Mirror image file generation method and device, refreshing method and device, equipment and medium

Abstract

The invention discloses a mirror image file generation method and device, a refreshing method and device, equipment and a medium, and is applied to the field of server refreshing. Obtaining a key corresponding to each client using the original mirror image file; encrypting and signing the original mirror image file based on the key corresponding to each client to obtain a mirror image file containing all keys and all signatures, and sending the mirror image file to the client corresponding to each client; all the keys and all the signatures are in one-to-one correspondence in the mirror image file. The problem of low mirror image file generation efficiency is solved.

Description

Technical Field

[0001] The present invention relates to the field of server refresh, and in particular to a mirror file generation method, a refresh method, a device, equipment and a medium. Background Art

[0002] At present, the flexibility of existing Secure Flash (a secure storage technology) technology is limited. For example, when a BIOS (Basic Input / Output System) developer has multiple customers, each customer will provide their own unique key, and other functional parts of the BIOS are the same, but it is still necessary to add a key for each customer separately and compile the corresponding image file with embedded signature. This method greatly increases the unnecessary duplication of work for developers and reduces development efficiency. Summary of the invention

[0003] In view of this, an object of the present invention is to provide a mirror file generation method, a refresh method, a device, a equipment and a medium, which solve the problem of low efficiency of mirror file generation in the prior art.

[0004] In order to solve the above technical problems, the present invention provides a method for generating an image file, comprising:

[0005] Get the original image file;

[0006] Obtaining keys corresponding to each client using the original image file;

[0007] The original image file is encrypted and signed based on the keys corresponding to each of the customers to obtain an image file containing all of the keys and all of the signatures, and the image file is sent to the client corresponding to each of the customers; all of the keys and all of the signatures correspond one to one in the image file.

[0008] On the one hand, the original image file is encrypted and signed based on the keys corresponding to the respective customers to obtain an image file containing all the keys and all the signatures, including:

[0009] The keys corresponding to the respective customers are added to the original image file generation code to generate the initial image files corresponding to the respective customers; the initial image files contain the image signatures generated according to the keys corresponding to the respective customers, and the keys of all the respective customers; the keys are sequentially stored in the key storage area of ​​the initial image files according to the customer numbers;

[0010] Selecting a file from the initial image files corresponding to each of the clients as a target image file;

[0011] Allocate a signature area for the target image file in advance according to each of the keys;

[0012] According to the storage order of the keys in each of the initial image files, the image signatures in the initial image files corresponding to each customer are transferred in sequence to the corresponding signature areas in the target image file to obtain the image file.

[0013] On the one hand, after sending the image file to the client corresponding to each of the customers, the method further includes:

[0014] When the key of the customer is updated, the updated key is added to the original image file generation code to generate an updated image file corresponding to the customer; the updated image file includes the updated key and the updated signature;

[0015] The key and signature in the image file are updated according to the updated image file.

[0016] The present invention also provides a refreshing method, comprising:

[0017] Get the client's key;

[0018] Determine whether the image file contains the signature corresponding to the customer according to the key; the image file is obtained by encrypting and signing the original image file using multiple keys, and the image file contains multiple keys and multiple signatures, and the multiple keys and the multiple signatures correspond to each other one by one;

[0019] If yes, the firmware is refreshed according to the image file.

[0020] On the one hand, obtain the customer's key, including:

[0021] The customer's key is obtained from the handover block; the customer's key is obtained from the image file according to the customer number.

[0022] On the one hand, before updating the firmware according to the image file, it also includes:

[0023] If the image file contains the signature corresponding to the customer, the signature is verified and the image file is verified;

[0024] When both the signature verification and the image verification are passed, the firmware is refreshed according to the image file.

[0025] The present invention also provides a device for generating an image file, comprising:

[0026] The original image file acquisition module is used to acquire the original image file;

[0027] A key acquisition module, used to acquire the key corresponding to each client using the original image file;

[0028] The image file generation module is used to encrypt and sign the original image file based on the keys corresponding to each customer, obtain an image file containing all the keys and all the signatures, and send the image file to the client corresponding to each customer; all the keys and all the signatures correspond to each other in the image file.

[0029] The present invention also provides a refreshing device, comprising:

[0030] A key acquisition module is used to obtain the customer's key;

[0031] a determination module, configured to determine whether the image file contains the signature corresponding to the customer according to the key; the image file is obtained by encrypting and signing the original image file using multiple keys, the image file contains multiple keys and multiple signatures, and the multiple keys correspond to the multiple signatures one by one;

[0032] A refresh module is used to refresh the firmware according to the image file if any.

[0033] The present invention also provides an electronic device, comprising:

[0034] Memory for storing computer programs;

[0035] A processor is used to implement the steps of the above method when executing the computer program.

[0036] The present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0037] The present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0038] It can be seen from the above technical scheme that the present invention obtains the original image file; obtains the key corresponding to each customer using the original image file; encrypts and signs the original image file based on the key corresponding to each customer, obtains the image file containing all keys and all signatures, and sends the image file to the client corresponding to each customer; all keys and all signatures correspond one by one in the image file. The beneficial effects of the present invention are: the image file generated by the present invention supports the storage and management of multiple groups of keys and signatures, avoids the repetitive work of compiling image files for each customer, reduces tedious operations, significantly improves the generation efficiency of the image file, and the signature and key are stored in the image file, so it does not affect the use of the image file by each customer for firmware refresh. Based on such an image file, it can also meet the requirement of dynamically loading corresponding signatures according to different customers during the refresh phase, thereby significantly improving the development efficiency and response speed, making the firmware refresh more flexible and secure, and meeting the security needs of different customers more quickly and conveniently.

[0039] In addition, the present invention also provides an image file generating device, a refreshing method, a refreshing device, an electronic device and a computer-readable storage medium, which also have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0041] Figure 1 A flowchart of a Secure Flash technology refresh method;

[0042] Figure 2 A flowchart of a method for generating an image file provided by an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of a signature transfer provided by an embodiment of the present invention;

[0044] Figure 4 A flowchart of a refreshing method provided by an embodiment of the present invention;

[0045] Figure 5 A flowchart of a method for generating an image file provided by an embodiment of the present invention;

[0046] Figure 6 A flow chart of a refreshing method provided by an embodiment of the present invention;

[0047] Figure 7 A schematic diagram of the structure of an image file generation device provided by an embodiment of the present invention;

[0048] Figure 8 A schematic diagram of the structure of a refreshing device provided by an embodiment of the present invention;

[0049] Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] First, several nouns involved in the present invention are analyzed:

[0052] BIOS (Basic Input / Output System): BIOS is the abbreviation of Basic Input / Output System, which is a part of the computer firmware and is responsible for the basic functions of hardware initialization and operating system loading when the computer starts.

[0053] HOB (Hand-Off Block): HOB is the abbreviation of hand-off block, which is a data structure for transferring system information during the UEFI (Unified Extensible Firmware Interface) startup process. HOB is generated by the PEI stage and handed over to the DXE stage for use at the end of the PEI stage. HOB contains the system's hardware and firmware status information, such as memory layout, processor information, and firmware configuration data. This information helps the drivers and applications in the DXE stage to initialize and configure.

[0054] FW (Firmware): FW is short for firmware, which refers to a specific type of software embedded in computer hardware. Firmware is a critical software layer between the hardware and the operating system, responsible for controlling the operation and function of hardware devices.

[0055] FV (Firmware Volume): FV is the abbreviation of firmware volume, which is a file system structure used to store firmware modules in UEFI. An FV can contain multiple files, each of which represents an independent firmware module or component.

[0056] FFS (Firmware File System): FFS is the abbreviation of firmware file system, which is the file system format used to store and organize firmware files in UEFI firmware. FFS defines how to store and manage firmware files in FV, including file header information, content, and checksum information.

[0057] PEI (Pre-EFI Initialization): PEI is the pre-EFI initialization phase, which is the earliest part of the UEFI boot process. In the PEI phase, the main task of the system is to initialize basic hardware components, including memory, processor, and some key controllers on the motherboard. The main purpose of the PEI phase is to provide the necessary hardware support for the following DXE (Driver Execution Environment) phase.

[0058] The DXE stage is the stage immediately following PEI in the UEFI boot process, and is mainly responsible for most of the hardware initialization and protocol generation.

[0059] The development of Secure Flash technology stems from the increasing demand for computer system firmware security. The original BIOS update process lacked security protection and was vulnerable to malicious attacks. To address this problem, Secure Flash technology came into being to ensure that the update and writing process of firmware in the server is protected. The core of Secure Flash technology is to provide a security mechanism to protect the BIOS firmware from unauthorized refreshes, such as Figure 1 As shown. By adding a private and well-kept key to the code, the corresponding image signature is generated during the compilation process and embedded into the final image package file that can be refreshed. In this way, when the BIOS performs a firmware refresh, if the BIOS image to be refreshed is not signed, it will be considered an illegal image and the refresh will fail, thereby achieving a safe refresh.

[0060] The existing secure flash can only add a pair of keys to the code, which has limited flexibility. For example, when a BIOS developer has multiple customers, each customer will provide their own unique key, and other functional parts of the BIOS are the same, but it is still necessary to add a key for each customer separately and compile the corresponding flashable BIOS image file with embedded signature. This method greatly increases the unnecessary duplication of work for developers and reduces development efficiency.

[0061] In order to solve the above problems, the present invention provides a method for generating an image file. Figure 1 , Figure 1A flowchart of a method for generating an image file provided by an embodiment of the present invention. The method may include:

[0062] S101: Obtaining an original image file.

[0063] The execution subject of this embodiment is the server. This embodiment does not limit the server. For example, it can be a computer. It should be noted that the original image file in this embodiment is the image file of BIOS. Specifically, the image file code can be compiled to generate the original image file.

[0064] S102: Obtain the key corresponding to each customer using the original image file.

[0065] It is understandable that each customer performs firmware refresh processing based on the same image file (i.e., the original image file), but each customer has his or her own unique key. The key can be customized by the customer or provided by the service provider. The key in this embodiment can be a symmetric key or an asymmetric key.

[0066] S103: Encrypt and sign the original image file based on the key corresponding to each customer, obtain an image file containing all keys and all signatures, and send the image file to the client corresponding to each customer; all keys and all signatures correspond to each other in the image file.

[0067] This step is to generate an image file with security verification by encrypting and signing the same image file (i.e., the original image file). In this way, when the firmware is refreshed based on the image file, the security of the firmware refresh can be guaranteed. Specifically, the keys corresponding to each customer can be added to the image file code, and then the added code can be compiled, and finally an image file can be generated, which contains all the keys and signatures, and the keys and signatures in the image file correspond one to one, and the storage locations also correspond one to one. The firmware refresh in this embodiment refers to the BIOS firmware refresh.

[0068] Furthermore, in order to facilitate the verification of the image file when the firmware is updated, the above-mentioned encryption and signing of the original image file based on the key corresponding to each customer to obtain the image file containing all keys and all signatures may include the following steps:

[0069] Step 21: Add the key corresponding to each customer to the original image file generation code to generate the initial image file corresponding to each customer; the initial image file contains the image signature generated according to the key corresponding to the customer, and the keys of all customers; the keys are stored in the key storage area of ​​the initial image file in sequence according to the customer number;

[0070] Step 22: Select a file from the initial image files corresponding to each customer as the target image file;

[0071] Step 23: pre-allocate a signature area for the target image file according to each key;

[0072] Step 24: According to the storage order of the keys in each initial image file, the image signatures in the initial image files corresponding to each customer are transferred to the corresponding signature areas in the target image file in turn to obtain the image file.

[0073] Specifically, please refer to Figure 2 When the key corresponding to each customer is added to the original image file generation code, the initial image file corresponding to each customer can be generated first, such as Figure 2 The right half is the initial image file corresponding to customer 02, which contains all keys, but the signature area only contains signature 02 generated based on key 02. According to the customer ID, the key storage area corresponding to each key can be determined first, and stored in the initial image file corresponding to each customer, but the signature area only contains the signature corresponding to the customer, and is stored in the signature position corresponding to its key. Such storage is conducive to the management of signatures and keys, and is more efficient for subsequent firmware refresh verification, improving verification and refresh efficiency. Among them, Figure 2 By taking the initial image file corresponding to client 01 as the target image file and calling the FWoverride.exe program, the keys in the initial image files corresponding to other clients can be transferred to their corresponding key storage areas. Of course, the target image file can be any of the initial image files.

[0074] Furthermore, in order to facilitate the customer's firmware update and the replacement of the customer key, after sending the image file to the client corresponding to each customer, the following steps may also be included:

[0075] Step 31: When the customer's key is updated, the updated key is added to the original image file generation code to generate an updated image file corresponding to the customer; the updated image file includes the updated key and the updated signature;

[0076] Step 32: Update the key and signature in the image file according to the updated image file.

[0077] Specifically, the purpose of this step is to update the signature and key of the customer in the image file in time when the customer's key changes, so that the firmware can be successfully updated when the user uses the image file. When the key and signature storage is stored according to the customer ID, the update efficiency of the signature and key in the image file can also be improved when the key and signature are updated.

[0078] Furthermore, after obtaining the image file containing all keys and all signatures, the following steps may also be included:

[0079] Save the image file to read-only memory.

[0080] Read-Only Memory (ROM) works in a non-destructive read mode, and can only read information but cannot write it. Once the information is written, it is fixed, and even if the power is cut off, the information will not be lost. In addition, it has a simple structure and is easy to use, so it is often used to store various fixed programs and data. Therefore, in this embodiment, the image file is stored in the read-only memory.

[0081] Furthermore, after the original image file is encrypted and signed based on the keys corresponding to each customer to obtain the image file containing all keys and all signatures, the following steps may also be included:

[0082] Each key in the image file is split and stored in different locations of the image file.

[0083] This embodiment stores the key in segments, so that even if a part of the key is leaked, the key cannot be completely restored, thereby ensuring the security of the image file and further improving the security of the firmware refresh.

[0084] The image file generation method provided by the embodiment of the present invention is applied, by obtaining the original image file; obtaining the key corresponding to each customer using the original image file; encrypting and signing the original image file based on the key corresponding to each customer, obtaining an image file containing all keys and all signatures, and sending the image file to the client corresponding to each customer; all keys and all signatures correspond one to one in the image file. The beneficial effect of this method is that the image file generated by the present invention supports the storage and management of multiple groups of keys and signatures, avoids the repetitive work of compiling image files for each customer, reduces tedious operations, significantly improves the generation efficiency of the image file, and the signature and key are stored in the image file, so it does not affect each customer's use of the image file for firmware refresh, significantly improving development efficiency and response speed.

[0085] Please refer to Figure 4 , Figure 4 A flowchart of a refresh method provided by an embodiment of the present invention. The method may include:

[0086] S201: Obtain the client's key.

[0087] The execution subject of this embodiment is the client, which refers to the target server that the client wants to refresh. In this embodiment, the client key can be directly obtained through the client input; or the client number can be obtained based on the refresh instruction of the client refresh, and the key corresponding to the client can be obtained from the image file based on the client number.

[0088] S202: Determine whether the image file contains the signature corresponding to the customer according to the key; the image file is obtained by encrypting and signing the original image file using multiple keys, and the image file contains multiple keys and multiple signatures, and the multiple keys and multiple signatures correspond to each other one by one.

[0089] The image file in this embodiment is a shared image file for multiple clients, wherein the functional parts of the image files are the same, wherein the difference lies in the key part and the signature part. The image file contains the keys of each client using the same original image file, and the corresponding signatures. The keys and signatures of each client are stored in the image file in a one-to-one correspondence. The corresponding signature is searched from the signature area of ​​the image file according to the client's key, wherein the basis is the client ID. Exemplarily, client 01 corresponds to key 01, and corresponds to signature 01.

[0090] S203: If yes, then update the firmware according to the image file.

[0091] When the signature area of ​​the image file contains the signature corresponding to the customer, the original image file in the image file can be used to refresh the firmware, wherein the original image file can be understood as the file required for refreshing.

[0092] Furthermore, the above-mentioned obtaining of the client's key may include the following steps:

[0093] Get the customer's key from the handover block; the customer's key is obtained from the image file based on the customer number.

[0094] In the PEI stage, the key corresponding to the customer in the image file is stored in the handover block HOB according to the customer ID, and the firmware refresh is started at this time.

[0095] Furthermore, in order to ensure the security of the firmware update, before the firmware update is performed according to the image file, the following steps may also be included:

[0096] Step 41: If the image file contains the signature corresponding to the customer, the signature is verified and the image file is verified;

[0097] Step 42: When both the signature verification and the image verification are passed, the firmware is refreshed according to the image file.

[0098] During the firmware refresh process of this embodiment, the signature of the image file is verified to ensure its integrity and authenticity, and to check whether the layout structure of the image file is correct. Among them, image verification usually includes checking the location and size of each component in the image file, as well as the dependencies between them, to ensure that all components can be correctly loaded and executed. Signature verification usually includes calculating the hash value of the image file, then decrypting the signature with the public key and comparing it with the calculated hash value. If the two match, the verification is successful. Among them, signature refers to a digital signature.

[0099] The refresh method provided by the embodiment of the present invention is applied, by obtaining the customer's key; determining whether the image file contains the signature corresponding to the customer based on the key; the image file is obtained by encrypting and signing the original image file using multiple keys, and the image file contains multiple keys and multiple signatures, and the multiple keys and multiple signatures correspond to each other one by one; if yes, the firmware is refreshed according to the image file. The beneficial effect of this method is that the present invention is based on an image file that supports multiple groups of keys and signatures, and can meet the requirement of dynamically loading corresponding signatures according to different customers during the refresh phase, thereby significantly improving development efficiency and response speed, making firmware refresh more flexible and secure, and meeting the security needs of different customers more quickly and conveniently.

[0100] In order to make the present invention easier to understand, please refer to Figure 5 and Figure 6 , Figure 5 An example flow chart of a method for generating an image file provided by an embodiment of the present invention, Figure 6 This is a flowchart of a refresh method provided by an embodiment of the present invention. Specifically, it may include:

[0101] Image file generation stage:

[0102] 1. Allocate BIOS image space FFS to store multiple sets of keys and signatures.

[0103] 2. Add multiple pairs of keys, each pair of keys corresponds to a customer, which corresponds to a customer id (customer number, i.e. customer ID) in the code

[0104] Table 1 Customer ID and key correspondence table

[0105]

[0106] 3. In the code compilation stage, that is, the image file generation stage, the native unsigned ROM.fd file, that is, the original image file, is first generated.

[0107] 4. Generate the initial image files ROM0, ROM1, ROM2, ROM3, etc. with embedded signatures according to the added keys.

[0108] 5. Call FWoverride.exe, which will search the signature area of ​​each ROM file in turn, and copy the signatures in ROM1, ROM2, ROM3, etc. to the signature storage area of ​​ROM0.

[0109] 6. ROM0 undergoes other processing to generate the final ROM file, which is the image file image.bin containing all signatures.

[0110] Refresh phase:

[0111] 1. Start the PEI phase, read the corresponding key from the key storage area FWKey FFS according to the currently set Customer ID, and save it in HOB.

[0112] 2. When using the in-band tool to refresh the BIOS image (i.e., image file), find the corresponding signature from the signature storage area of ​​the image file according to the current Customer ID setting value.

[0113] 3. Verify the signature and image layout.

[0114] 4. If the verification passes, the refresh is executed, otherwise, the refresh is aborted.

[0115] The image file generation device provided by an embodiment of the present invention is introduced below. The image file generation device described below and the image file generation method described above can be referred to each other.

[0116] Please refer to Figure 7 , Figure 7 A schematic diagram of the structure of an image file generation device provided by an embodiment of the present invention may include:

[0117] The original image file acquisition module 100 is used to acquire the original image file;

[0118] A key acquisition module 200, used to acquire a key corresponding to each client using the original image file;

[0119] The image file generation module 300 is used to encrypt and sign the original image file based on the keys corresponding to each of the customers, obtain an image file containing all of the keys and all of the signatures, and send the image file to the client corresponding to each of the customers; all of the keys and all of the signatures correspond to each other in the image file.

[0120] Based on the above embodiment, the image file generation module 300 may include:

[0121] An initial image file generating unit, used for adding the key corresponding to each customer to the original image file generating code, to generate the initial image file corresponding to each customer; the initial image file includes the image signature generated according to the key corresponding to the customer, and the keys of all the customers; the keys are sequentially stored in the key storage area of ​​the initial image file according to the customer number;

[0122] A target image file determining unit, used for selecting a file from the initial image files corresponding to each of the clients as a target image file;

[0123] A signature area allocation unit, used to allocate a signature area to the target image file in advance according to each of the keys;

[0124] The signature transfer unit is used to transfer the image signatures in the initial image files corresponding to each customer in turn to the corresponding signature areas in the target image file according to the storage order of the keys in each initial image file to obtain the image file.

[0125] Based on the above embodiment, the image file generating device may further include:

[0126] A first update module is used for, after sending the image file to the client corresponding to each of the customers, when the key of the customer is updated, adding the updated key to the original image file generation code to generate an updated image file corresponding to the customer; the updated image file includes the updated key and the updated signature;

[0127] The second updating module is used to update the key and signature in the image file according to the updated image file.

[0128] It should be noted that the order of the modules and units in the above-mentioned image file generation device can be changed without affecting the logic.

[0129] The image file generation device provided by the embodiment of the present invention is used to obtain the original image file through the original image file acquisition module 100; the key acquisition module 200 is used to obtain the key corresponding to each customer using the original image file; the image file generation module 300 is used to encrypt and sign the original image file based on the key corresponding to each customer, obtain the image file containing all the keys and all the signatures, and send the image file to the client corresponding to each customer; all the keys and all the signatures correspond to each other in the image file. Beneficial effects of this device: the image file generated by this device supports the storage and management of multiple groups of keys and signatures, avoids the repetitive work of compiling image files for each customer, reduces tedious operations, significantly improves the efficiency of image file generation, and the signature and key are stored in the image file, so it does not affect the use of the image file by each customer for firmware refresh, significantly improves development efficiency and response speed.

[0130] The image file generation device provided by an embodiment of the present invention is introduced below. The image file generation device described below and the image file generation method described above can be referred to each other.

[0131] Please refer to Figure 8 , Figure 8 A schematic diagram of the structure of an image file generation device provided by an embodiment of the present invention may include:

[0132] The key acquisition module 400 is used to acquire the client's key;

[0133] The determination module 500 is used to determine whether the image file contains the signature corresponding to the customer according to the key; the image file is obtained by encrypting and signing the original image file using multiple keys, and the image file contains multiple keys and multiple signatures, and the multiple keys and the multiple signatures correspond to each other one by one;

[0134] The refresh module 600 is used to refresh the firmware according to the image file if any.

[0135] Based on the above embodiment, the key acquisition module 400 may include:

[0136] The key acquisition unit is used to acquire the customer's key from the handover block; the customer's key is obtained from the image file according to the customer number.

[0137] Based on the above embodiment, the refreshing device may include:

[0138] A verification module, used for, before updating the firmware according to the image file, if the image file contains a signature corresponding to the customer, performing signature verification on the signature and image verification on the image file;

[0139] The refresh unit is used to refresh the firmware according to the image file when both the signature verification and the image verification are passed.

[0140] It should be noted that the order of the modules and units in the above-mentioned image file generation device can be changed without affecting the logic.

[0141] The image file generation device provided by the embodiment of the present invention is used to obtain the customer's key through the key acquisition module 400; the determination module 500 is used to determine whether the image file contains the signature corresponding to the customer according to the key; the image file is obtained by encrypting and signing the original image file using multiple keys, and the image file contains multiple keys and multiple signatures, and the multiple keys and the multiple signatures correspond to each other one by one; the refresh module 600 is used to refresh the firmware according to the image file if there is any. This device is based on an image file that supports multiple groups of keys and signatures, and can meet the requirements of dynamically loading corresponding signatures according to different customers during the refresh phase, thereby significantly improving development efficiency and response speed, making firmware refresh more flexible and secure, and meeting the security needs of different customers more quickly and conveniently.

[0142] Fig. 9 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Fig. 9 As shown, the electronic equipment includes:

[0143] A memory 60, for storing computer programs;

[0144] The processor 61 is used to implement the steps of the image file generation method and / or the refresh method in the above-mentioned embodiment when executing a computer program.

[0145] The electronic device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer or a desktop computer.

[0146] Among them, the processor 61 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 61 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 61 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 61 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 61 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0147] The memory 60 may include one or more computer-readable storage media, which may be non-transitory. The memory 60 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 60 is at least used to store the following computer program 601, wherein, after the computer program is loaded and executed by the processor 61, it can implement the relevant steps of the image file generation method and / or refresh method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 60 may also include an operating system 602 and data 603, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 602 may include Windows, Unix, Linux, etc. Data 603 may include but is not limited to data of the image file generation method and / or refresh method, etc.

[0148] In some embodiments, the electronic device may further include a display screen 62 , an input / output interface 63 , a communication interface 64 , a power supply 65 , and a communication bus 66 .

[0149] Those skilled in the art will understand that Fig. 9 The structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure.

[0150] It is understandable that if the image file generation method and / or refresh method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention is essentially or part of the contribution to the current technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk or optical disk and other media that can store program code.

[0151] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned image file generation method and / or refresh method are implemented.

[0152] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0153] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0154] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0155] The above is a detailed introduction to an image file generation method, a refresh method, an apparatus, a device and a medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for a person skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for generating an image file, characterized in that: include: Get the original image file; Obtaining keys corresponding to each client using the original image file; The original image file is encrypted and signed based on the keys corresponding to each of the customers to obtain an image file containing all of the keys and all of the signatures, and the image file is sent to the client corresponding to each of the customers; all of the keys and all of the signatures correspond one to one in the image file.

2. The image file generation method according to claim 1, characterized in that: The original image file is encrypted and signed based on the keys corresponding to the respective customers to obtain an image file containing all the keys and all the signatures, including: The keys corresponding to the respective customers are added to the original image file generation code to generate the initial image files corresponding to the respective customers; the initial image files contain the image signatures generated according to the keys corresponding to the respective customers, and the keys of all the respective customers; the keys are sequentially stored in the key storage area of ​​the initial image files according to the customer numbers; Selecting a file from the initial image files corresponding to each of the clients as a target image file; Allocate a signature area for the target image file in advance according to each of the keys; According to the storage order of the keys in each of the initial image files, the image signatures in the initial image files corresponding to each customer are transferred in sequence to the corresponding signature areas in the target image file to obtain the image file.

3. The image file generation method according to claim 1, characterized in that: After sending the image file to the client corresponding to each of the customers, the method further includes: When the key of the customer is updated, the updated key is added to the original image file generation code to generate an updated image file corresponding to the customer; the updated image file includes the updated key and the updated signature; The key and signature in the image file are updated according to the updated image file.

4. A refreshing method, characterized in that: include: Get the client's key; Determine whether the image file contains the signature corresponding to the customer according to the key; The image file is obtained by encrypting and signing the original image file using multiple keys, and the image file contains multiple keys and multiple signatures, and the multiple keys and the multiple signatures correspond to each other one by one; If yes, the firmware is refreshed according to the image file.

5. The refreshing method according to claim 4, characterized in that: Get the client's key, including: The customer's key is obtained from the handover block; the customer's key is obtained from the image file according to the customer number.

6. The refreshing method according to claim 4, characterized in that: Before updating the firmware according to the image file, the method further includes: If the image file contains the signature corresponding to the customer, the signature is verified and the image file is verified; When both the signature verification and the image verification are passed, the firmware is refreshed according to the image file.

7. A device for generating an image file, characterized in that: include: The original image file acquisition module is used to acquire the original image file; A key acquisition module, used to acquire the key corresponding to each client using the original image file; The image file generation module is used to encrypt and sign the original image file based on the keys corresponding to each of the customers, obtain an image file containing all the keys and all the signatures, and send the image file to the client corresponding to each of the customers; all the keys and all the signatures correspond to each other in the image file.

8. A refreshing device, characterized in that: include: A key acquisition module is used to obtain the customer's key; A determination module, used to determine whether the image file contains the signature corresponding to the customer according to the key; The image file is obtained by encrypting and signing the original image file using multiple keys, and the image file contains multiple keys and multiple signatures, and the multiple keys and the multiple signatures correspond to each other one by one; A refresh module is used to refresh the firmware according to the image file if any.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method according to any one of claims 1 to 6 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images