System chip and method, device and equipment for checking boot image

Abstract

Embodiments of the present application provide a system chip to verify a start image method, device, chip and equipment, the method comprises: the chip is burned with a root of trust, the root of trust comprises a plurality of root public keys; the method comprises: loading a start image and a verification data image signed by a predetermined administrator corresponding root private key, the verification data image comprises a verification header; calculate the hash value of each start image, and the hash value of each start image obtained is matched with the hash value of each start image saved in the verification data image; calculate the hash value of the verification data image, and the hash value of the verification data image is signed using the user public key in the verification header; the root public key corresponding to the root of trust in the verification header is used to sign the user public key data in the verification header; the root of trust in the verification header is matched with the root of trust burned in the system chip; when all results are verified, it is determined that the start image of the system chip is verified.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of chips, in particular to a system-on-chip verification method and device for a startup image, a chip and an apparatus. BACKGROUND

[0002] When verifying a system-on-chip, either the verification process is complex and time-consuming, or the verification process is risky and cannot guarantee the absolute security and legality of the system-on-chip. SUMMARY

[0003] Therefore, embodiments of the present application provide a system-on-chip verification method and device for a startup image, a chip and an apparatus to solve the problem that when verifying a system-on-chip, either the verification process is complex and time-consuming, or the verification process is risky and cannot guarantee the absolute security and legality of the system-on-chip.

[0004] In one aspect, the present application provides a system-on-chip verification method for a startup image. A one-time programmable memory of a system-on-chip has a root of trust burned therein, wherein the root of trust includes each root public key in a plurality of root keys, and each root public key is arranged in a predetermined order. The verification method includes: in response to a startup operation of the system-on-chip, loading a startup image and a verification data image signed by a root private key corresponding to a predetermined administrator, wherein the verification data image includes a verification header, and the verification header includes: current image verification data, user public key verification data, a user public key, and a root of trust; calculating a hash value of each startup image, and performing a matching operation on the hash value of each startup image obtained and the hash value of each startup image saved in the verification data image to obtain a first result value; calculating a hash value of the verification data image, and performing a signature verification operation on the hash value of the verification data image using the user public key in the verification header to obtain a second result value; performing a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the root of trust in the verification header to obtain a third result value; matching the root of trust in the verification header with the root of trust burned in the system-on-chip to obtain a fourth result value; detecting whether all result values are in a verification pass state, wherein the all result values include: the first result value, the second result value, the third result value, and the fourth result value, and the verification pass state includes: a complete match state and a signature verification success state; and determining that the startup image of the system-on-chip passes verification when all result values are in the verification pass state.

[0005] In some embodiments, the signing operation of the user public key of the current image verification data according to the hash value of each of the startup images and the user private key comprises: obtaining the hash value of each of the startup images, and collecting all the hash values into the verification data image; performing calculation on the collected verification data image to obtain a first hash value of the verification data image; performing signing operation on the first hash value using the user private key; and generating the current image verification data according to the first hash value and a signature corresponding to the signing operation.

[0006] In some embodiments, the system on chip further has a failure table burned therein, and the failure table indicates a failure state by a bit; and the signing operation of the user public key in the verification head using each root public key in sequence to obtain a plurality of signing states comprises: reading the failure table in the system on chip to determine a root public key that has failed; and performing signing operation of the user public key in the verification head using each of the other root public keys that have not failed in sequence.

[0007] In some embodiments, the method further comprises: determining the current image verification data according to the hash value of each of the startup images and the user private key; performing signing operation of the hash value of the user public key using the root private key corresponding to the predetermined administrator to obtain the user public key verification data; storing the current image verification data, the user public key verification data, the user public key corresponding to the user private key, and the root of trust in the verification head of the verification data image, and adding the stored verification data image to an image package.

[0008] In some embodiments, the determining of the current image verification data according to the hash value of each of the startup images and the user private key comprises: obtaining the hash value of each of the startup images, and collecting all the hash values into the verification data image; performing calculation on the collected verification data image to obtain a first hash value of the verification data image; performing signing operation on the first hash value using the user private key; and generating the current image verification data according to the first hash value and a signature corresponding to the signing operation.

[0009] In some embodiments, the verification data image further comprises: a serial number of a root key to be failed;

[0010] After the determination of the verification pass of the startup image of the system on chip, the method further comprises: obtaining the serial number of the root key to be failed from the verification data image; determining whether the root key to be failed is in a failure state in a failure table burned in the system on chip; and in the case of not being in the failure state, modifying a bit at a position corresponding to the serial number of the root key to be failed in the failure table.

[0011] In some embodiments, the determining whether the to-be-invalidated root key is in an invalid state in the invalidation table burned in the system-level chip comprises: determining whether a serial number of the to-be-invalidated root key is the same as a serial number of a root key used by a currently passed verification image package; in the case that the serial numbers are different, determining whether the to-be-invalidated root key is in an invalid state in the invalidation table burned in the system-level chip.

[0012] In another aspect, the embodiments of the present application provide a system-level chip for verifying a start-up image. A one-time programmable memory of the system-level chip is burned with a root of trust, wherein the root of trust comprises each root public key in a plurality of root keys, and each root public key is arranged in a predetermined order. The verification device comprises: a loading module configured to load a start-up image and a verification data image signed by a predetermined administrator corresponding root private key in response to a start-up operation of the system-level chip, wherein the verification data image comprises a verification header, and the verification header comprises: current image verification data, user public key verification data, a user public key, and a root of trust; a first result determination module configured to calculate a hash value of each start-up image, and perform a matching operation on the hash value of each start-up image obtained and the hash value of each start-up image saved in the verification data image to obtain a first result value; a second result determination module configured to calculate a hash value of the verification data image, and perform a signature verification operation on the hash value of the verification data image using the user public key verification data in the verification header to obtain a second result value; a third result determination module configured to perform a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the root of trust in the verification header to obtain a third result value; a fourth result determination module configured to match the root of trust in the verification header with the root of trust burned in the system-level chip to obtain a fourth result value; a detection module configured to detect whether all result values are in a verification passed state, wherein the all result values comprise: the first result value, the second result value, the third result value, and the fourth result value, and the verification passed state comprises: a complete matching state and a signature verification success state; and a result output module configured to determine that the start-up image of the system-level chip is verified to pass in the case that all results are in the verification passed state.

[0013] In another aspect, the embodiments of the present application provide a chip storing a computer program, wherein the computer program is executed by a processor to implement the steps of the above method.

[0014] In another aspect, the embodiments of the present application provide a computer device comprising at least a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program stored in the memory.

[0015] In an embodiment of the present application, a verification data image is burned into a memory of a system-on-chip together with other boot images. The verification data image includes a set of hash values ​​of other boot images and a verification header. The verification header stores current image verification data, user public key verification data, user public key, and trust root for verification. During the image package verification process, the integrity of each boot image is verified by verifying the hash values ​​of other boot images stored in the verification data image, and then the integrity of the verification data image is verified by the current image verification data and user public key in the verification header. The user public key data and trust root in the verification header and the trust root stored in the one-time editable memory of the system-on-chip are then verified, thereby ensuring the legitimacy of the verification header data, and then ensuring the absolute security and legitimacy of the entire verification process of the boot image package by the system-on-chip. The entire verification process is simple and easy to operate. Any administrator can sign the boot image to ensure that the boot image can pass the chip's security verification. Once the key of an administrator is leaked, another administrator can be replaced to sign to implement the verification process, thereby solving the risk problem in the chip verification process. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0017] Figure 1 A schematic diagram of a root of trust in a system-on-chip provided in the first embodiment of the present application;

[0018] Figure 2 A flowchart of a method for verifying a startup image on a system-on-chip according to the first embodiment of the present application;

[0019] Figure 3 A schematic diagram of a system-on-chip with a failure table burned into it provided by the first embodiment of the present application;

[0020] Figure 4 A schematic diagram of the composition of the verification data mirror provided in the first embodiment of the present application;

[0021] Figure 5 A schematic diagram of the process of generating an image package containing a verification data image and burning it into a SOC according to the first embodiment of the present application;

[0022] Figure 6 A schematic diagram of the verification process provided in the first embodiment of the present application;

[0023] Figure 7A structure diagram of a system-level chip for a verification device of a start-up image is provided in the second embodiment of the present application.

[0024] Figure 8 A structure diagram of an electronic device is provided in the fourth embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of the embodiments of the present application will be described clearly and completely below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the described embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without any creative effort fall within the scope of protection of the present application.

[0026] Unless otherwise defined, technical terms or scientific terms used in the present application should be understood as their common meanings to those of ordinary skill in the art to which the present application belongs. The terms “first”, “second” and similar terms used in the present application do not represent any order, number or importance, but are only used to distinguish different components. The terms “include” or “contain” and similar terms mean that the elements or objects before the terms cover the elements or objects listed after the terms and their equivalents, without excluding other elements or objects. The terms “connect” or “connected” and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms “up”, “down”, “left”, “right” and the like only represent relative positional relationships, which can change accordingly when the absolute positions of the described objects change.

[0027] In order to keep the following description of the embodiments of the present application clear and concise, detailed descriptions of known functions and known components are omitted in the present application.

[0028] The first embodiment of the present application provides a verification method of a system-level chip for a start-up image. A one-time programmable memory of the system-level chip is programmed with an unchangeable root of trust, wherein the root of trust includes each root public key in a plurality of root keys, such as Figure 1 As shown, each root public key is arranged in a predetermined order, which can be arranged in the order of root public key 1, root public key 2, root public key 3 and root public key 4 as shown in Figure 1 or in the order of root public key 3, root public key 2, root public key 1 and root public key 4, as long as it is arranged in a predetermined order; the flow of the verification method is as shown in Figure 2 including steps S101 to S107:

[0029] S101, in response to a start operation of the system level chip, loading a start image and a verification data image signed by a predetermined administrator corresponding root private key, wherein the verification data image comprises a verification header, and the verification header comprises current image verification data, user public key verification data, a user public key and a trust root.

[0030] The user public key is a user public key defined by any one of the multiple administrators, and the user public key of any administrator can be implemented.

[0031] The embodiment of the application is a verification process (i.e. a signature process) of a start image of a system level chip, and correspondingly, the verification data image needs to be stored in an image package (i.e. a collection of images) of the chip (i.e. a signature process) for verification when the chip starts. The signature process of the embodiment of the application comprises the following steps S201 to S203:

[0032] S201, determining the current image verification data according to the hash values of the respective start images and the user private key.

[0033] In a specific implementation, the hash values of the respective start images are first obtained, and all the hash values are summarized in the verification data image; then the summarized verification data image is calculated to obtain a first hash value of the verification data image; the first hash value is then signed using the user private key; and finally, the current image verification data is generated according to the first hash value and the signature corresponding to the signature operation.

[0034] S202, performing a signature operation on the hash value of the user public key using the root private key corresponding to the predetermined administrator to obtain the user public key verification data.

[0035] S203, storing the current image verification data, the user public key verification data, the user public key corresponding to the user private key and the trust root in the verification header of the verification data image, and adding the stored verification data image to the image package.

[0036] The process of S201 to S203 above completes the signature operation, and the start image package to which the verification data image is added is burned in the memory of the chip.

[0037] S102, calculating the hash values of the respective start images, and performing a matching operation on the obtained hash values of the respective start images and the hash values of the respective start images saved in the verification data image to obtain a first result value.

[0038] S103, calculating the hash value of the verification data image, and performing a signature verification operation on the hash value of the verification data image using the user public key in the verification header to obtain a second result value.

[0039] S104, signature verification is performed on the user public key check data in the verification header using the root public key corresponding to the root of trust in the verification header to obtain a third result value.

[0040] Since it is uncertain which root public key corresponding to an administrator is used for signature, the root of trust in the verification header is first parsed to obtain a plurality of root public keys, then each root public key is used in turn to perform signature verification on the user public key check data in the verification header to obtain a plurality of signature verification states, and finally the third result value is determined according to the plurality of signature verification states, wherein the signature verification state includes a signature verification failure state and a signature verification success state.

[0041] As shown in the implementation, Figure 3 The failure table can also be burned in the one-time programmable memory in the system-level chip, and the failure table indicates the failure state through a bit, and only the failed bit can be added, and the failed bit cannot be revoked. Since the failure table is burned in the SOC, the failure table in the system-level chip can be read to determine the failed root public key, and then each other non-failed root public key is used in turn to perform signature verification on the user public key check data in the verification header to determine the root public key corresponding to the signature. The failure table can avoid using the image package signed by the failed root public key, and ensures the safety of the chip.

[0042] S105, the root of trust in the verification header is matched with the root of trust burned in the system-level chip to obtain a fourth result value.

[0043] S106, it is detected whether all result values are in a check pass state, wherein the all result values include the first result value, the second result value, the third result value and the fourth result value, and the check pass state includes a complete match state and a signature verification success state.

[0044] The check process of the chip needs all checks to pass to ensure the safety of the chip, so the four result values obtained by the above check need to be in the check pass state.

[0045] S107, in the case that all results are in the check pass state, it is determined that the start-up image of the system-level chip passes the check.

[0046] The embodiment of the present application burns the verification data image and other start-up images in the memory of the system-level chip, the verification data image includes a set of hash values of the other start-up images and a verification header, the verification header stores the current image verification data, the user public key verification data, the user public key and the trust root for verification, in the image package verification process, the integrity of each start-up image is verified by the hash values of the other start-up images stored in the verification data image, the integrity of the verification data image is verified by the current image verification data and the user public key in the verification header, and the integrity of the verification data image is verified by the user public key data and the trust root in the verification header and the trust root stored in the one-time editable memory of the system-level chip, so that the legality of the verification header data is ensured, and then the absolute safety and legality of the system-level chip for the entire verification process of the start-up image package is ensured, the entire verification process is simple and easy to operate, any administrator can sign the start-up image to make the start-up image pass the security verification of the chip, and once the root key of an administrator is leaked, the verification process can be implemented by signing with other administrators, so that the risk problem in the chip verification process is solved.

[0047] If the root key of an administrator is leaked, the root public key burned in the chip trust root needs to be invalidated to avoid any illegal operation of the chip by the subsequently leaked root key and ensure the safety of the chip. Therefore, the composition of the above verification data image can also include, as shown in Figure 4 the sequence number of the root key to be invalidated, for example, root key 3, in addition to the current image verification data, the user public key verification data, the user public key corresponding to the user private key and the trust root.

[0048] After determining that the start-up image of the system-level chip passes the verification, the sequence number of the root key to be invalidated is obtained from the verification data image, and it is determined whether the root key to be invalidated is in the invalid state in the invalidation table burned in the system-level chip; in the case of not being in the invalid state, the bit at the corresponding position of the sequence number of the root key to be invalidated in the invalidation table is modified to adjust the root key to be invalidated to the invalid state in the invalidation table, so that the invalid root public key can be determined by reading the invalidation table in the system-level chip when the start-up image is loaded again.

[0049] In the process of determining whether the root key to be invalidated is in the invalid state in the invalidation table burned in the system-level chip, in order to avoid that the current image package is signed by the root key to be invalidated, it is necessary to determine whether the sequence number of the root key to be invalidated is the same as the sequence number of the root key used by the image package that has passed the verification; in the case that the sequence numbers are different, it is further determined whether the root key to be invalidated is in the invalid state in the invalidation table burned in the system-level chip, if not, the bit at the corresponding position of the sequence number of the root key to be invalidated in the invalidation table is modified for invalidation, and if it is invalid, no further processing is performed.

[0050] The above process is exemplarily described below in combination with the accompanying drawings.

[0051] Two kinds of keys, root key and user key, are used in the chip starting process; an asymmetric encryption algorithm is used, so each kind of key is in pairs, with a private key and a public key.

[0052] The verification method of the embodiment of the application configures 4 groups of root keys, and those skilled in the art can configure multiple groups according to actual conditions, for example, 3 groups, 5 groups, etc., and the 4 groups in the embodiment are only an example. The 4 groups of root public keys are combined in a fixed order to form a public trust root; then they are burned into the one-time programmable memory of the SOC and cannot be changed again, and it is the final basis of the entire starting verification link.

[0053] The 4 groups of root private keys are separately kept by 4 administrators, one of which cannot be changed and cannot be disclosed, and needs to be used when signing the starting image, each of the 4 administrators holds a group of root private keys and the serial number is clear; the user key is user-defined, and a new user key can be used each time the image package is signed; the user private key still needs special keeping, and the user public key is public.

[0054] Each administrator has a group of root private keys, a root public key set (i.e. a trust root), a user-defined user private key and a user public key, and based on the above preparation, the image package can be signed; the signed image package can be correctly verified when the chip is started after the trust root is burned.

[0055] When it is suspected that the root key of an administrator is disclosed, each administrator can specify the serial number of the root key that needs to be invalidated when signing the image package; after that, when the chip is started, the verification process is completed and passed, and the process corresponding to the invalidated key is entered.

[0056] The embodiment of the application includes a signing process, a verification process and an invalidated key process, which are described below.

[0057] (I) Signing process.

[0058] The signing process includes the following steps (11) to (14):

[0059] (11) The hash values of each starting image are summarized into a unified verification data image.

[0060] If the serial number of the key to be invalidated is specified, its value will also be added to the verification data image.

[0061] (12) The aggregated verification data image can calculate a hash value, which is signed by the user private key, and the final hash value and signature cost image verification data (i.e. the current image verification data) are saved at the beginning of the image (i.e. in the verification header);

[0062] (13) Any one of the 4 administrators signs the user public key hash value using his own root private key to obtain the user public key verification data, which exists together with the user public key and the trust root in the verification header of the verification data image.

[0063] (14) The finally generated verification data image is attached to the entire image package, burned to the SOC, and the signing is completed.

[0064] As shown in Figure 5 , for any administrator to participate in signing, the image package containing the verification data image is burned to the SOC.

[0065] (II) Verification process.

[0066] The SOC also has a failure table in its one-time programmable memory, which is used to record the serial number of the root key that has been failed and cannot be restored after failure; as long as each administrator's root key has not been failed, the image package signed by him independently can be correctly verified on the chip.

[0067] The verification process is shown in Figure 6 , which includes the following steps (21) to (27):

[0068] (21) After the chip is started, the startup image is loaded, and the verification data image is also loaded and parsed.

[0069] (22) Calculate the hash value of each startup image and compare it with the saved value in the verification data image to ensure the integrity of each startup image. If they are consistent, execute (23), otherwise execute (27).

[0070] (23) Calculate the hash value of the verification data image and use it to verify the user public key in the header to ensure the integrity of the verification data image. If the verification is passed, execute (24), otherwise execute (27).

[0071] (24) Read the failure table in the SOC, parse the 4 groups of root public keys from the trust root in the verification header, and try to verify the user public key verification data in the verification header with the root public keys that are not failed in turn to ensure the integrity and legality of the user public key. If the verification is passed, execute (25), otherwise execute (27).

[0072] (25) Finally, the root of trust in the checksum header is compared with the root of trust burned into the chip. If they are the same, they are legal and execute (26). Otherwise, execute (27).

[0073] (26) The verification is successful, confirming that the boot image is legal and complete. Finally, the legitimacy of the entire verification process is also guaranteed.

[0074] (27) Verification failed.

[0075] There is no specific order for the above steps (22) to (25), and all of them must be successfully verified for the verification to pass.

[0076] (3) Key expiration process.

[0077] As described above, if you possess any set of root private keys and obtain the public root of trust, you can then customize the user key to correctly sign the image package, allowing it to be correctly verified during the chip startup process. If any set of root private keys is at risk of being leaked, it must be invalidated. After that, the image package signed by this set of root keys will no longer be correctly verified during the chip startup process.

[0078] After confirming the root key serial number that needs to be invalidated, any other administrator can set the corresponding serial number in the key to be invalidated field of the verification data image when signing a new image package. After that, no user operation is required on the client. When the chip starts using the new image package, the key expiration process will be executed normally.

[0079] The failure process includes the following steps (31) to (35):

[0080] (31) The new image package passes verification when it is started, and the serial number of the root key to be invalidated is obtained.

[0081] (32) Determine whether the serial number is the same as the root key used to sign the current boot image package. If different, execute (33). If the same, there is a fault and an alarm needs to be processed.

[0082] (33) Determine whether the root key corresponding to the serial number has expired. If it has expired, the invalidation operation will not be repeated; if it has not expired, execute (34).

[0083] (34) Determine whether the current image package has been successfully and correctly started. If it has not been started, do not perform the key invalidation operation. If it has been started, perform (35).

[0084] This flag is generally determined by the partition table properties. This method is not fixed and is not necessary. It is mainly used to prevent the current new image package from failing to start correctly.

[0085] (35) Automatically modify the failure table in the SOC to complete the failure operation.

[0086] The above-mentioned invalid root key can be, for example, the following scenario: the chip with the trusted root burned has been using the root key 1 held by administrator 1 to sign the image package. The root key 1 held by administrator 1 is at risk. The root key 2 held by administrator 2 is started to sign the image package, and the key to be invalidated field is set to 1. After the new image package is burned to the chip, the chip can verify the new image package and confirm that the new image package can be started normally. Then the invalidation table of the chip is burned to invalidate the root key 1. After that, all image packages signed by the root key 1 cannot be started normally on the chip. The root key 2, root key 3 and root key 4 are all normal.

[0087] The one-time programmable memory in the chip of the embodiment of the present application contains a trust root composed of multiple root public keys in a fixed order, and also contains a root key expiration table; the bits of the expiration table correspond to the root keys with the same serial number, and when the bit is set to 1, the corresponding key is invalid, and once set, it cannot be restored.

[0088] Each administrator has his or her own independent root private key with a specific serial number. If the administrator believes that a root private key is at risk of being leaked, he or she can set one or more key serial numbers to be expired when signing the image package on the client. The key serial numbers to be expired will eventually be stored in the verification data image generated by the signature.

[0089] After the chip is started, when verifying the image package, it will parse the verification data image; in this process, you can obtain the set key serial number to be invalidated, and you can also obtain the root key serial number that signed the currently verified image package;

[0090] Since the programming of the one-time programmable memory cannot be restored, during the startup process, only the program running on the security domain has the authority to operate it; when starting the program running on the security domain, after completing the verification of the image package and confirming that the verification data image in the image package is complete and legal, it is determined that the key serial number to be invalidated in the verification data image is also legal. If the serial number value is not empty, the key expiration process is entered.

[0091] In the key expiration process, if the conditions are met, the bit corresponding to the key number to be invalidated in the expiration table of the one-time programmable memory in the chip will be rewritten and set to 1; after the setting is successful, all image packages signed by the invalidated key will not be able to start normally on the chip with the trusted root burned.

[0092] The embodiment of the present application pre-sets multiple groups of key combination trust roots. At the same time, these core keys are independent of each other and can each complete the chip startup image signature. Any group of repairs can perform corresponding key invalidation operations on the chip with solidified trust roots, thereby solving security risks. At the same time, the embodiment of the present application ensures the security of the secure boot solution based on the multi-key combination trust root through a complete signing, verification and invalidation process.

[0093] The second embodiment of the present application provides a system-on-chip verification device for a boot image, wherein a root of trust is burned into a one-time editable memory of the system-on-chip, wherein the root of trust includes each root public key of a plurality of root keys, and each root public key is arranged in a predetermined order; the structure of the device is shown in FIG. Figure 7 As shown, including:

[0094] A loading module 10 is configured to load a startup image and a verification data image signed by a predetermined administrator's corresponding root private key in response to a startup operation of the system-on-chip, wherein the verification data image includes a verification header including: current image verification data, user public key verification data, user public key, and a root of trust;

[0095] a first result determination module 20, coupled to the loading module 10, configured to calculate a hash value of each boot image and match the obtained hash value of each boot image with the hash value of each boot image stored in the verification data image to obtain a first result value;

[0096] A second result determination module 30, coupled to the loading module 10, is configured to calculate a hash value of the verification data image and perform a signature verification operation on the hash value of the verification data image using the user public key in the verification header to obtain a second result value;

[0097] a third result determination module 40, coupled to the loading module 10, configured to perform a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the trusted root in the verification header to obtain a third result value;

[0098] A fourth result determination module 50, coupled to the loading module 10, is configured to match the root of trust in the check header with the root of trust programmed into the system-on-chip to obtain a fourth result value;

[0099] Detection module 60, coupled to first result determination module 20, second result determination module 30, third result determination module 40, and fourth result determination module 50, is configured to detect whether all result values ​​are in a verification pass state, where all result values ​​include: first result value, second result value, third result value, and fourth result value, and verification pass states include: complete match state and signature verification success state;

[0100] The result output module 70 is coupled with the detection module 60, and is configured to determine that the start-up image of the system-level chip passes the verification when all the results are in the pass state.

[0101] The third result determination module 40 is specifically configured to parse the trust root in the verification header to obtain a plurality of root public keys, perform signature verification on the user public key verification data in the verification header using each root public key in sequence to obtain a plurality of signature verification states, and determine a third result value according to the plurality of signature verification states. The signature verification state includes a signature verification failure state and a signature verification success state.

[0102] The system-level chip further has a failure table burned therein, and the failure table indicates the failure state by using a bit. When the third result determination module 40 performs signature verification on the user public key in the verification header using each root public key in sequence to obtain a plurality of signature verification states, the third result determination module 40 is specifically configured to read the failure table in the system-level chip to determine the root public keys that have failed, and perform signature verification on the user public key in the verification header using each other root public key that has not failed in sequence.

[0103] The device further includes a signature module configured to determine current image verification data according to the hash values of each start-up image and the user private key, perform signature verification on the hash value of the user public key using the root private key corresponding to the predetermined administrator to obtain user public key verification data, store the current image verification data, the user public key verification data, the user public key corresponding to the user private key, and the trust root in the verification header of the verification data image, and add the verification data image after storage to the image package. When determining the current image verification data according to the hash values of each start-up image and the user private key, the hash values of each start-up image are first obtained, all the hash values are summarized into a verification data image, the verification data image after summarization is calculated to obtain a first hash value of the verification data image, the first hash value is then subjected to signature verification using the user private key, and finally the current image verification data is generated according to the first hash value and the signature corresponding to the signature verification.

[0104] The verification data image of the embodiment of the present application further includes the serial number of the root key to be failed. After determining that the start-up image of the system-level chip passes the verification, the failure module is configured to obtain the serial number of the root key to be failed from the verification data image, determine whether the root key to be failed is in the failure state in the failure table burned in the system-level chip, and modify the bit at the position corresponding to the serial number of the root key to be failed in the failure table when the root key to be failed is in the non-failure state.

[0105] Wherein, when determining whether the root key to be invalidated is in the invalidation state in the invalidation table burned in the system chip, first, it is determined whether the serial number of the root key to be invalidated is the same as the serial number of the root key used by the current image package that has passed the verification, and then, in the case that the serial numbers are different, it is determined whether the root key to be invalidated is in the invalidation state in the invalidation table burned in the system chip.

[0106] The verification data image and other start-up images are burned in the memory of the system chip, the verification data image includes a set of hash values of the other start-up images and a verification header, the verification header stores the current image verification data for verification, the user public key verification data, the user public key, and the trust root, in the image package verification process, the integrity of each start-up image is verified by the hash values of the other start-up images saved in the verification data image, the integrity of the verification data image is verified by the current image verification data and the user public key in the verification header, and the verification is performed by the user public key data and the trust root in the verification header and the trust root saved in the one-time editable memory of the system chip, so that the legality of the verification header data is ensured, and then the absolute safety and legality of the system chip for the entire verification process of the start-up image package are ensured, the entire verification process is simple and easy to operate, any administrator can sign the start-up image to make the start-up image pass the security verification of the chip, and once the administrator key is leaked, other administrators can be used to sign to realize the verification process, so that the risk problem in the chip verification process is solved.

[0107] The third embodiment of the present application provides a chip, the chip stores a computer program for a system chip, and a trust root is burned in the one-time editable memory of the system chip, wherein the trust root includes each root public key in a plurality of root keys, and each root public key is arranged in a predetermined order; the computer program is executed by a processor to implement the method provided by any embodiment of the present application, including the following steps S11 to S17:

[0108] S11, in response to a start-up operation of the system chip, loading a start-up image and a verification data image signed by a root private key corresponding to a predetermined administrator, wherein the verification data image includes a verification header, and the verification header includes: current image verification data, user public key verification data, a user public key, and a trust root;

[0109] S12, calculating the hash value of each start-up image, and matching the obtained hash value of each start-up image with the hash value of each start-up image saved in the verification data image to obtain a first result value;

[0110] S13, calculating the hash value of the verification data image, and performing signature verification on the hash value of the verification data image using the user public key in the verification header to obtain a second result value;

[0111] S14, performing a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the trust root in the verification header to obtain a third result value;

[0112] S15, matching the trust root in the verification header with the trust root burned in the system chip to obtain a fourth result value;

[0113] S16, detecting whether all result values are in a verification pass state, wherein the all result values include the first result value, the second result value, the third result value, and the fourth result value, and the verification pass state includes a complete match state and a signature success state;

[0114] S17, in the case that all results are in the verification pass state, determining that the start-up image of the system chip passes the verification.

[0115] When the computer program is executed by the processor to perform a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the trust root in the verification header to obtain a third result value, the processor specifically performs the following steps: parsing the trust root in the verification header to obtain a plurality of root public keys; performing a signature verification operation on the user public key verification data in the verification header using each root public key in turn to obtain a plurality of signature states; and determining the third result value according to the plurality of signature states, wherein the signature state includes a signature failure state and a signature success state.

[0116] The system chip also has a failure table burned therein, and the failure table indicates a failure state by using a bit; when the computer program is executed by the processor to perform a signature verification operation on the user public key in the verification header using each root public key in turn to obtain a plurality of signature states, the processor specifically performs the following steps: reading the failure table in the system chip to determine the root public keys that have failed; and performing a signature verification operation on the user public key in the verification header using each other root public key that has not failed in turn.

[0117] The computer program is specifically further executed by the processor to perform the following steps: determining the current image verification data according to the hash value of each start-up image and the user private key; performing a signature operation on the hash value of the user public key using the root private key corresponding to the predetermined administrator to obtain user public key verification data; storing the current image verification data, the user public key verification data, the user public key corresponding to the user private key, and the trust root in the verification header of the verification data image, and adding the stored verification data image to the image package.

[0118] When the computer program is executed by the processor to determine the current image verification data according to the hash values of the respective startup images and the user private key, the processor specifically executes the following steps: obtaining the hash values of the respective startup images, and collecting all the hash values into a verification data image; performing calculation on the collected verification data image to obtain a first hash value of the verification data image; performing a signature operation on the first hash value using the user private key; and generating the current image verification data according to the first hash value and the signature corresponding to the signature operation.

[0119] The verification data image further includes the serial number of the root key to be invalidated. When the computer program is executed by the processor to determine that the startup image of the system-level chip passes the verification, the processor further executes the following steps: obtaining the serial number of the root key to be invalidated from the verification data image; determining whether the root key to be invalidated is in an invalid state in the invalidation table burned in the system-level chip; and in the case of not being in the invalid state, modifying the bit at the corresponding position of the serial number of the root key to be invalidated in the invalidation table.

[0120] When the computer program is executed by the processor to determine whether the root key to be invalidated is in an invalid state in the invalidation table burned in the system-level chip, the processor specifically executes the following steps: determining whether the serial number of the root key to be invalidated is the same as the serial number of the root key used by the image package that has passed the verification; and in the case of different serial numbers, determining whether the root key to be invalidated is in an invalid state in the invalidation table burned in the system-level chip.

[0121] The verification data image and other startup images are burned in the memory of the system-level chip, the verification data image includes a collection of hash values of the other startup images and a verification header, the verification header stores the current image verification data, the user public key verification data, the user public key, and the trust root for verification, in the image package verification process, the integrity of each startup image is verified by the hash values of the other startup images saved in the verification data image, the integrity of the verification data image is verified by the current image verification data and the user public key in the verification header, and the user public key data and the trust root in the verification header and the trust root saved in the one-time editable memory of the system-level chip are verified, which ensures the legality of the verification header data, and then ensures the absolute safety and legality of the system-level chip for the entire verification process of the startup image package, the entire verification process is simple and easy to operate, any administrator can sign the startup image to make the startup image pass the security verification of the chip, once the key of an administrator is leaked, other administrators can be used to sign to realize the verification process, and the risk problem in the chip verification process is solved.

[0122] Optionally, in the embodiment, the computer program product can include, but is not limited to, a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes. Optionally, in the embodiment, the processor executes the method steps recorded in the above embodiments according to the program codes stored in the computer program product. Optionally, the specific examples in the embodiment can refer to the examples described in the above embodiments and optional implementation manners, which will not be described here. Obviously, those skilled in the art should understand that the modules or steps of the present application can be realized by a general computing device, which can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. Optionally, they can be realized by program codes executable by a computing device, so that they can be stored in a storage device and executed by a computing device, and in some cases, the steps shown or described can be executed in a different order, or they can be manufactured into individual integrated circuit modules, or multiple modules or steps can be manufactured into a single integrated circuit module. Thus, the present application is not limited to any specific hardware and software combination.

[0123] The fourth embodiment of the present application provides an electronic device, a structural schematic diagram of which can be as shown in Figure 8 The electronic device at least includes a memory 901 and a processor 902, the memory 901 stores a computer program, and the processor 902 implements the system-level chip verification method provided by any embodiment of the present application when executing the computer program on the memory 901. Illustratively, a one-time programmable memory of the system-level chip is burned with a root of trust, wherein the root of trust includes each root public key in a plurality of root keys, and each root public key is arranged in a predetermined order; the computer program steps of the computer device are as follows S21 to S27:

[0124] S21, in response to a start operation of the system-level chip, loading a start image and a verification data image signed by a predetermined administrator corresponding root private key, wherein the verification data image includes a verification header, and the verification header includes: current image verification data, user public key verification data, a user public key, and a root of trust;

[0125] S22, calculating a hash value of each start image, and performing a matching operation on the obtained hash value of each start image and the hash value of each start image saved in the verification data image to obtain a first result value;

[0126] S23, calculating a hash value of the verification data image, and performing a signature verification operation on the hash value of the verification data image using the user public key in the verification header to obtain a second result value;

[0127] S24, verifying the user public key check data in the verification header using the root public key corresponding to the trust root in the verification header to obtain a third result value;

[0128] S25, matching the trust root in the verification header with the trust root burned in the system chip to obtain a fourth result value;

[0129] S26, detecting whether all result values are in a check pass state, wherein the all result values include the first result value, the second result value, the third result value and the fourth result value, and the check pass state includes a complete match state and a signature success state;

[0130] S27, determining that the start image of the system chip passes the check in a case where all results are in the check pass state.

[0131] When the processor executes the computer program stored in the memory for verifying the user public key check data in the verification header using the root public key corresponding to the trust root in the verification header to obtain a third result value, the computer program is specifically executed as follows: the trust root in the verification header is parsed to obtain a plurality of root public keys; each root public key is used in turn to verify the user public key check data in the verification header to obtain a plurality of signature states; and the third result value is determined according to the plurality of signature states, wherein the signature state includes a signature failure state and a signature success state.

[0132] The system chip also has a failure table burned therein, and the failure table indicates a failure state through a bit; when the processor executes the computer program stored in the memory for verifying the user public key in the verification header using each root public key in turn to obtain a plurality of signature states, the computer program is specifically executed as follows: the failure table in the system chip is read to determine the root public keys that have failed; and the user public key in the verification header is verified using each other root public key that has not failed.

[0133] The processor specifically further executes the computer program as follows: current image check data is determined according to the hash value of each start image and the user private key; the hash value of the user public key is signed using the root private key corresponding to the predetermined administrator to obtain user public key check data; the current image check data, the user public key check data, the user public key corresponding to the user private key and the trust root are stored in the verification header of the check data image, and the check data image after storage is added to the image package.

[0134] The processor, when executing the computer program stored in the memory for determining the current image verification data according to the hash values of the respective startup images and the user private key, specifically executes the following computer program: obtaining the hash values of the respective startup images, and collecting all the hash values into a verification data image; performing calculation on the collected verification data image to obtain a first hash value of the verification data image; performing a signature operation on the first hash value using the user private key; and generating the current image verification data according to the first hash value and the signature corresponding to the signature operation.

[0135] The verification data image further includes the serial number of the root key to be invalidated. After executing the computer program stored in the memory for determining that the startup image of the system-level chip passes the verification, the processor further executes the following computer program: obtaining the serial number of the root key to be invalidated from the verification data image; determining whether the root key to be invalidated is in the invalidation state in the invalidation table burned in the system-level chip; and modifying the bit at the corresponding position of the serial number of the root key to be invalidated in the invalidation table in the case of not being in the invalidation state.

[0136] The processor, when executing the computer program stored in the memory for determining whether the root key to be invalidated is in the invalidation state in the invalidation table burned in the system-level chip, specifically executes the following computer program: determining whether the serial number of the root key to be invalidated is the same as the serial number of the root key used by the image package that has passed the verification; and determining whether the root key to be invalidated is in the invalidation state in the invalidation table burned in the system-level chip in the case of different serial numbers.

[0137] The verification data image and other startup images are burned in the memory of the system-level chip, the verification data image includes a collection of hash values of the other startup images and a verification header, the verification header stores the current image verification data, the user public key verification data, the user public key, and the trust root for verification, in the image package verification process, the integrity of the respective startup images is verified by the hash values of the other startup images saved in the verification data image, the integrity of the verification data image is verified by the current image verification data and the user public key in the verification header, and the user public key data and the trust root in the verification header and the trust root saved in the one-time editable memory of the system-level chip are verified, which ensures the legality of the verification header data, and then ensures the absolute safety and legality of the system-level chip for the entire verification process of the startup image package, the entire verification process is simple and easy to operate, any administrator can sign the startup image to make the startup image pass the security verification of the chip, once the key of an administrator is leaked, other administrators can be used to sign to realize the verification process, and the risk problem in the chip verification process is solved.

[0138] Furthermore, although example embodiments have been described herein, the scope of coverage of this patent will include any and all embodiments having equivalent elements, modifications, omissions, combinations (e.g., of the various embodiments

[0139] The foregoing description is intended primarily for normally skilled readers in the art and should not be interpreted to limit the scope of the claims. For example, the above examples (or one or more aspects thereof) can be used in combination with each other. For example, other embodiments can be used by one of ordinary skill in the art upon reading the foregoing description. Also, in the specific description of the embodiments above, various features can be grouped together in one or more embodiments. This should not be interpreted as an intention that any claim requires features from one embodiment to be present in any other claim. Rather, inventive subject matter can be claimed in less than all embodiments having there features. Accordingly, the claims as follows are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment, and it is made expressly clear that such embodiments can be combined with each other in various combinations or permutations. The scope of the application should be determined by reference to the appended claims and their full scope of equivalents.

[0140] The above detailed description has shown, described, and pointed out the various embodiments of the application. Based upon the teachings provided herein, changes in form and detail of the described embodiments can be made without departing from the spirit and scope of the application. Therefore, the foregoing description is to be considered exemplary, rather than limiting, of the scope of the application as conveyed by the patent claims appended hereto.

Claims

1. A method for verifying a startup image of a system-on-chip, characterized in that: A root of trust is burned into a one-time editable memory of the system-on-chip, wherein the root of trust includes each root public key of a plurality of root keys, and each of the root public keys is arranged in a predetermined order; The verification method includes: In response to a startup operation of the system-on-chip, loading a startup image and a verification data image signed by a predetermined administrator's corresponding root private key, wherein the verification data image includes a verification header, and the verification header includes: current image verification data, user public key verification data, user public key, and a trusted root; Calculating a hash value of each boot image, and matching the obtained hash value of each boot image with the hash value of each boot image stored in the verification data image to obtain a first result value; Calculating a hash value of the verification data image, and performing a signature verification operation on the hash value of the verification data image using the user public key in the verification header to obtain a second result value; Performing a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the trust root in the verification header to obtain a third result value; Matching the root of trust in the check header with the root of trust programmed in the system-on-chip to obtain a fourth result value; Check whether all result values ​​are in the verification pass state, where all result values ​​include: first result value, second result value, third result value, and fourth result value, and the verification pass state includes: complete match state and signature verification success state; If all the results are in the verification pass state, it is determined that the startup image verification of the system-level chip has passed; wherein, The performing a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the trust root in the verification header to obtain a third result value includes: Parsing the trust root in the verification header to obtain multiple root public keys; Using each root public key in turn to perform a signature verification operation on the user public key verification data in the verification header to obtain multiple signature verification states; Determining a third result value according to the plurality of signature verification states, wherein the signature verification states include: a signature verification failure state and a signature verification success state; The system-level chip is also burned with a failure table, and the failure table indicates the failure status through bits; The user public key verification data in the verification header is sequentially verified using each root public key to obtain multiple verification states, including: Reading the revocation table in the system-on-chip to determine the revoked root public key; The signature of the user public key verification data in the verification header is verified using other root public keys that have not expired in turn.

2. The method according to claim 1, wherein The method further comprises: Determine the current image verification data according to the hash value of each startup image and the user private key; Use the root private key corresponding to the predetermined administrator to sign the hash value of the user public key to obtain the user public key verification data; The current image verification data, the user public key verification data, the user public key corresponding to the user private key, and the trust root are stored in the verification header of the verification data image, and the stored verification data image is added to the image package.

3. The method according to claim 2, wherein The determining the current image verification data according to the hash value of each of the startup images and the user private key includes: Obtaining hash values ​​of the respective boot images, and aggregating all the hash values ​​into the verification data image; Calculating the aggregated verification data image to obtain a first hash value of the verification data image; Performing a signing operation on the first Hash value using the user private key; The current image verification data is generated according to the first hash value and the signature corresponding to the signature operation.

4. The method according to any one of claims 1 to 3, characterized in that The verification data mirror also includes: the serial number of the root key to be invalidated; After determining that the boot image of the system-on-chip passes the verification, the method further includes: Obtaining the serial number of the root key to be invalidated from the verification data image; Determining whether the root key to be invalidated is in an invalid state in the invalidation table burned in the system-on-chip; In the case of not being in expired state, modify the bit of the serial number of the root key to be expired at the corresponding position in the expiration table.

5. The method according to claim 4, wherein The determining whether the root key to be invalidated is in an invalid state in the invalidation table burned in the system-on-chip includes: Determine whether the serial number of the root key to be invalidated is the same as the serial number of the root key used by the currently verified mirror package; In the case that the serial numbers are different, it is determined whether the root key to be invalidated is in an invalid state in the invalidation table burned in the system-on-chip.

6. A system-on-chip verification device for a startup image, characterized in that: A root of trust is burned into a one-time editable memory of the system-on-chip, wherein the root of trust includes each root public key of a plurality of root keys, and each of the root public keys is arranged in a predetermined order; The verification device comprises: a loading module, configured to load, in response to a startup operation of the system-on-chip, a startup image and a verification data image signed by a predetermined administrator's corresponding root private key, wherein the verification data image includes a verification header, and the verification header includes: current image verification data, user public key verification data, user public key, and a trusted root; a first result determination module, configured to calculate a hash value of each boot image, and match the obtained hash value of each boot image with the hash value of each boot image stored in the verification data image to obtain a first result value; a second result determination module, configured to calculate a hash value of the verification data image, and perform a signature verification operation on the hash value of the verification data image using the user public key in the verification header to obtain a second result value; a third result determination module, configured to perform a signature verification operation on the user public key verification data in the verification header using the root public key corresponding to the trust root in the verification header to obtain a third result value; a fourth result determination module, configured to match the root of trust in the check header with the root of trust programmed in the system-on-chip to obtain a fourth result value; A detection module, configured to detect whether all result values ​​are in a verification pass state, wherein all result values ​​include: a first result value, a second result value, a third result value, and a fourth result value, and the verification pass state includes: a complete match state and a signature verification success state; The result output module is used to determine that the startup image verification of the system-level chip has passed when all the results are in the verification pass state; wherein, The third result determination module is specifically configured to: parse the trust root in the verification header to obtain multiple root public keys; sequentially use each root public key to perform a signature verification operation on the user public key verification data in the verification header to obtain multiple signature verification states; and determine a third result value based on the multiple signature verification states, wherein the signature verification states include: a signature verification failure state and a signature verification success state; The system-level chip is also burned with a revocation table, which indicates the revocation status through bits; when the third result determination module uses each root public key in turn to verify the user public key verification data in the verification header to obtain multiple verification statuses, it is specifically used to: read the revocation table in the system-level chip to determine the expired root public key; and use other non-expired root public keys in turn to verify the user public key verification data in the verification header.

7. A chip storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

8. An electronic device comprising at least a memory and a processor, wherein the memory stores a computer program, wherein: The processor implements the steps of the method of any one of claims 1 to 5 when executing the computer program on the memory.

Images