Hardware acceleration signature verification method based on plug-in encryption module and related equipment

Abstract

The embodiment of the invention belongs to the field of security authentication, and relates to a hardware acceleration signature verification method based on a plug-in encryption module, which comprises the following steps: acquiring mirror image data needing to be verified, and transmitting the mirror image data to the plug-in encryption module; sending a signature verification request to the plug-in encryption module, wherein the signature verification request carries data to be verified; receiving a signature verification result of the plug-in encryption module; and according to the signature verification result, judging whether to continue to execute the system booting process or not. The invention further provides a hardware acceleration signature verification system based on the plug-in encryption module, computer equipment and a readable storage medium. According to the application, the signature verification efficiency and security are improved, the integrity and legality of the mirror image data are ensured, malicious tampering of the mirror image file is prevented, the CPU load is reduced through hardware acceleration, and the system performance is improved.

Description

Technical Field

[0001] The present application relates to the field of security authentication technology, and in particular to a hardware accelerated signature verification method based on an external encryption module and related equipment. Background Art

[0002] With the rapid development of information technology, security issues have become increasingly important in various computing devices. Especially in smart devices and embedded systems, how to ensure the security of the system startup process and prevent malicious tampering or booting malicious code has become a key issue. Traditional encryption and signature verification schemes mainly rely on the main processor (CPU) to perform encryption and signature verification of data. However, the CPU hardware of many embedded devices or mobile devices has limited processing power for encryption and signature verification operations, especially when verifying large files, such as operating system image files, boot images (such as preloaders, LK images), etc. Although the traditional CPU encryption and signature verification method can achieve basic security protection, when faced with large-scale data, the performance often cannot meet the requirements, resulting in delays in the startup process, or even failure to complete the signature verification task in time. Summary of the invention

[0003] The purpose of the embodiments of the present application is to propose a hardware-accelerated signature verification method and related equipment based on an external encryption module to solve the technical problems of performance bottlenecks, insufficient security and hardware limitations existing in current encryption schemes.

[0004] In order to solve the above technical problems, the embodiment of the present application provides a hardware accelerated signature verification method based on an external encryption module, which adopts the following technical solution:

[0005] A hardware accelerated signature verification method based on an external encryption module comprises the following steps:

[0006] Obtain the image data that needs to be verified, and transmit the image data to the external encryption module;

[0007] Send a signature verification request to the external encryption module, along with the data to be verified;

[0008] Receiving the signature verification result of the external encryption module;

[0009] Determine whether to continue the system boot process according to the signature verification result.

[0010] In a possible implementation manner, before the step of receiving the signature verification result of the external encryption module, the method further includes:

[0011] The external encryption module receives the data to be verified;

[0012] Using a preset encryption algorithm to perform signature verification on the data to be verified, and obtaining a signature verification result;

[0013] Feedback the verification result. If the verification is successful, return True; otherwise, return False.

[0014] In a possible implementation, the encryption algorithm includes but is not limited to an RSA algorithm and an ECC algorithm, and the step of using a preset encryption algorithm to perform signature verification on the data to be verified and obtaining a signature verification result specifically includes:

[0015] Calculate a first hash value of the data to be verified using a hash algorithm;

[0016] Encrypt the first hash value using a private key of an RSA algorithm or an ECC algorithm to generate a digital signature;

[0017] Decrypt the digital signature using a public key of an RSA algorithm or an ECC algorithm to obtain a second hash value after decryption;

[0018] The first hash value and the second hash value are compared to see if they are the same. If they are the same, the data to be verified has not been tampered with; if they are different, the data to be verified has been tampered with.

[0019] In a possible implementation, the step of obtaining the image data that needs to be verified and transmitting the image data to the external encryption module specifically includes:

[0020] According to the preset system boot process, the image data that needs to be verified is identified;

[0021] Dividing the mirror data into a plurality of data blocks according to a preset size;

[0022] The data blocks are transmitted to the external encryption module block by block.

[0023] In a possible implementation manner, the image data includes a system image, an application image, and a data image. After the step of transmitting the data blocks to the external encryption module block by block, the step further includes:

[0024] The external encryption module verifies the integrity of the data blocks one by one or uniformly.

[0025] In a possible implementation manner, the step of sending a signature verification request to the external encryption module and carrying the data to be verified specifically includes:

[0026] Establishing a communication connection with the external encryption module;

[0027] Send a signature verification request containing signature verification data to the encryption module, where the signature verification request includes a request type, signature data, and algorithm selection.

[0028] In a possible implementation manner, after the step of determining whether to continue the system boot process according to the signature verification result, the method further includes:

[0029] If verification fails or an exception occurs, an error code, warning message or retry mechanism will be fed back and a log will be recorded.

[0030] In order to solve the above technical problems, the embodiment of the present application also provides a hardware accelerated signature verification system based on an external encryption module, which adopts the following technical solution:

[0031] A hardware accelerated signature verification system based on an external encryption module, comprising:

[0032] An acquisition module is used to acquire the image data that needs to be verified and transmit the image data to the external encryption module;

[0033] A request module, used to send a signature verification request to the external encryption module, and carry the data to be verified;

[0034] A receiving module, used to receive the signature verification result of the external encryption module;

[0035] The judgment module is used to judge whether to continue the system boot process according to the signature verification result.

[0036] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0037] A computer device includes a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the hardware-accelerated signature verification method based on an external encryption module as described above are implemented.

[0038] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0039] A computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the hardware-accelerated signature verification method based on an external encryption module as described above.

[0040] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0041] The hardware-accelerated signature verification method based on an external encryption module disclosed in the present application obtains the image data that needs to be verified and transmits the image data to the external encryption module; sends a signature verification request to the external encryption module, carrying the data to be verified; receives the signature verification result of the external encryption module; and determines whether to continue the system boot process according to the signature verification result. The present application improves the efficiency and security of signature verification by handing over the signature verification process to the hardware acceleration of the external encryption module, ensures the integrity and legality of the image data, prevents malicious tampering of the image file, reduces the CPU load through hardware acceleration, and improves system performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0044] Figure 2 It is a flowchart of an embodiment of a hardware accelerated signature verification method based on an external encryption module according to the present application;

[0045] Figure 3 It is a structural diagram of an embodiment of a hardware accelerated signature verification system based on an external encryption module according to the present application;

[0046] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0048] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0049] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0050] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0051] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0052] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 (Moving Picture Experts Group Audio Layer III) players, MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0053] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0054] It should be noted that the hardware-accelerated signature verification method based on the external encryption module provided in the embodiment of the present application is generally executed by a server. Accordingly, the hardware-accelerated signature verification system based on the external encryption module is generally set in the server.

[0055] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0056] Continue to refer Figure 2 , shows a flow chart of an embodiment of a hardware accelerated signature verification method based on an external encryption module according to the present application. The hardware accelerated signature verification method based on an external encryption module comprises the following steps:

[0057] Step S201, obtaining the image data that needs to be verified, and transmitting the image data to the external encryption module.

[0058] In this embodiment, the electronic device (for example, Figure 1 The server shown in the figure) can send or receive data through a wired connection or a wireless connection. It should be noted that the above wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0059] In this embodiment, the purpose of this step is to obtain the data that needs to be verified and send it to the external encryption module. Usually, these data are files that need to verify the integrity when the system starts (such as preloader or lk image files), which contain the startup information or firmware information of the operating system. First, the system reads the image file to be verified from the storage device (such as Flash, hard disk, etc.); then by selecting a suitable hardware interface (such as SPI, I2C, USB, PCIe, etc.), the main CPU transmits the data to be verified to the external encryption module. During the transmission process, if the data is large, it may be transmitted in blocks. Each data block needs to be verified by the encryption module. Assuming that an embedded device needs to verify the integrity of the preloader image when it starts, the device first reads the image file from the memory, and then transmits it to the external encryption module through the SPI interface, and the module verifies whether the image file has been tampered with.

[0060] Step S202: Send a signature verification request to the external encryption module, and carry the data to be verified.

[0061] In this embodiment, the main CPU sends a request containing the data to be verified to the external encryption module. This request will include necessary information, such as the data type (image file), the data to be verified (file content), and the encryption algorithm to be used (such as RSA, ECC, etc.). Specifically, the main CPU constructs a verification request package, which contains the data to be verified and other additional information (such as signature, algorithm used, etc.); the request is sent to the external encryption module through a previously set communication interface (such as SPI, I2C, etc.); the external encryption module receives the request and prepares to verify the signature. For example, in the verification process of the preloader image, the main CPU sends a request to the external encryption module, and the request content includes the image file content and signature information, requesting to verify whether the file is valid.

[0062] Step S203, receiving the signature verification result of the external encryption module.

[0063] In this embodiment, after receiving the request, the encryption module will perform a signature verification calculation according to a preset encryption algorithm, and then generate a signature verification result (such as True or False). If the signature verification passes, True is returned, indicating that the data is complete and has not been tampered with; if it fails, False is returned. The plug-in encryption module processes the data to be verified and verifies the data according to the selected algorithm (such as RSA, ECC, etc.); the verification result (True or False) is returned to the main CPU through the communication interface with the main CPU. Exemplarily, the encryption module uses the RSA-3072 public key to verify the signature of the preloader image file. If the signature matches the data, True is returned; if the signature or data is different, False is returned.

[0064] Step S204: determine whether to continue the system boot process according to the signature verification result.

[0065] In this embodiment, based on the signature verification result, the main CPU decides whether to continue the system boot. If the signature verification passes (the result is True), the system continues the boot process; if the signature verification fails (the result is False), the system may terminate the boot and enter the recovery mode or other security protection measures. After receiving the signature verification result, the main CPU uses logic to determine whether to continue loading the system image or other key files; if the signature verification result is True, the main CPU will continue the system boot process, load the operating system kernel and drivers, etc.; if the signature verification result is False, the main CPU will interrupt the boot and trigger the error handling or recovery mechanism. Exemplarily, after the preloader image verification passes, the main CPU continues to load the operating system. If the verification fails, the main CPU will enter a safe recovery mode, requiring the user to reload or repair the image file.

[0066] This application improves the efficiency and security of signature verification by handing over the signature verification process to an external encryption module for hardware acceleration. The integrity and legitimacy of the image data are guaranteed, and malicious tampering of the image file is prevented. Through hardware acceleration, the CPU load is reduced and system performance is improved.

[0067] In some optional implementations of this embodiment, before the step of receiving the signature verification result of the external encryption module, the following steps are further included:

[0068] The external encryption module receives the data to be verified;

[0069] Using a preset encryption algorithm to perform signature verification on the data to be verified, and obtaining a signature verification result;

[0070] Feedback the verification result. If the verification is successful, return True; otherwise, return False.

[0071] In this embodiment, after receiving the data to be verified, the external encryption module first receives data from the main CPU or other control units. These data usually contain part or all of the contents of the image file to be verified, which may be the startup file, firmware file, etc. of the operating system. The main CPU or other device sends the data to be verified to the external encryption module through a hardware interface (such as SPI, I2C, UART, etc.). Then, the encryption module receives the data and performs necessary preliminary checks (for example, checking the integrity and correctness of the data) to ensure that the data can be processed later. For example, when the system starts, it will read an operating system image file preloader and transfer the file to the external encryption module through the SPI interface for verification. After receiving the data to be verified, the external encryption module will process the data according to the pre-set encryption algorithm and perform the verification operation. According to the specific encryption algorithm (such as RSA, ECC, etc.), the encryption module will use the public key and signature stored in the module to verify the data to be verified. Specifically, the plug-in encryption module selects a suitable encryption algorithm (such as RSA, ECC, etc.) for signature verification; if a hash algorithm (such as SHA-256, SHA-512, etc.) is used, the hash value of the data to be verified is first calculated; the selected public key (such as RSA public key or ECC public key) is used to verify the data signature and calculate a decrypted hash value; the decrypted hash value is compared with the calculated hash value to determine whether the data has not been tampered with. For example, the plug-in encryption module uses the RSA public key to decrypt the signature of the preloader file, obtains the decrypted hash value, and compares it with the file hash value calculated by the SHA-256 algorithm to determine the integrity of the file. After the signature verification process is completed, the plug-in encryption module will feedback the signature verification result, and the signature verification result will return True or False according to the verification of the data. If the signature verification is successful (that is, the data has not been tampered with), True is returned, indicating that the data is complete and valid. If the signature verification fails (that is, the data has been tampered with or the signature does not match), False is returned, indicating that the data is invalid. Specifically, the plug-in encryption module generates a status flag (True or False) based on the signature verification result; if the signature verification passes, True is returned, indicating that the data is complete and has not been tampered with; if the signature verification fails, False is returned, indicating that the data has been tampered with or the signature verification failed. If the signature and hash of the preloader image match, the plug-in encryption module returns True and the system can continue to execute; if the verification fails, False is returned and the system will interrupt the boot process to avoid using damaged or tampered image files.

[0072] It should be noted that in traditional CPU signature verification, the processing speed may be limited by bottlenecks. The plug-in encryption module can be combined with ASIC (application-specific integrated circuit) or FPGA (field programmable gate array) hardware acceleration technology to significantly improve the speed of signature verification, especially for large-scale or complex data. Specifically, ASIC hardware acceleration: using ASIC chips specially designed for signature verification to perform efficient signature verification calculations. FPGA acceleration: by using FPGA to achieve a more flexible acceleration solution, different acceleration configurations can be made as needed.

[0073] This application enables the system to judge the integrity of the image file by feeding back the signature verification result (True / False), preventing invalid or tampered files from entering the system.

[0074] In some optional implementations of this embodiment, the encryption algorithm includes but is not limited to the RSA algorithm and the ECC algorithm. The step of using the preset encryption algorithm to perform signature verification on the data to be verified and obtaining the signature verification result specifically includes:

[0075] Calculate a first hash value of the data to be verified using a hash algorithm;

[0076] Encrypt the first hash value using a private key of an RSA algorithm or an ECC algorithm to generate a digital signature;

[0077] Decrypt the digital signature using a public key of an RSA algorithm or an ECC algorithm to obtain a second hash value after decryption;

[0078] The first hash value and the second hash value are compared to see if they are the same. If they are the same, the data to be verified has not been tampered with; if they are different, the data to be verified has been tampered with.

[0079] In this embodiment, during the signature verification process, it is first necessary to calculate the first hash value of the data to be verified. The hash algorithm (such as SHA-256, SHA-512, etc.) converts the data to be verified (such as image files, firmware data, etc.) into a "hash value" or "digest" of fixed length. This hash value is the unique fingerprint of the data and can effectively reflect the integrity of the data. After the external encryption module receives the data to be verified, it uses a hash algorithm (such as SHA-256) to calculate the data. The generated first hash value is the only representative of the data to be verified, and even if the data changes slightly, the first hash value will change significantly. For example, for the file preloader.bin to be verified, a 256-bit hash value H1 is calculated using the SHA-256 algorithm. Then, the calculated first hash value is encrypted using a private key. By encrypting the first hash value with a private key, a digital signature of the data can be generated, and the digital signature is used to verify the source and integrity of the data. The encryption module uses the private key to perform encryption operations on the calculated first hash value. If the RSA algorithm is used, the RSA private key is used to encrypt the hash value; if the ECC algorithm is used, the ECC private key is used to encrypt it. The encrypted hash value is the "digital signature", which corresponds to the original data one by one to ensure the uniqueness and integrity of the data. For example, the RSA private key PrivKey_RSA is used to encrypt the hash value H1 to obtain the digital signature Sig_RSA. During the signature verification process, the encrypted digital signature is decrypted using the public key. The decrypted result is the second hash value of the data, which should be the same as the first hash value. After receiving the digital signature, the plug-in encryption module uses the public key of the RSA algorithm or the ECC algorithm to decrypt the digital signature. After decryption, the data obtained should be the same hash value as the original data. If the RSA algorithm is used, the RSA public key is used for decryption; if the ECC algorithm is used, the ECC public key is used for decryption. For example, the digital signature Sig_RSA is decrypted using the RSA public key PubKey_RSA to obtain the decrypted hash value H2. Finally, verify whether the hash value obtained after decryption is consistent with the original hash value. If they are consistent, it means that the data has not been tampered with and the signature verification is successful. If they are inconsistent, it means that the data has been tampered with during transmission or storage, and the signature verification fails. For example, the module compares the hash value H1 (calculated from the data) with H2 (decrypted from the digital signature). If H1 == H2, it returns True, indicating that the data has not been tampered with. If H1 ! = H2, it returns False, indicating that the data has been tampered with.

[0080] It should be noted that the plug-in encryption module can be designed to support multiple signature verification algorithms (RSA, ECC, DSA, etc.), and select the appropriate encryption algorithm according to different security requirements and performance requirements. For example, the ECC algorithm is used in scenarios that require higher performance, and the RSA algorithm is used in scenarios that require higher security. With the development of quantum computing, traditional RSA and ECC algorithms may face threats. The plug-in encryption module can support encryption algorithms that are resistant to quantum computing (such as algorithms based on lattice cryptography) to ensure that the system can still maintain high security in the era of quantum computing.

[0081] This application calculates the file digest through a hash algorithm and combines it with public key encryption (such as RSA or ECC) to ensure the integrity and non-tampering of the data. The introduction of the hash algorithm reduces the processing burden of large data files and improves the efficiency of signature verification. In addition, the combination of public key encryption algorithms such as RSA / ECC ensures the high security of signature verification and prevents the file from being illegally tampered with.

[0082] In some optional implementations of this embodiment, the step of obtaining the image data that needs to be verified and transmitting the image data to the external encryption module specifically includes:

[0083] According to the preset system boot process, the image data that needs to be verified is identified;

[0084] Dividing the mirror data into a plurality of data blocks according to a preset size;

[0085] The data blocks are transmitted to the external encryption module block by block.

[0086] In this embodiment, during the system boot process, it is necessary to clarify which image data (such as operating system image, boot program, firmware, etc.) needs to be verified. Usually, during the boot process, the main system will identify which images are critical and need to be securely verified based on the boot order and system requirements. The system automatically identifies the data that needs to be verified according to the preset boot process (such as the loading order of the boot program or operating system). In Android or embedded systems, key image files such as preloader, lk, boot.img, etc. are usually identified and verified. This identification can be achieved through preset configurations or metadata in the boot program to ensure that only important system files are verified to prevent unnecessary waste of resources. For example, during the Android boot process, the system will first load the preloader file, then load the lk (Linux Kernel) file, and then boot.img. The system identifies the image that needs to be verified based on the boot order of these files.

[0087] In order to improve the efficiency of signature verification, especially when processing large image files, the data can be divided into multiple smaller blocks, and each data block will be individually verified. This can reduce memory pressure and use the hardware acceleration module to process multiple data blocks in parallel. The size of each data block (such as 1MB, 4MB, 8MB, etc.) is set through the system's preset strategy. This block size can be adjusted according to the system's memory capacity, processing power, image file size, and the performance of the hardware acceleration module. When transmitting image data, the system will divide the entire image file into multiple small blocks according to the set block size. Each data block is transmitted and verified separately. Data block segmentation usually does not affect the security of signature verification because the integrity of each data block is independently verified. Assuming that the size of the boot.img image file is 16MB, the system will divide it into 4 4MB data blocks, and each data block will be transmitted separately to the plug-in encryption module for signature verification. After each data block is divided, it will be transmitted one by one to the plug-in encryption module for signature verification in sequence. This block-by-block transmission can realize data parallel processing, improve processing efficiency, and reduce system memory usage. For example, for the 16MB boot.img file mentioned above, the system will be divided into four 4MB data blocks (block1, block2, block3, block4), and these data blocks will be transmitted one by one to the external encryption module for signature verification. It should be noted that if the external encryption module supports multi-threaded or multi-core processing, different data blocks can be assigned to different processing units for parallel signature verification, which can significantly improve data processing efficiency, especially when large files or multiple image files need to be verified at the same time. For larger data sets, the system can adopt an incremental signature verification method, that is, when processing large image files, only the incremental part (such as incremental data since the last signature verification) can be verified, instead of verifying the entire image every time, which can further reduce the consumption of system resources.

[0088] This application effectively avoids delays or memory overflows caused by large files (such as image data) by dividing large files (such as image data) into small blocks and transmitting them one by one. This block transmission method makes signature verification more flexible, and the system can verify data block by block to ensure the integrity of each data block.

[0089] In some optional implementations of this embodiment, the image data includes a system image, an application image, and a data image. After the step of transmitting the data blocks to the external encryption module block by block, the step further includes:

[0090] The external encryption module verifies the integrity of the data blocks one by one or uniformly.

[0091] In this embodiment, each data block transmitted to the external encryption module will first be verified for integrity after being received by the encryption module. Common verification methods include using a hash algorithm (such as SHA-256) to calculate the hash value of each data block and comparing the hash value with the previously stored hash value. If the system chooses to verify block by block, the encryption module will process one data block at a time, calculate the hash value of the data block, and compare the stored hash value to ensure that the integrity of the data block is not destroyed; in some application scenarios, the system can also choose to uniformly verify multiple data blocks. This method is usually suitable for the overall integrity verification of files or images. For example, after all data blocks have been transmitted, the system will uniformly perform a verification to ensure the integrity of the entire image.

[0092] This application can detect the integrity of each block of data in real time and comprehensively by verifying the image data blocks one by one or in a unified manner, ensuring that the data of the image file is not tampered with or damaged during the transmission and storage process, thereby enhancing the security and reliability of the system.

[0093] In some optional implementations of this embodiment, the step of sending a signature verification request to the external encryption module and carrying the data to be verified specifically includes:

[0094] Establishing a communication connection with the external encryption module;

[0095] Send a signature verification request containing signature verification data to the encryption module, where the signature verification request includes a request type, signature data, and algorithm selection.

[0096] In this embodiment, in order to ensure that the data can be stably and accurately transmitted to the encryption module, the system first needs to establish a communication connection with the encryption module. Specifically, hardware interface selection: select a suitable communication protocol, such as SPI, UART, I2C, USB or PCIe, according to the interface standard between the system and the encryption module. Initialize the connection: confirm the connection status by initializing the communication interface. During the initialization process, it may be necessary to complete steps such as device identity authentication and connection confirmation. Data transmission preparation: After the connection is established, the system is ready to send the data to be verified. At this time, ensure that the data format meets the requirements of the encryption module, such as the size of the data block, the transmission order, etc. After the communication connection is established, the system needs to send a signature verification request to the external encryption module, which contains the data to be verified. In addition to the data itself, this request also needs to contain other relevant information for the signature verification, such as the request type, signature data and algorithm selection. Specifically, request type: the system will indicate to the encryption module that this operation is a "signature verification" request, which helps the encryption module to make correct processing when receiving the request. Example: It can be a "signature verification request" or a "data integrity verification request", depending on the design of the encryption module. Signature data: The data to be verified must contain signature information, which is usually the signature result after the data is processed by an encryption algorithm (such as RSA, ECC, etc.). The signature data itself is an encryption protection for the original data, the purpose of which is to prevent the data from being tampered with during transmission. Example: If it is system image data, the signature data contained may be the encrypted information of the image after it is signed by the RSA private key. Algorithm selection: When sending a signature verification request, the system needs to specify the signature verification algorithm to be used. This choice affects how the encryption module handles the request. For example, the system may choose the RSA algorithm, the ECC algorithm, or other supported encryption algorithms, depending on the capabilities and security requirements of the hardware. Example: The request can be clearly identified as using the RSA-2048 algorithm for signature verification, or using the ECC-512 algorithm for efficient verification.

[0097] This application ensures that the encryption module can correctly receive and process the data to be verified by establishing a communication connection with the plug-in encryption module and sending a request containing the signature verification data. This step clearly specifies how to perform the signature verification operation through the encryption module, improving the automation and transparency of the system operation. The request sent includes the request type, signature data, and algorithm selection, making the signature verification process more flexible and supporting different encryption algorithms.

[0098] In some optional implementations of this embodiment, after the step of determining whether to continue the system boot process according to the signature verification result, the method further includes:

[0099] If verification fails or an exception occurs, an error code, warning message or retry mechanism will be fed back and a log will be recorded.

[0100] In this embodiment, if the encryption module returns a result of signature verification failure, or an exception occurs during the signature verification process (such as hardware failure, communication error, etc.), the system will take a series of countermeasures, the main purpose of which is to ensure the stability and security of the system and provide effective feedback for subsequent troubleshooting. Specifically, first, the signature verification result is judged: after the signature verification process is completed, the system determines whether to continue the system boot process based on the result feedback from the encryption module; if the signature verification result is True and there is no exception, the system will continue to execute the boot process, load the operating system image, application program, etc. If the signature verification result is False, it means that the data to be verified (such as an image file) may be tampered with, and the system needs to stop further operations immediately and take measures to provide feedback. When the signature verification fails, the system should generate and return an error code to indicate the reason for the signature verification failure. For example, the error code may indicate "the image file has been tampered with" or "the signature verification failed". In addition to the error code, the system can also provide more detailed warning information so that the user or system administrator can understand the specific reason for the failure. For example, the warning information may include "the signature verification failed, the signature does not match" or "the signature verification timed out". These error codes and warning messages can be recorded in the system log or communicated to the user through output interfaces such as the graphical user interface (GUI) or serial terminal. If the signature verification failure is caused by a temporary system failure (such as communication packet loss, encryption module overload, etc.), the system can request the signature verification operation again through the retry mechanism. The retry mechanism can be performed automatically within a specified number of times to avoid system startup failure due to occasional failures. If the signature verification still fails after the retry, the system may prompt the user for manual intervention (for example, check the device connection, restart the encryption module, reload the image, etc.). Whether the signature verification succeeds or fails, the system should record relevant logs for subsequent auditing, analysis, and troubleshooting of the operation.

[0101] The recorded log information may include: timestamp of the signature verification request, verification result, error code, warning information, number of retries, etc.

[0102] This application provides an error handling mechanism after signature verification fails, including feedback error codes, warning information, and a retry mechanism to ensure that the system can respond in a timely manner when signature verification fails or is abnormal, preventing the system from continuing to start risky image files. The retry mechanism improves the system's fault tolerance, and logging provides valuable data for subsequent troubleshooting. These measures greatly enhance the robustness of the system and ensure that the system can take appropriate remedial measures when faced with anomalies.

[0103] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0104] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0105] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0106] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0107] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a hardware accelerated signature verification system based on an external encryption module and a hardware accelerated signature verification system based on an external encryption module. Figure 2 Corresponding to the method embodiment shown, the system can be specifically applied to various electronic devices.

[0108] like Figure 3As shown, the hardware accelerated signature verification system based on the external encryption module described in this embodiment includes: an acquisition module 301, a request module 302, a receiving module 303 and a judgment module 304. Among them:

[0109] The acquisition module 301 is used to acquire the image data that needs to be verified and transmit the image data to the external encryption module;

[0110] The request module 302 is used to send a signature verification request to the external encryption module, and carry the data to be verified;

[0111] The receiving module 303 is used to receive the signature verification result of the external encryption module;

[0112] The judgment module 304 is used to judge whether to continue the system boot process according to the signature verification result.

[0113] The hardware-accelerated signature verification system based on the external encryption module provided in the present application improves the efficiency and security of signature verification by handing over the signature verification process to the external encryption module for hardware acceleration. The integrity and legality of the image data are guaranteed, and malicious tampering of the image file is prevented. Through hardware acceleration, the CPU load is reduced and the system performance is improved.

[0114] In some optional implementations of this embodiment, the receiving module 303 is further configured to:

[0115] The external encryption module receives the data to be verified;

[0116] Using a preset encryption algorithm to perform signature verification on the data to be verified, and obtaining a signature verification result;

[0117] Feedback the verification result. If the verification is successful, return True; otherwise, return False.

[0118] The hardware-accelerated signature verification system based on the plug-in encryption module provided in this application realizes the system's judgment on the integrity of the image file by feeding back the signature verification result (True / False), thereby preventing invalid or tampered files from entering the system.

[0119] In some optional implementations of this embodiment, the receiving module 303 is further configured to:

[0120] Calculate a first hash value of the data to be verified using a hash algorithm;

[0121] Encrypt the first hash value using a private key of an RSA algorithm or an ECC algorithm to generate a digital signature;

[0122] Decrypt the digital signature using a public key of an RSA algorithm or an ECC algorithm to obtain a second hash value after decryption;

[0123] The first hash value and the second hash value are compared to see if they are the same. If they are the same, the data to be verified has not been tampered with; if they are different, the data to be verified has been tampered with.

[0124] The hardware-accelerated signature verification system based on the plug-in encryption module provided by this application calculates the file digest through the hash algorithm and combines it with public key encryption (such as RSA or ECC) to ensure the integrity and non-tampering of the data. The introduction of the hash algorithm reduces the processing burden of large data files and improves the efficiency of signature verification. In addition, the combination of public key encryption algorithms such as RSA / ECC ensures the high security of signature verification and prevents the file from being illegally tampered with.

[0125] In some optional implementations of this embodiment, the acquisition module 301 is further used to:

[0126] According to the preset system boot process, the image data that needs to be verified is identified;

[0127] Dividing the mirror data into a plurality of data blocks according to a preset size;

[0128] The data blocks are transmitted to the external encryption module block by block.

[0129] The hardware-accelerated signature verification system based on the plug-in encryption module provided by this application effectively avoids delays or memory overflow problems caused by large files during transmission by dividing large files (such as image data) into small blocks and transmitting them block by block. This block transmission method makes the signature verification process more flexible, and the system can verify the data block by block to ensure the integrity of each data block.

[0130] In some optional implementations of this embodiment, the acquisition module 301 is further used to:

[0131] The external encryption module verifies the integrity of the data blocks one by one or uniformly.

[0132] The hardware-accelerated signature verification system based on the plug-in encryption module provided by this application can detect the integrity of each block of data in real time and comprehensively by verifying each block of image data one by one or in a unified manner. This ensures that the data of the image file is not tampered with or damaged during the transmission and storage process, and enhances the security and reliability of the system.

[0133] In some optional implementations of this embodiment, the request module 302 is further configured to:

[0134] Establishing a communication connection with the external encryption module;

[0135] Send a signature verification request containing signature verification data to the encryption module, where the signature verification request includes a request type, signature data, and algorithm selection.

[0136] The hardware-accelerated signature verification system based on the plug-in encryption module provided by this application ensures that the encryption module can correctly receive and process the data to be verified by establishing a communication connection with the plug-in encryption module and sending a request containing the signature verification data. This step clearly specifies how to perform the signature verification operation through the encryption module, improving the automation and transparency of the system operation. The request sent includes the request type, signature data, and algorithm selection, making the signature verification process more flexible and supporting different encryption algorithms.

[0137] In some optional implementations of this embodiment, the determination module 304 is further configured to:

[0138] If verification fails or an exception occurs, an error code, warning message or retry mechanism will be fed back and a log will be recorded.

[0139] The hardware-accelerated signature verification system based on the plug-in encryption module provided by this application provides an error handling mechanism after signature verification fails, including feedback error code, warning information and retry mechanism, to ensure that the system can respond in time when signature verification fails or is abnormal, and prevent the system from continuing to start risky image files. The retry mechanism improves the system's fault tolerance, and the log records provide valuable data for subsequent troubleshooting. These measures greatly enhance the robustness of the system and ensure that the system can take appropriate remedial measures when faced with anomalies.

[0140] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0141] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0142] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0143] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. equipped on the computer device 4. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the hardware acceleration signature verification method based on the external encryption module. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0144] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for running the hardware-accelerated signature verification method based on the external encryption module.

[0145] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0146] The computer device provided by the present application improves the efficiency and security of signature verification by handing over the signature verification process to an external encryption module for hardware acceleration, thereby ensuring the integrity and legality of the image data and preventing malicious tampering with the image file. Through hardware acceleration, the CPU load is reduced and the system performance is improved.

[0147] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the hardware-accelerated signature verification method based on the external encryption module as described above.

[0148] The computer-readable storage medium provided by the present application improves the efficiency and security of signature verification by handing over the signature verification process to an external encryption module for hardware acceleration, thereby ensuring the integrity and legitimacy of the image data and preventing malicious tampering with the image file. Through hardware acceleration, the CPU load is reduced and the system performance is improved.

[0149] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0150] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A hardware accelerated signature verification method based on an external encryption module, characterized in that: The steps include: Obtain the image data that needs to be verified, and transmit the image data to the external encryption module; Send a signature verification request to the external encryption module, along with the data to be verified; Receiving the signature verification result of the external encryption module; Determine whether to continue the system boot process according to the signature verification result.

2. According to claim 1, the hardware accelerated signature verification method based on the external encryption module is characterized in that: Before the step of receiving the signature verification result of the external encryption module, the method further includes: The external encryption module receives the data to be verified; Using a preset encryption algorithm to perform signature verification on the data to be verified, and obtaining a signature verification result; Feedback the verification result. If the verification is successful, return True; otherwise, return False.

3. The hardware accelerated signature verification method based on an external encryption module according to claim 2 is characterized in that: The encryption algorithm includes but is not limited to the RSA algorithm and the ECC algorithm. The step of using the preset encryption algorithm to perform signature verification on the data to be verified and obtaining the signature verification result specifically includes: Calculate a first hash value of the data to be verified using a hash algorithm; Encrypt the first hash value using a private key of an RSA algorithm or an ECC algorithm to generate a digital signature; Decrypt the digital signature using a public key of an RSA algorithm or an ECC algorithm to obtain a second hash value after decryption; The first hash value and the second hash value are compared to see if they are the same. If they are the same, the data to be verified has not been tampered with; if they are different, the data to be verified has been tampered with.

4. The hardware accelerated signature verification method based on an external encryption module according to claim 1, characterized in that: The step of obtaining the image data that needs to be verified and transmitting the image data to the external encryption module specifically includes: According to the preset system boot process, the image data that needs to be verified is identified; Dividing the mirror data into a plurality of data blocks according to a preset size; The data blocks are transmitted to the external encryption module block by block.

5. The hardware accelerated signature verification method based on an external encryption module according to claim 4 is characterized in that: The image data includes a system image, an application image and a data image. After the step of transmitting the data blocks to the external encryption module block by block, the method further includes: The external encryption module verifies the integrity of the data blocks one by one or uniformly.

6. The hardware accelerated signature verification method based on an external encryption module according to claim 1, characterized in that: The step of sending a signature verification request to the external encryption module and carrying the data to be verified specifically includes: Establishing a communication connection with the external encryption module; Send a signature verification request containing signature verification data to the encryption module, where the signature verification request includes a request type, signature data, and algorithm selection.

7. The hardware accelerated signature verification method based on an external encryption module according to claim 1, characterized in that: After the step of determining whether to continue the system boot process according to the signature verification result, the method further includes: If verification fails or an exception occurs, an error code, warning message or retry mechanism will be fed back and a log will be recorded.

8. A hardware accelerated signature verification system based on an external encryption module, characterized in that: include: An acquisition module is used to acquire the image data that needs to be verified and transmit the image data to the external encryption module; A request module, used to send a signature verification request to the external encryption module, and carry the data to be verified; A receiving module, used to receive the signature verification result of the external encryption module; The judgment module is used to judge whether to continue the system boot process according to the signature verification result.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the hardware-accelerated signature verification method based on an external encryption module as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the hardware-accelerated signature verification method based on an external encryption module as described in any one of claims 1 to 7 are implemented.

Images