Integrity checking method, apparatus, device, and storage medium

Abstract

The present disclosure provides an integrity verification method and device, equipment and storage medium, relating to the technical field of computer. The method comprises: sending an integrity verification request to a universal flash memory (UFS) device in a first hardware, wherein the verification request contains an identifier of a first file; and performing an integrity verification operation on the first file based on the UFS device and a Merkle tree module in the first hardware. Thus, the hash calculation and verification process are integrated into the UFS device, which can significantly reduce the overall energy consumption of the system. This is of great significance to battery life and device heat dissipation, especially in mobile and portable devices, where the integrity verification can be performed in the UFS controller, significantly reducing CPU load, improving overall computing efficiency, avoiding excessive occupation of processor resources, and avoiding affecting the execution of other system tasks.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to an integrity verification method, apparatus, device, and storage medium. Background Technology

[0002] With the widespread use of mobile devices in daily life, ensuring the integrity of system files and the security of the system has become particularly important. Traditional software-based verification methods rely on the processor to perform hash calculations on the data, which can lead to a significant consumption of processor resources during large-scale data processing, affecting the execution of other system tasks. Summary of the Invention

[0003] This disclosure provides an integrity verification method, apparatus, device, and storage medium, which aims to at least partially solve one of the technical problems in the related art.

[0004] Firstly, this disclosure provides an integrity verification method, including:

[0005] Send an integrity verification request to the general-purpose flash UFS device in the first hardware, the verification request containing the identifier of the first file;

[0006] Based on the UFS device and the Merkle tree module in the first hardware, an integrity verification operation is performed on the first file.

[0007] Secondly, this disclosure provides an integrity verification device, comprising:

[0008] The sending module is used to send an integrity verification request to the general-purpose flash memory UFS device in the first hardware, wherein the verification request contains the identifier of the first file;

[0009] The verification module is used to perform an integrity verification operation on the first file based on the UFS device and the Merkle tree module in the first hardware.

[0010] Thirdly, this disclosure provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement an integrity verification method.

[0011] Fourthly, this disclosure provides a computer-readable storage medium that, when the instructions in the computer-readable storage medium are executed by the processor of an electronic device, enables the electronic device to perform an integrity verification method.

[0012] Fifthly, this disclosure provides a computer program product, including a computer program, wherein the computer program is executed by a processor using an integrity verification method.

[0013] In this embodiment, an integrity verification request is first sent to the Universal Flash Memory (UFS) device in the first hardware. This verification request contains the identifier of the first file. Then, based on the UFS device and the Merkle tree module in the first hardware, an integrity verification operation on the first file is performed. Thus, integrating the hash calculation and verification process into the UFS device significantly reduces overall system power consumption. This is significant for battery life and device heat dissipation, especially in mobile and portable devices. By performing integrity verification within the UFS controller, CPU load is significantly reduced, overall computing efficiency is improved, excessive processor resource consumption is avoided, and the execution of other system tasks is prevented.

[0014] Additional aspects and advantages of this disclosure will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this disclosure. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0016] Figure 1 This is a flowchart illustrating the integrity verification method according to the first embodiment of this disclosure;

[0017] Figure 2 This is a flowchart illustrating the integrity verification method according to the second embodiment of this disclosure;

[0018] Figure 3 This is another schematic flowchart illustrating the integrity verification method according to the second embodiment of this disclosure;

[0019] Figure 4 This is a flowchart illustrating the integrity verification method according to the third embodiment of this disclosure;

[0020] Figure 5 This is another schematic flowchart illustrating the integrity verification method according to the third embodiment of this disclosure;

[0021] Figure 6 This is a schematic diagram of the integrity verification device according to the fourth embodiment of this disclosure;

[0022] Figure 7 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown.

[0023] The accompanying drawings have illustrated specific embodiments of this disclosure, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concepts of this disclosure to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0024] Embodiments of this disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are used only to explain this disclosure, and should not be construed as limiting this disclosure. Rather, embodiments of this disclosure include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.

[0025] Integrity verification helps prevent unauthorized alterations and malicious operations, thus protecting device and data security. Integrity verification at boot time verifies whether the system has been tampered with during startup. Performing integrity verification during runtime is equally important. For example, devices can use digital signatures to verify the integrity of system files, ensuring they haven't been modified by malware. Furthermore, secure boot techniques can be employed to ensure that the firmware and drivers loaded at system startup are certified and tamper-proof. Additionally, IoT devices can use encryption to protect data integrity and privacy, and implement access control mechanisms to restrict modification and access to system files. Combining these security measures effectively improves the security and reliability of IoT devices.

[0026] dm-verity is a data integrity verification mechanism in the Android system. When using dm-verity, the file system is divided into fixed-size data blocks. For each data block, a hash value is calculated, and these hash values ​​are used to build a Merkle tree. The hash value of the root node of the Merkle tree is stored somewhere in the system. When reading data blocks stored in UFS or other storage media, the system calculates the hash value of the data block in real time and compares it with the pre-calculated hash value. If the two do not match, it means that the data block may have been tampered with or corrupted.

[0027] However, in a Merkle tree structure, for example, reading an address requires at least three hash256 calculations and comparisons to satisfy the corresponding integrity checks. These calculations increase the overall system's energy consumption, especially on mobile devices, reducing device uptime, degrading the user experience, and increasing latency. Furthermore, attackers could potentially exploit these calculations and comparisons, resulting in poor security.

[0028] To address the aforementioned issues, this disclosure proposes an integrity verification method that decouples the hash calculation and comparison processes from the CPU, instead assigning them to a dedicated hardware unit. This frees up CPU resources, reducing CPU load and power consumption. The hardware unit can complete the hash calculation and comparison operations in a short time, thereby improving the overall system processing speed and response time. Because the hash calculation and comparison processes are performed at the hardware level, attackers cannot compromise data integrity verification through software attacks, achieving faster, more energy-efficient, and more secure data integrity verification.

[0029] It should be noted that the execution subject of the integrity verification method in this embodiment is an integrity verification device, which can be implemented by software and / or hardware. The device can be configured in any electronic device, such as mobile phones, tablets, smartwatches, vehicles, and other mobile devices. Alternatively, the execution subject of the integrity verification method in this embodiment can also be the Linux kernel, which is not limited here.

[0030] Figure 1 This is a flowchart illustrating the integrity verification method according to the first embodiment of this disclosure, as shown below. Figure 1 As shown, the method includes:

[0031] S101: Send an integrity verification request to the general-purpose flash UFS device in the first hardware. The verification request contains the identifier of the first file.

[0032] UFS (Universal Flash Storage) devices can consist of a controller chip (UFS controller) and flash memory chips. The controller chip is responsible for managing data transmission, error detection and correction, command parsing, and other functions, while the flash memory chips are used to store data, and this is not limited to any particular function.

[0033] The UFS controller is a key component of a UFS device, responsible for managing and controlling various operations and functions. The UFS controller comprises a controller chip and related circuitry. The controller chip is the core of the UFS device, handling commands and data from the host and interacting with the flash memory chips. It also includes a built-in processor and memory for executing control algorithms and caching data to improve performance and reliability. Furthermore, the controller chip provides physical and data link layer functions for the UFS interface, ensuring correct data transmission and stable communication.

[0034] The first file can be a system file to be verified.

[0035] For example, IoT devices need to perform integrity checks when they are powered on. When users use IoT devices, they usually perform various operations, such as opening applications and modifying settings. During the use of IoT devices, the system needs to read various system files to perform operations, so integrity checks are also required during runtime.

[0036] The integrity verification request is used to request the UFS device to start integrity verification, and the identifier of the first file contained in the request indicates the system file to be verified.

[0037] For example, if a user wants to modify a setting X while using the device, they can use the file x associated with setting X as the first file, without any restrictions.

[0038] The first piece of hardware can be a mobile phone chip, an Internet of Things (IoT) chip, or an automotive chip, and there are no restrictions on this.

[0039] It should be noted that the UFS device can be located within the first hardware component. For example, if the first hardware component is a mobile phone chip, the chip contains many cores (IP cores) to perform specific functions, such as storage cores, processor cores, and memory controller cores; this is not limited to any one of these. The UFS device can be configured within any of these cores.

[0040] The identifier of the first document can be a symbol, letter, number, serial number or other form of information used to represent the first document, and can uniquely identify the first document, without any limitation.

[0041] Optionally, in response to determining that the first file is a system file to be used by the device, an integrity verification request is sent to the generic flash UFS device in the first hardware.

[0042] The system files to be used can be those required by the system when performing a certain operation. For example, if a user wants to open application A, the system file associated with application A can be the system file to be used, that is, the first file, without any restrictions.

[0043] S102: Based on the UFS device and the Merkle tree module in the first hardware, perform an integrity verification operation on the first file.

[0044] Merkle trees can be a type of hash tree structure.

[0045] In this embodiment of the disclosure, the Merkle tree module is referred to as MTU (Merkle Tree Unit) for the following description. MTU can be a component or module used to implement Merkle tree functionality.

[0046] Optionally, the Merkle tree module can be inlined in the UFS device, or the Merkle tree module and the UFS device can be located separately in the first hardware.

[0047] One possible approach is to divide the first file into different data blocks, calculate the hash value x for each data block, and determine the corresponding hash value y in the Merkle tree using the MTU. Then, compare and verify whether hash values ​​x and y match in the UFS device. If they match, the first file is complete and the data has not been tampered with, therefore it can be used. If they do not match, the first file may have been tampered with or corrupted, and the data is incomplete; therefore, it cannot be accessed or used. This approach is not limited here.

[0048] In this embodiment, an integrity verification request is first sent to the Universal Flash Memory (UFS) device in the first hardware. This verification request contains the identifier of a first file. Then, based on the UFS device and the Merkle tree module in the first hardware, an integrity verification operation on the first file is performed. Thus, integrating the hash calculation and verification process into the UFS device significantly reduces overall system power consumption. This is significant for battery life and device heat dissipation, especially in mobile and portable devices. By performing integrity verification within the UFS controller, CPU load is significantly reduced, overall computing efficiency is improved, and excessive processor resource consumption is avoided, preventing interference with other system tasks. This enhances system resilience, making it more difficult to be attacked externally or tampered with internally. Since critical verification steps are performed within the UFS controller, potential attackers have difficulty accessing these critical verification processes, thereby improving overall system security.

[0049] Figure 2 This is a flowchart illustrating the integrity verification method according to the second embodiment of this disclosure, as shown below. Figure 2 As shown, the method includes:

[0050] S201: Send an integrity verification request to the general-purpose flash memory UFS device in the first hardware. The verification request contains the identifier of the first file.

[0051] It should be noted that the specific implementation of step S201 can be referred to the above embodiments, and will not be repeated here.

[0052] S202: If the Merkle tree module is inline in the UFS device, determine the first storage address mapped to the first file in the UFS device.

[0053] If the Merkle tree module is inline within the UFS device, it means that the MTU is located within the UFS device.

[0054] The first storage address can be the block storage address of the UFS device.

[0055] Optionally, a driver can be run to read the system image address of the first file, which can then be used as the first storage address for mapping the first file in the UFS device.

[0056] The system image address can be the actual physical address of the system image in the system memory.

[0057] Here, a block storage address is an address used to access and locate data blocks on a storage device. In this embodiment of the disclosure, the first storage address can be the physical address of the file data block corresponding to the first file.

[0058] In UFS devices, system files are typically stored and managed in fixed-size blocks. Each block has a unique address, which allows for precise location and access to a specific data block.

[0059] In this embodiment of the disclosure, the system kernel can run the driver, then read the system image address of the first file, and use the system image address as the first storage address mapped by the first file in the UFS device.

[0060] S203: Based on the Merkle tree module inline in the UFS device, the first storage address is converted to the second storage address.

[0061] Optionally, the first memory address can be input into the Merkle tree module (MTU), and then the MTU can convert the first memory address into the second memory address through logical mapping transformation relationship, that is, it can perform mapping or calculation.

[0062] The second storage address can be the storage address of the first file in the Merkle tree.

[0063] S204: Obtain the file data of the first file to calculate the corresponding first hash value.

[0064] Optionally, the file data of the first file can be obtained from the file system based on the first storage address.

[0065] Specifically, the file data of the first file can be obtained from the file system based on the first storage address using a UFS device. The file system can be a system partition, with different areas storing data blocks of different files. In this embodiment, the data of the first file, i.e., the file data of the first file, can be read from the file system according to the first storage address corresponding to the first file.

[0066] The first hash value can be a hash value obtained by hashing the file data of the first file.

[0067] The hash value of the file data can be generated using a hash function. A hash function is an algorithm that maps data of any size to a hash value of fixed length, such as MD5, SHA-1, and SHA-256, but is not limited here.

[0068] It's important to note that since hash functions can only process data of a finite length at a time, the file data needs to be divided into appropriately sized blocks. Fixed-size or variable-length blocks can be used as input. Then, a hash operation can be performed on each data block, applying the chosen hash function to obtain its hash value. A hash function generates a hash value by taking each byte of the data block as input and performing a series of complex operations. If the file data has multiple blocks, the hash values ​​of each block can be combined into a larger data structure, such as a Merkle tree or a hash list. This allows for more efficient integrity verification during validation.

[0069] Optionally, if the first file contains only one data block, then the hash value of that block is the final hash value of the file. If a composite structure is used, the final hash value can be obtained by performing further hash operations on these structures; this is not limited here.

[0070] S205: Based on the second storage address, determine the second hash value corresponding to the first file from the pre-constructed Merkle tree.

[0071] The pre-built Merkle tree can contain reference hash values ​​corresponding to different files in the system. It should be noted that the hash values ​​for each file in the pre-built Merkle tree are pre-calculated values, representing the hash value of each file assuming the data is intact, unaltered, and undamaged.

[0072] The second hash value can be the hash value of the first file in the pre-built Merkle tree.

[0073] It should be noted that since the second storage address is the storage address of the first file in the Merkle tree, the second hash value corresponding to the first file can be determined from the pre-constructed Merkle tree through the second storage address.

[0074] S206: Based on the UFS device, perform integrity verification on the first file according to the first hash value and the second hash value.

[0075] Specifically, the first hash value and the second hash value can be compared and verified within the UFS device to determine if they match. If they match, the first file is complete and the data has not been tampered with, therefore the first file can be used. If they do not match, the first file may have been tampered with or corrupted, and the data is incomplete, therefore the first file cannot be accessed or used; this limitation is not specified here.

[0076] like Figure 3 As shown, Figure 3 This is a flowchart illustrating an integrity verification method according to an embodiment of this disclosure. The Merkle Tree Module (MTU) is inline within the UFS device. After sending a request (integrity verification request) to the UFS device, the first storage address mapped to the first file in the UFS device is determined, and a logical mapping conversion is performed based on the MTU. Then, the first storage address is converted to a second storage address. Subsequently, the UFS device reads the file data corresponding to the first file from the file system based on the first storage address, converts it to a first hash value, determines a second hash value from the Merkle tree based on the second storage address, and then performs the verification.

[0077] In this embodiment, an integrity verification request is first sent to the Universal Flash Memory (UFS) device in the first hardware. The verification request includes the identifier of the first file. If the Merkle tree module is inline in the UFS device, the first storage address mapped to the first file in the UFS device is determined. Then, based on the Merkle tree module inline in the UFS device, the first storage address is converted to a second storage address. Next, the file data of the first file is obtained to calculate the corresponding first hash value. Then, based on the second storage address, the second hash value corresponding to the first file is determined from the pre-built Merkle tree. Finally, based on the UFS device, the integrity of the first file is verified according to the first and second hash values. This ensures the consistency and integrity of the file data of the first file. Since the verification calculation is performed in the UFS device based on the first and second hash values, CPU power consumption is reduced, CPU load is significantly reduced, and overall computing efficiency is improved. Because the hash verification process is accelerated at the hardware level, the data reading and verification process is faster, greatly reducing the system latency when reading protected data.

[0078] Figure 4 This is a flowchart illustrating the integrity verification method according to the third embodiment of this disclosure, as shown below. Figure 4 As shown, the method includes:

[0079] S301: Send an integrity verification request to the general-purpose flash memory UFS device in the first hardware. The verification request contains the identifier of the first file.

[0080] S302: If the Merkle tree module and the UFS device are located separately in the first hardware, determine the first storage address mapped by the first file in the UFS device.

[0081] It should be noted that the specific implementation methods of steps S301 and S302 can be referred to the above embodiments, and will not be repeated here.

[0082] S303: Pass the first storage address to the Merkle tree module so that the first storage address can be converted into the second storage address by the Merkle tree module.

[0083] Optionally, since the Merkle tree module and the UFS device are located separately in the first hardware, the UFS device can pass the first storage address to the Merkle tree module (MTU). The MTU can then perform a logical mapping transformation based on the first storage address, that is, perform mapping or calculation to convert the first storage address into a second storage address. The MTU can then return the second storage address to the UFS device.

[0084] S304: Obtain the file data of the first file to calculate the corresponding first hash value.

[0085] S305: Based on the second storage address, determine the second hash value corresponding to the first file from the pre-constructed Merkle tree.

[0086] S306: Based on the UFS device, perform integrity verification on the first file according to the first hash value and the second hash value.

[0087] It should be noted that steps S304-S306 can be referred to the above embodiments, and will not be repeated here.

[0088] like Figure 5 As shown, Figure 5 This is a flowchart illustrating another integrity verification method according to an embodiment of this disclosure. In this method, the Merkle tree module and the UFS device are located separately in the first hardware. After sending a request (integrity verification request) to the UFS device, the first storage address mapped to the first file in the UFS device is determined. The UFS device passes the first storage address to the MTU, which performs logical mapping conversion and then converts the first storage address to a second storage address for the UFS device. Subsequently, the UFS device reads the file data corresponding to the first file from the file system based on the first storage address and converts it into a first hash value. Based on the second storage address, it determines a second hash value from the Merkle tree and then performs verification.

[0089] In this embodiment, an integrity verification request is first sent to the Universal Flash Memory (UFS) device in the first hardware. The verification request includes the identifier of the first file. If the Merkle tree module and the UFS device are located separately in the first hardware, the first storage address mapped to the first file in the UFS device is determined. Then, the first storage address is passed to the Merkle tree module to convert it into a second storage address. Next, the file data of the first file is obtained to calculate the corresponding first hash value. Then, based on the second storage address, the second hash value corresponding to the first file is determined from a pre-built Merkle tree. Finally, based on the UFS device, the integrity of the first file is verified according to the first and second hash values. This ensures the consistency and integrity of the file data of the first file. Since the verification calculation is performed in the UFS device based on the first and second hash values, CPU power consumption is reduced, significantly alleviating CPU load and improving overall computational efficiency. Because the hash verification process is accelerated at the hardware level, data reading and verification are faster, greatly reducing system latency when reading protected data.

[0090] Figure 6 This is a block diagram of an integrity verification device disclosed herein, such as... Figure 6 As shown, the integrity verification device 600 includes:

[0091] The sending module 610 is used to send an integrity verification request to the general-purpose flash memory UFS device in the first hardware, wherein the verification request contains the identifier of the first file;

[0092] The verification module 620 is used to perform an integrity verification operation on the first file based on the UFS device and the Merkle tree module in the first hardware.

[0093] Optionally, the Merkle tree module is inlined in the UFS device.

[0094] Alternatively, the Merkle tree module and the UFS device may be located separately in the first hardware.

[0095] Optionally, if the Merkle tree module and the UFS device are located separately in the first hardware, the verification module includes:

[0096] The first determining unit is configured to determine the first storage address mapped by the first file in the UFS device;

[0097] A conversion unit is used to pass the first storage address to the Merkle tree module so that the first storage address can be converted into a second storage address by the Merkle tree module;

[0098] The acquisition unit is used to acquire the file data of the first file in order to calculate the corresponding first hash value;

[0099] The second determining unit is used to determine the second hash value corresponding to the first file from a pre-constructed Merkle tree based on the second storage address;

[0100] The verification unit is used to perform integrity verification on the first file based on the UFS device, according to the first hash value and the second hash value.

[0101] Optionally, if the Merkle tree module is inlined in the UFS device, the verification module is specifically used for:

[0102] Determine the first storage address mapped to the first file in the UFS device;

[0103] Based on the Merkle tree module inlined in the UFS device, the first storage address is converted into a second storage address;

[0104] Obtain the file data of the first file to calculate the corresponding first hash value;

[0105] Based on the second storage address, the second hash value corresponding to the first file is determined from the pre-constructed Merkle tree;

[0106] Based on the UFS device, the integrity of the first file is verified according to the first hash value and the second hash value.

[0107] Optionally, the acquisition unit is specifically used for:

[0108] Based on the first storage address, the file data of the first file is obtained from the file system.

[0109] Optionally, the first determining unit is specifically used for:

[0110] Run the driver to read the system image address of the first file;

[0111] The system image address is used as the first storage address mapped by the first file in the UFS device.

[0112] Optionally, the sending module is specifically used for:

[0113] In response to determining that the first file is a system file to be used by the device, an integrity verification request is sent to the general-purpose flash UFS device in the first hardware.

[0114] In this embodiment, an integrity verification request is first sent to the Universal Flash Memory (UFS) device in the first hardware. This verification request contains the identifier of a first file. Then, based on the UFS device and the Merkle tree module in the first hardware, an integrity verification operation on the first file is performed. Thus, integrating the hash calculation and verification process into the UFS device significantly reduces overall system power consumption. This is significant for battery life and device heat dissipation, especially in mobile and portable devices. By performing integrity verification within the UFS controller, CPU load is significantly reduced, overall computing efficiency is improved, and excessive processor resource consumption is avoided, preventing interference with other system tasks. This enhances system resilience, making it more difficult to be attacked externally or tampered with internally. Since critical verification steps are performed within the UFS controller, potential attackers have difficulty accessing these critical verification processes, thereby improving overall system security.

[0115] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0116] Figure 7 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present disclosure is shown. Figure 7The electronic device 12 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0117] like Figure 7 As shown, the electronic device 12 is represented in the form of a general-purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, memory 28, and bus 18 connecting different system components (including memory 28 and processing unit 16).

[0118] Bus 18 represents one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any of the various bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0119] Electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0120] Memory 28 may include computer system readable media in the form of volatile memory, such as Random Access Memory (RAM) 30 and / or cache 32. Electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (… Figure 7 Not shown; usually referred to as a "hard drive"). Although Figure 7Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk") and an optical disc drive for reading and writing to a removable non-volatile optical disc (e.g., a compact disc read-only memory (CD-ROM), a digital video disc read-only memory (DVD-ROM), or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. Memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this disclosure.

[0121] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory 28. Such program modules 42 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of this disclosure.

[0122] Electronic device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and with one or more devices that enable a user to interact with electronic device 12, and / or with any device that enables electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 22. Furthermore, electronic device 12 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of electronic device 12 via bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0123] The processing unit 16 executes various functional applications and data processing by running programs stored in the memory 28, such as implementing the methods mentioned in the foregoing embodiments.

[0124] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0125] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0126] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of this disclosure includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of this disclosure pertain.

[0127] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0128] It should be understood that various parts of this disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0129] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0130] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0131] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present disclosure.

Claims

1. An integrity verification method, characterized in that, include: In response to determining that the first file is a system file to be used by the device, an integrity verification request is sent to the Universal Flash Memory (UFS) device in the first hardware; wherein, the integrity verification request is used to request the UFS device to start integrity verification, and the identifier of the first file contained in the integrity verification request indicates the system file to be verified; Based on the UFS device and the Merkle tree module in the first hardware, an integrity verification operation is performed on the first file. If the Merkle tree module and the UFS device are located separately in the first hardware, a driver is run to read the system image address of the first file. The system image address is determined as the first storage address mapped by the first file in the UFS device. The first storage address is passed to the Merkle tree module to convert it into a second storage address. Based on the first storage address, the file data of the first file is obtained from the file system to calculate the corresponding first hash value. Based on the second storage address, the second hash value corresponding to the first file is determined from a pre-built Merkle tree. Based on the UFS device, the integrity of the first file is verified according to the first hash value and the second hash value.

2. The method according to claim 1, characterized in that, If the Merkle tree module is inlined in the UFS device, the step of performing an integrity verification operation on the first file based on the UFS device and the Merkle tree module includes: Determine the first storage address mapped to the first file in the UFS device; Based on the Merkle tree module inlined in the UFS device, the first storage address is converted into a second storage address; Based on the first storage address, the file data of the first file is obtained from the file system to calculate the corresponding first hash value; Based on the second storage address, the second hash value corresponding to the first file is determined from the pre-constructed Merkle tree; Based on the UFS device, the integrity of the first file is verified according to the first hash value and the second hash value.

3. The method according to claim 2, characterized in that, Determining the first storage address mapped by the first file in the UFS device includes: Run the driver to read the system image address of the first file; The system image address is used as the first storage address mapped by the first file in the UFS device.

4. An integrity verification device, characterized in that, include: The sending module is configured to, in response to determining that the first file is a system file to be used by the device, send an integrity verification request to the general-purpose flash memory (UFS) device in the first hardware, wherein the verification request contains an identifier of the first file; The verification module is used to perform an integrity verification operation on the first file based on the UFS device and the Merkle tree module in the first hardware. Specifically, if the Merkle tree module and the UFS device are located separately in the first hardware, a driver is run to read the system image address of the first file; the system image address is determined as the first storage address mapped by the first file in the UFS device; the first storage address is passed to the Merkle tree module to convert it into a second storage address; based on the first storage address, file data of the first file is obtained from the file system to calculate the corresponding first hash value; based on the second storage address, a second hash value corresponding to the first file is determined from a pre-built Merkle tree; and based on the UFS device, the integrity of the first file is verified according to the first hash value and the second hash value.

5. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-3.

Images