Firmware protection method, device and system and electronic medium

Abstract

The invention discloses a firmware protection method, a firmware protection device, a firmware protection system and an electronic medium, all-around efficient protection of industrial control system firmware is realized by taking an FPGA as a core execution body and applying an elliptic curve digital signature algorithm, the problems of easy bypassing, insufficient safety and the like in the prior art are effectively solved, the firmware safety is remarkably improved, and the safety of the industrial control system firmware is improved. The system has strong tamper-proofing, illegal access prevention and malicious software infection prevention capabilities, meanwhile, has excellent reliability, ensures stable operation of the system through a perfect protection, detection and recovery mechanism, has good expandability by virtue of the characteristics of the FPGA, can be adapted to industrial control scenes with various scales and complexity degrees, and has wide application prospects. The continuity, stability and safety of industrial production are powerfully guaranteed, and economic losses and safety risks caused by firmware safety problems are greatly reduced.

Description

Technical Field

[0001] The present application belongs to the technical field of industrial control system firmware protection, and specifically relates to a firmware protection method, device, system and electronic medium. Background Art

[0002] In today's era of rapid industrial automation, industrial control systems have become the core hub of modern industrial production. Numerous industrial equipment and complex control systems rely heavily on embedded devices to achieve precise control and efficient management goals. Firmware, as a key software program pre-implanted in these embedded devices, is responsible for the normal operation, function implementation and performance optimization of the equipment. It not only provides a basic set of operating instructions when the equipment is initially deployed, but also has the flexibility to fix possible vulnerabilities, introduce new features or significantly improve equipment performance through update operations, thereby effectively extending the service life of the equipment and enhancing its adaptability.

[0003] However, it is accompanied by severe security challenges. As the scale of the network connected to industrial control systems continues to expand, its openness and interconnectivity are increasing, which undoubtedly provides more opportunities for malicious attackers. At present, control system firmware faces security threats from many aspects, among which unauthorized access is a common form. Attackers may break through the access restrictions of the system through network vulnerabilities or physical contact with the device, illegally obtain firmware code and related data, and then maliciously analyze and exploit them. Firmware tampering is an extremely harmful threat behavior. Malicious attackers can quietly change the original logic and behavior mode of the firmware by implanting malicious code, modifying key parameters or replacing some functional modules, so that it can perform operations according to the attacker's intentions, such as stealing sensitive industrial data, interfering with production processes or destroying equipment hardware. In addition, malware infection has also become a major hidden danger to firmware security. Once malware successfully invades the firmware system, it may replicate itself and quickly spread to the entire industrial network, triggering a chain reaction, leading to large-scale system failures or even paralysis.

[0004] Existing firmware protection methods have many defects. For example, one method is to insert an application firmware detection mechanism into the Bootloader, and use the Boot firmware to decrypt and verify the application firmware, but it may implant illegal code in the Bootloader, resulting in bypassing the firmware detection mechanism; another method is to perform a single hash operation on the firmware program to obtain a hash key for verification. Due to its relatively simple operation method, the application firmware and the corresponding hash data may be replaced by illegal firmware and the corresponding hash data, allowing the illegal firmware to pass the verification mechanism and run in the device, resulting in serious consequences. Summary of the invention

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present application provides a firmware protection method, device, system and electronic medium, which utilizes the FPGA with priority power-on and the elliptic curve digital signature algorithm when the whole is powered on to achieve all-round protection of the firmware, effectively solving the problems of the prior art being easy to be bypassed and insufficient in security, and significantly improving the firmware security.

[0006] To achieve the above objectives, the present application adopts the following technical solution, a firmware protection method, including: When the system is powered on, the FPGA is powered on first and performs self-checking. If the verification fails, the overall power-on sequence of the system is stopped; If the verification passes, the FPGA reads the Flash and then performs a power-on firmware test; If the test passes, the entire system is powered on; If the detection fails, the FPGA initiates firmware recovery.

[0007] Furthermore, the FPGA includes: Power-on timing control module: It starts running after the power-on firmware detection passes, is connected to the power control circuit of the firmware to be protected on the board level, and controls the power-on timing of the firmware; Information storage module: used to control the built-in storage of FPGA, save non-volatile data content, realize data writing, reading and storage management operations, and ensure the availability and integrity of relevant data during system operation; Flash control module: used for reading and writing control of the firmware to be protected Flash. In the firmware verification stage, the module can bypass the control bus of the firmware to be protected to the Flash according to the instruction, and the FPGA will take the lead in the data reading operation of the Flash. After the verification is passed, the control authority of the Flash will be transferred to the firmware to be protected according to the preset rules, and the read and write authority of different areas of the Flash will be configured and managed to protect the security of the data in the area where the firmware is located; Application layer module: performs firmware protection operations.

[0008] Furthermore, the system also includes an initialization step: The firmware generates firmware hash data through a hash algorithm, and runs an elliptic curve digital signature algorithm to obtain signature data of the firmware program; The hash data and signature data are stored in Flash, and the public key is stored in the FPGA information storage module.

[0009] Furthermore, the firmware detection method includes: The FPGA reads the firmware data and signature data in the Flash and the public key in the information storage module; Generate HASH according to the firmware data and perform elliptic curve signature verification; If the signature verification passes, the firmware power-on sequence is started; If the signature verification fails, the firmware will be refused to power on and firmware recovery will be initiated.

[0010] Furthermore, during the FPGA signature verification process, the Flash is protected, and the specific method includes: During the signature verification process, the bus of the firmware to be protected to the Flash is bypassed; After the signature verification is passed, the FPGA latches the protection area of ​​the Flash, and then transfers the control authority of the Flash to the firmware to be protected according to the preset rules, so as to configure and manage the read and write permissions of different areas of the Flash.

[0011] Furthermore, after the system is powered on, the FPGA monitors the protection firmware, and when an abnormality occurs in the protection firmware, the FPGA initiates firmware recovery.

[0012] Furthermore, the firmware recovery method includes: FPGA erases the data in the firmware storage area in Flash; Read the data in the firmware backup area in the Flash, write it into the firmware storage area, read it back and verify it; If the verification fails, repeat the recovery operation for the area; If the verification passes, the firmware writing is confirmed to be complete and the next area data recovery is continued; After the Flash firmware storage area recovery operation is completed, the FPGA re-reads the data in the area and performs firmware detection; If the test passes, the firmware power-on sequence is started; If the detection fails, the firmware will be powered off and an alarm will be sent.

[0013] The present invention also provides another embodiment, a firmware protection device, comprising: FPGA: used to power on the system first and perform firmware detection. After the verification passes, the firmware power-on sequence is executed. After powering on, the firmware operation is monitored and the firmware recovery program is executed after an abnormality occurs. Protection firmware: communicates with the FPGA and is connected to the Flash through the FPGA, and implements power-on detection and operation detection through the FPGA; Flash: contains multiple partitions for storing protection firmware data and backup data, as well as temporary data generated by the protection firmware.

[0014] The present application also discloses a firmware protection system, including: one or more processors; A computer readable storage medium for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method described in any one of claims 1 to 7.

[0015] The present application also discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

[0016] The beneficial effects of this application are: 1. Scalability: Using FPGA as the execution body, it has dedicated processing and connection I / O ports, fast response speed, and can be expanded to multiple devices, levels or security domains to adapt to various application scenarios.

[0017] 2. Non-bypassability: Designed with FPGA as the center, it has physical isolation and defense mechanisms. Unauthorized firmware cannot be bypassed, ensuring component security.

[0018] 3. High security: FPGA executes firmware protection mechanism, implements elliptic curve digital signature algorithm with logic unit, efficiently executes signature verification process, ensures speed and security, and improves the trust and security of digital signature. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present application is described with the aid of the following drawings: Figure 1 The overall power-on timing flow chart of the system of the present application is shown; Figure 2 The schematic diagram of the system framework structure of the present application is shown; Figure 3 The flowchart of the firmware recovery method of the present application is shown; Figure 4 A schematic diagram of FPGA application expansion of the present application is shown. DETAILED DESCRIPTION

[0020] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below in conjunction with the accompanying drawings through specific implementation methods. It is understood that the specific embodiments described below are only used to explain the relevant inventions, rather than to limit the invention. It should also be noted that the embodiments and features in the embodiments of this application can be combined with each other in the absence of conflict; for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0021] As known from the background technology, the existing firmware protection method can easily bypass firmware detection, and a single hash operation and key can be easily illegally replaced, resulting in illegal firmware passing the verification, resulting in serious consequences.

[0022] In view of the above problems, the present application provides a firmware protection method, the overall power-on timing of the system is as follows Figure 1 As shown, including: When the system is powered on, the FPGA is powered on first and performs self-checking. If the verification fails, the overall power-on sequence of the system is stopped; If the verification passes, the FPGA reads the Flash and then performs a power-on firmware test; If the test passes, the entire system is powered on; If the detection fails, the FPGA initiates firmware recovery.

[0023] Among them, the FPGA power-on self-check can be executed by the watchdog. When the FPGA is powered on first, it starts to send a dog feeding signal to the watchdog. If the dog feeding signal is normal, it is determined that the FPGA is in a normal state, the self-check passes, and the system power-on sequence can be executed. When the watchdog does not receive the FPGA dog feeding signal within a certain period of time, it directly sends a signal to the FPGA to stop the FPGA power-on sequence and stop the overall power-on of the system.

[0024] The present invention uses FPGA as the execution subject of firmware protection to realize the protection of firmware. Figure 2 This is the framework diagram of this system, where the FPGA includes: Power-on sequence control module: starts running after the power-on firmware passes the detection, and is connected to the power control circuit of the firmware to be protected (such as the CPU) on the board level, responsible for accurately controlling the power-on sequence of the firmware. At the beginning of system startup, this module ensures that the firmware to be protected is in a waiting state before the firmware verification is completed and the result is passed, avoiding the security risks that may be caused by the premature startup of unverified firmware. Once the verification is successful, a stable power-on sequence is provided for the firmware to be protected according to the preset safe startup sequence to ensure the orderly startup of the system.

[0025] Information preservation module: mainly used to control the built-in storage of FPGA, and the non-volatile data content it saves is crucial. It includes the FPGA's own firmware program to ensure the normal operation and updatability of the FPGA function; the firmware status information of the Flash firmware to be protected, which is used to monitor and record the status changes of the firmware in real time, such as whether there is an update, whether there is an abnormality, etc.; the FPGA operation log, which records the key operations and events of the FPGA during operation, which is convenient for troubleshooting and system performance analysis; and the public key information used for signature verification, which is a key element in realizing the secure signature verification mechanism. This module has complete data writing, reading and storage management functions to ensure the integrity, accuracy and availability of data throughout the system operation cycle.

[0026] Flash control module: implements fine read and write control of the firmware Flash to be protected. During the firmware verification stage, it can accurately bypass the control bus of the firmware to be protected to the Flash according to the system instructions, so that the FPGA can dominate the reading operation of the firmware data in the Flash, thereby ensuring the independence and security of the verification process. After the verification passes, according to the preset permission transfer rules, the control authority of the Flash is conditionally transferred to the firmware to be protected, and the read and write permissions of different areas of the Flash are strictly configured and managed. For example, for the key areas where the firmware is stored, only the firmware to be protected is allowed to perform read operations to prevent illegal burning or erasing, effectively protecting the security and integrity of the data in the firmware area.

[0027] Application layer module: undertakes the core specific operation tasks of firmware protection. It runs the elliptic curve digital signature algorithm (ECDSA) to verify the signature of the firmware. By deeply processing and accurately analyzing the firmware data of the firmware to be protected, it can effectively detect the integrity of the firmware data and determine its unique source.

[0028] To execute the method of the present invention, in the system initialization stage, the firmware to be protected is used as the basis, and the firmware hash data is obtained through a hash algorithm to provide preliminary data features for subsequent signature verification. Then, based on the private key, the elliptic curve digital signature algorithm is run to obtain the signature data of the firmware program. The firmware program, backup firmware and signature data of the device to be protected are stored in the firmware's Flash, and the public key information is stored in the FPGA built-in storage. This data storage method and signature generation mechanism lay a solid security foundation for the entire firmware protection system, so that in the subsequent startup and operation process, the authenticity and integrity of the firmware can be ensured through the asymmetric encryption verification mechanism of the public key and the private key.

[0029] The power-on timing of the system of the present invention is as follows: Figure 1 As shown in the figure, when the system is powered on, the FPGA is powered on first and performs self-checking. Only after the self-checking passes and the FPGA is confirmed to be started normally, will the firmware (CPU is used as an example for explanation) detection and power-on procedure be started. If the FPGA self-checking fails, it means that the FPGA cannot play the role of firmware startup protection at this time. In order to avoid firmware tampering or malware infection, the FPGA will stop the overall system power-on sequence.

[0030] When the FPGA self-check passes, the system will enter the CPU firmware detection and power-on sequence. First, the FPGA reads the hash data and signature data in the Flash according to the firmware commitment during the system initialization phase, combines the public key stored in the FPGA information storage module, generates HASH from the firmware data, and performs elliptic curve signature verification. Only components that have been strictly verified and meet the preset security standards will be loaded and executed in a predefined order. This process effectively prevents attackers from loading unauthorized components by changing the startup sequence, and ensures the security of the firmware and the stability of the system from the source of system startup. If the firmware detection fails, the FPGA will stop the CPU power-on sequence and execute the firmware recovery program. Through the implementation of this solution, the overall firmware protection operation can be realized, covering comprehensive solutions such as protection, detection, and recovery. In terms of protection, illegal access and tampering can be prevented by setting hardware locks and permission control; in terms of detection, the firmware status is scanned regularly or in real time to detect potential risks in a timely manner; in terms of recovery, when the firmware is detected to be abnormal or damaged, the recovery operation can be quickly executed to ensure that the firmware can quickly recover to a normal state after an unexpected situation, thereby ensuring the security, stability and reliability of the industrial control system firmware during the entire operation process.

[0031] The process of the FPGA execution firmware protection method of the present application includes: During the signature verification process, the bus of the firmware to be protected to the Flash is bypassed. When the FPGA is powered on to verify the integrity of the CPU firmware, the control bus of the CPU to the Flash is bypassed. At this stage, the CPU's read and write operations to the Flash are temporarily prohibited, and the FPGA is fully responsible for reading and verifying the Flash data. Only when the FPGA completes the verification and the result is passed, will the CPU be allowed to read and write data in the Flash. This control method ensures the independence and accuracy of the verification process, and avoids the interference of possible security vulnerabilities in the device to be protected itself on the verification process.

[0032] After the signature verification is passed, the FPGA locks the protection area of ​​the Flash, and then transfers the control authority of the Flash to the firmware to be protected according to the preset rules, so as to configure and manage the read and write permissions of different areas of the Flash. Among them, in order to protect the firmware, the Flash is divided into multiple areas with specific functions, including a storage area (FreeSpace area) for storing firmware information that can be read when the CPU is powered on, a backup area (GoldenSpace area) for storing backup firmware data, and a free read and write area for storing temporary data for CPU operation. After the firmware signature verification is passed, the FPGA FPGA writes a specific protection value to the protection register of the protection area (such as the GoldenSpace area) and performs a latch operation. This operation further strengthens the security protection of the protection area, and then transfers the control authority of the Flash to the device to be protected according to the preset security rules. In this process, the operating authority of the device to be protected for the protection area is strictly limited, and only read operations are allowed, while any form of burning, erasing, and other operations that may damage the integrity of the firmware are strictly prohibited. For non-protected areas in Flash (such as free read and write areas), the device to be protected is given normal data read and write permissions so that it can complete the storage of operating data, such as communication data, configuration information, etc. This method of distinguishing different areas and setting permissions differently not only ensures the security of the firmware, but also takes into account the needs of the system for normal operation to read and write data.

[0033] The FPGA execution firmware monitoring method of the present application includes: after the entire system is powered on, the FPGA will detect the remaining device firmware data stored on the board level after self-starting to prevent abnormal behavior, data attacks and damage to key components caused by powering on damaged firmware.

[0034] First, the FPGA itself is powered on and performs a comprehensive self-check to ensure that it functions normally and the data is complete. Then, the signature data and firmware data in the FreeSpace area of ​​the CPUFlash are read, and the HASH value is generated using this data. The elliptic curve signature verification algorithm is used for strict signature verification. During the entire signature verification process, the CPU is not allowed to power on in order to ensure the accuracy and security of the signature verification results. If the elliptic curve signature verification of the firmware is successful, it indicates that the firmware is complete and the source is reliable. At this time, the FPGA will start the CPU power-on sequence to allow the system to start the subsequent process normally; if the signature verification fails, it means that the firmware may be abnormal or tampered with. The FPGA will refuse to power on the CPU and immediately execute the recovery plan to try to repair the damaged firmware.

[0035] The FPGA execution firmware recovery method of the present application is as follows: Figure 3 As shown, including: FPGA erases the data in the firmware storage area in Flash to clear any errors or tampered data that may exist.

[0036] Read the firmware backup area (GoldenSpace area) in the Flash, write the firmware storage area (FreeSpace area), read back and verify. When reading the backup data in the GoldenSpace area, the FPGA reads it out in blocks and writes it to the corresponding part of the FreeSpace area. Read back in time to verify the accuracy of the data writing. When an abnormality occurs, the abnormal area can be accurately located, which is convenient for system maintenance.

[0037] If the check fails, the recovery operation for the area is repeated. Preferably, the recovery operation for the area is attempted up to 8 times. If the 8 consecutive read-backs fail, the recovery operation is stopped and an alarm signal is immediately issued to notify the system administrator or relevant maintenance personnel to conduct further troubleshooting and processing.

[0038] If the verification passes, it confirms that the firmware writing is complete, and continues to perform data recovery in the next area until all data recovery is completed.

[0039] After the Flash firmware storage area recovery operation is completed, the FPGA re-reads the data in the area and performs a firmware test. If the test passes, the CPU power-on sequence is started; if the test fails, the CPU power-on is stopped and an alarm is sent. The firmware recovery program ensures that the firmware can quickly recover to a normal state after an unexpected situation, thereby ensuring the security, stability and reliability of the industrial control system firmware during the entire operation process. When the firmware cannot be recovered, an alarm can also be issued and the system power-on is stopped, effectively improving the firmware's protection capabilities.

[0040] The core operation of the present invention is to implement the firmware detection step, in which the elliptic curve digital signature algorithm (ECDSA) is used to ensure the security and reliability of the firmware signature. Digital signature is an encryption technology widely used in the field of information security, and its main purpose is to verify the authenticity and integrity of information and the identity of the signer.

[0041] As an elliptic curve version of digital signature, ECDSA plays a key role in this invention. Compared with traditional digital signature algorithms (such as RSA's digital signature), ECDSA only requires a shorter key length at the same security level, which gives it a significant performance advantage in resource-constrained industrial control systems.

[0042] In the specific implementation of the present invention, the hash function H(M) used by ECDSA is SHA256. Before executing the firmware protection operation, the signature data of the CPU firmware is first calculated using a specific signature algorithm. The signature process mainly includes complex steps such as carefully selecting a confidential random number, creating a third point on the elliptic curve according to specific rules, and accurately calculating two parameters of the signature. The signature information generated by these steps can be coordinated with the public key information stored in the FPGA, and the legitimacy of the signature can be strictly verified according to the signature verification algorithm, thereby ensuring the security and integrity of the firmware during transmission, storage and operation.

[0043] like Figure 4As shown, the present invention uses FPGA as the core for firmware protection. The architectural characteristics of FPGA itself give it excellent basic expansion capabilities. FPGA is equipped with a dedicated processing unit and a rich connection I / O port, which makes it possible for it to gain a foothold in industrial control systems of different scales and complexities. Its processing unit can flexibly allocate computing resources and efficiently process firmware protection tasks according to actual needs. Whether it is firmware management in simple small embedded devices or firmware collaborative protection of numerous devices in large industrial automation networks, it can handle it with ease. The rich I / O ports provide a convenient channel for connecting with various external devices, control systems at different levels, and multiple security domains, so that it can be easily integrated into a diverse industrial environment architecture to achieve seamless docking and interactive collaboration.

[0044] Secondly, this solution shows excellent adaptability and scalability when dealing with multi-device integration scenarios. With the continuous development of industrial automation, more and more devices are often integrated into the system, and these devices may come from different manufacturers and have different hardware characteristics and firmware architectures. The FPGA-based firmware protection device can customize the firmware protection requirements of different devices through its flexibly programmable logic units. For example, for new device types, it only needs to add corresponding adapter modules to the logic design of the FPGA to incorporate them into the overall firmware protection system without the need for large-scale redesign and transformation of the entire industrial control system. This method effectively reduces the cost and complexity of system upgrades and expansions, allowing industrial control systems to continue to maintain efficient and stable firmware protection capabilities as the number of devices increases and the types of devices become richer.

[0045] In summary, the beneficial effects of the method of the present invention are: 1. Scalability: Using FPGA as the execution body, it has dedicated processing and connection I / O ports, fast response speed, and can be expanded to multiple devices, levels or security domains to adapt to various application scenarios.

[0046] 2. Non-bypassability: Designed with FPGA as the center, it has physical isolation and defense mechanisms. Unauthorized firmware cannot be bypassed, ensuring component security.

[0047] 3. High security: FPGA executes firmware protection mechanism, implements elliptic curve digital signature algorithm with logic unit, efficiently executes signature verification process, ensures speed and security, and improves the trust and security of digital signature.

[0048] Another embodiment of the present invention is a firmware protection device, comprising: FPGA: used to power on the system first and perform firmware detection. After the verification passes, the firmware power-on sequence is executed. After powering on, the firmware operation is monitored and the firmware recovery program is executed after an abnormality occurs. Protection firmware: communicates with the FPGA and is connected to the Flash through the FPGA, and implements power-on detection and operation detection through the FPGA; Flash: contains multiple partitions for storing protection firmware data and backup data, as well as temporary data generated by the protection firmware.

[0049] A third embodiment of the present invention is a firmware protection system, comprising: one or more processors; A computer readable storage medium for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method described in any one of claims 1 to 7.

[0050] A fourth embodiment of the present invention is a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the device address allocation method described in any one of claims 1 to 7 are implemented.

[0051] It should be noted that in the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several distinct components and by means of a suitably programmed computer. The use of the words first, second, third, etc., is for convenience of expression only and does not imply any order. These words may be understood as part of the component name.

[0052] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0053] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments after knowing the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

[0054] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention should also include these modifications and variations.

Claims

1. A firmware protection method, characterized in that: When the system is powered on, the FPGA is powered on first and performs self-checking. If the verification fails, the overall power-on sequence of the system is stopped; If the verification passes, the FPGA reads the Flash and then performs a power-on firmware test; If the test passes, the entire system is powered on; If the detection fails, the FPGA initiates firmware recovery.

2. The firmware protection method according to claim 1, characterized in that: The FPGA comprises: Power-on timing control module: It starts running after the power-on firmware detection passes, is connected to the power control circuit of the firmware to be protected on the board level, and controls the power-on timing of the firmware; Information storage module: used to control the built-in storage of FPGA, save non-volatile data content, realize data writing, reading and storage management operations, and ensure the availability and integrity of relevant data during system operation; Flash control module: used for reading and writing control of the firmware to be protected Flash. In the firmware verification stage, the module can bypass the control bus of the firmware to be protected to the Flash according to the instruction, and the FPGA will take the lead in the data reading operation of the Flash. After the verification is passed, the control authority of the Flash will be transferred to the firmware to be protected according to the preset rules, and the read and write authority of different areas of the Flash will be configured and managed to protect the security of the data in the area where the firmware is located; Application layer module: performs firmware protection operations.

3. The firmware protection method according to claim 2, characterized in that: The system also includes an initialization step: The firmware generates firmware hash data through a hash algorithm, and runs an elliptic curve digital signature algorithm to obtain signature data of the firmware program; The hash data and signature data are stored in Flash, and the public key is stored in the FPGA information storage module.

4. The firmware protection method according to claim 3, characterized in that: The firmware detection method comprises: The FPGA reads the firmware data and signature data in the Flash and the public key in the information storage module; Generate HASH according to the firmware data and perform elliptic curve signature verification; If the signature verification passes, the firmware power-on sequence is started; If the signature verification fails, the firmware will be refused to power on and firmware recovery will be initiated.

5. The firmware protection method according to claim 4, characterized in that: During the FPGA signature verification process, Flash is protected. The specific method includes: During the signature verification process, the bus of the firmware to be protected to the Flash is bypassed; After the signature verification is passed, the FPGA latches the protection area of ​​the Flash, and then transfers the control authority of the Flash to the firmware to be protected according to the preset rules, so as to configure and manage the read and write permissions of different areas of the Flash.

6. The firmware protection method according to claim 1, characterized in that: After the system is powered on, the FPGA monitors the protection firmware. When an abnormality occurs in the protection firmware, the FPGA initiates firmware recovery.

7. The firmware protection method according to claim 6, characterized in that: The firmware recovery method comprises: FPGA erases the data in the firmware storage area in Flash; Read the data in the firmware backup area in the Flash, write it into the firmware storage area, read it back and verify it; If the verification fails, repeat the recovery operation for the area; If the verification passes, the firmware writing is confirmed to be complete and the next area data recovery is continued; After the Flash firmware storage area recovery operation is completed, the FPGA re-reads the data in the area and performs firmware detection; If the test passes, the firmware power-on sequence is started; If the detection fails, the firmware will be powered off and an alarm will be sent.

8. A firmware protection device, characterized in that: include: FPGA: used to power on the system first and perform firmware detection. After the verification passes, the firmware power-on sequence is executed. After power-on, the firmware is monitored for operation and the firmware recovery procedure is executed if an abnormality occurs; Protection firmware: communicates with the FPGA and is connected to the Flash through the FPGA, and implements power-on detection and operation detection through the FPGA; Flash: contains multiple partitions for storing protection firmware data and backup data, as well as temporary data generated by the protection firmware.

9. A firmware protection system, characterized in that: include: one or more processors; A computer readable storage medium for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images