Chip restart method, main processor, security module, chip, medium and product

Abstract

An embodiment of the present application provides a chip restart method, a main processor, a security module, a chip, a medium, and a product. The method includes: when the main processor receives a processing instruction indicating that the second storage area is the active storage area, sending a signature generation instruction to the security module, executing an identification maintenance task to switch the active storage area from the first storage area to the second storage area, and performing a restart. In the solution of the present application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. When the chip system encounters an abnormality of identification maintenance failure after the signature is generated, the main processor can still start from the first storage area, avoiding the situation of system lockup, thereby improving the reliability of the chip system.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a chip restart method, a main processor, a security module, a chip, a medium, and a product. Background Art

[0002] Embedded systems are specialized computer systems widely used in consumer electronics, automotive, industrial control, medical equipment, and other fields. With the rapid development of the Internet of Things and artificial intelligence, the demand and complexity of embedded systems are increasing. In embedded design, verifying the correctness of the flash memory data in the main processor is crucial to ensure the stability and performance of the chip system.

[0003] Existing verification schemes for the main processor's flash memory data primarily use a single signature to verify the signature of the program in the chip's currently running memory zone. When a memory zone switch is required, the signature is updated to the signature corresponding to the new memory zone. However, if a power outage occurs during the memory zone switch, the signature and the program in the memory zone may not match, causing the chip to lock up. Therefore, the current problem to be solved is how to improve the reliability of the chip system. Summary of the Invention

[0004] Embodiments of the present application provide a chip restart method, a main processor, a security module, a chip, a medium, and a product to improve the reliability of a chip system.

[0005] In a first aspect, an embodiment of the present application provides a chip restart method, which is applied to a main processor, the main processor including a first storage area and a second storage area, and the method includes: receiving a processing instruction, the processing instruction indicating that the second storage area is the active storage area; wherein the current active storage area is the first storage area; according to the processing instruction, sending a signature generation instruction to the security module, so that the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area; executing an identification maintenance task, and executing a restart; wherein the identification maintenance task is used to update the active identification to the identification corresponding to the second storage area; the active identification represents the storage area where the startup code for restarting is located.

[0006] In one possible implementation, executing a restart includes: executing a startup program based on the startup code of the storage area corresponding to the current active identifier according to the current active identifier, the startup program including: sending a signature verification instruction to the security module; if the security module returns a verification pass, the storage area corresponding to the current active identifier is used as the active storage area to execute system startup.

[0007] In a possible implementation, the method further includes: if the security module returns a verification failure, stopping the startup program.

[0008] In a possible implementation, the processing instruction includes an update instruction; and before sending the signature generation instruction to the security module according to the processing instruction, the method further includes: receiving an update code corresponding to the update instruction, and writing the update code into the second storage area.

[0009] In a possible implementation, if the identification maintenance task is successfully executed, the storage area corresponding to the current active identification is used as the active storage area to execute system startup, including: using the second storage area as the active storage area to execute system startup to perform the update.

[0010] In a possible implementation, the processing instruction includes a rollback instruction, where the rollback instruction is used to instruct to roll back to a system state in which the second storage area is the active storage area.

[0011] In a possible implementation, if the identification maintenance task is successfully executed, the storage area corresponding to the current active identification is used as the active storage area to execute system startup, including: using the second storage area as the active storage area to execute system startup to perform rollback.

[0012] In a second aspect, an embodiment of the present application provides a chip restart method, which is applied to a security module. The method includes: receiving a signature generation instruction, which is sent by a main processor according to a processing instruction. The main processor includes a first storage area and a second storage area. The processing instruction indicates that the second storage area is the active storage area; wherein the current active storage area is the first storage area; according to the signature generation instruction, a signature corresponding to the second storage area is generated and the signature corresponding to the first storage area of ​​the main processor is retained.

[0013] In a possible embodiment, the method also includes: receiving a signature verification instruction sent by the main processor, the signature verification instruction including the identifier of the storage area corresponding to the current active identifier; if the signature verification instruction includes the identifier corresponding to the first storage area, then verifying the code in the first storage area with the signature corresponding to the first storage area, and returning the verification result to the security module; if the signature verification instruction includes the identifier corresponding to the second storage area, then verifying the code in the second storage area with the signature corresponding to the second storage area, and returning the verification result to the security module.

[0014] In one possible implementation, generating a signature corresponding to the second storage area includes: calculating the code in the second storage area based on an RSA encryption algorithm to obtain the signature corresponding to the second storage area; and verifying the code in the second storage area and the signature corresponding to the second storage area, including: calculating based on the RSA decryption algorithm according to the code in the second storage area and the signature corresponding to the second storage area to obtain a verification result.

[0015] In a possible implementation, before verifying the code in the storage area corresponding to the current active identifier and the signature corresponding to the storage area, the method further includes: determining the signature address corresponding to the storage area corresponding to the current active identifier based on the identifier in the signature verification instruction; and obtaining the signature corresponding to the storage area based on the signature address.

[0016] In a third aspect, an embodiment of the present application provides a main processor, which includes a first storage area and a second storage area, and the main processor is used to: receive a processing instruction, the processing instruction indicating that the second storage area is the active storage area; wherein the current active storage area is the first storage area; according to the processing instruction, send a signature generation instruction to the security module, so that the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area; execute an identification maintenance task, and execute a restart; wherein the identification maintenance task is used to update the active identification to the identification corresponding to the second storage area; the active identification represents the storage area where the startup code for restart is located.

[0017] In a fourth aspect, an embodiment of the present application provides a security module, which is used to: receive a signature generation instruction, the signature generation instruction is sent by a main processor based on a processing instruction, the main processor includes a first storage area and a second storage area, and the processing instruction indicates that the second storage area is the active storage area; wherein the current active storage area is the first storage area; according to the signature generation instruction, generate a signature corresponding to the second storage area and retain the signature corresponding to the first storage area of ​​the main processor.

[0018] In a fifth aspect, an embodiment of the present application provides a chip comprising the main processor as described above and the security module as described above.

[0019] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementation methods of the first aspect.

[0020] In a seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0021] In the chip restart method, main processor, security module, chip, medium, and product provided in the embodiments of the present application, after the main processor receives a processing instruction indicating that the second storage area is the active storage area, it sends a signature generation instruction to the security module, executes an identification maintenance task to switch the active storage area from the first storage area to the second storage area, and performs a restart. In the solution of the present application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. If the chip system encounters an abnormality of identification maintenance failure after the signature is generated, the main processor can still restart from the first storage area, avoiding system lockup, thereby improving the reliability of the chip system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0023] Figure 1 A schematic diagram of a chip restart method provided in this application;

[0024] Figure 2 A flowchart of the chip restart method provided in this application;

[0025] Figure 3 A flowchart of the chip restart method provided in this application;

[0026] Figure 4 A flowchart of the chip restart method provided in this application;

[0027] Figure 5 A flowchart of the chip restart method provided in this application;

[0028] Figure 6 A flowchart of the chip restart method provided in this application;

[0029] Figure 7 A flowchart of the chip restart method provided in this application;

[0030] Figure 8 A flowchart of the chip restart method provided in this application;

[0031] Figure 9 A schematic diagram of the structure of the chip provided in this application;

[0032] Figure 10 This is a schematic diagram of the state changes of the chip provided in this application.

[0033] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0034] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0035] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their ordinary and usual meanings. The terms "including" and "having" in the specification and claims of this application and the above-mentioned drawings, as well as any variations thereof, are intended to cover but not exclude inclusion. For example, a product or device that includes a series of components is not necessarily limited to those components that are clearly listed, but may include other components that are not clearly listed or are inherent to these products or devices. The term "module" used in this application refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic or combination of hardware and / or software code that can perform the functions associated with the element.

[0036] Figure 1 This is a schematic diagram of the scenario of the chip restart method provided in this application. Figure 1 As shown, the chip's hardware architecture includes the main processor (Main CPU), code flash memory (Code Flash), random access memory (RAM), device registers, and a hardware security module (HSM). The HSM includes the HSM processor (HSM CPU), data flash memory (Data Flash), and registers. The HSM can access external resources through the chip's public bus, but a firewall on the HSM CPU prevents external access to internal HSM resources. When the chip boots up and the Main CPU executes a program in the Code Flash, the HSM verifies the program based on a signature stored in the Data Flash.

[0037] In the related art, Data Flash usually stores only one signature to verify a storage area in Code Flash. When the storage area needs to be switched, such as in a program update or program rollback scenario, the HSM calculates the signature of the new storage area and uses the new storage area as the storage area for the program to be started next time. However, since only one signature is stored in Data Flash, the HSM will overwrite the signature of the old storage area after calculating the signature of the new storage area. At this time, if the chip loses power or the operation of using the new storage area as the storage area for the program to be started next time fails, a lock exception will occur when the chip is restarted again. That is, the chip starts in the old storage area, and when the signature verification is performed, the signature corresponding to the new storage area is stored in the HSM, causing the signature verification to fail.

[0038] The technical content provided by this application is intended to solve the technical problems of related technologies such as the above. In the chip restart method, main processor, security module, chip, medium and product provided in the embodiment of this application, when the main processor receives the processing instruction indicating that the second storage area is the active storage area, it sends a signature generation instruction to the security module, executes the identification maintenance task to switch the active storage area from the first storage area to the second storage area, and performs a restart. In the solution of this application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. When the chip system has an abnormality of identification maintenance failure after the signature is generated, the main processor can still start from the first storage area, avoiding the situation of system lock, thereby improving the reliability of the chip system.

[0039] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0040] Figure 2 This is a flow chart of the chip restart method provided by the present application. The method is applied to a main processor, and the main processor includes a first storage area and a second storage area, such as Figure 2 As shown, the method includes:

[0041] S201: Receive a processing instruction, where the processing instruction indicates that the second storage area is an active storage area; wherein the current active storage area is the first storage area;

[0042] In practical applications, the processing instruction can be a storage area switching instruction in the following scenarios: during a firmware update, the second storage area stores the new version of the firmware, and the first storage area stores the old version of the firmware, and the processing instruction instructs booting with the new version of the firmware; during fault recovery, when the code in the first storage area is damaged, the processing instruction instructs booting with the firmware in the backup storage area of ​​the first storage area, that is, the second storage area; during configuration switching, in some systems, it may be necessary to select different boot codes according to different operating modes or configurations. In this case, the processing instruction instructs booting with the firmware in the second storage area, which is different from the firmware in the first storage area. It should be noted that in this example, the first storage area and the second storage area are defined only by the active state, where the first storage area is the currently active storage area and the second storage area is the currently inactive storage area. Exemplarily, there can be multiple second storage areas, and the multiple second storage areas can back up each other or the code in each second storage area is different to implement different functions. Exemplarily, both the first storage area and the second storage area are non-volatile memories such as read-only memory, flash memory, or other types of non-volatile memories.

[0043] S202: Send a signature generation instruction to the security module according to the processing instruction, so that the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area;

[0044] Exemplarily, the security module is a module with signature generation and signature verification functions. In practical applications, the security module can be a hardware security module (HSM), a trusted platform module (TPM), or a secure microcontroller, etc., without limitation herein. Exemplarily, the signature generation instruction sent to the security module may include the code of the second storage area, so that upon receiving the signature generation instruction, the security module generates a signature corresponding to the code of the second storage area in the instruction. Optionally, the signature generation instruction does not include the code of the second storage area, but only includes an identifier of the second storage area, so that the security module obtains the code of the second storage area based on the identifier and generates a signature corresponding to the second storage area. After generating the signature corresponding to the second storage area, the security module may store the signatures corresponding to the first storage area and the second storage area in different partitions or database tables. In this example, by having the security module generate the signature corresponding to the second storage area while retaining the signature corresponding to the first storage area, the signature corresponding to the second storage area can be prevented from overwriting the signature corresponding to the first storage area. Furthermore, based on the storage areas and corresponding signatures, the main processor can ensure verification when starting from any storage area, thereby avoiding chip lock issues.

[0045] S203, executing an identification maintenance task and performing a restart; wherein the identification maintenance task is used to update the active identification to an identification corresponding to the second storage area; the active identification represents the storage area where the startup code for restarting is located.

[0046] In this example, by executing the identification maintenance task, the main processor can execute the storage area corresponding to the active identification, that is, the startup code in the second storage area, when executing the restart. Optionally, executing the identification maintenance task can also include: updating the next active identification to the identification corresponding to the second storage area, wherein the priority of the next active identification is higher than the priority of the active identification. Specifically, the identification maintenance process includes: the main processor updates the next active identification to the identification corresponding to the second storage area, and the active identification is still the identification corresponding to the first storage area at this time; after the main processor determines the second storage area according to the next active identification and starts according to the startup code in the second storage area, it updates the active identification from the identification corresponding to the first storage area to the identification corresponding to the second storage area, and clears the identification information corresponding to the next active identification. Through this optional solution, the reliability and logic of the identification maintenance process can be improved.

[0047] In the chip restart method provided in an embodiment of the present application, after the main processor receives a processing instruction indicating that the second storage area is the active storage area, it sends a signature generation instruction to the security module, executes an identification maintenance task to switch the active storage area from the first storage area to the second storage area, and then performs a restart. In the solution of the present application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. If the chip system encounters an abnormality of identification maintenance failure after the signature is generated, the main processor can still restart from the first storage area, avoiding system lockup and thereby improving the reliability of the chip system.

[0048] Figure 3 This is a flowchart of the chip restart method provided in this application, such as Figure 3 As shown, this embodiment Figure 2 Based on the embodiment, the chip restart method is described in detail. Among them, executing the restart includes:

[0049] S301: Execute a startup program based on the startup code in the storage area corresponding to the current active identifier, the startup program including: sending a signature verification instruction to a security module;

[0050] S302: If the security module returns a verification result, the storage area corresponding to the current active identifier is used as the active storage area to execute system startup.

[0051] In this example, if the identification maintenance task is successful, that is, the active identification is successfully updated to the identification corresponding to the second storage area, the startup program is executed based on the startup code of the second storage area; if the identification maintenance task fails, such as the chip is powered off during identification maintenance or the identification corresponding to the second storage area fails to be written during identification maintenance, the active identification is still the identification corresponding to the first storage area. Among them, the startup programs in the first storage area and the second storage area both include sending signature verification instructions to the security module. If the security module returns a verification pass, the storage area corresponding to the current active identification is used as the active storage area, and the system startup is executed. The solution of this example, when the identification maintenance task is successful or unsuccessful, executes the startup program of the storage area corresponding to the active identification, and sends a signature verification instruction to the security module and executes the system startup based on the verification of the security module, which can improve the security of the program startup.

[0052] Figure 4 This is a flowchart of the chip restart method provided in this application, such as Figure 4 As shown, this embodiment Figure 3 Based on the embodiment, the chip restart method is described in detail. The chip restart method also includes:

[0053] S401: If the security module returns that the verification is not passed, the startup program is stopped.

[0054] Exemplarily, the security module can halt the startup program by controlling the main processor to remain in a reset state, or by actively terminating the startup program when the main processor receives a verification failure signal. Exemplarily, upon receiving a verification failure signal, the main processor can initiate a reboot, allowing the security module to perform signature verification again. Optionally, a threshold can be set for the number of signature verification failures. Within this threshold, the main processor can continue to reboot. When the number of verification failures resulting from multiple reboots exceeds the threshold, the startup program is halted. This exemplary solution, which halts the startup program when the security module returns a verification failure, improves program startup security.

[0055] As another example, the processing instruction includes an update instruction; and according to the processing instruction, before sending the signature generation instruction to the security module, the processing further includes:

[0056] An update code corresponding to the update instruction is received, and the update code is written into the second storage area.

[0057] Optionally, after receiving the update code corresponding to the update instruction, the update code is first integrity checked, such as by using a hash function to generate a checksum, and the source of the update code is verified, such as by using a digital signature or certificate verification to ensure that the source is trustworthy. Optionally, before writing the update code to the second storage area, the existing code version in the current system, i.e., the code version in the first storage area, is checked. If the new code version is older or the same, the update is rejected to prevent downgrade attacks. The solution of this example, by receiving the update code corresponding to the update instruction and writing the update code to the second storage area, can improve the security and controllability of the chip's firmware update.

[0058] As another example, this embodiment, based on any of the embodiments, describes in detail a chip restart method. If the identification maintenance task is successfully executed, the storage area corresponding to the current active identification is used as the active storage area, and the system is started, including:

[0059] The system is started up with the second storage area as the active storage area to perform the update.

[0060] In this example, if the identification maintenance task is successfully executed, the active identification is updated to the identification corresponding to the second storage area. The main processor executes the startup program based on the startup code of the second storage area corresponding to the current active identification, wherein the startup program includes: sending a signature verification instruction to the security module. It should be noted that, based on any embodiment, the signature corresponding to the second storage area has been generated by the security module, so when the security module performs signature verification, it can determine the signature corresponding to the second storage area based on the identification of the second storage area. In the solution of this example, after the identification maintenance task is successfully executed, the second storage area is used as the active storage area, and the system startup is executed to perform the update, thereby improving the efficiency of the chip firmware update.

[0061] As yet another example, the processing instruction includes a rollback instruction, where the rollback instruction is used to instruct to roll back to a system state in which the second storage area is the active storage area.

[0062] In this example, the second storage area represents the previous active storage area before the first storage area was active. In practice, the firmware version of the chip in the second storage area can be higher or lower than that in the first storage area, without limitation. This example allows for rollback based on processing instructions in a rollback scenario.

[0063] As another example, if the identification maintenance task is successfully executed, the storage area corresponding to the current active identification is used as the active storage area, and the system is started, including:

[0064] The system is started with the second storage area as the active storage area to perform the rollback.

[0065] In this example, if the identification maintenance task is successfully executed, the active identification is updated to the identification corresponding to the second storage area. The main processor executes the startup program based on the startup code of the second storage area corresponding to the current active identification, wherein the startup program includes: sending a signature verification instruction to the security module. It should be noted that, based on any embodiment, the signature corresponding to the second storage area has been generated by the security module, so when the security module performs signature verification, it can determine the signature corresponding to the second storage area based on the identification of the second storage area. In the solution of this example, when the identification maintenance task is successfully executed and a rollback is performed, based on the premise that the signature corresponding to the second storage area is not covered by the signature corresponding to the first storage area, there is no need to regenerate the signature corresponding to the second storage area during the rollback, thereby improving the efficiency of the chip firmware rollback.

[0066] In the chip restart method provided in an embodiment of the present application, after the main processor receives a processing instruction indicating that the second storage area is the active storage area, it sends a signature generation instruction to the security module, executes an identification maintenance task to switch the active storage area from the first storage area to the second storage area, and then performs a restart. In the solution of the present application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. If the chip system encounters an abnormality of identification maintenance failure after the signature is generated, the main processor can still restart from the first storage area, avoiding system lockup and thereby improving the reliability of the chip system.

[0067] Example 2

[0068] Figure 5 This is a flow chart of the chip restart method provided by this application, which is applied to the security module, such as Figure 5 As shown, the method includes:

[0069] S501: Receive a signature generation instruction, where the signature generation instruction is sent by a main processor in response to a processing instruction. The main processor includes a first storage area and a second storage area, and the processing instruction indicates that the second storage area is an active storage area; wherein the current active storage area is the first storage area.

[0070] Exemplarily, the security module is a module with signature generation and signature verification functions. In practical applications, the security module may be a hardware security module (HSM), a trusted platform module (TPM), or a secure microcontroller, etc., without limitation herein. Exemplarily, the signature generation instruction may include the code of the second storage area, so that upon receiving the signature generation instruction, the security module generates a signature corresponding to the code of the second storage area in the instruction. Optionally, the signature generation instruction does not include the code of the second storage area, but only includes an identifier of the second storage area, so that the security module obtains the code of the second storage area based on the identifier and generates a signature corresponding to the second storage area.

[0071] In practical applications, the processing instruction can be a storage area switching instruction in the following scenarios: during a firmware update, the second storage area stores the new version of the firmware, and the first storage area stores the old version of the firmware, and the processing instruction instructs booting with the new version of the firmware; during fault recovery, when the code in the first storage area is damaged, the processing instruction instructs booting with the firmware in the backup storage area of ​​the first storage area, that is, the second storage area; during configuration switching, in some systems, it may be necessary to select different boot codes according to different operating modes or configurations. In this case, the processing instruction instructs booting with the firmware in the second storage area, which is different from the firmware in the first storage area. It should be noted that in this example, the first storage area and the second storage area are defined only by the active state, where the first storage area is the currently active storage area and the second storage area is the currently inactive storage area. Exemplarily, there can be multiple second storage areas, and the multiple second storage areas can back up each other or the code in each second storage area is different to implement different functions. Exemplarily, both the first storage area and the second storage area are non-volatile memories such as read-only memory, flash memory, or other types of non-volatile memories.

[0072] S502: Generate a signature corresponding to the second storage area according to the signature generation instruction and retain the signature corresponding to the first storage area of ​​the main processor.

[0073] In actual applications, signature generation may include the following processes: using a hash algorithm to convert the data in the second storage area into a hash value of a fixed length; using an encryption algorithm to generate a pair of keys: a private key and a public key, the private key is used to encrypt the hash value to generate a signature, and the public key is used to verify the signature. In this example, after generating the signature corresponding to the second storage area, the security module may store the signature corresponding to the first storage area and the signature corresponding to the second storage area in different partitions or database tables. In this example, by generating the signature corresponding to the second storage area and retaining the signature corresponding to the first storage area through the security module, it is possible to avoid the signature corresponding to the second storage area overwriting the signature corresponding to the first storage area. At the same time, based on the storage area and the corresponding signature, the main processor can pass the verification when starting any storage area, thereby avoiding the problem of chip locking.

[0074] In the chip restart method provided in an embodiment of the present application, after the main processor receives a processing instruction indicating that the second storage area is the active storage area, it sends a signature generation instruction to the security module, executes an identification maintenance task to switch the active storage area from the first storage area to the second storage area, and then performs a restart. In the solution of the present application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. If the chip system encounters an abnormality of identification maintenance failure after the signature is generated, the main processor can still restart from the first storage area, avoiding system lockup and thereby improving the reliability of the chip system.

[0075] Figure 6 This is a flowchart of the chip restart method provided in this application, such as Figure 6 As shown, this embodiment Figure 5 Based on the embodiment, the chip restart method is described in detail. The chip restart method also includes:

[0076] S601: Receive a signature verification instruction sent by a main processor, where the signature verification instruction includes an identifier of a storage area corresponding to a current active identifier;

[0077] S602: If the signature verification instruction includes the identifier corresponding to the first storage area, verify the code in the first storage area with the signature corresponding to the first storage area, and return the verification result to the security module;

[0078] S603: If the signature verification instruction includes the identifier corresponding to the second storage area, verify the code in the second storage area with the signature corresponding to the second storage area, and return the verification result to the security module.

[0079] In this example, the main processor receives a signature verification instruction including the identifier of the storage area corresponding to the currently active identifier. Based on the identifier of the corresponding storage area, the code in that storage area is verified against the signature corresponding to that storage area, and the verification result is returned to the security module. In this example, the signature corresponding to each storage area is stored independently and indexed by the corresponding identifier of the storage area. This improves the accuracy of signature verification by effectively managing signature data.

[0080] Figure 7 This is a flowchart of the chip restart method provided in this application, such as Figure 7 As shown, this embodiment Figure 6 Based on the embodiment, the chip restart method is described in detail. Among them, generating the signature corresponding to the second storage area includes:

[0081] S701. Calculate the code in the second storage area based on the RSA encryption algorithm to obtain a signature corresponding to the second storage area;

[0082] Verifying the code in the second storage area and the signature corresponding to the second storage area includes:

[0083] S702 : Perform calculation based on the RAS decryption algorithm according to the code in the second storage area and the signature corresponding to the second storage area to obtain a verification result.

[0084] In actual applications, the code in the second storage area is first converted into a hash value of fixed length based on a hash algorithm such as SHA-256 or SHA-1, and then the hash value is calculated based on the RSA encryption algorithm to obtain a signature. Exemplarily, the RSA encryption algorithm refers to the private key in the RSA key generation process. Correspondingly, the RSA decryption algorithm refers to the public key in the RSA key generation process. On the other hand, according to the code in the second storage area and the signature corresponding to the second storage area, the calculation based on the RSA decryption algorithm may include the following process: calculating the hash value of the code in the second storage area through the RSA decryption algorithm, and calculating another hash value of the code in the second storage area through the RSA encryption algorithm. If the two hash values ​​are the same, the verification is passed, and if they are different, the verification fails. The solution of this example uses the RSA algorithm to generate and verify the signature of the code in the same storage area, which can improve the security of the chip system.

[0085] Figure 8 This is a flowchart of the chip restart method provided in this application, such as Figure 8 As shown, this embodiment Figure 6 Example or Figure 7Based on the embodiment, the chip restart method is described in detail. Among them, before verifying the code in the storage area corresponding to the current active identifier and the signature corresponding to the storage area, it also includes:

[0086] S801. Determine the signature address corresponding to the storage area corresponding to the current active identifier based on the identifier in the signature verification instruction;

[0087] S802: Obtain the signature corresponding to the storage area according to the signature address.

[0088] Exemplarily, a mapping table or directory may be maintained that associates the identifier of each storage area with its corresponding signature address. By searching this table, the signature address of the storage area corresponding to the currently active identifier can be quickly determined. Optionally, the signature address mapping table may be dynamically updated and managed as needed, and a variety of storage media and signature algorithms may be supported to accommodate different security requirements and hardware platforms. The solution in this example determines the signature address corresponding to the storage area corresponding to the currently active identifier based on the identifier in the signature verification instruction, and obtains the signature corresponding to the storage area based on the signature address, thereby achieving rapid positioning of the required signature through the identifier, thereby reducing the time for signature verification.

[0089] In the chip restart method provided in an embodiment of the present application, after the main processor receives a processing instruction indicating that the second storage area is the active storage area, it sends a signature generation instruction to the security module, executes an identification maintenance task to switch the active storage area from the first storage area to the second storage area, and then performs a restart. In the solution of the present application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. If the chip system encounters an abnormality of identification maintenance failure after the signature is generated, the main processor can still restart from the first storage area, avoiding system lockup and thereby improving the reliability of the chip system.

[0090] Example 3

[0091] The present application provides an embodiment of a main processor 10, which includes a first storage area and a second storage area. The main processor 10 is configured to:

[0092] receiving a processing instruction, the processing instruction indicating that the second storage area is an active storage area; wherein the current active storage area is the first storage area;

[0093] Sending a signature generation instruction to the security module according to the processing instruction, so that the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area;

[0094] Execute an identification maintenance task and perform a restart; wherein the identification maintenance task is used to update the active identification to the identification corresponding to the second storage area; the active identification represents the storage area where the startup code for restart is located.

[0095] In one example, the main processor 10 is specifically configured to:

[0096] According to the current active identifier, a startup program is executed based on the startup code of the storage area corresponding to the active identifier, the startup program including: sending a signature verification instruction to the security module;

[0097] If the security module returns a verification result, the storage area corresponding to the current active identifier is used as the active storage area to execute system startup.

[0098] In one example, the main processor 10 is further configured to:

[0099] If the security module returns that the verification has failed, the startup program is stopped.

[0100] In one example, the main processor 10 is further configured to:

[0101] An update code corresponding to the update instruction is received, and the update code is written into the second storage area.

[0102] In one example, the processing instruction includes a rollback instruction, where the rollback instruction is used to instruct to roll back to a system state in which the second storage area is the active storage area.

[0103] In one example, if the maintenance task is successfully executed, the main processor 10 is specifically configured to:

[0104] The system is started with the second storage area as the active storage area to perform the rollback.

[0105] The main processor provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0106] The present application also provides an embodiment of a security module 20, which is used to:

[0107] receiving a signature generation instruction, the signature generation instruction being sent by a main processor in response to a processing instruction, the main processor including a first storage area and a second storage area, the processing instruction indicating that the second storage area is an active storage area; wherein the current active storage area is the first storage area;

[0108] According to the signature generation instruction, a signature corresponding to the second storage area is generated and the signature corresponding to the first storage area of ​​the main processor is retained.

[0109] In one example, the security module 20 is further configured to:

[0110] receiving a signature verification instruction sent by the main processor, the signature verification instruction including an identifier of a storage area corresponding to a current active identifier;

[0111] If the signature verification instruction includes the identifier corresponding to the first storage area, verifying the code in the first storage area with the signature corresponding to the first storage area, and returning the verification result to the security module;

[0112] If the signature verification instruction includes the identifier corresponding to the second storage area, the code in the second storage area and the signature corresponding to the second storage area are verified, and the verification result is returned to the security module.

[0113] In one example, the security module 20 is specifically configured to:

[0114] Calculate the code in the second storage area based on the RSA encryption algorithm to obtain a signature corresponding to the second storage area;

[0115] A verification result is obtained by performing calculation based on the RAS decryption algorithm according to the code in the second storage area and the signature corresponding to the second storage area.

[0116] In one example, the security module 20 is further configured to:

[0117] According to the identifier in the signature verification instruction, determine the signature address corresponding to the storage area corresponding to the current active identifier;

[0118] According to the signature address, obtain the signature corresponding to the storage area.

[0119] The security module provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0120] Figure 9 The schematic diagram of the chip structure provided in this application is as follows: Figure 9 As shown, the chip provided by this embodiment includes: a main processor 10 and a security module 20.

[0121] In the chip provided in an embodiment of the present application, after the main processor receives a processing instruction indicating that the second storage area is the active storage area, it sends a signature generation instruction to the security module, executes an identification maintenance task to switch the active storage area from the first storage area to the second storage area, and performs a restart. In the solution of the present application, after receiving the signature generation instruction, the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area. If the chip system experiences an exception indicating an identification maintenance failure after the signature is generated, the main processor can still boot from the first storage area, avoiding system lockup and thereby improving the reliability of the chip system.

[0122] Figure 10 A schematic diagram of the state changes of the chip provided in this application. As shown in the figure, in state 1, the active identifier in the main processor indicates the first storage area, and the signatures corresponding to the first storage area and the second storage area in the processor of the security module match; if the main processor receives an update instruction, the update code is written to the second storage area, and state 2 is obtained. At this time, the code in the second storage area and the signature corresponding to the second storage area do not match; the security module calculates the signature corresponding to the second storage area and obtains state 3. At this time, the code in the second storage area and the signature corresponding to the second storage area match; the main processor performs the identification maintenance task. If the identification maintenance fails at this time, state 4 is obtained. At this time, when the chip is restarted, it can still be restarted based on the code in the first storage area to avoid the chip being locked. Further, if in state 1, the main processor receives a rollback instruction and performs the identification maintenance task and fails to obtain state 5, at this time, when the chip is restarted, it can still be restarted based on the code in the first storage area to avoid the current chip being locked. At the same time, the signature corresponding to the rolled-back storage area, that is, the second storage area, does not need to be calculated again by the security module, thereby optimizing the process and reducing resource waste.

[0123] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0124] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0125] The readable storage medium may be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0126] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0127] The division of units is merely a logical functional division; actual implementations may employ alternative divisions, such as combining or integrating multiple units or components into another system, or omitting or disabling certain features. Furthermore, any direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units, either through an interface, electrical, mechanical, or other means.

[0128] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0129] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0130] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the method of the present invention. The aforementioned storage medium includes various media that can store program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0131] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0132] Finally, it should be noted that those skilled in the art will readily identify other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The present invention is not limited to the precise structure described above and illustrated in the accompanying drawings, and various modifications and variations may be made without departing from the scope thereof. The scope of the present invention is limited solely by the appended claims.

Claims

1. A chip restart method, characterized in that: Applied to a main processor, the main processor includes a first storage area and a second storage area, the method includes: receiving a processing instruction, the processing instruction indicating that the second storage area is an active storage area; wherein the current active storage area is the first storage area; sending a signature generation instruction to a security module according to the processing instruction, so that the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area; Execute an identification maintenance task and perform a restart; wherein the identification maintenance task is used to update the active identification to the identification corresponding to the second storage area; the active identification represents the storage area where the startup code for restart is located.

2. The method according to claim 1, characterized in that The restarting step includes: According to the current active identifier, executing a startup program based on the startup code of the storage area corresponding to the active identifier, the startup program including: sending a signature verification instruction to the security module; If the security module returns a verification success, the storage area corresponding to the current active identifier is used as the active storage area to execute system startup.

3. The method according to claim 2, characterized in that The method further comprises: If the security module returns that the verification is not passed, the startup program is stopped.

4. The method according to claim 2, characterized in that The processing instruction includes an update instruction; and before sending the signature generation instruction to the security module according to the processing instruction, the method further includes: An update code corresponding to the update instruction is received, and the update code is written into the second storage area.

5. The method according to claim 4, characterized in that If the identification maintenance task is successfully executed, the storage area corresponding to the current active identification is used as the active storage area to execute system startup, including: The system is started up with the second storage area as the active storage area to perform the update.

6. The method according to claim 1, wherein The processing instruction includes a rollback instruction, and the rollback instruction is used to instruct to roll back to a system state in which the second storage area is an active storage area.

7. The method according to claim 6, characterized in that If the identification maintenance task is successfully executed, the storage area corresponding to the current active identification is used as the active storage area to execute system startup, including: The second storage area is used as the active storage area, and the system is started to perform the rollback.

8. A chip restart method, characterized in that: Applied to a security module, the method includes: receiving a signature generation instruction, the signature generation instruction being sent by a main processor in response to a processing instruction, the main processor including a first storage area and a second storage area, the processing instruction indicating that the second storage area is an active storage area; wherein the current active storage area is the first storage area; According to the signature generation instruction, a signature corresponding to the second storage area is generated and a signature corresponding to the first storage area of ​​the main processor is retained.

9. The method according to claim 8, characterized in that The method further comprises: receiving a signature verification instruction sent by the main processor, wherein the signature verification instruction includes an identifier of a storage area corresponding to a current active identifier; If the signature verification instruction includes the identifier corresponding to the first storage area, verifying the code in the first storage area with the signature corresponding to the first storage area, and returning the verification result to the security module; If the signature verification instruction includes the identifier corresponding to the second storage area, the code in the second storage area and the signature corresponding to the second storage area are verified, and the verification result is returned to the security module.

10. The method according to claim 9, characterized in that Generating a signature corresponding to the second storage area includes: Calculate the code in the second storage area based on the RSA encryption algorithm to obtain a signature corresponding to the second storage area; The verifying the code in the second storage area and the signature corresponding to the second storage area includes: A verification result is obtained by performing calculation based on the RAS decryption algorithm according to the code in the second storage area and the signature corresponding to the second storage area.

11. The method according to claim 9 or 10, characterized in that Before verifying the code in the storage area corresponding to the current active identifier and the signature corresponding to the storage area, the method further includes: Determine, based on the identifier in the signature verification instruction, the signature address corresponding to the storage area corresponding to the current active identifier; According to the signature address, the signature corresponding to the storage area is obtained.

12. A main processor, characterized in that: The main processor includes a first storage area and a second storage area, and the main processor is configured to: receiving a processing instruction, the processing instruction indicating that the second storage area is an active storage area; wherein the current active storage area is the first storage area; sending a signature generation instruction to a security module according to the processing instruction, so that the security module generates a signature corresponding to the second storage area and retains the signature corresponding to the first storage area; Execute an identification maintenance task and perform a restart; wherein the identification maintenance task is used to update the active identification to the identification corresponding to the second storage area; the active identification represents the storage area where the startup code for restart is located.

13. A security module, characterized in that: The security module is used for: receiving a signature generation instruction, the signature generation instruction being sent by a main processor in response to a processing instruction, the main processor including a first storage area and a second storage area, the processing instruction indicating that the second storage area is an active storage area; wherein the current active storage area is the first storage area; According to the signature generation instruction, a signature corresponding to the second storage area is generated and a signature corresponding to the first storage area of ​​the main processor is retained.

14. A chip, characterized in that: The device comprises the main processor according to claim 12 and the security module according to claim 13.

15. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 or claims 8 to 11 when executed by a processor.

16. A computer program product, characterized in that The method comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 7 or claims 8 to 11.

Images