according to the return value of the security chip.

5. The method of claim 1, wherein the method further comprises: determining whether the first signature is valid; and determining whether the second signature is valid. ； The signature verification program in the kernel Ramdisk is located in the Ramdisk file system, the Ramdisk and the kernel are packaged into the same FIT image file, and the image file is signed; When reading the signature, the device tree parsing syntax is used for parsing to obtain the source file size and the position of the signature information.

6. The secure boot method of the embedded Linux system based on the forward and reverse signature verification of the full start-up procedure according to claim 1, characterized in that S4 is specifically: (1) Load the kernel Ramdisk file system, run the signature verification program; (2) Verify the boot program uboot, and if passed, proceed to the next step, otherwise stop the startup; (3) Verify the startup script in the file system, and if passed, proceed to the next step, otherwise stop the startup; (4) Verify the security management software in the file system, and if passed, proceed to the next step, otherwise stop the startup.

7. A computer device, comprising: One or more processors; The processor is configured to store one or more programs; When the one or more programs are executed by the one or more processors, the method for secure booting of the embedded Linux system based on the forward and reverse signature verification of the full startup process is implemented. The computer program is stored thereon, and when the computer program is executed, the method for secure booting of the embedded Linux system based on the forward and reverse signature verification of the full startup process is implemented.

8. A computer-readable storage medium, characterized in that, ​

Images