Safe plug-in storage software upgrading method and system

Abstract

The invention belongs to the technical field of computers, and particularly relates to a safe plug-in storage software upgrading method and system.The to-be-upgraded software code is divided into a program starting area C1 and an application area C2, and a symmetric encryption algorithm is adopted to be matched with a secret key generated by a hardware random number generator to conduct two-layer encryption processing; and the information security of each link from the file preparation stage to the final deployment process is ensured. Meanwhile, a special area is arranged in the main control chip to store a decryption key, and the decryption key is protected by utilizing the read protection characteristic of the chip, so that illegal access is effectively prevented. By means of the innovative scheme, the overall safety of the software upgrading process is improved, operation simplicity and convenience and cost effectiveness are guaranteed, and a reliable data protection solution is provided for the fields of embedded systems and the like.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a safe external storage software upgrading method and system. Background Art

[0002] In modern electronic devices, software upgrades are an important means of keeping device functions updated and secure. Traditional software upgrade solutions usually adopt two methods: one is to store all codes and data inside the main control chip to improve security; the other is to expand the storage space through external storage chips to cope with the growing functional requirements and storage capacity limitations. However, with the increasing complexity of equipment and the improvement of flexibility requirements, more and more applications tend to use external storage chip solutions. Although this method solves the problem of insufficient storage space, it also introduces significant security risks. The solutions of the prior art are as follows:

[0003] Chip memory storage solution: This method stores all execution code and related data completely inside the main control chip. Since this data is not easily accessible from the outside, it has high security. However, as the functions of devices continue to increase, this solution faces the problem of tight memory resources, especially when frequent software updates are required, its limitations become more and more obvious.

[0004] External storage chip solution: In order to solve the above problems, the industry has begun to use external storage chips to store part or all of the software code, especially for new versions of firmware during software upgrades. This solution can provide larger storage space and is easy to implement. However, since external storage chips generally lack hardware-level encryption protection mechanisms, this makes it one of the main targets of attackers. Attackers can easily obtain sensitive information stored on external chips through physical contact, network packet capture, etc., resulting in serious consequences such as data leakage and application logic reverse engineering.

[0005] At present, the most prominent technical problem in the process of using external storage chips to achieve software upgrades is the lack of security in data transmission and storage. Specifically, existing solutions often rely on a single layer of encryption measures, which are not enough to resist complex attack methods. In addition, the management of keys is not strict enough and can be easily cracked by attackers, thus causing security vulnerabilities in the entire system. Summary of the invention

[0006] The purpose of the present invention is to provide a secure external storage software upgrade method and system, which not only improves the overall security of the software upgrade process, but also ensures ease of operation and cost-effectiveness, and provides a reliable data protection solution for embedded systems and other fields to solve the problems raised in the above background technology.

[0007] To achieve the above object, the present invention provides a safe external storage software upgrade method, comprising the following steps:

[0008] The software code to be upgraded is divided into a program startup area C1 and an application area C2, wherein the program startup area C1 contains a boot program, an encryption / decryption module, and a firmware upgrade logic;

[0009] Use a symmetric encryption algorithm combined with a key generated by a hardware random number generator to perform primary encryption on the program startup area C1 and the application area C2, generating the file C3 for factory burning and the preliminary upgrade file C3P;

[0010] Use another set of keys to perform secondary encryption on the preliminary upgrade file C3P, generate the final upgrade file, and transmit it to the target device;

[0011] The program startup area C1 area in the target device uses the preset key to decrypt and verify the received upgrade file. After ensuring the integrity and security of the file, the decrypted data is written to the application area C2 area to complete the upgrade.

[0012] Preferably, the use of a symmetric encryption algorithm in combination with a key generated by a hardware random number generator to perform primary encryption on the program startup area C1 and the application area C2 includes:

[0013] The first level encryption uses the TinyEncryptionAlgorithm algorithm, based on 32-bit blocks and 128-bit keys, and the key consists of four 32-bit integers.

[0014] Preferably, the secondary encryption of the preliminary upgrade file C3P using another set of keys includes:

[0015] Secondary encryption uses the same algorithm as primary encryption but is performed using a different key.

[0016] Preferably, the key is stored in a program startup area inside the chip, and the read protection feature of the chip is used to prevent external access.

[0017] Preferably, the program startup area C1 has a built-in encryption key for decrypting the externally stored upgrade firmware.

[0018] Preferably, it also includes:

[0019] An anti-tampering mechanism is implemented during the upgrade process, that is, the information of the entire file is verified after the update is completed to confirm that it has not been tampered with.

[0020] In another aspect, the present invention provides an external storage software upgrade system, comprising:

[0021] An external storage device, used for storing encrypted software upgrade files;

[0022] The main control chip has a program startup area C1 and an application area C2, wherein the program startup area C1 contains encryption / decryption functions and firmware upgrade logic;

[0023] The key management module is responsible for generating, storing and managing the keys required for encryption;

[0024] Communication interface, supporting wired or wireless data transmission.

[0025] Preferably, the main control chip also integrates a hardware encryption acceleration module to improve the speed and efficiency of the encryption and decryption process.

[0026] Preferably, the key management module uses a hardware random number generator to generate keys.

[0027] Preferably, it also includes: a host computer software tool for processing the process of preparing and encrypting software upgrade files and sending the upgrade files to the target device.

[0028] Technical effects and advantages of the present invention: Compared with the prior art, the present invention provides a safe external storage software upgrade method and system, which has the following advantages:

[0029] The present invention divides the software code to be upgraded into the program startup area C1 and the application area C2, and uses a symmetric encryption algorithm with the key generated by the hardware random number generator to perform two-layer encryption processing, thereby ensuring the information security of each link from the file preparation stage to the final deployment process. At the same time, by setting up a special area in the main control chip to store the decryption key and using the chip's own read protection characteristics to protect it, illegal access is effectively prevented. This innovative solution not only improves the overall security of the software upgrade process, but also ensures ease of operation and cost-effectiveness, providing a reliable data protection solution for embedded systems and other fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A flow chart of a secure external storage software upgrade method of the present invention;

[0031] Figure 2 A schematic diagram of the internal storage partition of the chip of the present invention;

[0032] Figure 3 Upgrade logic diagram for application area C2 of the present invention;

[0033] Figure 4 A specific logic diagram for first-layer encryption of the present invention;

[0034] Figure 5 Incorporating software views for the diagrams of the present invention;

[0035] Figure 6Generate a topology map for the burning and upgrading of the present invention;

[0036] Figure 7 The present invention is a framework diagram of an external storage software upgrade system. DETAILED DESCRIPTION

[0037] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. The specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0038] The present invention provides a secure external storage software upgrade method, the purpose of which is to solve the security risks in the existing external storage chip solution through symmetric encryption technology, multi-level encryption mechanism, and key management strategy. Under the premise of ensuring low cost, the information security in the software upgrade process is ensured, especially in the wired or wireless upgrade process, to prevent the leakage of key information through means such as packet capture, eavesdropping, reverse analysis, etc., and protect the system from malicious attacks.

[0039] like Figure 1 As shown, a secure plug-in storage software upgrade method in this embodiment includes the following steps:

[0040] Step 1: Divide the software code to be upgraded into a program startup area C1 and an application area C2, wherein the program startup area C1 includes a boot program, an encryption / decryption module, and a firmware upgrade logic;

[0041] Specifically, Figure 2 As shown, the software upgrade is divided into two parts, namely the program startup area C1 and the application area C2.

[0042] Application area C2 contains the business function code and upgrade function required for the final device to run (only responsible for writing the firmware upgrade data to the external storage). C2 external storage upgrade logic: wait for the event of firmware upgrade. Transfer and write the upgraded firmware to application area C2.

[0043] C2 upgrade logic is as follows Figure 3 As shown, including: start; initialization; waiting for upgrade;

[0044] Check whether the upgrade data has been received: If not, continue to wait for the upgrade. If received, proceed to the next step.

[0045] Write to off-chip flash memory (Flash);

[0046] The host computer sends an upgrade completion command: If the upgrade completion command is received, jump to the program startup area. If the upgrade completion command is not received, check whether the data packet reception is completed:

[0047] Jump to the program startup area.

[0048] Furthermore, the program startup area C1 is the first area executed after the device is powered on. The main function of C1 is to manage the boot process of the device and is responsible for some upgrade-related operations. The role and structure of C1 can be described as follows:

[0049] Built-in encryption keys:

[0050] The C1 area has an encryption key built into the code (that is, only the products that leave the factory will have it, and then using the chip read protection feature, this part of the program cannot be read even after leaving the factory), which is used to decrypt the upgraded firmware in external storage (such as the firmware loaded from the external storage device). In order to protect the security of the firmware, the upgraded firmware is encrypted and then stored in the external storage device.

[0051] C1 external storage upgrade logic:

[0052] C1 will check if there is a new firmware version available for upgrade. If a new firmware file is stored in an external storage device (such as Flash, SD card, eMMC, etc.), C1 will be responsible for: Reading the firmware file from the external storage. Decrypting the firmware file using the built-in key. Verifying the integrity and validity of the firmware (for example, data verification by complement checksum). Transferring and writing the upgraded firmware to the application area C2.

[0053] Data verification and integrity verification:

[0054] C1 is responsible for the integrity verification of the external storage and the firmware in the chip C2 area, through the complement checksum method. This step ensures that the firmware has not been damaged or tampered with.

[0055] Upgrade operation:

[0056] Decrypt upgrade firmware: Decrypt the upgrade firmware in the external storage using the key and encryption algorithm.

[0057] Data verification: Check the integrity of the firmware based on its complement checksum.

[0058] Update application area (C2): Update the decrypted and verified firmware to application area C2 to achieve product iteration.

[0059] The structure of the C1 file:

[0060] Bootloader: The initial code used to start the device. It is a small binary program that contains basic functions such as hardware initialization and memory mapping for simple upgrade requirements.

[0061] Encryption / decryption module: The code part used to decrypt the firmware file, relying on the built-in key for encryption and decryption.

[0062] Firmware upgrade logic: including external storage device access, file parsing, complement code checking and updating and other functional modules.

[0063] Upgrade firmware verification code: used to verify the firmware file to ensure that the data has not been tampered with.

[0064] Data Format:

[0065] The firmware file uses the .bin package file format.

[0066] The firmware verification information complement checksum is also stored with the firmware.

[0067] The logic of C1 upgrade function is as follows: upgrade initialization; determine whether the specific address value of RAM is legal;

[0068] Process 1: Check whether the app area code is consistent with the app verification area; determine whether the app verification area is legal; feedback whether the off-chip flash firmware is legal;

[0069] Process 2: The host computer sends an upgrade completion instruction;

[0070] Load the external flash code to the chip; write the app verification area; reply to the host computer; delete the specific address value of RAM; check whether the external flash firmware is legal; the host computer sends a restart command; load the external flash code to the chip, and check whether writing the app verification area is completed.

[0071] Step 2: Use a symmetric encryption algorithm combined with the key generated by the hardware random number generator to perform a first-level encryption on the program startup area C1 and the application area C2 to generate the file C3 for factory burning and the preliminary upgrade file C3P; further, the first-level encryption adopts the TinyEncryptionAlgorithm algorithm, based on a 32-bit block and a 128-bit key, and the key consists of four 32-bit integers.

[0072] Specifically, the multi-layer design of encryption strategy:

[0073] First layer of encryption: Use the merge software A to load the C1 and C2 burning files, and then use the Tiny Encryption Algorithm symmetric encryption algorithm based on 32-bit blocks and 128-bit key 1 (4 32-bit keys, key[0], key[1], key[2], key[3]). Encrypt to generate C3 and C3P files. The generated C3 is the factory burned file, ensuring that only properly authorized devices can decrypt the corresponding upgraded C3P. C3P is the first-level encrypted version, which serves as the preliminary upgrade file.

[0074] like Figure 7 As shown, the specific logic of the first layer of encryption is:

[0075] Add function description:

[0076] enter:

[0077] firstChunk and secondChunk are the data blocks to be encrypted, each block is 32 bits.

[0078] key is the encryption key, which contains 4 32-bit integers, a total of 128 bits.

[0079] Encryption process:

[0080] In the EncryptTEA function, firstChunk and secondChunk are first assigned to y and z.

[0081] sum is a variable used to accumulate the golden section number delta (0x9e3779b9).

[0082] delta is the constant Ox9e3779b9, which is added to sum in each round of encryption to prevent pattern attacks.

[0083] Each round of encryption uses operations such as addition, shift, and XOR, which are performed alternately with the four parts of the key (key[0] to key[3]).

[0084] Iterations:

[0085] The encryption process is performed 8 times in one loop, and the number of loops can be increased to improve the security of the encryption.

[0086] Feistel structure:

[0087] In each round, y and z are modified and finally saved back to the original firstChunk and secondChunk.

[0088] Output:

[0089] The encrypted result will be returned through a pointer, that is, the values ​​of firstChunk and secondChunk are modified.

[0090] like Figure 5 As shown, merge software A view: the BOOT file is used to load the corresponding C1 file, the App file is used to load the corresponding C2, and then the C3 and C3P files can be output.

[0091] Step 3: Use another set of keys to perform secondary encryption on the preliminary upgrade file C3P, generate the final upgrade file, and transmit it to the target device; specifically, the second layer of encryption: use the upgrade software B to load the corresponding C3P file, and then use the 128-bit key 2 and the symmetric encryption algorithm (the same as the merge software A) to perform secondary encryption before transmitting it to the product chip that needs to be upgraded.

[0092] Furthermore, the secondary encryption uses the same algorithm as the primary encryption, but is executed with a different key. In addition, the key is stored in the program startup area inside the chip, and the chip's read protection feature is used to prevent external access. The keys for all decryption operations are stored in the program startup area of ​​the chip, which is the first execution logic area of ​​the C3 file. The chip is burned during the factory burning stage, and the chip's read protection mechanism can prevent direct reading of memory from physical interfaces (such as JTAG, SWD, serial ports) by setting a higher protection level, so external attackers cannot extract or access these keys. Because C3P undergoes multiple layers of encryption, even if the external storage chip is physically extracted, the attacker cannot obtain a valid encryption key.

[0093] Hardware Random Number Generator (HRNG): Ensure that the random number generator has sufficient entropy to avoid security vulnerabilities that may be caused by using software random number generators. Hardware random number generators generally provide higher quality randomness and reduce the risk of keys being predicted.

[0094] Furthermore, the program startup area C1 has a built-in encryption key for decrypting the upgrade firmware stored externally.

[0095] Step 4: The program startup area C1 in the target device uses the preset key to decrypt and verify the received upgrade file. After ensuring the integrity and security of the file, the decrypted data is written to the application area C2 to complete the upgrade.

[0096] In addition, regarding key distribution: burn the key before the product leaves the factory, use different keys for different products, the number of encrypted keys and the number of TEA iterations (pre-configured keys). This practice is to write the key (whether it is a public key, a private key, or a symmetric key) directly into the hardware when the product is manufactured, or embed it in the device when the program starts, rather than dynamically distributing it over the network or other insecure channels. This can avoid various attacks that may be suffered when transmitting keys over the network, especially man-in-the-middle attacks (MITM).

[0097] like Figure 6 As shown, the factory burned C3 file includes two running worlds: the boot area (program startup area C1) and the app area (application area C2). The boot area has built-in key content, which is used for encryption and parsing to use external storage data to achieve secure upgrade of the app area.

[0098] The C2 file is used for subsequent product iterations and upgrades. It is generated by merging software A for first-level symmetric encryption and can be subsequently encrypted by upgrading software B for second-level symmetric encryption before being transmitted to the product for upgrading by wire or wireless (detailed descriptions are given in 3.2.1.2 Program Startup Area (C1)).

[0099] Upgrade process: During the chip upgrade process, the upgraded data is first placed in the external flash storage. After the upgrade is completed, the chip runs the boot to decrypt, verify and other operations. After the legality is detected, the external data is loaded into the app area.

[0100] In another embodiment, the step of implementing an anti-tampering mechanism during the upgrade process is also included, that is, verifying the information of the entire file after the update is completed to confirm that it has not been tampered with. In addition to basic encryption protection, the present invention also adds an anti-tampering mechanism during the upgrade process. That is, after the upgrade is completed, the information of the entire file is verified, such as the file size and file checksum. If the file is illegal, the illegal upgrade file will be invalidated, and the old firmware will still be used to run to prevent malicious attacks.

[0101] On the other hand, this embodiment also proposes a plug-in storage software upgrade system, such as Figure 7 As shown, including:

[0102] External storage device, used to store encrypted software upgrade files, ensuring that even if the external storage device is physically obtained, the firmware content cannot be directly read or tampered with

[0103] The main control chip is the control center of the entire system. It contains two main areas: the program startup area (C1) and the application area (C2). The program startup area (C1) is responsible for the initialization boot process of the device, and has an embedded encryption / decryption function module and firmware upgrade logic to ensure that the firmware in the external storage can be safely loaded and verified when the device starts. In order to improve performance, the main control chip also integrates a hardware encryption acceleration module, which helps to speed up encryption and decryption, while reducing power consumption and improving efficiency.

[0104] The key management module is one of the core parts of system security. It is not only responsible for generating, storing and managing keys for encryption operations, but also uses a hardware random number generator to create high-entropy keys. This approach can effectively prevent security risks caused by pseudo-random numbers generated by software, thereby providing a more powerful protection mechanism. In addition, all keys required for decryption operations are securely stored in a specific area inside the main control chip and are protected by chip-level read protection measures, making it difficult for external attackers to access these critical information.

[0105] The communication interface supports a variety of data transmission methods, including but not limited to wired connection methods such as USB, UART, SPI, I2C, and wireless communication protocols such as Wi-Fi and Bluetooth. This provides flexible and diverse upgrade paths for different types of devices, while also ensuring stable and reliable firmware updates in various network environments.

[0106] The host software tool, as the user interface and control platform, is responsible for preparing, encrypting and sending upgrade files. It allows users to easily select the target device to be upgraded through a graphical interface, and automatically completes the entire upgrade process according to the set parameters. More importantly, it can perform preliminary security checks locally, such as verifying file integrity and confirming version compatibility, to ensure that only correct upgrade packages are sent to the target device.

[0107] Through the coordinated work of the above components, the plug-in storage software upgrade system provided in this embodiment achieves the following significant technical effects:

[0108] Enhanced security: Multi-level encryption technology and a strict key management system are used to eliminate the possibility of unauthorized access at the source; even if the external storage device is stolen or maliciously analyzed, the content on it cannot be decrypted due to the lack of a valid decryption key.

[0109] Efficiency: The built-in hardware encryption acceleration module greatly improves the encryption and decryption speed, reduces waiting time, and improves user experience. At the same time, the optimized algorithm design reduces resource usage and ensures smooth system operation.

[0110] Flexibility and compatibility: It widely supports multiple data transmission standards and is suitable for embedded systems and smart terminals of different architectures. It not only meets the needs of diverse application scenarios, but also is easy to integrate into existing product lines.

[0111] In summary, the plug-in storage software upgrade system proposed in the present invention provides an innovative solution for the security maintenance of modern electronic devices. While ensuring information security, it also brings users a more convenient and efficient usage experience.

[0112] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A safe external storage software upgrade method, characterized in that: The following steps are involved: The software code to be upgraded is divided into a program startup area C1 and an application area C2, wherein the program startup area C1 contains a boot program, an encryption / decryption module, and a firmware upgrade logic; Use a symmetric encryption algorithm combined with a key generated by a hardware random number generator to perform primary encryption on the program startup area C1 and the application area C2, generating the file C3 for factory burning and the preliminary upgrade file C3P; Use another set of keys to perform secondary encryption on the preliminary upgrade file C3P, generate the final upgrade file, and transmit it to the target device; The program startup area C1 area in the target device uses the preset key to decrypt and verify the received upgrade file. After ensuring the integrity and security of the file, the decrypted data is written to the application area C2 area to complete the upgrade.

2. A safe plug-in storage software upgrade method according to claim 1, characterized in that: The method of using a symmetric encryption algorithm in combination with a key generated by a hardware random number generator to perform primary encryption on the program startup area C1 and the application area C2 includes: The first level encryption uses the TinyEncryptionAlgorithm algorithm, based on 32-bit blocks and 128-bit keys, and the key consists of four 32-bit integers.

3. A safe plug-in storage software upgrade method according to claim 2, characterized in that: The secondary encryption of the preliminary upgrade file C3P using another set of keys includes: Secondary encryption uses the same algorithm as primary encryption but is performed using a different key.

4. A safe plug-in storage software upgrade method according to claim 3, characterized in that: The key is stored in a program startup area inside the chip, and the read protection feature of the chip is used to prevent external access.

5. A safe plug-in storage software upgrade method according to claim 4, characterized in that: The program startup area C1 has a built-in encryption key for decrypting the upgrade firmware in external storage.

6. A safe plug-in storage software upgrade method according to claim 1, characterized in that: Also includes: An anti-tampering mechanism is implemented during the upgrade process, that is, the information of the entire file is verified after the update is completed to confirm that it has not been tampered with.

7. A plug-in storage software upgrade system for implementing the method described in any one of claims 1 to 6, characterized in that: include: An external storage device, used for storing encrypted software upgrade files; The main control chip has a program startup area C1 and an application area C2, wherein the program startup area C1 contains encryption / decryption functions and firmware upgrade logic; The key management module is responsible for generating, storing and managing the keys required for encryption; Communication interface, supporting wired or wireless data transmission.

8. The system according to claim 7, characterized in that The main control chip also integrates a hardware encryption acceleration module to improve the speed and efficiency of the encryption and decryption process.

9. The system according to claim 7, characterized in that The key management module uses a hardware random number generator to generate keys.

10. The system according to claim 7, characterized in that Also includes: The host computer software tool is used to handle the process of preparing and encrypting software upgrade files and sending the upgrade files to the target device.

Images