Tamper-proof firmware upgrading method based on ECC (Error Correction Code) and Hash verification

Abstract

According to the anti-tampering firmware upgrading method based on the ECC and the Hash verification, after a product receives complete upgrading firmware, the firmware is separated, a ciphertext of an encrypted firmware part is extracted, then the separated application firmware is subjected to the Hash verification, signature verification is carried out according to the ciphertext and a Hash value, and upgrading is carried out after signature verification is passed; the generation method of the encrypted firmware comprises the steps that firstly, a pair of secret keys is obtained through an ECC method and divided into a public key and a private key, the public key is used for signature verification by an electronic device product, the private key is used for encrypting a hash code of application firmware, and signature ciphertext firmware is obtained; and finally, combining the application firmware and the ciphertext firmware into one file to obtain final upgrade firmware. According to the invention, the damaged firmware file or the wrong firmware file is prevented from being transmitted to the product and being mistakenly upgraded by the product.

Description

Technical Field

[0001] The present invention relates to the field of electronic equipment security technology, and in particular to an anti-tampering firmware upgrade method based on ECC and hash verification. Background Art

[0002] With the rapid development of technology, electronic products play an increasingly important role in our lives. In order to maintain the performance and security of products, software upgrades and firmware updates have become essential. Firmware upgrades for electronic equipment products refer to the process of updating the operating system (also called firmware or software) running on the product to a new version. This process involves loading new firmware into the product to replace the currently running firmware. Firmware upgrades usually include updates to improve performance, fix vulnerabilities, add new features, etc.

[0003] When an electronic device upgrades its firmware, an upgrade package is provided to the user, and the upgraded firmware file is transmitted to the product using the corresponding upgrade method. The product verifies its version and other related information, and then completes the self-upgrade. If some data bytes in the firmware file are destroyed during network transmission, or the data in the firmware file is maliciously destroyed, the user will upgrade the firmware to the product, which will cause the product to be completely disabled. Some manufacturers provide firmware plus description files, and the description files provide hash verification. This method can also destroy the firmware and generate a new description file, causing the product to be disabled after the upgrade. Summary of the invention

[0004] The purpose of the present invention is to overcome the above-mentioned shortcomings and provide an anti-tampering firmware upgrade method based on ECC and hash verification, which prevents damaged firmware files or erroneous firmware files from being transmitted to the product and mistakenly upgraded by the product through corresponding methods such as self-decryption and self-verification.

[0005] The object of the present invention is achieved in that: A tamper-proof firmware upgrade method based on ECC and hash verification, comprising the following contents: S1. Perform hash operation on the application firmware to be upgraded, and use the CertUtil command or other tools provided by the Windows system to obtain the hash code H0; S2. Use the ECC encryption algorithm to generate a pair of exclusive keys for the electronic device product, which are divided into an ECC public key G0 and a private key S0; Use the exclusive private key S0 to encrypt the hash code H0 to obtain the signature ciphertext M0; S3. Use the copy command or other tools provided by the Windows system to add the signature M0 mark to the end of the application firmware file to obtain the final upgrade firmware; S4, transmitting the final upgraded firmware to the electronic device product through its corresponding upgrade path; S5. The electronic product equipment is internally provided with a boot firmware area, an application firmware area, a reserved area, and a temporary firmware area. The application firmware area is provided with an upgrade firmware receiving module and a signature verification module. The receiving module stores the received upgrade firmware in the temporary firmware area, and the signature verification module performs separate signature verification on the upgrade firmware received in the temporary firmware area. When system resources are tight, the signature verification module is placed in the boot firmware, and after receiving, the signature verification is switched to the boot area. The boot firmware area is the boot system startup and upgrade firmware. When the normal product is started, it is checked whether an upgrade is required. If no upgrade is required, it directly jumps to the current system firmware area to run the system function. The receiving module of the electronic device product receives the firmware to be upgraded and stores it in the temporary firmware storage area; S6. The electronic device runs the signature verification module to separate the firmware to be upgraded received from the temporary firmware area and separate the signature M1 at the end; S7, the signature verification module performs a hash operation on the application firmware received in the temporary firmware area to obtain a hash code H1; S8, the signature verification module performs a signature verification operation on the signature M1 and the hash code H1 using the public key G0, and if the verification is successful, the received firmware data remains intact during the entire transmission and storage process, and the electronic device product runs the upgrade module; S9. After the signature verification is passed, the upgrade module in the boot firmware area will perform the upgrade process, overwrite the application firmware in the temporary firmware area to the system firmware area, and compare whether the two firmwares are consistent. If they are consistent, the overwriting is completed and the system switches to the system firmware area for operation; if they are inconsistent, they are re-overwritten until they are consistent and then switched to the system firmware area for operation.

[0006] Further, in step S6, if the firmware data is not damaged, the signature M1 is equal to the signature M0, and the application firmware is also equal.

[0007] Furthermore, in step S7, the signature verification module receives the application firmware in the temporary firmware area without the signature M1.

[0008] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides an anti-tampering firmware upgrade method based on ECC and hash verification, which adopts self-decryption and self-verification to prevent damaged firmware files or erroneous firmware files from being transmitted to products and being mistakenly upgraded by the products, causing the products to become "bricked".

[0009] The firmware upgrade method of the present invention uses different key pairs in the application of diversified user products, and even if the firmware of different products is misplaced, the non-corresponding firmware will not be successfully upgraded to the product. Compared with the traditional RSA encryption algorithm, the present invention adopts the ECC algorithm, which has less resource consumption on the embedded microcontroller, high computing efficiency, strong security, and especially less resource consumption, which is crucial for the microcontroller platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 This is a schematic diagram of the final firmware of the electronic equipment product of the present invention.

[0011] Figure 2 This is a schematic diagram of the internal firmware of the electronic equipment product of the present invention. DETAILED DESCRIPTION

[0012] In order to better understand the technical solution of the present invention, the following will be described in detail in conjunction with the relevant illustrations. It should be understood that the following specific embodiments are not intended to limit the specific implementation of the technical solution of the present invention, and are only implementations that can be adopted by the technical solution of the present invention. It should be noted that the description of the positional relationship of each component in this article, such as component A being located above component B, is based on the description of the relative positions of the components in the illustration, and is not intended to limit the actual positional relationship of the components.

[0013] See also Figure 1-2 , Figure 1 The final firmware schematic diagram of the tamper-proof firmware upgrade method based on ECC and hash check of the present invention is drawn. As shown in the figure, the present invention relates to a tamper-proof firmware upgrade method based on ECC and hash check, which is applied to electronic equipment products. The electronic equipment products are provided with firmware to be upgraded, and the firmware includes application firmware and encryption firmware. The application firmware is the functional software of the product, which ensures the normal operation of the product for various functions of the product, and the encryption firmware is the ciphertext after the application firmware is hash checked and then ECC encrypted.

[0014] After the product receives the complete upgrade firmware, it first separates the firmware, extracts the ciphertext of the encrypted firmware part, and then performs hash verification on the separated application firmware. The signature is verified based on the ciphertext and hash value, and the upgrade is carried out if the signature verification passes.

[0015] The method for generating the encrypted firmware is: first use the ECC method to obtain a pair of keys, which are divided into a public key and a private key. The public key is used by the electronic device product to verify the signature, and the private key is used to encrypt the hash code of the application firmware to obtain the signed ciphertext firmware.

[0016] Finally, the application firmware and the ciphertext firmware are merged into one file to obtain the final upgrade firmware.

[0017] The interior of the electronic product device includes a boot firmware area, an application firmware area, a reserved area and a temporary firmware area. The application firmware area includes a conventional performance application module and an upgrade firmware receiving module, which stores the received upgrade firmware in the temporary firmware area; The application firmware area is also equipped with a signature verification module to perform separate signature verification on the upgrade firmware received in the temporary firmware area; when system resources are tight, the signature verification module is placed in the boot firmware, and after reception is completed, it switches to the boot area for signature verification.

[0018] The boot firmware area is used to boot the system and upgrade the firmware. When the product starts normally, it checks whether an upgrade is required. If no upgrade is required, it directly jumps to the current system firmware area to run system functions. When an upgrade is detected, the application firmware received in the temporary firmware area is updated to the current system firmware after confirming that the signature is correct. After confirming that the update is correct, it switches to the current system application firmware to run system functions. Example 1

[0019] The present embodiment 1 involves an anti-tampering firmware upgrade method based on ECC and hash verification, including the following contents: Step 1: Perform hash operation on the application firmware to be upgraded, and use the CertUtil command or other tools provided by the Windows system to obtain the hash code H0; Step 2: Use the ECC encryption algorithm to generate a pair of exclusive keys for the electronic device product, which are divided into an ECC public key G0 and a private key S0; Use the exclusive private key S0 to encrypt the hash code H0 to obtain the signature ciphertext M0; Step 3. Use the copy command or other tools that come with the Windows system to add the signature M0 mark to the end of the application firmware file to obtain the final upgrade firmware; Step 4: delivering the final application firmware to the electronic device product through its corresponding upgrade path; Step 5: The receiving module of the electronic device product receives the firmware to be upgraded and stores it in the temporary firmware storage area; Step 6: The electronic device runs the signature verification module to separate the firmware to be upgraded received in the temporary firmware area and separate the signature M1 at the end. If the firmware data is not damaged, the signature M1 is equal to the signature M0, and the application firmware should also be equal; Step 7: The signature verification module performs a hash operation on the application firmware (excluding the signature M1) received from the temporary firmware area to obtain a hash code H1; Step 8: The signature verification module uses the public key G0 to perform a signature verification operation on the signature M1 and the hash code H1. If the verification is successful, the received firmware data remains intact during the entire transmission and storage process, and the electronic device product runs the upgrade module; Step 9: After the signature verification is passed, the upgrade module in the boot firmware area will perform the upgrade process, overwrite the application firmware in the temporary firmware area to the system firmware area, and compare whether the two firmwares are consistent. If they are consistent, the overwriting is completed and the system switches to the system firmware area for operation; if they are inconsistent, they are re-overwritten until they are consistent and then switched to the system firmware area for operation.

[0020] The above are only specific application examples of the present invention and do not constitute any limitation on the protection scope of the present invention. Any technical solution formed by equivalent transformation or equivalent replacement shall fall within the protection scope of the present invention.

Claims

1. A tamper-proof firmware upgrade method based on ECC and hash check, characterized in that: Includes the following: S1. Perform hash operation on the application firmware to be upgraded, and use the CertUtil command or other tools provided by the Windows system to obtain the hash code H0; S2. Use the ECC encryption algorithm to generate a pair of exclusive keys for the electronic device product, which are divided into an ECC public key G0 and a private key S0; Use the exclusive private key S0 to encrypt the hash code H0 to obtain the signature ciphertext M0; S3. Use the copy command or other tools provided by the Windows system to add the signature M0 mark to the end of the application firmware file to obtain the final upgrade firmware; S4, transmitting the final upgraded firmware to the electronic device product through its corresponding upgrade path; S5. The electronic product equipment is internally provided with a boot firmware area, an application firmware area, a reserved area, and a temporary firmware area. The application firmware area is provided with an upgrade firmware receiving module and a signature verification module. The receiving module stores the received upgrade firmware in the temporary firmware area, and the signature verification module performs separate signature verification on the upgrade firmware received in the temporary firmware area. When system resources are tight, the signature verification module is placed in the boot firmware, and after receiving, the signature verification is switched to the boot area. The boot firmware area is the boot system startup and upgrade firmware. When the normal product is started, it is checked whether an upgrade is required. If no upgrade is required, it directly jumps to the current system firmware area to run the system function. The receiving module of the electronic device product receives the firmware to be upgraded and stores it in the temporary firmware storage area; S6. The electronic device runs the signature verification module to separate the firmware to be upgraded received from the temporary firmware area and separate the signature M1 at the end; S7, the signature verification module performs a hash operation on the application firmware received in the temporary firmware area to obtain a hash code H1; S8, the signature verification module performs a signature verification operation on the signature M1 and the hash code H1 using the public key G0, and if the verification is successful, the received firmware data remains intact during the entire transmission and storage process, and the electronic device product runs the upgrade module; S9. After the signature verification is passed, the upgrade module in the boot firmware area will perform the upgrade process, overwrite the application firmware in the temporary firmware area to the system firmware area, and compare whether the two firmwares are consistent. If they are consistent, the overwriting is completed and the system switches to the system firmware area for operation; if they are inconsistent, they are re-overwritten until they are consistent and then switched to the system firmware area for operation.

2. The tamper-proof firmware upgrade method based on ECC and hash check according to claim 1, characterized in that: In step S6, if the firmware data is not damaged, the signature M1 is equal to the signature M0, and the application firmware is also equal.

3. The tamper-proof firmware upgrade method based on ECC and hash check according to claim 1, characterized in that: In step S7, the signature verification module receives the application firmware in the temporary firmware area without the signature M1.

Images