A safety measurement method for high real-time performance of secure and trusted controller

Abstract

The present application discloses a high real-time security measurement method for a secure and trusted controller, comprising the following steps: step S1: determining the critical firmware in the controller; step S2: verifying the integrity of the critical firmware through a security chip; step S3: verifying the integrity of the firmware in the external memory using the security chip; step S4: if the integrity verification of the critical firmware passes, an integrity report is generated; if it fails, corresponding security measures are taken; step S5: for non-critical firmware, a soft measurement strategy is used for verification; step S6: when updating the firmware, the security chip is used to recalculate the verification information; step S7: if the critical firmware update is completed, the system is restarted and step S3 is re-executed; if the non-critical firmware update is completed, the non-critical firmware is restarted. Improve the security of the system, optimize the startup performance, and simplify the maintenance and update process.

Description

Technical Field

[0001] The present application relates to the field of automation information security, and in particular to a high real-time security measurement method for a secure and trusted controller. Background Art

[0002] In the existing technical environment, the integrity measurement of trusted computing mainly relies on hardware security chips, and common security chips include TCM, TPM, etc. Figure 1 For the integrity measurement hardware, TCM, TPM and a flash (common SPI interface) need to be connected. The CPU first needs to write the measured firmware or application integrity measurement trust root and measurement value into the security chip, and write the firmware or application into the external flash. After the hardware is powered on, the security chip starts first, and measures the firmware or application of each area in turn until the measurement is completed and an integrity report is generated. After the CPU starts normally, it reads the integrity report to determine whether the current firmware or application has been tampered with, thereby protecting the information security of the device.

[0003] When the firmware or application is updated, the measurement value is calculated by the security chip cryptographic algorithm engine, and the new integrity measurement trust root is written into the security chip. When the device or application is restarted, the security chip executes the new measurement strategy and generates a new measurement report, repeating the process.

[0004] With respect to the above-mentioned related technologies, the inventors believe that there are the following defects: based on the traditional solution, for the high real-time performance of the automation control system, if all firmware is measured, considering that the interaction between the security chip and the external flash is a hardware SPI interface, the maximum transmission rate is 50MHz, and the time it takes for the security chip to perform hash calculations on large files, the overall measurement time will be very long in actual scenarios, and therefore needs to be improved. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present application provides a security measurement method for a secure and trusted controller with high real-time performance, aiming to solve the above problems.

[0006] A security measurement method for high real-time performance of a secure and trusted controller comprises the following steps:

[0007] Step S1: Determine the key firmware in the controller;

[0008] Step S2: verifying the integrity of the critical firmware through a security chip, and storing the verification information in the security chip;

[0009] Step S3: When the controller starts, the security chip is used to verify the integrity of the firmware in the external memory;

[0010] Step S4: if the integrity verification of the critical firmware passes, an integrity report is generated; if it fails, corresponding security measures are taken;

[0011] Step S5: For non-critical firmware, a soft metric strategy is used for verification;

[0012] Step S6: When updating the firmware, recalculate the verification information using the security chip, and update the verification information stored in the security chip;

[0013] Step S7: If the critical firmware update is completed, the system restarts and re-executes steps S3 and S4. If the non-critical firmware update is completed, only the non-critical firmware needs to be restarted and step S5 is re-executed.

[0014] By adopting the above technical solution, first, the key firmware in the controller is determined, and the integrity of these firmware is verified through the security chip to ensure that they have not been tampered with. As a trust root, the security chip provides an unalterable trust foundation, ensures the security of the startup process, and prevents the system from running in an unsafe state. For non-critical firmware, a soft measurement strategy is used for verification, and a suitable verification algorithm is selected according to the CPU performance to ensure an efficient and flexible verification process. When updating the firmware, the security chip automatically recalculates and updates the verification information, simplifies the maintenance and update process, and ensures that the new version of the firmware is also strictly verified. After the update is completed, the system restarts and repeats the process of the startup phase to ensure that the updated system is still safe and reliable. For non-critical firmware, it is directly restarted, and the firmware is executed according to step S5, which is safe and reliable, and it is non-disruptive to the entire system. Overall, this security measurement method not only improves the overall security of the system, but also optimizes the startup performance, simplifies the maintenance and update process, and ensures that the system can remain efficient, reliable and safe under various conditions.

[0015] Optionally, the integrity verification includes calculating a hash value of the critical firmware and comparing it with a pre-stored root of trust.

[0016] Optionally, the soft measurement strategy in step S5 includes an implicit component strategy, a direct storage strategy, and a lightweight measurement strategy.

[0017] Optionally, the implicit component strategy specifically includes the following steps:

[0018] Step a1: compressing the compression table together with the boot loader, and storing the compressed file in an external non-volatile memory;

[0019] Step a2: storing the firmware programs of other functional components in a non-volatile storage device in the form of compressed files;

[0020] Step a3: After the boot loader is started, the Huffman table of each firmware and the corresponding compressed file are read first, the compressed file is decompressed, the original firmware program is restored, the pre-stored signature check value or hash value is read from the security chip, the hash value of the restored firmware program is dynamically calculated, and compared with the read signature check value or hash value;

[0021] Step a4: If the hash values ​​match, the verification is successful; if not, take appropriate security measures.

[0022] By adopting the above technical solution, the compression table is compressed together with the boot loader and stored in an external non-volatile memory, so that the original firmware file is not directly exposed in the storage chip, which increases the difficulty for attackers to obtain and tamper with the firmware; at the same time, the firmware programs of other functional components are stored in the non-volatile storage device in the form of compressed files, which effectively saves storage space, is particularly suitable for embedded systems with limited storage resources, and reduces the bandwidth required for transmission. After the boot loader is started, the Huffman table and the corresponding compressed file of each firmware are read and decompressed and restored, and then the pre-stored signature check value or hash value is read from the security chip, and the hash value of the restored firmware program is dynamically calculated and compared with it. This double verification mechanism ensures the integrity and authenticity of the firmware and prevents unauthorized modification. Although the decompression process will increase the startup time, modern compression algorithms and hardware acceleration functions can significantly reduce this delay, ensuring that the startup process is as fast as possible; automatic integrity verification is performed at each startup to ensure that the system always runs in a safe state. If any abnormality is detected, appropriate security measures are taken immediately to avoid potential security risks; during the firmware update process, the security chip recalculates and updates the verification information to ensure that the new version of the firmware is also strictly verified to maintain the security and consistency of the system. The implicit component strategy not only enhances the security of the system, but also improves the startup performance and resource utilization efficiency, and simplifies the maintenance and update process.

[0023] Optionally, the direct storage strategy specifically includes the following steps:

[0024] Step b1: directly storing the original firmware program file in a non-volatile storage device;

[0025] Step b2: During the boot process, the boot loader quickly reads the firmware of other functional components from the non-volatile storage device and directly calculates the signature check value or hash value;

[0026] Step b3: Compare the calculated signature check value or hash value with the value pre-stored in the security chip;

[0027] Step b4: If the calculated value is consistent with the value in the security chip, it is confirmed that the current firmware has not been tampered with and the subsequent programs continue to run normally; if the calculated value is inconsistent with the value in the security chip, boot into safe mode and restore factory settings.

[0028] By adopting the above technical solution, the original firmware program file is directly stored in a non-volatile storage device, and its high reading speed is used to quickly read the firmware of other functional components during the startup process, thereby greatly shortening the startup time. The boot loader directly calculates the signature check value or hash value at startup, and compares it with the value pre-stored in the security chip to ensure that the firmware has not been tampered with. If the calculated values ​​are consistent, the integrity of the current firmware is confirmed and subsequent programs continue to run normally; if they are inconsistent, the system is booted into safe mode and factory settings are restored to effectively prevent malware or unauthorized code from running. This method not only improves the system's startup efficiency and response speed, but also enhances security, simplifies maintenance processes, and ensures that the system always runs in a safe state.

[0029] Optionally, the lightweight measurement strategy specifically includes: after the boot loader reads the firmware in the non-volatile storage device during the startup process, a relatively lightweight measurement algorithm CRC32 is selected for calculation verification to reduce calculation time.

[0030] By adopting the above technical solution, after the boot loader reads the firmware in the non-volatile storage device, the CRC32 algorithm is used for calculation verification. Since the calculation complexity of CRC32 is low and the conflict probability is low, the calculation time can be greatly reduced while ensuring sufficient security. It is particularly suitable for CPUs with weak processing capabilities or limited resources. It not only speeds up the startup speed, but also reduces the CPU burden, ensuring that the system can be efficiently started under various hardware conditions.

[0031] Optionally, the safety measures include preventing the system from starting up, issuing an alarm, and entering a safe mode.

[0032] By adopting the above technical solutions, when the firmware integrity verification failure or other security anomalies are detected, the system startup is immediately blocked, effectively preventing malware or unauthorized code from running, and ensuring that the system will not start in an unsafe state. At the same time, an alarm prompt is triggered to notify the administrator or user of the potential security threat, so that further investigation and response measures can be taken in time. In addition, the system automatically enters the safe mode, providing a restricted but controllable operating environment, allowing users or administrators to troubleshoot, restore factory settings, or apply necessary security updates. This approach not only improves the overall security of the system, but also ensures that a quick response and appropriate remedial measures can be taken when a security incident occurs, reducing potential security risks and losses. In summary, these security measures enhance the reliability of the system and user trust through a multi-level protection mechanism.

[0033] Optionally, the critical firmware includes a boot loader, an operating system kernel, and a driver that interacts directly with the hardware.

[0034] In summary, the present application includes at least one of the following beneficial technical effects:

[0035] 1. First, determine the key firmware in the controller and verify the integrity of these firmware through the security chip to ensure that they have not been tampered with. As a root of trust, the security chip provides an unalterable trust foundation to ensure the security of the boot process and prevent the system from running in an unsafe state. For non-critical firmware, a soft measurement strategy is used for verification, and the appropriate verification algorithm is selected according to the CPU performance to ensure an efficient and flexible verification process. When updating the firmware, the security chip automatically recalculates and updates the verification information, which simplifies the maintenance and update process, while ensuring that the new version of the firmware is also strictly verified. After the update is completed, the system is restarted or the application is restarted and the measurement process is repeated to ensure that the updated system is still safe and reliable. Overall, this security measurement method not only improves the overall security of the system, but also optimizes the startup performance, simplifies the maintenance and update process, and non-intrusive updates to some applications, ensuring that the system can remain efficient, reliable and secure under various conditions.

[0036] 2. By compressing the compression table together with the boot loader and storing them in an external non-volatile memory, the original firmware file is not directly exposed to the storage chip, which increases the difficulty for attackers to obtain and tamper with the firmware; at the same time, the firmware programs of other functional components are stored in the non-volatile storage device in the form of compressed files, which effectively saves storage space, is particularly suitable for embedded systems with limited storage resources, and reduces the bandwidth required for transmission. After the boot loader is started, the Huffman table and the corresponding compressed file of each firmware are read and decompressed and restored, and then the pre-stored signature check value or hash value is read from the security chip, and the hash value of the restored firmware program is dynamically calculated and compared with it. This double verification mechanism ensures the integrity and authenticity of the firmware and prevents unauthorized modifications. Although the decompression process will increase the startup time, modern compression algorithms and hardware acceleration functions can significantly reduce this delay, ensuring that the startup process is as fast as possible; automatic integrity verification is performed at each startup to ensure that the system always runs in a safe state. If any abnormality is detected, appropriate security measures are taken immediately to avoid potential security risks; during the firmware update process, the security chip recalculates and updates the verification information to ensure that the new version of the firmware is also strictly verified to maintain the security and consistency of the system. The implicit component strategy not only enhances the security of the system, but also improves the startup performance and resource utilization efficiency, and simplifies the maintenance and update process.

[0037] 3. Store the original firmware program file directly in a non-volatile storage device, and use its high reading speed to quickly read the firmware of other functional components during the startup process, thereby greatly shortening the startup time. The boot loader directly calculates the signature check value or hash value at startup, and compares it with the value pre-stored in the security chip to ensure that the firmware has not been tampered with. If the calculated values ​​are consistent, the integrity of the current firmware is confirmed and subsequent programs continue to run normally; if they are inconsistent, boot into safe mode and restore factory settings to effectively prevent malware or unauthorized code from running. This method not only improves the system's startup efficiency and response speed, but also enhances security, simplifies maintenance processes, and ensures that the system always runs in a safe state.

[0038] 4. When firmware integrity verification failure or other security anomalies are detected, the system is immediately blocked from booting, effectively preventing malware or unauthorized code from running, and ensuring that the system does not boot in an unsafe state. At the same time, an alarm is triggered to notify the administrator or user of potential security threats, so that further investigation and response measures can be taken in a timely manner. In addition, the system automatically enters safe mode, providing a restricted but controllable operating environment, allowing users or administrators to troubleshoot, restore factory settings, or apply necessary security updates. This approach not only improves the overall security of the system, but also ensures that a quick response and appropriate remedial measures can be taken when a security incident occurs, reducing potential security risks and losses. In summary, these security measures enhance system reliability and user trust through multi-level protection mechanisms. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of the prior art.

[0040] Figure 2 It is a flowchart of an embodiment of the present application.

[0041] Figure 3 It is a flowchart of an embodiment of the present application.

[0042] Figure 4 It is a flowchart of an embodiment of the present application.

[0043] Figure 5 It is a flowchart of the implicit component strategy in the embodiment of the present application.

[0044] Figure 6 It is a flowchart of the direct storage strategy in the embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to facilitate the understanding of the present application, the present application is described in more detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that when an element is described as "fixed to" another element, it can be directly on the other element, or there can be one or more centered elements therebetween. When an element is described as "connected to" another element, it can be directly connected to the other element, or there can be one or more centered elements therebetween. The terms "vertical", "horizontal", "left", "right" and similar expressions used in this specification are for illustrative purposes only.

[0046] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The term "and / or" used in this specification includes any and all combinations of one or more of the related listed items.

[0047] The present application embodiment discloses a high real-time security measurement method for a secure and reliable controller. Figure 2 , Figure 3 and Figure 4 , including the following steps: Step S1: determine the key firmware in the controller, the key firmware includes the boot loader (such as uboot), the operating system kernel and the driver that directly interacts with the hardware; Step S2: perform integrity verification on the key firmware through the security chip, and store the verification information in the security chip; Step S3: when the controller starts, use the security chip to verify the integrity of the firmware in the external memory, the integrity verification includes calculating the hash value of the key firmware and comparing it with the pre-stored trust root; Step S4: if the integrity verification of the key firmware passes, an integrity report is generated; if it fails, corresponding security measures are taken; Step S5: for non-critical firmware, a soft metric strategy is used for verification; Step S6: when updating the firmware, the verification information is recalculated using the security chip, and the verification information stored in the security chip is updated; Step S7: if the update of the key firmware is completed, the system restarts and re-executes steps S3 and S4. If the update of the non-critical firmware is completed, only the non-critical firmware needs to be restarted and step S5 is re-executed. First, the key firmware in the controller is determined, and the integrity of these firmware is verified by the security chip to ensure that they have not been tampered with. As a root of trust, the security chip provides an unalterable trust foundation, ensures the security of the boot process, and prevents the system from running in an unsafe state. For non-critical firmware, a soft measurement strategy is used for verification, and the appropriate verification algorithm is selected according to the CPU performance to ensure an efficient and flexible verification process. When updating the firmware, the security chip automatically recalculates and updates the verification information, which simplifies the maintenance and update process, while ensuring that the new version of the firmware is also strictly verified. After the update is completed, the system or firmware restarts and repeats steps S3 and S4 to ensure that the updated system is still safe and reliable. Overall, this security measurement method not only improves the overall security of the system, but also optimizes the startup performance, simplifies the maintenance and update process, and ensures that the system can remain efficient, reliable and secure under various conditions.

[0048] Reference Figure 2 and Figure 4, the soft metric strategy in step S5 includes implicit component strategy, direct storage strategy and lightweight metric strategy. According to the CPU performance, the appropriate security metric strategy is flexibly selected to maintain the real-time response of the system under high load. If the system has extremely high requirements for security and hopes to ensure that the firmware file is not illegally accessed or tampered with during storage and transmission, the implicit component strategy hides the firmware file by compression and encryption, which increases the difficulty for attackers to obtain the original firmware. For devices with limited storage space, the implicit component strategy can reduce the space occupied by the firmware through compression, thereby saving valuable storage resources. If the boot time is not the top priority, the implicit component strategy can be adopted, because decompression and hash calculation may increase a certain startup delay. For systems that need to start quickly and run efficiently, the direct storage strategy can significantly improve the boot speed because no additional decompression steps are required and the reading speed is faster. If the device has sufficient storage space, the direct storage strategy can simplify the system design, avoid complex compression / decompression operations, and reduce system complexity. For devices with weak CPU processing power, the direct storage strategy can reduce the CPU burden, especially when the CPU does not support hardware acceleration, the use of lightweight verification algorithms can further optimize performance.

[0049] Reference Figure 2 and Figure 5,The implicit component strategy specifically includes the following steps: Step a1: compress the compression table together with the boot loader, and store the compressed file in an external non-volatile memory (such as EMMC or NAND Flash); Step a2: store the firmware programs of other functional components in a non-volatile storage device in the form of compressed files; Step a3: after the boot loader is started, first read the Huffman table of each firmware and the corresponding compressed file, decompress the read compressed file, restore the original firmware program, read the pre-stored signature check value or hash value from the security chip, dynamically calculate the hash value of the restored firmware program, and compare it with the read signature check value or hash value; Step a4: if the hash value matches, the verification is passed; if it does not match, take corresponding security measures. By compressing the compression table together with the boot loader and storing it in an external non-volatile memory, the original firmware file is not directly exposed to the storage chip, which increases the difficulty for attackers to obtain and tamper with the firmware; at the same time, the firmware programs of other functional components are stored in the non-volatile storage device in the form of compressed files, which effectively saves storage space. It is particularly suitable for embedded systems with limited storage resources and reduces the bandwidth required for transmission. After the boot loader is started, the Huffman table and the corresponding compressed file of each firmware are read and decompressed and restored. Then, the pre-stored signature check value or hash value is read from the security chip, and the hash value of the restored firmware program is dynamically calculated and compared with it. This double verification mechanism ensures the integrity and authenticity of the firmware and prevents unauthorized modifications. Although the decompression process will increase the startup time, modern compression algorithms and hardware acceleration functions can significantly reduce this delay, ensuring that the startup process is as fast as possible; automatic integrity verification is performed at each startup to ensure that the system always runs in a safe state. If any abnormality is detected, appropriate security measures are taken immediately to avoid potential security risks; during the firmware update process, the security chip recalculates and updates the verification information to ensure that the new version of the firmware is also strictly verified to maintain the security and consistency of the system. The implicit component strategy not only enhances the security of the system, but also improves the startup performance and resource utilization efficiency, and simplifies the maintenance and update process.

[0050] Reference Figure 2 and Figure 6, the direct storage strategy specifically includes the following steps: Step b1: directly store the original firmware program file in a non-volatile storage device; Step b2: during the startup process, the boot loader quickly reads the firmware of other functional components from the non-volatile storage device and directly calculates the signature check value or hash value; Step b3: compares the calculated signature check value or hash value with the value pre-stored in the security chip; Step b4: if the calculated value is consistent with the value in the security chip, it is confirmed that the current firmware has not been tampered with, and the subsequent program continues to run normally; if the calculated value is inconsistent with the value in the security chip, it is booted into the safe mode (the safe mode is to restore the factory settings through the factory-specific tool) and restore the factory settings. The original firmware program file is directly stored in the non-volatile storage device, and its high reading speed is used to enable the firmware of other functional components to be quickly read during the startup process, thereby greatly shortening the startup time. The boot loader directly calculates the signature check value or hash value at startup and compares it with the value pre-stored in the security chip to ensure that the firmware has not been tampered with. If the calculated values ​​are consistent, the integrity of the current firmware is confirmed and subsequent programs continue to run normally; if they are inconsistent, the system is booted into safe mode and restored to factory settings, effectively preventing malware or unauthorized code from running. This method not only improves the system's startup efficiency and response speed, but also enhances security, simplifies the maintenance process, and ensures that the system always runs in a safe state.

[0051] Reference Figure 2 and Figure 6 , the lightweight measurement strategy specifically includes: during the startup process, after the boot loader reads the firmware in the non-volatile storage device, a relatively lightweight measurement algorithm CRC32 is selected for calculation verification to reduce the calculation time. After the boot loader reads the firmware in the non-volatile storage device, the CRC32 algorithm is used for calculation verification. Since the calculation complexity of CRC32 is low and the probability of conflict is low, it can greatly reduce the calculation time while ensuring sufficient security. It is particularly suitable for CPUs with weak processing power or limited resources. It not only speeds up the startup speed, but also reduces the CPU burden, ensuring that the system can be efficiently started under various hardware conditions. If the selected strategy has low system resource usage, it can be made into a dynamic scan to effectively prevent worm viruses. The strategy is stored in an external security chip. At the same time, based on the characteristics of the security chip, the information security of the device can also be guaranteed.

[0052] Reference Figure 2 and Figure 4, security measures include preventing the system from booting, alarming, and entering safe mode. When firmware integrity verification failure or other security anomalies are detected, the system is immediately prevented from booting, effectively preventing malware or unauthorized code from running, and ensuring that the system does not boot in an unsafe state. At the same time, an alarm is triggered to notify the administrator or user of potential security threats, so that further investigation and response measures can be taken in a timely manner. In addition, the system automatically enters safe mode, providing a restricted but controllable operating environment, allowing users or administrators to troubleshoot, restore factory settings, or apply necessary security updates. This approach not only improves the overall security of the system, but also ensures that a quick response and appropriate remedial measures can be taken when a security incident occurs, reducing potential security risks and losses. In summary, these security measures enhance the reliability of the system and user trust through a multi-level protection mechanism.

[0053] Reference Figure 2 and Figure 3 , for controllers whose hardware has been designed, if no security chip is added, how to ensure the information security of the controller. Here, we can directly expand on the strategy based on soft measurement. All measurement strategies are stored in the external NAND flash or EMMC, and stored in a certain area in ciphertext. At the same time, for security reasons, they cannot be stored continuously and need to be stored in segments. For CPUs with average performance, soft measurement can adopt the idea of ​​local measurement: compile some interface functions involving key data access in the core firmware or other functional components into a fixed address segment, and only sign or hash the content of the address segment. This method not only greatly reduces the amount of data involved in the calculation, reduces the CPU overhead, and further shortens the startup time; at the same time, because the interface for key data access participates in the measurement, even if the original file of the firmware is obtained, it can protect the key data from being stolen, thereby ensuring information security.

[0054] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A security measurement method for high real-time performance of a secure and trusted controller, characterized by: The following steps are involved: Step S1: Determine the key firmware in the controller; Step S2: verifying the integrity of the critical firmware through a security chip, and storing the verification information in the security chip; Step S3: When the controller starts, the security chip is used to verify the integrity of the firmware in the external memory; Step S4: if the integrity verification of the critical firmware passes, an integrity report is generated; if it fails, corresponding security measures are taken; Step S5: For non-critical firmware, a soft metric strategy is used for verification; Step S6: When updating the firmware, recalculate the verification information using the security chip, and update the verification information stored in the security chip; Step S7: If the critical firmware update is completed, the system restarts and re-executes steps S3 and S4. If the non-critical firmware update is completed, only the non-critical firmware needs to be restarted and step S5 is re-executed. The soft metric strategy in step S5 includes an implicit component strategy, a direct storage strategy, and a lightweight metric strategy. The implicit component strategy specifically includes the following steps: Step a1: compressing the compression table together with the boot loader, and storing the compressed file in an external non-volatile memory; Step a2: storing the firmware programs of other functional components in a non-volatile storage device in the form of compressed files; Step a3: After the boot loader is started, the Huffman table of each firmware and the corresponding compressed file are read first, the compressed file is decompressed, the original firmware program is restored, the pre-stored signature check value or hash value is read from the security chip, the hash value of the restored firmware program is dynamically calculated, and compared with the read signature check value or hash value; Step a4: If the hash values ​​match, the verification is successful; if not, take appropriate security measures.

2. According to claim 1, a security measurement method for high real-time performance of a secure and trusted controller is characterized by: The integrity verification includes calculating a hash value of the critical firmware and comparing it with a pre-stored root of trust.

3. The method for measuring the high real-time performance of a secure and reliable controller according to claim 1, characterized in that: The direct deposit strategy specifically includes the following steps: Step b1: directly storing the original firmware program file in a non-volatile storage device; Step b2: During the boot process, the boot loader quickly reads the firmware of other functional components from the non-volatile storage device and directly calculates the signature check value or hash value; Step b3: Compare the calculated signature check value or hash value with the value pre-stored in the security chip; Step b4: If the calculated value is consistent with the value in the security chip, it is confirmed that the current firmware has not been tampered with and the subsequent programs continue to run normally; if the calculated value is inconsistent with the value in the security chip, boot into safe mode and restore factory settings.

4. The method for measuring the high real-time performance of a secure and reliable controller according to claim 3, characterized in that: The lightweight measurement strategy specifically includes: after the boot loader reads the firmware in the non-volatile storage device during the startup process, a relatively lightweight measurement algorithm CRC32 is selected for calculation verification to reduce calculation time.

5. The method for measuring the high real-time performance of a secure and reliable controller according to claim 1, characterized in that: The safety measures include preventing the system from starting, issuing an alarm, and entering a safe mode.

6. The method for measuring the high real-time performance of a secure and reliable controller according to claim 1, characterized in that: The critical firmware includes the boot loader, the operating system kernel, and drivers that interact directly with the hardware.

Images