Control device, trust chain and control method

Abstract

The invention provides a control device, a trust chain and a control method. The control device comprises a first memory, a second memory, a processing circuit and an input / output interface, the first memory stores a secure boot program. The second memory stores a first specified program. The processing circuit executes the secure boot program for performing a first legality check on the first specified program. When the first specified program passes the first validity check, the processing circuit executes the first specified program to generate a check signal. The input / output interface is used for outputting the test signal to an external device and receiving a reply signal generated by the external device. The processing circuit performs a second legality test on the reply signal. When the reply signal does not pass the second validity check, the processing circuit ignores the requirement of the external device.

Description

Technical Field

[0001] The present invention relates to a control device, and more particularly to a control device having firmware for verifying itself and firmware for an external device. Background Art

[0002] With the advancement of technology, the concept of everything being connected to the Internet has gradually been realized in daily life. For example, users can remotely control home electrical devices through a smartphone. However, if someone injects abnormal software into the user's home electrical devices, it may leak the user's personal information and cause risks in the use of electrical devices. Summary of the invention

[0003] One embodiment of the present invention provides a control device, including a first memory, a second memory, a processing circuit and an input-output interface. The first memory stores a secure boot program. The second memory stores a first designated program. The processing circuit executes the secure boot program to perform a first legitimacy check on the first designated program. When the first designated program passes the first legitimacy check, the processing circuit executes the first designated program to generate a check signal. The input-output interface is used to output the check signal to an external device and receive a reply signal generated by the external device. The processing circuit performs a second legitimacy check on the reply signal. When the reply signal fails the second legitimacy check, the processing circuit ignores the request of the external device.

[0004] The present invention further provides a trust chain, including a root device and a first device. The root device includes a first memory, a second memory, a processing circuit and a first input-output interface. The first memory stores a secure boot program. The second memory stores a first designated program. The root processing circuit executes the secure boot program to perform a first legitimacy check on the first designated program. When the first designated program passes the first legitimacy check, the root processing circuit executes the first designated program to generate a first check signal. The first input-output interface is used to output the first check signal and receive a first reply signal. The first device includes a second input-output interface, a third memory and a first processing circuit. The second input-output interface is used to receive the first check signal and output the first reply signal. The third memory stores a second designated program. The first processing circuit reads the third memory according to the first check signal to generate a first reply signal. The root processing circuit performs a second legitimacy check on the first reply signal. When the first reply signal fails the second legitimacy check, the root processing circuit ignores the request of the first device.

[0005] The present invention further provides a control method applicable to a trust chain. The trust chain includes at least one root device and a first device. The root device includes a one-time programmable memory and an erasable programmable memory. The one-time programmable memory stores a secure boot program. The erasable programmable memory stores a first designated program. The control method of the present invention includes executing a secure boot program to determine whether the first designated program passes a first legitimacy check; when the first designated program passes the first legitimacy check, executing the first designated program to generate a first check signal; providing the first check signal to the first device, wherein the first device generates a first reply signal based on the first check signal; determining whether the first reply signal passes a second legitimacy check; when the first reply signal passes the second legitimacy check, commanding the root device to allow the request of the first device.

[0006] The control method of the present invention can be implemented through the trust chain and control device of the present invention, which is hardware or firmware that can execute the specified function, or can be recorded in a recording medium in the form of program code and implemented in combination with specified hardware. When the program code is loaded and executed by an electronic device, processor, computer or machine, the electronic device, processor, computer or machine becomes a trust chain and control device for implementing the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1A Schematic diagram of the trust chain of the present invention.

[0008] Figure 1B Another schematic diagram of the trust chain of the present invention.

[0009] Figure 2 Schematic diagram of the device of the present invention.

[0010] Figure 3 Another schematic diagram of the device of the present invention.

[0011] Figure 4 It is a flow chart of the control method of the present invention.

[0012] Reference numerals:

[0013] 100: Chain of Trust

[0014] 110, 120, 130, 140, 150, 160, 170: Device

[0015] 111, 112, 121, 131: Memory

[0016] BL1: Secure Boot Procedure

[0017] KY1~KY3:Key

[0018] BL2~BL4:Specified program

[0019] SIG1~SIG3: signature

[0020] 113, 123: Processing circuit

[0021] 114, 122, 124: Input and output interfaces

[0022] 115: Notification circuit

[0023] 116: Password generation circuit

[0024] 117: Networking Circuit

[0025] SCD: Connection password

[0026] SV1, SV2: test signal

[0027] SR1, SR2: Reply signal

[0028] S411~S419: Steps DETAILED DESCRIPTION

[0029] In order to make the purpose, features and advantages of the present invention more clearly understood, the following embodiments are specifically cited and described in detail with reference to the accompanying drawings. The present invention specification provides different embodiments to illustrate the technical features of different implementations of the present invention. Among them, the configuration of each element in the embodiment is for illustrative purposes and is not intended to limit the present invention. In addition, some of the figure numbers in the embodiments are repeated for the purpose of simplifying the description and do not mean the correlation between different embodiments.

[0030] Figure 1A FIG. 1 is a schematic diagram of the trust chain of the present invention. Figure 1A As shown, the trust chain 100 includes devices 110 and 120. Device 110 is located at the top of the trust chain 100, so it can be called a root device. In this embodiment, device 110 includes at least memories 111 and 112. Memory 111 stores at least a secure bootloader BL1. In a possible embodiment, memory 111 further stores a key KY1, but this is not intended to limit the present invention. In some embodiments, key KY1 is stored in another independent memory other than memory 111.

[0031] The present invention does not limit the type of the memory 111. In one possible embodiment, the memory 111 is a non-volatile memory (NVM). In some embodiments, the secure boot program BL1 is stored in the memory 111 when the memory 111 is shipped from the factory. In this example, the secure boot program BL1 cannot be cleared or re-burned. In one possible embodiment, the memory 111 is a one-time programmable (OTP) memory, a mask memory (MarkRom) or a programmable red-only memory (PROM).

[0032] The memory 112 stores at least one designated program BL2. In another possible example, the memory 112 further stores firmware required for the normal operation of the device 110. The present invention does not limit the type of the memory 112. In a possible embodiment, the memory 112 is a non-volatile memory. For example, the memory 112 may be an erasable programmable read only memory (EPROM), an electrically erasable programmable read-only memory (EPROM), or a flash memory.

[0033] After the trust chain 100 is powered on, the device 110 executes the secure boot program BL1 to verify the legitimacy of the designated program BL2. In one possible embodiment, the device 110 performs a first legitimacy check on the designated program BL2 to determine whether the designated program BL2 has been tampered with. When the designated program BL2 passes the first legitimacy check, it indicates that the designated program BL2 has not been tampered with. Therefore, the device 110 loads and executes the designated program BL2. After loading the designated program BL2, the device 110 operates normally. However, when the designated program BL2 fails to pass the first legitimacy check, it indicates that the designated program BL2 has been tampered with. Therefore, the device 110 does not load the designated program BL2. In one possible embodiment, the device 110 may issue a warning message, such as a sound message or an image message.

[0034] The present invention does not limit how the device 110 determines whether the designated program BL2 has been tampered with. In one possible embodiment, the device 110 uses the key KY1 to decrypt a signature SIG1 stored in the memory 112 to generate a first hash value. The device 110 uses a first hash algorithm to process the designated program BL2 to generate a second hash value. When the first hash value is equal to the second hash value, it indicates that the designated program BL2 passes the first legitimacy check. Therefore, the device 110 loads and executes the designated program BL2.

[0035] The present invention does not limit the source of the signature SIG1. In one possible embodiment, a first operation circuit (not shown) uses the same first hash algorithm to process the designated program BL2 to generate a first designated hash value, and uses a first private key to encrypt the first designated hash value to generate the signature SIG1. The first operation circuit then stores the signature SIG1 in the memory 112. In one possible embodiment, the first operation circuit may be integrated into the device 110, or may be independent of the device 110.

[0036] In other embodiments, the device 110 further verifies whether the device 120 is a legitimate device. When the device 110 loads and executes the designated program BL2, the device 110 requires the device 120 to provide relevant information of the internal firmware. When the device 110 does not receive the information provided by the device 120 within a preset time, the device 110 regards the device 120 as an illegal device and refuses to communicate with the device 120. In another possible embodiment, when the information provided by the device 120 does not pass the legitimacy check, the device 110 ignores the signal from the device 120.

[0037] In one possible embodiment, the device 120 includes a memory 121. The memory 121 stores at least a specified program BL3. In other embodiments, the memory 121 further stores firmware required for the normal operation of the device 120. Since the characteristics of the memory 121 are the same as those of the memory 112, they will not be described in detail.

[0038] Device 110 determines whether the designated program BL3 has been tampered with based on the information provided by device 120. When the designated program BL3 has not been tampered with, it indicates that device 120 is a legitimate device. Therefore, device 110 accepts the access request of device 120. However, when the designated program BL3 has been tampered with, it indicates that device 120 is not a legitimate device. Therefore, device 110 rejects the access request of device 120.

[0039] The present invention does not limit how the device 110 determines whether the designated program BL3 has been tampered with. In one possible embodiment, the memory 112 further stores a key KY2. The key KY2 is used to verify the designated program BL3. In this example, the device 110 uses the key KY2 to decrypt a signature SIG2 stored in the memory 121 to generate a third hash value. The device 110 uses a second hash algorithm to process the designated program BL3 to generate a fourth hash value. When the third hash value is equal to the fourth hash value, it indicates that the designated program BL3 has passed a second legitimacy check. At this time, since the designated program BL3 has not been tampered with, the device 110 regards the device 120 as a legitimate device and accepts the access request of the device 120.

[0040] However, when the third hash value is not equal to the fourth hash value, it indicates that the designated program BL3 has been tampered with. Therefore, the device 110 refuses to communicate with the device 120. In one possible embodiment, the device 110 may issue a warning message, such as a sound message or an image message. In another possible embodiment, the device 110 updates the designated program BL3. At this time, the device 110 may provide an initial program to replace the tampered designated program BL3.

[0041] The present invention does not limit the source of the signature SIG2. In one possible embodiment, a second operation circuit (not shown) uses the same second hash algorithm to process the designated program BL3 to generate a second designated hash value, and uses a second private key (such as KY3) to encrypt the second designated hash value to generate the signature SIG2. The second operation circuit then stores the signature SIG2 in the memory 121. In one possible embodiment, the second operation circuit may be integrated into the device 120, or may be independent of the device 120.

[0042] When the designated program BL3 passes the second legitimacy check, the device 120 loads and executes the designated program BL3. The present invention does not limit the number of devices 120. In other embodiments, the device 110 is coupled to more devices 120. In this example, each time a device 120 is connected to the device 110, the device 110 first verifies whether the corresponding device 120 is a legal device. Only when the designated program in the device 120 passes the legitimacy check, the corresponding device 120 has the authority to access the device 110. In addition, the present invention does not limit the communication protocol between the devices 110 and 120. The device 110 may communicate with the device 120 using a wired method or a wireless method.

[0043] In some embodiments, the trust chain 100 further includes a device 130. The device 130 includes a memory 131. The memory 131 stores at least a specified program BL4. In another possible example, the memory 131 further stores firmware required for the normal operation of the device 130. Since the characteristics of the memory 131 are the same as those of the memory 112, they are not described in detail.

[0044] In this embodiment, device 120 verifies whether device 130 is a legitimate device. When device 120 loads and executes designated program BL3, device 120 requires device 130 to provide relevant information of the internal firmware. Device 120 determines whether designated program BL4 has been tampered with based on the information provided by device 130. When designated program BL4 has not been tampered with, it indicates that device 130 is a legitimate device. Therefore, device 120 accepts the access request of device 130. However, when designated program BL4 has been tampered with, it indicates that device 130 is not a legitimate device. Therefore, device 120 rejects the access request of device 130. In some embodiments, when device 120 does not receive the information provided by device 130 within a preset time, device 120 regards device 130 as an illegal device and ignores the signal or request from device 130.

[0045] The present invention does not limit how the device 120 determines whether the designated program BL4 has been tampered with. In one possible embodiment, the memory 121 further stores a key KY3. The key KY3 is used to verify the designated program BL4. In this example, the device 120 uses the key KY3 to decrypt a signature SIG3 stored in the memory 131 to generate a fifth hash value. The device 120 uses a third hash algorithm to process the designated program BL4 to generate a sixth hash value. When the fifth hash value is equal to the sixth hash value, it indicates that the designated program BL4 has passed a third legitimacy check. At this time, since the designated program BL4 has not been tampered with, the device 120 regards the device 130 as a legitimate device and accepts the access request of the device 130.

[0046] However, when the fifth hash value is not equal to the sixth hash value, it indicates that the designated program BL4 has been tampered with. Therefore, the device 120 rejects the request from the device 130. In one possible embodiment, the device 120 reports to the device 110. At this time, the device 110 may issue a warning message, such as a sound message or an image message. In another possible embodiment, the device 110 provides an initial program to the device 130 through the device 120 to update the designated program BL4.

[0047] The present invention does not limit the source of the signature SIG3. In one possible embodiment, a third operation circuit (not shown) uses the same third hash algorithm to process the designated program BL4 to generate a third designated hash value, and uses a third private key to encrypt the third designated hash value to generate the signature SIG3. The third operation circuit then stores the signature SIG3 in the memory 131. In one possible embodiment, the third operation circuit may be integrated into the device 130, or may be independent of the device 130.

[0048] The present invention does not limit the number of devices 130. In other embodiments, device 120 is coupled to more devices 130. In this example, each time a device 130 is connected to 120, device 120 first verifies whether the designated program BL4 of the corresponding device 130 has been tampered with. Only when the designated program BL4 of device 130 passes the legality check, device 130 has the authority to access device 120. In addition, the present invention does not limit the communication protocol between devices 120 and 130. Device 120 may communicate with device 130 using a wired method or a wireless method.

[0049] The present invention does not limit the types of devices 110, 120, and 130. In one possible embodiment, devices 110, 120, and 130 are all Internet of Things (IoT) devices. For example, device 110 is a wireless base station (WiFi hotspot). In this example, device 120 may be a hub, and device 130 may be a home appliance, such as a refrigerator, a television, an air conditioner, etc. Device 110 provides networking services and can be connected to the Internet. When device 120 is connected to device 110, it can be connected to the Internet through device 110.

[0050] In this embodiment, the device 110 executes its own secure boot program BL1 to verify the designated program BL2. If the designated program BL2 passes the verification, the device 110 executes the designated program BL2. When executing the designated program BL2, the device 110 verifies the device 120. The device 110 may require the device 120 to provide relevant information about the internal firmware. If the designated program BL3 of the device 120 is tampered with, the device 110 ignores the connection request from the device 120. However, if the designated program BL3 is not tampered with, the device 110 allows the connection request of the device 120. At this time, the device 120 executes the designated program BL3.

[0051] When executing the designated program BL3, if the device 130 wants to connect to the device 120, the device 120 first verifies the device 130. At this time, the device 120 may require the device 130 to provide relevant information about the internal firmware. If the designated program BL4 of the device 130 fails to pass the legality check, the device 120 may ignore the connection request from the device 130. However, if the designated program BL4 passes the legality check, the device 120 allows the connection request of the device 130.

[0052] In other embodiments, when a device fails to pass the verification, the upper layer device does not provide a connection password to the device, so the device cannot connect to the Internet. Taking device 120 as an example, when device 120 passes the verification, device 110 provides a connection password to device 120. When device 120 fails to pass the verification, device 110 does not provide a connection password to device 120, so device 120 cannot connect to the Internet through device 110. In a possible embodiment, device 110 sets a different connection password each time it is powered on.

[0053] In this embodiment, since the secure boot program BL1 is stored in a memory that cannot be repeatedly erased and written, the risk of the secure boot program BL1 can be greatly reduced, and the secure boot program BL1 can be ensured to be trustworthy. As long as the legitimacy check of the secure boot program BL1 can be passed, it means that the corresponding designated program (such as BL2) is also trustworthy. Therefore, the designated program BL2 does not need to be stored in a designated memory (such as MKROM), so the component cost can be reduced.

[0054] Figure 1B Another schematic diagram of the trust chain of the present invention. Figure 1B resemblance Figure 1A , except that the trust chain 100 further includes devices 140, 150, 160 and 170. Device 110 verifies whether the firmware inside devices 120 and 150 has been tampered with. When the firmware of device 120 or 150 has been tampered with, device 110 disconnects the corresponding device. In a possible embodiment, when device 110 finds that the firmware of device 120 or 150 has been tampered with, device 110 issues a warning message to notify the user.

[0055] In this embodiment, the device 120 verifies whether the firmware inside the devices 130 and 140 has been tampered with. When the firmware of the devices 130 and 140 has been tampered with, the device 120 disconnects the corresponding devices. In one possible embodiment, the device 120 reports the tampering event to the device 110. In another possible embodiment, the device 120 updates the firmware of the tampered device. The device 120 may initialize the tampered device to restore the firmware of the device to an initial state.

[0056] For example, when the device 130 is coupled to the device 120, the device 120 sends a check signal (or second check signal) to verify whether the device 130 is a legitimate device. In this example, the device 130 provides a second reply signal according to the second check signal. The device 120 performs a third legitimacy check on the second reply signal. When the second reply signal passes the third legitimacy check, the device 120 accepts the request of the device 130. When the second reply signal does not pass the third legitimacy check, the device 120 rejects the request of the device 130.

[0057] Similarly, when the device 140 is coupled to the device 120, the device 120 sends a check signal (or a third check signal) to verify whether the device 140 is a legitimate device. In this example, the device 140 provides a third reply signal according to the third check signal. The device 120 performs a fourth legitimacy check on the third reply signal. When the third reply signal passes the fourth legitimacy check, the device 120 accepts the request of the device 140. When the third reply signal does not pass the fourth legitimacy check, the device 120 rejects the request of the device 140.

[0058] Device 150 verifies whether the firmware inside devices 160 and 170 has been tampered with. Since the operation of device 150 is similar to that of device 120, it will not be described in detail. In this embodiment, devices 110-170 are connected wirelessly. When the firmware of a device is tampered with, the upper layer device disconnects the tampered device, thereby preventing abnormal software from invading the trust chain 100. Only devices that are verified to be legitimate can run on the trust chain 100, thereby ensuring the security of the trust chain.

[0059] Figure 2 Schematic diagram of the device 110 of the present invention. Figure 2 As shown, the device 110 (or control device) includes memories 111, 112 and a processing circuit 113. The memory 111 stores a secure boot program BL1 and a key KY1, but the present invention is not limited thereto. In some embodiments, the key KY1 is stored in another independent memory other than the memory 111.

[0060] The memory 112 stores the designated program BL2 and a key KY2, but this is not intended to limit the present invention. In other embodiments, the key KY2 is stored in another independent memory outside the memory 112. In some embodiments, the memory 112 further stores a signature SIG1.

[0061] The processing circuit 113 (or root processing circuit) executes the secure boot program BL1 to perform a first legitimacy check on the designated program BL2. When the designated program BL2 passes the first legitimacy check, the processing circuit 113 executes the designated program BL2 to generate a check signal SV1. The present invention does not limit the architecture of the processing circuit 113. In one possible embodiment, the processing circuit 113 is composed of a logic circuit. In other embodiments, the processing circuit 113 is a central processing unit (CPU).

[0062] The present invention does not limit how the processing circuit 113 verifies the designated program BL2. In one possible embodiment, the processing circuit 113 uses the key KY1 to decrypt the signature SIG1 to generate a first hash value. The processing circuit 113 processes the designated program BL2 to generate a second hash value. When the first hash value is not equal to the second hash value, it indicates that the designated program BL2 has not passed the first legitimacy check. Therefore, the processing circuit 113 does not load the designated program BL2. When the first hash value is equal to the second hash value, it indicates that the designated program BL2 has passed the first legitimacy check. Therefore, the processing circuit 113 loads the designated program BL2. In one possible embodiment, when the processing circuit 113 executes the designated program BL2, the processing circuit 113 generates a verification signal SV1.

[0063] In other embodiments, the device 110 further includes an input / output interface 114. The input / output interface 114 is used to output the test signal SV1 to the device 120 and receive a response signal SR1 generated by the device 120. The present invention does not limit the type of the input / output interface 114. In one possible embodiment, the input / output interface 114 has a wireless transceiver for transmitting the test signal SV1 and the response signal SR1. In another possible embodiment, the input / output interface 114 is a general-purpose input / output (GPIO) interface.

[0064] In a possible embodiment, when the input / output interface 114 is coupled to an external device (such as the device 120), the processing circuit 113 requests the device 120 to provide relevant information of the internal firmware through the verification signal SV1. The device 120 uses its own firmware data as a response signal SR1 according to the verification signal SV1, and provides the response signal SR1 to the input / output interface 114. In this example, the processing circuit 113 performs a validity check on the response signal SR1. When the response signal SR1 passes a validity check, it indicates that the device 120 is a valid device. Therefore, the processing circuit 113 communicates with the device 120.

[0065] However, when the response signal SR1 fails a validity check, it indicates that the device 120 is not a valid device. Therefore, the processing circuit 113 rejects the request from the device 120. In one possible embodiment, the processing circuit 113 suspends communication with the device 120. In other embodiments, when the response signal SR1 fails a validity check, the processing circuit 113 updates the firmware data of the device 120 through the input / output interface 114.

[0066] In other embodiments, the device 110 further includes a notification circuit 115. The notification circuit 115 is coupled to the processing circuit 113. When the designated program BL2 fails the legality check, the processing circuit 113 triggers the notification circuit 115. Therefore, the notification circuit 115 sends a notification message. In a possible embodiment, the notification message is a sound message or an image signal. For example, the notification circuit 115 may be a speaker, a light emitting device (such as an LED) or a screen.

[0067] In some embodiments, the device 110 further includes a password generating circuit 116. When the reply signal SR1 provided by the device 120 passes the legitimacy check, the processing circuit 113 triggers the password generating circuit 116. The password generating circuit 116 generates a connection password SCD. The password generating circuit 116 may directly provide the connection password SCD to the input-input interface 114. The input-input interface 114 outputs the connection password SCD to the device 120. In another possible embodiment, the password generating circuit 116 provides the connection password SCD to the processing circuit 113. In this example, the processing circuit 113 outputs the connection password SCD to the device 120 through the input-input interface 114.

[0068] In other embodiments, the device 110 further includes a networking circuit 117. The networking circuit 117 is used to connect to an Internet network. In this example, the device 120 uses the connection code SCD and connects to the Internet through the processing circuit 113 and the networking circuit 117.

[0069] Figure 3 Schematic diagram of the device 120 of the present invention. Figure 3 As shown, the device 120 includes a memory 121, an input / output interface 122, and a processing circuit 123. The memory 121 stores a designated program BL3. In one possible embodiment, the memory 121 further stores a signature SIG2. In other embodiments, the memory 121 further stores a key KY3. The key KY3 is used to verify an external device (such as the device 130). When the device 120 does not need to verify other devices, the key KY3 can be omitted. The key KY3 may be stored in another independent memory outside the memory 121.

[0070] The input / output interface 122 is used to receive the test signal SV1 and output the response signal SR1. The present invention does not limit the type of the input / output interface 122. In one possible embodiment, the input / output interface 122 has a wireless transceiver for transmitting the test signal SV1 and the response signal SR1. In another possible embodiment, the input / output interface 122 is a universal input / output interface.

[0071] The processing circuit 123 reads the memory 121 according to the verification signal SV1 to generate a reply signal SR1. In one possible embodiment, the processing circuit 123 uses the designated program BL3 and the signature SIG2 as the reply signal SR1. In some embodiments, the processing circuit 123 executes the designated program BL3 to generate a verification signal SV2. The present invention does not limit the architecture of the processing circuit 123. In one possible embodiment, the processing circuit 123 is composed of a logic circuit. In other embodiments, the processing circuit 123 is a central processing unit.

[0072] In other embodiments, the device 120 further includes an input / output interface 124. When the input / output interface 124 is coupled to an external device (such as the device 130), the processing circuit 123 executes a designated program BL3 to generate a verification signal SV2. The input / output interface 124 outputs the verification signal SV2 to the device 130 to request the device 130 to provide relevant information of the internal firmware. According to the verification signal SV2, the device 130 uses its own firmware data as a response signal SR2 and provides the response signal SR2 to the input / output interface 124. In this example, the processing circuit 123 performs a validity check on the response signal SR2. When the response signal SR2 passes a validity check, it indicates that the device 130 is a legal device. Therefore, the processing circuit 123 communicates with the device 130.

[0073] When the reply signal SR2 fails a validity check, it indicates that the device 130 is not a valid device. Therefore, the processing circuit 123 ignores the request from the device 130. In one embodiment, the processing circuit 123 notifies Figure 2 In this example, the processing circuit 113 may initialize the device 130 through the device 120.

[0074] In some embodiments, the device 130 has an input / output interface (not shown), a memory, and a processing circuit. In this example, the input / output interface of the device 130 is used to receive the test signal SV2 and output the response signal SR2. The memory of the device 130 stores at least a third specified program. The processing circuit of the device 130 reads the corresponding memory according to the test signal SV2 to provide the response signal SR2. Since the input / output interface, memory, and processing circuit of the device 130 are similar to the input / output interface 122, memory 121, and processing circuit 123 of the device 120, the architecture of the device 130 will not be described in detail.

[0075] Figure 4 The flowchart of the control method of the present invention is shown in FIG. The control method of the present invention may exist through program code. When the program code is loaded and executed by a machine, the machine becomes a trust chain and a control device for implementing the present invention. In a possible embodiment, the trust chain includes at least one root device and a first device. The root device includes a one-time programmable memory and an erasable programmable memory. The one-time programmable memory stores a secure boot program. The erasable programmable memory stores a first specified program.

[0076] First, a secure boot procedure is executed to verify the first designated program (step S411). In one possible embodiment, the erasable programmable memory further stores a signature. In this example, step S411 uses a first key to decrypt the signature to generate a first hash value. Step S411 uses a first hash algorithm to process the first designated program to generate a second hash value.

[0077] Next, it is determined whether the first designated program passes a first validity check (step S412). In one possible embodiment, step S412 determines whether the first hash value is the same as the second hash value. When the first hash value is different from the second hash value, it indicates that the first designated program has not passed the first validity check. Therefore, the first designated program is not executed (step S413). In one possible embodiment, step S413 further issues a warning message to notify the user.

[0078] However, when the first hash value is the same as the second hash value, it means that the first designated program passes the first legality check. Therefore, the first designated program is executed (step S414). After the first designated program is executed, a first verification signal is generated to verify whether the first device is a legal device (step S415).

[0079] Next, a first verification signal is provided to the first device (step S416). In one possible embodiment, the first device uses its own firmware information as a first reply signal according to the first verification signal. Then, it is determined whether the first reply signal passes a second legitimacy check (step S417). In one possible embodiment, step S417 uses a second key to decrypt a signature of the first reply signal to generate a third hash value. In this example, step S417 uses a second hash algorithm to process a file information of the first reply signal to generate a fourth hash value.

[0080] When the third hash value is different from the fourth hash value, it indicates that the first reply signal does not pass the second legitimacy check. Therefore, the command root device rejects the request of the first device (step S418). In one possible embodiment, the root device updates the firmware of the first device. For example, the root device provides an initial firmware to the first device. However, when the third hash value is the same as the fourth hash value, it indicates that the first reply signal passes the second legitimacy check. Therefore, the root device is allowed to communicate with the first device (step S419).

[0081] In this embodiment, the root device determines whether its own designated program has been tampered with. If so, the designated program is not executed to avoid malicious attacks. When it is known that the designated program has not been tampered with, the root device determines whether an external device (or first device) is a legitimate device. If the firmware of the external device has been tampered with, the root device rejects the request of the external device. In a possible embodiment, the root device may rewrite the firmware of the external device. When the firmware of the external device has not been tampered with, it indicates that the external device is a legitimate device. Therefore, the root device allows the request of the external device.

[0082] It should be understood that when an element or layer is referred to as being "coupled" to another element or layer, it may be directly coupled or connected to the other element or layer, or have other elements or layers interposed therebetween. Conversely, if an element or layer is "connected" to another element or layer, there will be no other elements or layers interposed therebetween.

[0083] The control method of the present invention, or a specified form or part thereof, may exist in the form of program code. The program code may be stored in a physical medium, such as a floppy disk, a CD, a hard disk, or any other machine-readable (such as computer-readable) storage medium, or a computer program product not limited to an external form, wherein when the program code is loaded and executed by a machine, such as a computer, the machine becomes a trust chain and control device (or root device) for participating in the present invention. The program code may also be transmitted through some transmission media, such as wires or cables, optical fibers, or any transmission mode, wherein when the program code is received, loaded and executed by a machine, such as a computer, the machine becomes a trust chain and control device for participating in the present invention. When implemented in a general-purpose processing unit, the program code combines with the processing unit to provide a unique device that operates similarly to an application-specified logic circuit.

[0084] Unless otherwise defined, all words (including technical and scientific words) herein are generally understood by those skilled in the art to which the present invention belongs. In addition, unless expressly indicated, the definitions of words in general dictionaries should be interpreted as consistent with the meanings in articles in the relevant technical field, and should not be interpreted as ideal or overly formal. Although the terms "first", "second", etc. can be used to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element.

[0085] Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art may make some changes and modifications without departing from the spirit and scope of the present invention. For example, the system, device or method described in the embodiments of the present invention may be implemented in a physical embodiment of hardware, software or a combination of hardware and software. Therefore, the scope of protection of the present invention shall be subject to the scope defined by the attached claims.

Claims

1. A control device, characterized in that: include: a first memory storing a secure boot program; a second memory storing a first designated program; a processing circuit, executing the secure boot program to perform a first validity check on the first designated program, and when the first designated program passes the first validity check, the processing circuit executes the first designated program to generate a check signal; as well as an input / output interface for outputting the test signal to an external device and receiving a response signal generated by the external device, The processing circuit performs a second validity check on the reply signal. When the reply signal fails the second validity check, the processing circuit ignores the request from the external device.

2. The control device according to claim 1, characterized in that The first memory is a non-volatile memory, and the second memory is a flash memory.

3. The control device according to claim 1, characterized in that: The first memory further stores a first key, and the second memory further stores a second key and a first signature. The processing circuit uses the first key to decrypt the first signature to generate a first hash value. The processing circuit processes the first designated program to generate a second hash value. When the first hash value is equal to the second hash value, it indicates that the first designated program passes the first legitimacy check.

4. The control device according to claim 3, characterized in that: The reply signal includes a second designated program and a second signature. The processing circuit uses the second key to decrypt the second signature to generate a third hash value. The processing circuit processes the second designated program to generate a fourth hash value. When the third hash value is equal to the fourth hash value, it indicates that the reply signal passes the second legitimacy check.

5. The control device according to claim 4, characterized in that When the reply signal fails to pass the second validity check, the processing circuit updates the second designated program.

6. A trust chain, characterized in that: include: A device comprising: a first memory storing a secure boot program; a second memory storing a first designated program; a root processing circuit that executes the secure boot program to perform a first validity check on the first designated program. When the first designated program passes the first validity check, the root processing circuit executes the first designated program to generate a first check signal; and a first input / output interface for outputting the first test signal and receiving a first reply signal; and A first device, comprising: a second input / output interface, configured to receive the first verification signal and output the first reply signal; a third memory storing a second designated program; and a first processing circuit, reading the third memory according to the first test signal to generate the first reply signal, The root processing circuit performs a second validity check on the first reply signal. When the first reply signal fails the second validity check, the root processing circuit ignores the request of the first device.

7. The trust chain of claim 6, wherein: The first memory further stores a first key, and the second memory further stores a second key and a first signature. The root processing circuit uses the first key to decrypt the first signature to generate a first hash value. The root processing circuit processes the first designated program to generate a second hash value. When the first hash value is equal to the second hash value, it indicates that the first designated program passes the first legitimacy check.

8. The trust chain as claimed in claim 7, characterized in that: The third memory further stores a second signature, and the first processing circuit uses the second designated program and the second signature as the first reply signal. The root processing circuit uses the second key to decrypt the second signature to generate a third hash value. The root processing circuit processes the second specified program to generate a fourth hash value. When the third hash value is equal to the fourth hash value, it indicates that the first reply signal passes the second legitimacy check.

9. The trust chain of claim 8, wherein: Also includes: A second device is coupled to the first device and provides a second response signal to the first device according to a second check signal. The first processing circuit performs a third validity check on the second response signal. When the second response signal fails the third validity check, the first processing circuit ignores the request of the second device.

10. A control method, characterized in that: Applicable to a trust chain, the trust chain includes at least one root device and a first device, the root device includes a one-time programmable memory and an erasable programmable memory, the one-time programmable memory stores a secure boot program, and the erasable programmable memory stores a first specified program, the control method includes: Executing the secure boot program to determine whether the first designated program passes a first legitimacy check; When the first designated program passes the first legality check, executing the first designated program to generate a first check signal; Providing the first test signal to the first device, wherein the first device generates a first response signal according to the first test signal; Determining whether the first reply signal passes a second validity check; and When the first reply signal passes the second validity check, the root device is instructed to grant the request of the first device.

Images