Firmware upgrading method, device and system

Abstract

The invention provides a firmware upgrading method, a firmware upgrading device and a firmware upgrading system. The method comprises the following steps: a generation step: a second partition receives second firmware sent by an upper computer, decrypts a signature part of the second firmware by using a public key to generate a first abstract, processes a non-signature part of the second firmware by at least using an ECDSA algorithm to generate a second abstract, and the second firmware is generated by at least using SHA256 operation of the upper computer to generate a second abstract; performing digital signature generation on the to-be-upgraded third firmware; and an upgrading step: comparing whether the content of the first abstract and the content of the second abstract are the same or not, and under the condition that the content of the first abstract and the content of the second abstract are the same, the second partition at least sends the non-signature part of the second firmware to the first partition so as to complete firmware upgrading of the control chip. The method solves the problem that the security of firmware upgrading cannot be ensured in the prior art.

Description

Technical Field

[0001] The present application relates to the field of firmware upgrade, and in particular, to a firmware upgrade method, upgrade device and upgrade system. Background Art

[0002] With the progress of the times and the development of science and technology, people's demand for data and power transmission continues to increase. The USB Type-C interface plays an increasingly important role in computer peripherals, mobile devices, audio devices, storage devices and other fields.

[0003] After the USB Type-C PD controller is put into use, if there is a firmware problem, it is usually repaired by upgrading. The principle of upgrading is to burn the new file to be upgraded into the USB Type-C PD controller in different ways to update the original file. During the firmware upgrade process, hackers may steal the firmware file used for the upgrade and tamper with some information. Or, the firmware upgrade interface is maliciously exploited, the firmware upgrade channel is hijacked, and the self-made firmware upgrade package is burned into the USB Type-C PD controller to be upgraded, introducing security risks. When the USB Type-C PD controller is implanted with firmware with backdoors, it may affect the normal use of the device and may even pose security risks, such as data leakage, unauthorized data extraction, virus transmission, etc., causing immeasurable losses to individuals or companies. If the data is not encrypted or the transmission security is insufficient during the firmware upgrade process, the device manufacturer may face legal liability. In addition, unsafe firmware upgrades may require continuous patching and updates, increasing maintenance costs.

[0004] Based on the above problems, encryption algorithms are generally used to ensure the security of firmware upgrades for USB Type-C PD control chips. In actual applications, AES (Advanced Encryption Standard) is used for encryption and decryption to ensure the security of data reception and transmission. Obviously, AES encryption is a symmetric encryption algorithm that is relatively easy to crack and has certain security risks.

[0005] Therefore, there is an urgent need for a method to ensure the security of firmware upgrades. Summary of the invention

[0006] The main purpose of the present application is to provide a firmware upgrade method, upgrade device and upgrade system to at least solve the problem in the prior art that the security of firmware upgrade cannot be ensured.

[0007] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a firmware upgrade method is provided, the upgrade method is applied to a USB-Type-C PD control chip, the control chip includes a secure storage area, the secure storage area includes a first partition and a second partition, the first firmware of the first partition is a file with a partition switching function, and the second partition is a partition with an encryption verification function, the upgrade method includes: a generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, at least uses the ECDSA algorithm to process the non-signature part of the second firmware to generate a second summary, the second firmware is the host computer at least uses SHA256 operation to generate a digital signature for the third firmware to be upgraded; an upgrade step: compare whether the content of the first summary is the same as the content of the second summary. When the content of the first summary is the same as the content of the second summary, the second partition at least sends the non-signature part of the second firmware to the first partition to complete the firmware upgrade of the control chip.

[0008] Optionally, before the second partition receives the second firmware sent by the host computer, the method also includes: using the ECDSA algorithm to generate a first random number, the first random number is a private key; performing operations on the private key and the elliptic curve base point to obtain the public key; and storing the public key in the second partition.

[0009] Optionally, the second firmware is obtained by the host computer performing at least a hash value calculation step, a random point generation step and a signature step on the third firmware, wherein: the hash value calculation step is to use the SHA256 operation to calculate the third firmware to obtain the hash value of the third firmware; the random point generation step is to calculate the elliptic curve base point and the second random number to obtain a random point when the second random number is within a predetermined security range, and perform a modulo operation on the abscissa of the random point to obtain a first result, the predetermined security range is an integer between zero and the order of the elliptic curve base point of the elliptic curve, and the second random number is data randomly generated by the ECDSA algorithm; the signature step is to calculate the private key and the hash value to obtain a second result when the first result is not equal to zero, and when the second result is greater than zero, combine the first result and the second result to obtain the signature part of the second firmware, and add the signature part to the end of the file of the third firmware to generate the second firmware, the signature part includes abscissa and ordinate, the abscissa of the signature part is the first result, and the ordinate of the signature part is the second result.

[0010] Optionally, the random point generating step further includes: when the first result is equal to zero, repeating the random point generating step at least once until the first result is not equal to zero, thereby obtaining the horizontal coordinate of the signature part.

[0011] Optionally, the signing step also includes: when the second result is not greater than zero, the signing step is to repeat the hash value calculation step and the random point generation step in sequence at least once until the second result is greater than zero.

[0012] Optionally, when the content of the first digest is the same as the content of the second digest, the second partition sends at least the non-signed part of the second firmware to the first partition to complete the firmware upgrade of the control chip, including: when the content of the first digest is the same as the content of the second digest, the second partition sends the non-signed part of the second firmware to the first partition; after receiving the non-signed part of the second firmware, the first partition deletes the first firmware of the first partition; and runs the non-signed part of the second firmware of the first partition to complete the firmware upgrade of the control chip.

[0013] Optionally, the method also includes: determining that the upgrade of the second firmware has failed at least when the content of the first summary and the content of the second summary are different; at least determining whether the content of the second firmware received by the second partition and the signature part are correct; at least analyzing whether the generation step is correct at least when the content of the second firmware received by the second partition and the signature part are correct, and obtaining a first reason when the generation step is incorrect, and recording the first reason for the failure to upgrade the second firmware in a first log file; at least analyzing whether the content of the second firmware received by the second partition and the signature part are incorrect at least when the content of the signature part is incorrect, and obtaining a second reason when the content of the signature part is incorrect, and recording the second reason for the failure to upgrade the second firmware in a second log file; and when the first reason appears in the first log file or the second reason appears in the second log file, running the first firmware of the first partition to enable the control chip to work.

[0014] Optionally, the method further includes: when the second firmware upgrade fails and when a firmware upgrade instruction of the control chip is received, repeating the generating step and the upgrading step in sequence at least once until the second firmware upgrade is completed.

[0015] In order to achieve the above-mentioned object, according to one aspect of the present application, a firmware upgrade device is provided, the upgrade device is used to execute an upgrade method, the upgrade method is applied to a USB-Type-C PD control chip, the control chip includes a secure storage area, the secure storage area includes a first partition and a second partition, the first firmware of the first partition is a file with a partition switching function, and the second partition is a partition with an encryption verification function, and the upgrade device includes:

[0016] A generating unit, configured to execute a generating step: the second partition receives the second firmware sent by the host computer, decrypts the signature part of the second firmware using the public key to generate a first summary, processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary, and the second firmware is generated by the host computer using at least SHA256 operation to perform a digital signature on the third firmware to be upgraded;

[0017] An upgrading unit is used to execute an upgrading step: comparing whether the content of the first digest is the same as the content of the second digest. When the content of the first digest is the same as the content of the second digest, the second partition sends at least the non-signed part of the second firmware to the first partition to complete the firmware upgrade of the control chip.

[0018] According to another aspect of the present application, an upgrade system is provided, the upgrade system comprising a USB-Type-C PD control chip and a host computer, the USB-Type-C PD control chip being used to execute a firmware upgrade of the control chip, the host computer being communicatively connected to the control chip, the control chip comprising a secure storage area, the secure storage area comprising a first partition and a second partition, the first firmware of the first partition being a file having a partition switching function, the second partition being a partition having an encryption verification function, the upgrade system being used to execute any one of the firmware upgrade methods described above.

[0019] By applying the technical solution of the present application, first, the second partition of the secure storage area of ​​the control chip receives the second firmware sent by the host computer, decrypts the signature part of the above-mentioned second firmware using the public key to generate a first summary, and at the same time, processes the non-signature part of the above-mentioned firmware using at least the ECDSA algorithm to generate a second summary; secondly, compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the content of the above-mentioned second firmware excluding the signature to the first partition of the above-mentioned secure storage area of ​​the above-mentioned control chip, thereby completing the firmware upgrade of the above-mentioned control chip. Compared with the prior art, the present application uses the ECDSA algorithm to verify the signature of the second firmware, and uses the public key and the ECDSA algorithm to process the signature part and the non-signature part of the second firmware respectively, to obtain the first digest and the second digest, and when the contents of the first digest and the second digest are the same, the second firmware is upgraded, and by verifying the contents of the first digest and the second digest, it is determined whether the content of the second firmware has been tampered with. If the content of the first digest is the same as the content of the second digest, the content of the second firmware has not been tampered with, and the second firmware can be used to upgrade the firmware of the control chip; if they are different, it has been tampered with, and the firmware of the control chip is not upgraded, which effectively prevents the installation of malicious firmware and ensures the security of the firmware upgrade, thereby solving the problem that the security of the firmware upgrade cannot be ensured in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0021] Figure 1 A hardware structure block diagram of a mobile terminal for executing a firmware upgrade method provided in an embodiment of the present application is shown;

[0022] Figure 2 A schematic diagram of a process of upgrading a firmware according to an embodiment of the present application is shown;

[0023] Figure 3 A detailed flow chart of using the ECDSA algorithm to perform firmware encryption upgrade in a firmware upgrade method provided according to an embodiment of the present application is shown;

[0024] Figure 4 A system block diagram of the entire USB Type-CPD control chip security upgrade process of a firmware upgrade method provided according to an embodiment of the present application is shown;

[0025] Figure 5A detailed process diagram of a tool signature for a firmware upgrade method provided in accordance with an embodiment of the present application is shown;

[0026] Figure 6 A main flow chart of a firmware upgrade method according to an embodiment of the present application is shown;

[0027] Figure 7 A structural block diagram of a firmware upgrade device provided according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0029] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] As introduced in the background technology, the prior art cannot ensure the security of firmware upgrades. To solve the above problem, the embodiments of the present application provide a firmware upgrade method, upgrade device and upgrade system.

[0032] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0033] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1FIG. 1 is a hardware structure diagram of a mobile terminal of a firmware upgrade method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0034] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] In this embodiment, a method for upgrading firmware running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] Figure 2FIG. 1 is a flowchart of a firmware upgrade method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0037] Step S201, generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary. The second firmware is generated by the host computer using at least SHA256 operation to digitally sign the third firmware to be upgraded.

[0038] Specifically, the host computer is a software application running on a general-purpose computer and is the starting point of the upgrade process. The role of the host computer in this process is to trigger the firmware burning, send the new firmware to be upgraded to the slave computer, and record the key steps in the upgrade process. The host computer and the interface chip are connected and communicated through the I2C (Inter-Integrated Circuit) or CC (Configuration Channel) interface.

[0039] Specifically, the secure storage of the control chip is mainly divided into two partitions. The first partition is the main function of the control chip, and the second partition is mainly for security upgrade functions. The first firmware with the switching function and the firmware with the encryption upgrade function are burned to the first partition and the second partition of the control chip respectively through tools via I2C or CC. Among them, the switching function means that when performing an encryption upgrade, you can jump to the second partition.

[0040] Specifically, a secure upgrade channel and platform are built between the control chip of the USB-Type-C device and the host computer. The secure transmission channel is used for the transmission of encrypted files, including the secure sending and receiving of files. Through the secure upgrade channel and platform, the host computer sends the second firmware to the second partition, and the second partition receives the data and performs signature verification. Under normal circumstances, the chip memory runs in the first partition, and the first partition has the functions of the entire control chip; when a security upgrade is required, the first partition will switch to the second partition upon receiving the command to perform a security upgrade, and the second partition will perform the security upgrade process. After the second partition receives the file to be upgraded, it is stored within a memory area.

[0041] Specifically, after the second partition of the control chip receives the second firmware, it first uses the pre-stored public key to decrypt the signature part to obtain the first summary, and then performs SHA256 and random number operations in the ECDSA algorithm on the non-signature part to obtain the second summary.

[0042] Step S202, upgrade step: compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the above-mentioned non-signed part of the above-mentioned second firmware to the above-mentioned first partition to complete the firmware upgrade of the above-mentioned control chip.

[0043] Specifically, if the content of the first digest is identical to the content of the second digest, the second partition writes the received non-signed portion of the second firmware to the first partition.

[0044] Specifically, Figure 3 As shown, Figure 3 The present invention is a detailed flow chart of firmware encryption upgrade using ECDSA algorithm. The whole process in the figure is to start the operation, start the control chip, the chip runs in the first partition of the secure storage area, determine whether the chip needs to be encrypted upgraded, if not, restart the control chip, run the chip in the first partition of the secure storage area, if so, switch the chip operation to the second partition, and the host computer sends the second firmware to the second partition. After the second partition receives the second firmware, the non-signature part of the second firmware is subjected to SHA256 operation to obtain the first summary, and the signature part of the second firmware is decrypted to obtain the second summary, and it is determined whether the first summary is equal to the second summary. If so, the verification is passed, and the non-signature part of the second firmware is written to the first partition, and the first firmware of the first partition is deleted, and the first partition is re-run. After completing these steps, the chip update is successful and the process ends. If not, the verification fails. According to the experimental phenomenon and the upgrade record, the cause of the failure is analyzed, indicating that the update failed, and the process ends.

[0045] Specifically, Figure 4 As shown, Figure 4 The present invention is a system block diagram of the entire USB Type-C PD control chip security upgrade process, which includes an upgrade tool used to generate a signed upgrade file and the upgrade process of the upgraded Type-C device. The main process is to use the host computer tool to sign the third firmware to be upgraded, and use the upgrade tool to upgrade the third firmware. As a result, in the USB Type-C device, before the upgrade, the control chip's secure storage area includes the first firmware, and after the upgrade, its secure storage area includes the unsigned part of the second firmware.

[0046] In the above embodiment, first, the second partition of the secure storage area of ​​the control chip receives the second firmware sent by the host computer, decrypts the signature part of the second firmware using the public key to generate a first summary, and at the same time, processes the non-signature part of the firmware using at least the ECDSA algorithm to generate a second summary; secondly, compare whether the content of the first summary is the same as the content of the second summary. When the content of the first summary is the same as the content of the second summary, the second partition at least sends the non-signature part of the second firmware to the first partition of the secure storage area of ​​the control chip, thereby completing the firmware upgrade of the control chip. Compared with the prior art, the present application uses the ECDSA algorithm to perform signature verification on the second firmware, and uses the public key and the ECDSA algorithm to process the signature part and the non-signature part of the second firmware respectively, to obtain the first digest and the second digest, and when the contents of the first digest and the second digest are the same, the second firmware is upgraded, and by verifying the contents of the first digest and the second digest, it is determined whether the content of the second firmware has been tampered with. If the content of the first digest is the same as the content of the second digest, the content of the second firmware has not been tampered with, and the non-signature part of the second firmware can be used to upgrade the firmware of the control chip; if they are different, it has been tampered with, and the firmware of the control chip is not upgraded, which effectively prevents the installation of malicious firmware, thereby ensuring the security of the firmware upgrade, thereby solving the problem that the security of the firmware upgrade cannot be ensured in the prior art.

[0047] In one embodiment of the present application, before the second partition receives the second firmware sent by the host computer, the method further includes: using the ECDSA algorithm to generate a first random number, the first random number being a private key; performing operations on the private key and the elliptic curve base point to obtain the public key; and storing the public key in the second partition. In this method, by storing the public key in the second partition and locking the second partition so that its content cannot be modified, it can be further ensured that after the firmware is encrypted with the private key, only the device with the corresponding public key can decrypt the data, thereby further enhancing the security of the system.

[0048] Specifically, during the initialization phase of the entire firmware security upgrade process, a pair of keys, including a private key and a public key, is generated based on the ECDSA algorithm. The private key is securely stored in the supplier's high-protection computer that provides the signing tool, while the public key is implanted or pre-stored in the second partition of the secure storage area of ​​the control chip.

[0049] In order to more effectively prevent the data of the third firmware from being tampered with and forged, thereby further ensuring the integrity and security of the third firmware, in one embodiment of the present application, the above-mentioned second firmware is obtained by the above-mentioned host computer performing at least a hash value calculation step, a random point generation step and a signature step on the above-mentioned third firmware, wherein: the above-mentioned hash value calculation step is to use the above-mentioned SHA256 operation to calculate the above-mentioned third firmware to obtain the hash value of the above-mentioned third firmware; the above-mentioned random point generation step is to calculate the above-mentioned elliptic curve base point and the above-mentioned second random number when the second random number is within a predetermined security range to obtain a random point, and the horizontal coordinate of the above-mentioned random point is subjected to a modulo operation to obtain a first result, and the above-mentioned predetermined The security range is determined to be an integer between zero and the order of the elliptic curve base point of the elliptic curve, the second random number is data randomly generated by the ECDSA algorithm; the signing step is to calculate the private key and the hash value to obtain the second result when the first result is not equal to zero, and to combine the first result with the second result when the second result is greater than zero to obtain the signature part of the second firmware, and add the signature part to the end of the file of the third firmware to generate the second firmware, the signature part includes a horizontal coordinate and a vertical coordinate, the horizontal coordinate of the signature part is the first result, and the vertical coordinate of the signature part is the second result.

[0050] Specifically, Figure 5 Above, Figure 5 The figure is a detailed process diagram of tool signature, and its main process is as follows: the starting step, the first process is to select a random number k and determine whether k is within the safe range. If not, reselect the random number k. If so, calculate k times the public key base point to obtain the random point K, obtain the horizontal coordinate x of the random point K, perform a modulo operation on the horizontal coordinate x, obtain the first result r, and verify whether r is equal to 0. If so, repeat the steps of the first process. If not, the first result r is the horizontal coordinate part of the signature. At the same time, after the starting step, the second process is to input the original message M to be signed, use the SHA256 function to calculate the hash value of the original message M, calculate the vertical coordinate part of the signature, and obtain the second result s. Determine whether the second result s is greater than 0. If not, re-execute the steps of the second process. If so, the second result s is the vertical coordinate part of the signature. Combine the horizontal coordinate r and the vertical coordinate s of the signature to obtain the signature (r, s), and end the process.

[0051] In another embodiment, the random point generation step further comprises: when the first result is equal to zero, repeating the random point generation step at least once until the first result is not equal to zero, thereby obtaining the horizontal coordinate of the signature part. In this method, the random point is within a predetermined security range, which can more effectively protect the security of the random point.

[0052] In order to further improve the security and reliability of the signature, in one embodiment of the present application, the above-mentioned signing step also includes: when the above-mentioned second result is not greater than zero, the above-mentioned signing step is to repeat the above-mentioned hash value calculation step and the above-mentioned random point generation step in sequence at least once until the above-mentioned second result is greater than zero.

[0053] In another embodiment, when the content of the first summary is the same as the content of the second summary, the second partition at least sends the non-signed part of the second firmware to the first partition to complete the firmware upgrade of the control chip, including: when the content of the first summary is the same as the content of the second summary, the second partition sends the non-signed part of the second firmware to the first partition; after receiving the non-signed part of the second firmware, the first partition deletes the first firmware of the first partition; runs the non-signed part of the second firmware of the first partition to complete the firmware upgrade of the control chip. In this method, when verifying that the content of the first summary is the same as the content of the second summary, the control chip will execute a firmware installation process, which is to erase the first firmware of the first partition in the secure storage area of ​​the control chip, write the second firmware of the second partition into the first partition, and re-run the third firmware of the first partition to complete the firmware upgrade of the control chip, thereby further ensuring the security and stability of the firmware upgrade.

[0054] In order to further ensure the success and security of the second firmware upgrade, in one embodiment of the present application, the method further includes: at least when the content of the first digest is different from the content of the second digest, the second firmware upgrade fails; at least when the content of the first digest is different from the content of the second digest, determining that the second firmware upgrade fails; at least determining whether the content of the second firmware received by the second partition and the signature part are correct; at least when the content of the second firmware received by the second partition and the signature part are correct, at least analyzing whether the generation step is correct, and when the generation step is incorrect, obtaining a first reason, and recording the first reason for the failure of the second firmware upgrade in the first log file; at least when the content of the second firmware received by the second partition and the signature part are both incorrect, at least analyzing whether the content of the signature part is wrong, and when the content of the signature part is wrong, obtaining a second reason, and recording the second reason for the failure of the second firmware upgrade in the second log file; when the first reason appears in the first log file or the second reason appears in the second log file, running the first firmware of the first partition so that the control chip works.

[0055] Specifically, if the firmware upgrade fails, the reasons for the failure need to be checked, including: the signature size and content of the received upgrade file are incorrect; the upgrade content and signature verification fail; a problem occurred in the process of the second partition writing the verified encrypted file to the first partition; a problem occurred in the firmware transmission channel; a problem occurred in the process of decrypting the signature part using the public key.

[0056] Specifically, the key steps and results of the entire security upgrade are recorded in a log file for subsequent inspection. If it is verified that the content of the first summary is different from the content of the second summary, the cause of the upgrade failure can be specifically analyzed based on the log file.

[0057] In another embodiment, the method further includes: in the case where the second firmware upgrade fails and in the case where a firmware upgrade instruction of the control chip is received, the generation step and the upgrade step are sequentially repeated at least once until the second firmware upgrade is completed. In this method, even if the second firmware upgrade fails, the system will continue to try to regenerate the firmware and upgrade it until the second firmware upgrade is successfully completed. By continuously and repeatedly executing the generation and upgrade steps, various problems that may be encountered during the firmware upgrade process can be more effectively dealt with, thereby further ensuring the normal operation of the system and the upgrade of the firmware.

[0058] Specifically, after the upgrade fails, it will not automatically upgrade again. If you want to continue the upgrade, repeat the generation steps and the upgrade steps. Regardless of whether the upgrade is successful or not, the control chip will be started in the last step of the upgrade. At this time, the secure storage area of ​​the entire control chip will run in the first partition to realize the basic functions of the entire chip.

[0059] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the firmware upgrade method of the present application will be described in detail below in conjunction with specific embodiments.

[0060] This embodiment relates to a specific firmware upgrade method, which includes the following steps:

[0061] Step 1: Build a secure upgrade channel and platform between the USB-Type-C device and the host computer;

[0062] Step 2: Prepare the first firmware with the switching function and the firmware with the encryption upgrade function;

[0063] Step 3: Burn the first firmware with the switching function and the firmware with the encryption upgrade function into the first partition and the second partition of the secure storage area of ​​the control chip respectively, wherein the first partition is the area for realizing the main functions of the control chip, and the second partition is the area for security upgrade;

[0064] Step 4: The host computer performs a signing operation on the third firmware to be upgraded to obtain a signature part, and appends the signature part to the end of the third firmware file to generate the second firmware. The host computer sends the second firmware to the second partition of the secure storage area of ​​the control chip;

[0065] Step 5: The second partition receives the second firmware and performs signature verification, wherein the signature verification includes: decrypting the signature part of the second firmware to obtain a first digest, using the SHA256 operation in the ECDSA algorithm to calculate the non-signature part of the second firmware to obtain a second digest, and comparing whether the content of the first digest is the same as the content of the second digest;

[0066] Step 6: If the verification is successful, the second firmware is upgraded securely; otherwise, the failure reason is analyzed, and the firmware security upgrade is performed again when a firmware encryption upgrade instruction is received. The process mainly includes: when the content of the first summary and the content of the second summary are the same, the second partition sends the non-signed part of the second firmware to the first partition, then deletes the first firmware of the first partition, and runs the first partition; at least when the content of the first summary and the content of the second summary are different, it means that the second firmware upgrade has failed. According to the experimental phenomenon and the upgrade record, the reason for the upgrade failure is recorded in the log file, and the first partition is run. When the second firmware upgrade fails and a firmware upgrade instruction is received, steps 5 and 6 are re-executed until the upgrade of the second firmware is completed.

[0067] The main process of this process can be found in Figure 6 shown.

[0068] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0069] The embodiment of the present application also provides a firmware upgrade device. It should be noted that the firmware upgrade device of the embodiment of the present application can be used to execute the firmware upgrade method provided by the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions have been omitted. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0070] The following is an introduction to the firmware upgrade device provided in the embodiment of the present application.

[0071] Figure 7Schematic diagram of a firmware upgrade device according to an embodiment of the present application. Figure 7 As shown, the upgrade device is used to execute the upgrade method, the upgrade method is applied to the USB-Type-C PD control chip, the control chip includes a secure storage area, the secure storage area includes a first partition and a second partition, the first firmware of the first partition is a file with a partition switching function, and the second partition is a partition with an encryption verification function, and the device includes:

[0072] The generation unit 10 is used to execute the generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and uses at least the ECDSA algorithm to process the non-signature part of the second firmware to generate a second summary. The second firmware is generated by the host computer using at least SHA256 operation to digitally sign the third firmware to be upgraded.

[0073] Specifically, the host computer is a software application running on a general-purpose computer and is the starting point of the upgrade process. The role of the host computer in this process is to trigger the firmware burning, send the new firmware to be upgraded to the slave computer, and record the key steps in the upgrade process. The host computer and the interface chip are connected and communicated through the I2C (Inter-Integrated Circuit) or CC (Configuration Channel) interface.

[0074] Specifically, the secure storage of the control chip is mainly divided into two partitions. The first partition is the main function of the control chip, and the second partition is mainly for security upgrade functions. The first firmware with the switching function and the firmware with the encryption upgrade function are burned into the first partition and the second partition of the control chip respectively. Among them, the switching function means that in the case of encryption upgrade, it can jump to the second partition.

[0075] Specifically, a security upgrade channel and platform are built between the control chip of the USB-Type-C device and the host computer. Through the security upgrade channel and platform, the host computer sends the second firmware to the second partition, and the second partition receives the data and performs signature verification. Under normal circumstances, the chip memory runs in the first partition, and the first partition has the functions of the entire control chip; when a security upgrade is required, the first partition will switch to the second partition when it receives the command to perform a security upgrade, and the second partition will perform the security upgrade process. After the second partition receives the file to be upgraded, it is stored within a memory area.

[0076] Specifically, after the second partition of the control chip receives the second firmware, it first uses the pre-stored public key to decrypt the signature part to obtain the first summary, and then performs the SHA256 operation in the ECDSA algorithm on the non-signature part to obtain the second summary.

[0077] The upgrade unit 20 is used to execute the upgrade step: compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the above-mentioned non-signed part of the above-mentioned second firmware to the above-mentioned first partition to complete the firmware upgrade of the above-mentioned control chip.

[0078] Specifically, if the content of the first digest is identical to the content of the second digest, the second partition writes the received non-signed portion of the second firmware to the first partition.

[0079] In the above embodiment, first, the second partition of the secure storage area of ​​the control chip receives the second firmware sent by the host computer, decrypts the signature part of the second firmware using the public key to generate a first summary, and at the same time, processes the non-signature part of the firmware using at least the ECDSA algorithm to generate a second summary; secondly, compare whether the content of the first summary is the same as the content of the second summary. When the content of the first summary is the same as the content of the second summary, the second partition at least sends the non-signature part of the second firmware to the first partition of the secure storage area of ​​the control chip, thereby completing the firmware upgrade of the control chip. Compared with the prior art, the present application uses the ECDSA algorithm to perform signature verification on the second firmware, and uses the public key and the ECDSA algorithm to process the signature part and the non-signature part of the second firmware respectively, to obtain the first digest and the second digest, and when the contents of the first digest and the second digest are the same, the second firmware is upgraded, and by verifying the contents of the first digest and the second digest, it is determined whether the content of the second firmware has been tampered with. If the content of the first digest is the same as the content of the second digest, the content of the second firmware has not been tampered with, and the non-signature part of the second firmware can be used to upgrade the firmware of the control chip; if they are different, it has been tampered with, and the firmware of the control chip is not upgraded, which effectively prevents the installation of malicious firmware, thereby ensuring the security of the firmware upgrade, thereby solving the problem that the security of the firmware upgrade cannot be ensured in the prior art.

[0080] In one embodiment of the present application, the generation unit includes a first generation module, a calculation module and a storage module, wherein the first generation module is used to generate a first random number using the above-mentioned ECDSA algorithm, wherein the above-mentioned first random number is a private key; the above-mentioned private key and the elliptic curve base point are calculated to obtain the above-mentioned public key; and the above-mentioned public key is stored in the above-mentioned second partition. In this scheme, by storing the public key in the second partition and locking the second partition so that its content cannot be modified, it can be further ensured that after the firmware is encrypted by the private key, only the device with the corresponding public key can decrypt the data, thereby further enhancing the security of the system.

[0081] Specifically, during the initialization phase of the entire firmware security upgrade process, a pair of keys, including a private key and a public key, is generated based on the ECDSA algorithm. The private key is securely stored in the supplier's high-protection computer that provides the signing tool, while the public key is implanted or pre-stored in the second partition of the secure storage area of ​​the control chip.

[0082] In order to more effectively prevent the data of the third firmware from being tampered with and forged, thereby further ensuring the integrity and security of the third firmware, in one embodiment of the present application, the above-mentioned second firmware is obtained by the above-mentioned host computer performing at least a hash value calculation step, a random point generation step and a signature step on the above-mentioned third firmware, wherein: the above-mentioned hash value calculation step is to use the above-mentioned SHA256 operation to calculate the above-mentioned third firmware to obtain the hash value of the above-mentioned third firmware; the above-mentioned random point generation step is to calculate the above-mentioned elliptic curve base point and the above-mentioned second random number when the second random number is within a predetermined security range to obtain a random point, and the horizontal coordinate of the above-mentioned random point is subjected to a modulo operation to obtain a first result, and the above-mentioned predetermined The security range is determined to be an integer between zero and the order of the elliptic curve base point of the elliptic curve, the second random number is data randomly generated by the ECDSA algorithm; the signing step is to calculate the private key and the hash value to obtain the second result when the first result is not equal to zero, and to combine the first result with the second result when the second result is greater than zero to obtain the signature part of the second firmware, and add the signature part to the end of the file of the third firmware to generate the second firmware, the signature part includes a horizontal coordinate and a vertical coordinate, the horizontal coordinate of the signature part is the first result, and the vertical coordinate of the signature part is the second result.

[0083] In another embodiment, the random point generation step further comprises: when the first result is equal to zero, repeating the random point generation step at least once until the first result is not equal to zero, thereby obtaining the horizontal coordinate of the signature part. In this solution, the random point is within a predetermined security range, which can more effectively protect the security of the random point.

[0084] In order to further improve the security and reliability of the signature, in one embodiment of the present application, the above-mentioned signing step also includes: when the above-mentioned second result is not greater than zero, the above-mentioned signing step is to repeat the above-mentioned hash value calculation step and the above-mentioned random point generation step in sequence at least once until the above-mentioned second result is greater than zero.

[0085] In another embodiment, the upgrade unit includes a sending module, a deleting module and an operating module, wherein the sending module is used for the second partition to send the non-signed part of the second firmware to the first partition when the content of the first summary is the same as the content of the second summary; the deleting module is used for the first partition to delete the first firmware of the first partition after receiving the non-signed part of the second firmware; the operating module is used for running the non-signed part of the second firmware of the first partition to complete the firmware upgrade of the control chip. In this solution, when it is verified that the content of the first summary is the same as the content of the second summary, the control chip will execute the firmware installation process, which is to erase the first firmware of the first partition in the secure storage area of ​​the control chip, write the non-signed part of the second firmware of the second partition to the first partition, and re-run the first partition to complete the firmware upgrade of the control chip, thereby further ensuring the security and stability of the firmware upgrade.

[0086] In order to further ensure the success and security of the second firmware upgrade, in one embodiment of the present application, the upgrade unit also includes a first upgrade failure module, a second upgrade failure module, a first recording module, a second recording module, and a second running module, wherein the first upgrade module is used to determine that the second firmware upgrade has failed at least when the content of the first summary and the content of the second summary are different; the second upgrade module is used to determine that the second firmware upgrade has failed at least when the content of the first summary and the content of the second summary are different; the first recording module is used to at least determine whether the content of the second firmware received by the second partition and the signature part are correct; at least when the content of the second firmware received by the second partition and the signature part are correct , at least analyze whether the above-mentioned generation step is correct. When the above-mentioned generation step is incorrect, obtain the first reason, and record the above-mentioned first reason for the failure of the second firmware upgrade in the first log file; the second recording module is used to at least analyze whether the content of the above-mentioned signature part is wrong when both the content of the above-mentioned second firmware received by the above-mentioned second partition and the above-mentioned signature part are incorrect. When the content of the above-mentioned signature part is wrong, obtain the second reason, and record the above-mentioned second reason for the failure of the second firmware upgrade in the second log file; the second running module is used to run the above-mentioned first firmware of the above-mentioned first partition when the above-mentioned first reason appears in the above-mentioned first log file or the above-mentioned second reason appears in the above-mentioned second log file, so that the above-mentioned control chip works.

[0087] Specifically, if the firmware upgrade fails, the reasons for the failure need to be checked, including: the signature size and content of the received upgrade file are incorrect; the upgrade content and signature verification fail; a problem occurred in the process of the second partition writing the verified encrypted file to the first partition; a problem occurred in the firmware transmission channel; a problem occurred in the process of decrypting the signature part using the public key.

[0088] Specifically, the key steps and results of the entire security upgrade are recorded in a log file for subsequent inspection. If it is verified that the content of the first summary is different from the content of the second summary, the cause of the upgrade failure can be specifically analyzed based on the log file.

[0089] In another embodiment, the upgrade unit further includes a repeating module, wherein the repeating module is used to, in the case where the above-mentioned second firmware upgrade fails and in the case where a firmware upgrade instruction of the above-mentioned control chip is received, repeat the above-mentioned generation step and the above-mentioned upgrade step at least once in sequence until the above-mentioned second firmware upgrade is completed. In this solution, even if the second firmware upgrade fails, the system will continue to try to regenerate the firmware and upgrade it until the second firmware upgrade is successfully completed. By continuously repeating the generation and upgrade steps, various problems that may be encountered during the firmware upgrade process can be more effectively dealt with, thereby further ensuring the normal operation of the system and the upgrade of the firmware.

[0090] Specifically, after the upgrade fails, it will not automatically upgrade again. If you want to continue the upgrade, repeat the generation steps and the upgrade steps. Regardless of whether the upgrade is successful or not, the control chip will be started in the last step of the upgrade. At this time, the secure storage area of ​​the entire control chip will run in the first partition to realize the basic functions of the entire chip.

[0091] The firmware upgrade device includes a processor and a memory. The generation unit and the upgrade unit are stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The modules are all located in the same processor; or, the modules are located in different processors in any combination.

[0092] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set to ensure the security of firmware upgrades by adjusting kernel parameters.

[0093] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0094] An embodiment of the present invention provides an upgrade system, the upgrade system comprising a USB-Type-C PD control chip and a host computer, the USB-Type-C PD control chip is used to perform a firmware upgrade of the control chip, the host computer is communicatively connected with the control chip, the control chip comprises a secure storage area, the secure storage area comprises a first partition and a second partition, the first firmware of the first partition is a file having a partition switching function, the second partition is a partition having an encryption verification function, the upgrade system is used to perform the firmware upgrade method, the method comprising:

[0095] Step S201, generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary. The second firmware is generated by the host computer using at least SHA256 operation to digitally sign the third firmware to be upgraded.

[0096] Step S202, upgrade step: compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the non-signed part of the above-mentioned second firmware to the above-mentioned first partition to complete the firmware upgrade of the above-mentioned control chip.

[0097] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the firmware upgrade method, the method comprising:

[0098] Step S201, generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary. The second firmware is generated by the host computer using at least SHA256 operation to digitally sign the third firmware to be upgraded.

[0099] Step S202, upgrade step: compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the non-signed part of the above-mentioned second firmware to the above-mentioned first partition to complete the firmware upgrade of the above-mentioned control chip.

[0100] An embodiment of the present invention provides a processor, the processor is used to run a program, wherein when the program is running, the firmware upgrade method is executed, the method comprising:

[0101] Step S201, generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary. The second firmware is generated by the host computer using at least SHA256 operation to digitally sign the third firmware to be upgraded.

[0102] Step S202, upgrade step: compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the non-signed part of the above-mentioned second firmware to the above-mentioned first partition to complete the firmware upgrade of the above-mentioned control chip.

[0103] An embodiment of the present invention provides a device, the device including a processor, a memory, and a program stored in the memory and executable on the processor, and when the processor executes the program, at least the following steps are implemented:

[0104] Step S201, generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary. The second firmware is generated by the host computer using at least SHA256 operation to digitally sign the third firmware to be upgraded.

[0105] Step S202, upgrade step: compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the non-signed part of the above-mentioned second firmware to the above-mentioned first partition to complete the firmware upgrade of the above-mentioned control chip.

[0106] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0107] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0108] Step S201, generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary. The second firmware is generated by the host computer using at least SHA256 operation to digitally sign the third firmware to be upgraded.

[0109] Step S202, upgrade step: compare whether the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary. When the content of the above-mentioned first summary is the same as the content of the above-mentioned second summary, the above-mentioned second partition at least sends the non-signed part of the above-mentioned second firmware to the above-mentioned first partition to complete the firmware upgrade of the above-mentioned control chip.

[0110] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0111] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0112] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0113] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0114] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0115] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0116] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0117] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes and other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0118] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0119] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0120] In the above embodiment, first, the second partition of the secure storage area of ​​the control chip receives the second firmware sent by the host computer, decrypts the signature part of the second firmware using the public key to generate a first summary, and at the same time, processes the non-signature part of the firmware using at least the ECDSA algorithm to generate a second summary; secondly, compare whether the content of the first summary is the same as the content of the second summary. When the content of the first summary is the same as the content of the second summary, the second partition at least sends the non-signature part of the second firmware to the first partition of the secure storage area of ​​the control chip, thereby completing the firmware upgrade of the control chip. Compared with the prior art, the present application uses the ECDSA algorithm to perform signature verification on the second firmware, and uses the public key and the ECDSA algorithm to process the signature part and the non-signature part of the second firmware respectively, to obtain the first digest and the second digest, and when the contents of the first digest and the second digest are the same, the second firmware is upgraded, and by verifying the contents of the first digest and the second digest, it is determined whether the content of the second firmware has been tampered with. If the content of the first digest is the same as the content of the second digest, the content of the second firmware has not been tampered with, and the non-signature part of the second firmware can be used to upgrade the firmware of the control chip; if they are different, it has been tampered with, and the firmware of the control chip is not upgraded, which effectively prevents the installation of malicious firmware, thereby ensuring the security of the firmware upgrade, thereby solving the problem that the security of the firmware upgrade cannot be ensured in the prior art.

[0121] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A firmware upgrade method, characterized in that: The upgrade method is applied to a USB-Type-C PD control chip, the control chip includes a secure storage area, the secure storage area includes a first partition and a second partition, the first firmware of the first partition is a file with a partition switching function, and the second partition is a partition with an encryption verification function, and the upgrade method includes: Generation step: the second partition receives the second firmware sent by the host computer, uses the public key to decrypt the signature part of the second firmware to generate a first summary, and uses at least the ECDSA algorithm to process the non-signature part of the second firmware to generate a second summary, and the second firmware is generated by the host computer using at least SHA256 operation to perform a digital signature on the third firmware to be upgraded; Upgrading step: comparing whether the content of the first digest is the same as the content of the second digest. If the content of the first digest is the same as the content of the second digest, the second partition sends at least the non-signed part of the second firmware to the first partition to complete the firmware upgrade of the control chip.

2. The upgrading method according to claim 1, characterized in that: Before the second partition receives the second firmware sent by the host computer, the method further includes: Generate a first random number using the ECDSA algorithm, where the first random number is a private key; Performing operation on the private key and the elliptic curve base point to obtain the public key; The public key is stored in the second partition.

3. The upgrading method according to claim 2, characterized in that: The second firmware is obtained by the host computer performing at least a hash value calculation step, a random point generation step, and a signature step on the third firmware, wherein: The hash value calculation step is to use the SHA256 operation to calculate the third firmware to obtain the hash value of the third firmware; The random point generation step is to calculate the elliptic curve base point and the second random number to obtain a random point when the second random number is within a predetermined safety range, and perform a modulo operation on the abscissa of the random point to obtain a first result, wherein the predetermined safety range is an integer between zero and the order of the elliptic curve base point of the elliptic curve, and the second random number is data randomly generated by the ECDSA algorithm; The signing step is, when the first result is not equal to zero, calculating the private key and the hash value to obtain a second result, and when the second result is greater than zero, combining the first result and the second result to obtain the signature part of the second firmware, and adding the signature part to the end of the file of the third firmware to generate the second firmware, the signature part includes a horizontal coordinate and a vertical coordinate, the horizontal coordinate of the signature part is the first result, and the vertical coordinate of the signature part is the second result.

4. The upgrading method according to claim 3, characterized in that: The random point generation step also includes: When the first result is equal to zero, the random point generation step is repeated at least once until the first result is not equal to zero, thereby obtaining the horizontal coordinate of the signature part.

5. The upgrading method according to claim 3, characterized in that: The signing step also includes: When the second result is not greater than zero, the signing step is to repeat the hash value calculation step and the random point generation step in sequence at least once until the second result is greater than zero.

6. The upgrading method according to claim 1, characterized in that: In a case where the content of the first digest is the same as the content of the second digest, the second partition sends at least the non-signed part of the second firmware to the first partition to complete the firmware upgrade of the control chip, including: In a case where the content of the first digest is identical to the content of the second digest, the second partition sends the non-signed portion of the second firmware to the first partition; After receiving the non-signed portion of the second firmware, the first partition deletes the first firmware of the first partition; The non-signed portion of the second firmware of the first partition is run to complete the firmware upgrade of the control chip.

7. The upgrading method according to claim 1, characterized in that: The method further comprises: At least when the content of the first digest is different from the content of the second digest, determining that the second firmware upgrade fails; At least determining whether the content and the signature portion of the second firmware received by the second partition are correct; At least when the content and the signature part of the second firmware received by the second partition are correct, at least analyze whether the generation step is correct, and when the generation step is incorrect, obtain a first reason, and record the first reason for the failure of the second firmware upgrade in a first log file; At least when both the content and the signature part of the second firmware received by the second partition are incorrect, at least analyzing whether the content of the signature part is incorrect, and when the content of the signature part is incorrect, obtaining a second reason, and recording the second reason for the failure of the second firmware upgrade in a second log file; When the first reason appears in the first log file or the second reason appears in the second log file, the first firmware of the first partition is run to enable the control chip to work.

8. The upgrading method according to claim 1, characterized in that: The method further comprises: In the case where the second firmware upgrade fails and a firmware upgrade instruction from the control chip is received, the generating step and the upgrading step are sequentially repeated at least once until the second firmware upgrade is completed.

9. A firmware upgrade device, characterized in that: The upgrade device is used to execute the upgrade method, the upgrade method is applied to the USB-Type-C PD control chip, the control chip includes a secure storage area, the secure storage area includes a first partition and a second partition, the first firmware of the first partition is a file with a partition switching function, and the second partition is a partition with an encryption verification function, and the upgrade device includes: A generating unit, configured to execute a generating step: the second partition receives the second firmware sent by the host computer, decrypts the signature part of the second firmware using the public key to generate a first summary, processes the non-signature part of the second firmware using at least the ECDSA algorithm to generate a second summary, and the second firmware is generated by the host computer using at least SHA256 operation to perform a digital signature on the third firmware to be upgraded; An upgrading unit is used to execute an upgrading step: comparing whether the content of the first digest is the same as the content of the second digest. When the content of the first digest is the same as the content of the second digest, the second partition sends at least the non-signed part of the second firmware to the first partition to complete the firmware upgrade of the control chip.

10. An upgrade system, characterized in that: The upgrade system includes a USB-Type-C PD control chip and a host computer, the USB-Type-C PD control chip is used to execute the firmware upgrade of the control chip, the host computer is communicatively connected with the control chip, the control chip includes a secure storage area, the secure storage area includes a first partition and a second partition, the first firmware of the first partition is a file with a partition switching function, and the second partition is a partition with an encryption verification function, and the upgrade system is used to execute the firmware upgrade method described in any one of claims 1 to 8.

Images