Safe starting method and device for microprocessor of autonomous controllable power secondary equipment

Abstract

The invention discloses a method and a device for safely starting a microprocessor of autonomous controllable power secondary equipment. The method comprises the following steps: respectively generating signature application programs or key files of all microprocessors of the power secondary equipment in an off-line manner from a program publishing server; obtaining a first signature code from the signature application program or the key file, and calculating a first digest value of each signature application program or key file by using a software national cryptographic algorithm; performing signature verification operation on the first signature code and the first abstract value of each signature application program or key file, and updating the application program or key file of each microprocessor of the power secondary equipment; after all application programs or key files of the power secondary equipment are updated, the equipment is restarted, and credible starting measurement is carried out on the operating environment of the first microprocessor operating system; and credible starting measurement is carried out on bare core operation environments of the second microprocessor and the third microprocessor, so that safe starting of all the microprocessors of the power secondary equipment is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of secure startup of secondary power equipment, and more particularly, to a method and device for secure startup of a microprocessor of secondary power equipment with independent controllability. Background Art

[0002] A substation is an important carrier for ensuring the safe and stable operation of the power grid. At present, the information security of substations mainly focuses on boundary protection, and the security protection of the secondary power equipment itself is insufficient, unable to effectively cope with unknown viruses or attack behaviors that penetrate network isolation measures through means such as covert channels.

[0003] The secondary power equipment is located within a structured boundary protection fence and is an important target for organized cyberattacks on the power system. Once breached, it will cause inestimable harm to the power grid. At present, the country continues to strengthen research on key core technologies, and independent controllable technologies and core products represented by microprocessors and operating systems are constantly developing, providing good basic conditions for realizing the security of the secondary power equipment in substations.

[0004] Trusted measurement is an effective means to achieve the security of secondary power equipment. However, at present, the trusted measurement method for secondary power equipment only targets the management CPU running the operating system, and fails to include the protection CPU and intelligent CPU running in the bare core that carry core control and real-time interaction functions in the trusted measurement scope. In addition, trusted measurement generally only performs integrity verification on application programs, and does not verify the source legality of application programs, or the signature verification process is imperfect, there is a risk that the attacker can easily bypass it, resulting in the overall failure of the trusted verification measurement mechanism. Summary of the Invention

[0005] Aiming at the deficiencies of the prior art, the present invention provides a method and device for secure startup of a microprocessor of secondary power equipment with independent controllability.

[0006] According to one aspect of the present invention, a method for secure startup of a microprocessor of secondary power equipment with independent controllability is provided, including:

[0007] Offline generating signature application programs or key files for all microprocessors of secondary power equipment from a program release server, where the microprocessors include: a first microprocessor, a second microprocessor, and a third microprocessor, wherein the first microprocessor runs management task applications based on the operating system mode; the second microprocessor runs strong real-time task applications based on the bare core mode; the third microprocessor runs real-time communication service applications based on the bare core mode, and a first trusted chip is deployed on the program release server;

[0008] Transfer the signature application or critical file to the secondary power equipment. Obtain the first signature code from the signature application or critical file through the first microprocessor, and calculate the first digest value of each signature application or critical file using the software national cryptography algorithm. A second trusted chip is deployed on the secondary power equipment.

[0009] Perform signature verification operations on the first signature code and the first digest value of each signature application or critical file through the second trusted chip. When the signature verification passes, update the application or critical file of each microprocessor of the secondary power equipment.

[0010] After all the applications or critical files of the secondary power equipment are updated, restart the device, and perform a trusted boot measurement on the operating system running environment of the first microprocessor through the second trusted chip.

[0011] When the trusted boot measurement of the first microprocessor passes, perform a trusted boot measurement on the bare-metal running environment of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor. When the trusted boot measurements of the second microprocessor and the third microprocessor pass, achieve the secure boot of all microprocessors of the secondary power equipment.

[0012] Optionally, separately generate the signature applications or critical files of all microprocessors of the secondary power equipment offline from the program release server, including:

[0013] Use the offline tool of the program release server to call the function interface of the first trusted chip to generate a pair of public and private keys inside the first trusted chip.

[0014] Store the private key in the pair of public and private keys inside the first trusted chip, and export the public key in the pair of public and private keys to the second trusted chip of the secondary power equipment.

[0015] Transfer the signature applications or critical files to be signed of all microprocessors of the secondary power equipment to the program release server.

[0016] Calculate the signature code of the signature application or critical file to be signed through the private key and attach it to a specific position of the signature application or critical file to be signed, generating the signature applications or critical files with signature information of all microprocessors.

[0017] Optionally, perform signature verification operations on the first signature code and the first digest value of each signature application or critical file, including:

[0018] When the signature verification fails, prohibit the update and upgrade of the application or critical file of the microprocessor of the secondary power equipment.

[0019] Optionally, after all application programs or key files of the secondary power equipment are updated, restart the equipment, and perform a trusted startup measurement on the operating environment of the first microprocessor through the second trusted chip, including:

[0020] Obtain the first signature code for each signed application program or key file on the first microprocessor and calculate the first digest value;

[0021] Transfer the first signature code and the first digest value of the first microprocessor to the second trusted chip;

[0022] Call the function interface of the second trusted chip, and use the pre-stored public key to perform signature verification operations on the first signature code and the first digest value of each signed application program or key file on the first microprocessor.

[0023] Optionally, perform a trusted startup measurement on the bare-metal operating environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor, including:

[0024] Start the second microprocessor and the third microprocessor and run the static measurement program to read the signed application programs or key files of the second microprocessor and the third microprocessor, and obtain the second signature code;

[0025] Use the software national cryptography algorithm to calculate the second digest value for the signed application programs or key files of the second microprocessor and the third microprocessor;

[0026] Transmit the second signature code and the second digest value to the second trusted chip through the first microprocessor that has been successfully measured;

[0027] Call the function interface of the second trusted chip, and use the pre-stored public key to perform signature verification operations on the second signature code and the second digest value of each signed application program or key file;

[0028] Determine whether the bare-metal operating environments of the second microprocessor and the third microprocessor pass the trusted startup measurement according to the signature verification result.

[0029] According to another aspect of the present invention, there is provided a microprocessor secure startup device for an autonomous and controllable secondary power equipment, including:

[0030] A generation module, configured to separately and offline generate signed application programs or key files for all microprocessors of the secondary power equipment from a program release server. The microprocessors include: a first microprocessor, a second microprocessor, and a third microprocessor. The first microprocessor runs management task applications based on an operating system mode; the second microprocessor runs strong real-time task applications based on a bare-metal mode; the third microprocessor runs real-time communication service applications based on a bare-metal mode, and a first trusted chip is deployed on the program release server;

[0031] A calculation module, configured to transmit a signature application or a key file to a secondary power device, obtain a first signature code from the signature application or the key file through a first microprocessor, and calculate a first digest value of each signature application or key file by using a national cryptographic algorithm for software, wherein a second trusted chip is deployed on the secondary power device;

[0032] A signature verification module, configured to perform a signature verification operation on the first signature code and the first digest value of each signature application or key file through the second trusted chip, and update the application program or key file of each microprocessor of the secondary power device when the signature verification is passed;

[0033] A measurement module, configured to restart the device after all application programs or key files of the secondary power device are updated, and perform a trusted boot measurement on the operating environment of the first microprocessor operating system through the second trusted chip;

[0034] A boot module, configured to perform a trusted boot measurement on the bare-metal operating environment of a second microprocessor and a third microprocessor through the second trusted chip and the first microprocessor when the trusted boot measurement of the first microprocessor passes, and implement secure boot of all microprocessors of the secondary power device when the trusted boot measurements of the second microprocessor and the third microprocessor pass.

[0035] According to another aspect of the present invention, there is provided a computer-readable storage medium storing a computer program for executing the method according to any one of the above aspects of the present invention.

[0036] According to another aspect of the present invention, there is provided an electronic device including: a processor; a memory for storing executable instructions of the processor; the processor is configured to read the executable instructions from the memory and execute the instructions to implement the method according to any one of the above aspects of the present invention.

[0037] Therefore, the present application provides a method for secure boot of a microprocessor of a self - controllable power secondary device. First, perform an operation of generating a signature file offline on the program release server for the power secondary device application program or key files; then transfer the signature application program or key files with signature information generated offline to the power secondary device, and the program update and upgrade module on the power secondary device calls the function interface of the second trusted chip of the device to verify the signature of the application program or key files to check the integrity and source legality. Only after the verification result passes, is it allowed to update the device application program or key files; finally, restart the device. When the device starts, the measurement agent module of the first microprocessor of the second trusted chip of the device completes the trusted boot measurement of the operating system environment step by step, and then the first microprocessor verification module and the static measurement program of the bare - core processor BootLoader jointly complete the trusted boot measurement of the application programs on the second microprocessor and the third microprocessor, realizing the trusted boot of the microprocessors in the device, including the operating system of the first microprocessor and the bare - core operating environments such as the second microprocessor and the third microprocessor. It can eliminate the security risks of incomplete trusted measurement chain of the device and imperfect verification of application program legality, fill the technical gap that the power secondary device does not perform trusted measurement on the bare - core operating environment, ensure the security of the device operating environment at the system level, and improve the ability of the power secondary device to resist external attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The exemplary embodiments of the present invention can be more fully understood by referring to the following drawings:

[0039] Figure 1 is a flowchart of the method for secure boot of a microprocessor of a self - controllable power secondary device provided by an exemplary embodiment of the present invention;

[0040] Figure 2 is a structural diagram of the method for secure boot of a microprocessor of a self - controllable power secondary device provided by an exemplary embodiment of the present invention;

[0041] Figure 3 is a structural diagram of the device for secure boot of a microprocessor of a self - controllable power secondary device provided by an exemplary embodiment of the present invention;

[0042] Figure 4 is the structure of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0043] Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments of the present invention. It should be understood that the present invention is not limited by the exemplary embodiments described herein.

[0044] It should be noted that: Unless otherwise specifically stated, the relative arrangements, numerical expressions, and numerical values of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0045] Those skilled in the art can understand that terms such as "first", "second", etc. in the embodiments of the present invention are only used to distinguish different steps, devices, or modules, etc., and neither represent any specific technical meaning nor indicate an inevitable logical order between them.

[0046] It should also be understood that in the embodiments of the present invention, "a plurality of" may refer to two or more, and "at least one" may refer to one, two, or more.

[0047] It should also be understood that for any component, data, or structure mentioned in the embodiments of the present invention, without clear definition or contrary indication in the context, it can generally be understood as one or more.

[0048] In addition, the term "and / or" in the present invention is merely a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in the present invention generally represents an "or" relationship between the associated objects before and after.

[0049] It should also be understood that the present invention emphasizes the differences between the various embodiments, and their similarities or similarities can be referred to each other. For the sake of brevity, they will not be elaborated one by one.

[0050] At the same time, it should be understood that for the convenience of description, the dimensions of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0051] The following description of at least one exemplary embodiment is actually merely illustrative and in no way limits the present invention and its application or use.

[0052] Techniques, methods, and devices known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, the techniques, methods, and devices should be regarded as part of the specification.

[0053] It should be noted that: Similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0054] Embodiments of the present invention can be applied to electronic devices such as terminal devices, computer systems, servers, etc., which can operate together with many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, servers, etc. include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, minicomputer systems, mainframe computer systems, and distributed cloud computing technology environments including any of the above systems, and so on.

[0055] Electronic devices such as terminal devices, computer systems, servers, etc. can be described in the general context of computer system-executable instructions (such as program modules) executed by a computer system. Generally, program modules can include routines, programs, target programs, components, logics, data structures, etc., which perform specific tasks or implement specific abstract data types. The computer system / server can be implemented in a distributed cloud computing environment, where tasks are executed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules can be located on local or remote computing system storage media including storage devices.

[0056] Exemplary method

[0057] Figure 1 is a schematic flowchart of a method for secure startup of a microprocessor of a self-controlled and controllable secondary power device provided by an exemplary embodiment of the present invention. This embodiment can be applied to an electronic device, such as Figure 1 As shown, the method 100 for secure startup of a microprocessor of a self-controlled and controllable secondary power device includes the following steps:

[0058] Step 101, separately offline generate signature application programs or key files for all microprocessors of the secondary power device from a program release server. The microprocessors include: a first microprocessor, a second microprocessor, and a third microprocessor. The first microprocessor runs a management task application program based on an operating system mode; the second microprocessor runs a strong real-time task application program based on a bare-metal mode; the third microprocessor runs a real-time communication service application program based on a bare-metal mode, and a first trusted chip is deployed on the program release server.

[0059] Optionally, separately offline generate signature application programs or key files for all microprocessors of the secondary power device from a program release server, including:

[0060] Use the offline tool of the program release server to call the function interface of the first trusted chip to generate a pair of public and private keys inside the first trusted chip;

[0061] Store the private key in the first trusted chip of the public-private key pair, and export the public key in the public-private key pair to the second trusted chip of the secondary power equipment;

[0062] Transfer the application programs or critical files to be signed of all microprocessors of the secondary power equipment to the program release server;

[0063] Calculate the signature code of the application program or critical file to be signed through the private key and attach it to a specific position of the application program or critical file to be signed, generating the signed application program or critical file with signature information for all microprocessors.

[0064] Among them, the first microprocessor (hereinafter referred to as the management CPU) runs management task application programs with low real-time requirements such as human-computer interaction, event recording, and status monitoring based on the operating system mode; the second microprocessor (hereinafter referred to as the protection CPU) runs strong real-time task application programs such as protection logic and core function algorithms based on the bare core mode; the third microprocessor (hereinafter referred to as the intelligent CPU) runs real-time communication service application programs such as digital sampling and distributed expansion based on the bare core mode, and the first trusted chip is deployed on the program release server.

[0065] Specifically, as shown in Figure 2 Generate the signature file offline. First, deploy the first trusted chip on the program release server and deploy the second trusted chip on the management CPU of the secondary power equipment. Then, on the program release server where the first trusted chip has been deployed and the running state is trusted, use the offline tool to call the function interface of the server's first trusted chip to generate a pair of public-private keys (only generated once) inside the first trusted chip. The private key is stored inside the first trusted chip and physically protected by the chip and cannot be accessed; the public key is exported outside the server, and the public key is imported into the second trusted chip on the device side for secure storage during in-plant production debugging of the device management CPU. Finally, transfer the application programs or critical files to be signed of the device to the program release server. On the server, use the offline tool to call the function interface of the server's first trusted chip, calculate the signature code for the device application program or critical file using the private key inside the first trusted chip, and then attach the signature code to a specific position of the original device application program or critical file to generate the signed application program or critical file with signature information.

[0066] Among them, the trust measurement function of the first trusted chip ensures that the server has the active immune protection ability and is in a trusted running state; the second trusted chip uses an external TPCM or a security core built into a multi-core processor chip. It serves as the source of device trust during the power-on startup phase of the secondary power equipment, and transfers the trustworthiness step by step through the trust transfer mechanism from the trusted chip, the system boot program of the management CPU, the operating system kernel, and the applications on the management CPU until the trusted startup of the operating system running environment of the management CPU is completed; and then further extends the trustworthiness to the bare-metal running environments of the protection CPU and the intelligent CPU through bare-metal trusted startup, realizing the complete microprocessor secure startup of the device.

[0067] The offline tool refers to the tool software running on the program release server. Its main function is to access the function interface of the first trusted chip on the server to obtain various cryptographic services provided by the first trusted chip, including generating signature verification public and private keys, exporting the verification public key, calculating the signature information of the file to be signed, and outputting a new file with the signature information.

[0068] Step 102: Transfer the signature application or key file into the secondary power equipment. Obtain the first signature code from the signature application or key file through the first microprocessor, and calculate the first digest value of each signature application or key file using the national cryptographic algorithm for software, where the second trusted chip is deployed on the secondary power equipment.

[0069] Step 103: Use the second trusted chip to perform a signature verification operation on the first signature code and the first digest value of each signature application or key file, and update the application or key file of each microprocessor of the secondary power equipment in the case of successful signature verification.

[0070] Optionally, after performing the signature verification operation on the first signature code and the first digest value of each signature application or key file, it further includes:

[0071] Transfer the first signature code and the first digest value of each microprocessor into the second trusted chip;

[0072] Call the function interface of the second trusted chip, and use the pre-stored public key to perform a signature verification operation on the first signature code and the first digest value of each signature application or key file.

[0073] Specifically, refer to Figure 2As shown in the figure, for the update and upgrade of device applications or critical files, first, the signed application or critical file with signature information generated offline is transmitted to the secondary power device. Then, the protection CPU program upgrade module of the secondary power device obtains the first signature code (where the first signature code is the signature code identified during the update process) from the specified location of the received file, and calculates the first digest value of the file (where the first digest value is the digest value calculated during the update process) using the national cryptographic algorithm for software. Finally, the management CPU program upgrade module transmits the first signature code and the first digest value to the second trusted chip, calls the function interface of the second trusted chip, and performs signature verification operations using the public key pre-stored in the chip. Only after the signature verification result passes is the update of the application or critical file of the secondary power device allowed; otherwise, the update and upgrade of the device application or critical file are prohibited.

[0074] The secondary power device generally adopts the architecture mode of management CPU + protection CPU + intelligent CPU. The functions of the management CPU are deployed on the CPU board or the management core of the CPU board. The functions of the protection CPU are deployed on the DSP board or the protection core of the CPU board. The functions of the intelligent CPU are deployed on an independent intelligent board. The management CPU conducts data interaction with the protection CPU and the intelligent CPU through the internal bus, and the management CPU uniformly manages the startup and program update and upgrade of all boards of the secondary power device.

[0075] Step 104: After all the applications or critical files of the secondary power device are updated, restart the device, and conduct a trusted startup measurement on the operating environment of the first microprocessor operating system through the second trusted chip.

[0076] Step 105: When the trusted startup measurement of the first microprocessor passes, conduct a trusted startup measurement on the bare-metal operating environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor. When the trusted startup measurements of the second microprocessor and the third microprocessor pass, achieve the secure startup of all the microprocessors of the secondary power device.

[0077] Optionally, conducting a trusted startup measurement on the bare-metal operating environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor includes:

[0078] Start the second microprocessor and the third microprocessor and run the static measurement program to read the signed application or critical file of the second microprocessor and the third microprocessor, and obtain the second signature code;

[0079] Calculate the second digest value for the signed application or critical file of the second microprocessor and the third microprocessor using the national cryptographic algorithm for software;

[0080] Transmit the second signature code and the second digest value to the second trusted chip through the first microprocessor that has been successfully measured;

[0081] Call the function interface of the second trusted chip, and use the pre-stored public key to perform signature verification operations on the second signature code and the second digest value of each signature application or key file;

[0082] Determine whether the running environments of the second microprocessor and the third microprocessor bare core pass the trusted boot measurement according to the signature verification result.

[0083] Specifically, as shown in Figure 2 For the trusted boot measurement of the device, each time the device starts up, it will sequentially perform trusted boot measurements on the operating system running environment and the bare core running environment. The process of the trusted boot measurement of the operating system running environment of the management CPU by the second trusted chip of the device is similar to most trusted boot methods and will not be elaborated here. Trusted boot measurement of the bare core running environment: First, add a static measurement program to the BootLoader of the protected CPU and the intelligent CPU, start the bare core processors on the protected CPU and the intelligent CPU, and run the static measurement program in the BootLoader after startup. The static measurement program will read the second signature code of the bare core application (where the second signature code is the signature code identified during the trusted boot measurement process) and calculate the second digest value of the bare core application through the software national cryptography algorithm (where the second digest value is the digest value identified during the trusted boot measurement process), and transmit the second signature code and the second digest value to the management CPU that has been successfully measured. Then, the signature code and the digest value are passed into the second trusted chip by the verification module of the management CPU, and the function interface of the second trusted chip is called to perform signature verification on the bare core application using the pre-stored public key in the second trusted chip. Finally, the management CPU returns the signature verification result to the bare core processor. If the signature verification passes, the BootLoader is allowed to load and run the bare core applications of the protected CPU and the intelligent CPU; otherwise, the loading and running of the bare core applications are prohibited.

[0084] The second trusted chip serves as the source of device trust during the power-on startup stage of the secondary power equipment. Through the hierarchical trust transfer mechanism, the trustworthiness is transferred step by step from the trusted chip, the system boot program of the management CPU, the operating system kernel, and the applications on the management CPU until the trusted boot of the operating system running environment of the management CPU is completed. This process is similar to the trusted boot method of general computers; furthermore, through the trusted boot of the bare core, the trustworthiness is extended to the bare core running environments of the protected CPU and the intelligent CPU, realizing the secure startup of the complete microprocessors of the device.

[0085] The static measurement program in the BootLoader is the firmware program of the bare-core processor and must be burned through a dedicated program burner or pre-burned. Generally, when the board is produced, the soldering of the program burning port is cancelled and the startup chip loaded with the BootLoader is set to read-only mode. Therefore, the BootLoader program cannot be replaced or modified and can be considered secure.

[0086] Therefore, the present application provides a secure startup method for the microprocessor of the autonomous and controllable secondary power equipment. First, perform an off-line signature file generation operation on the device application program or key file on the program release server; then transfer the off-line generated device application program or key file with signature information to the secondary power equipment. The program update and upgrade module on the secondary power equipment calls the function interface of the second trusted chip on the device to verify the signature of the application program or key file to verify the integrity and source legality. Only after the verification result passes is it allowed to update the device application program or key file; finally, restart the device. When the device starts up, the second trusted chip on the device and the measurement agent module of the management CPU complete the trusted startup measurement of the operating system environment step by step, and then the management CPU verification module and the static measurement program of the bare-core processor BootLoader jointly complete the trusted startup measurement of the application programs on the protected CPU and the intelligent CPU, realizing the trusted startup of the microprocessor in the device, including the operating system of the management CPU and the bare-core operating environments such as the protected CPU and the intelligent CPU. It can eliminate the security risks of incomplete device trusted measurement chains and imperfect application program legality verification, fill the technical gap of the lack of trusted measurement for the bare-core operating environment in secondary power equipment, ensure the security of the device operating environment at the system level, and improve the ability of secondary power equipment to resist external attacks.

[0087] Exemplary device

[0088] Figure 3 It is a schematic structural diagram of a secure startup device for the microprocessor of the autonomous and controllable secondary power equipment provided by an exemplary embodiment of the present invention. As Figure 3 shown, the device 300 includes:

[0089] A generation module 310, configured to respectively generate off-line signature application programs or key files for all microprocessors of the secondary power equipment from the program release server. The microprocessors include: a first microprocessor, a second microprocessor, and a third microprocessor. The first microprocessor runs management task application programs based on the operating system mode; the second microprocessor runs strong real-time task application programs based on the bare-core mode; the third microprocessor runs real-time communication service application programs based on the bare-core mode, and a first trusted chip is deployed on the program release server;

[0090] The calculation module 320 is used to transmit the signature application or critical file to the secondary power equipment, obtain the first signature code from the signature application or critical file through the first microprocessor, and calculate the first digest value of each signature application or critical file by using the national cryptographic algorithm of software, where a second trusted chip is deployed on the secondary power equipment;

[0091] The signature verification module 330 is used to perform signature verification operations on the first signature code and the first digest value of each signature application or critical file through the second trusted chip, and update the application or critical file of each microprocessor of the secondary power equipment when the signature verification passes;

[0092] The measurement module 340 is used to restart the device after all the applications or critical files of the secondary power equipment are updated, and perform trusted boot measurement on the operating environment of the first microprocessor operating system through the second trusted chip;

[0093] The startup module 350 is used to perform trusted boot measurement on the bare-metal operating environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor when the trusted boot measurement of the first microprocessor passes, and achieve secure startup of all microprocessors of the secondary power equipment when the trusted boot measurements of the second microprocessor and the third microprocessor pass.

[0094] Optionally, the generation module 310 includes:

[0095] The first generation sub-module is used to call the function interface of the first trusted chip by using the offline tool of the program release server to generate a pair of public and private keys inside the first trusted chip;

[0096] The export sub-module is used to store the private key in the pair of public and private keys inside the first trusted chip, and export the public key in the pair of public and private keys to the second trusted chip of the secondary power equipment;

[0097] The first incoming sub-module is used to transmit the signature application or critical file to be signed of all microprocessors of the secondary power equipment to the program release server;

[0098] The second generation sub-module is used to calculate the signature code of the signature application or critical file to be signed through the private key and attach it to a specific position of the signature application or critical file to be signed, and generate the signature application or critical file with signature information of all microprocessors.

[0099] Optionally, the signature verification module 330 includes:

[0100] The prohibition module is used to prohibit the update and upgrade of the application or critical file of the microprocessor of the secondary power equipment when the signature verification fails.

[0101] Optionally, the metric module 340 includes:

[0102] A first calculation sub-module for obtaining the first signature code for each of the signature applications or key files on the first microprocessor and calculating the first digest value;

[0103] A second input sub-module for passing the first signature code and the first digest value of the first microprocessor to the second trusted chip;

[0104] A first signature verification sub-module for calling the function interface of the second trusted chip and performing a signature verification operation on the first signature code and the first digest value of each of the signature applications or key files on the first microprocessor using the pre-stored public key.

[0105] Optionally, the startup module 350 performs a trusted startup metric on the bare-metal running environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor, including:

[0106] A reading sub-module for starting the second microprocessor and the third microprocessor and running a static metric program to read the signature applications or key files of the second microprocessor and the third microprocessor to obtain the second signature code;

[0107] A calculation sub-module for calculating the second digest value for the signature applications or key files of the second microprocessor and the third microprocessor using a software national cryptography algorithm;

[0108] A transmission sub-module for transmitting the second signature code and the second digest value to the second trusted chip through the first microprocessor that has been successfully metricated;

[0109] A second signature verification sub-module for calling the function interface of the second trusted chip and performing a signature verification operation on the second signature code and the second digest value of each signature application or key file using the pre-stored public key;

[0110] A decision sub-module for determining whether the bare-metal running environments of the second microprocessor and the third microprocessor pass the trusted startup metric according to the signature verification result.

[0111] Exemplary electronic device

[0112] Figure 4 is the structure of an electronic device provided by an exemplary embodiment of the present invention. As Figure 4 shown, the electronic device 40 includes one or more processors 41 and a memory 42.

[0113] The processor 41 can be a central processing unit (CPU) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and can control other components in the electronic device to perform desired functions.

[0114] The memory 42 can include one or more computer program products, and the computer program products can include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory can include, for example, random access memory (RAM) and / or cache memory, etc. The non-volatile memory can include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions can be stored on the computer-readable storage media, and the processor 41 can run the program instructions to implement the methods of the software programs of the various embodiments of the present invention described above and / or other desired functions. In one example, the electronic device can further include: an input device 43 and an output device 44, and these components are interconnected through a bus system and / or other forms of connection mechanisms (not shown).

[0115] In addition, the input device 43 can further include, for example, a keyboard, a mouse, and so on.

[0116] The output device 44 can output various information to the outside. The output device 44 can include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0117] Of course, for simplicity, Figure 4 only some of the components related to the present invention in the electronic device are shown, and components such as buses, input / output interfaces, etc. are omitted. In addition, according to specific application scenarios, the electronic device can further include any other appropriate components.

[0118] Exemplary computer program product and computer-readable storage medium

[0119] In addition to the above methods and devices, the embodiments of the present invention can also be computer program products, which include computer program instructions that, when run by a processor, cause the processor to execute the steps in the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above in this specification.

[0120] The computer program product can be written in any combination of one or more programming languages for executing the program code of the operations of the embodiments of the present invention. The programming languages include object-oriented programming languages such as Java, C++, etc., and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, executed as an independent software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0121] In addition, an embodiment of the present invention can also be a computer-readable storage medium storing computer program instructions, and when the computer program instructions are run by a processor, the processor is caused to execute the steps in the methods according to various embodiments of the present invention described in the "Exemplary Method" section above in this specification.

[0122] The computer-readable storage medium can adopt any combination of one or more readable media. The readable media can be a readable signal medium or a readable storage medium. The readable storage medium can, for example, include but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0123] The basic principles of the present invention have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, benefits, effects, etc. mentioned in the present invention are only examples and not limitations, and it cannot be considered that these advantages, benefits, effects, etc. are essential for each embodiment of the present invention. In addition, the above-disclosed specific details are only for illustrative and facilitating understanding purposes and are not limitations. The above details do not limit the present invention to necessarily adopt the above specific details for implementation.

[0124] Each embodiment in this specification is described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. For the same or similar parts among the embodiments, reference can be made to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and reference can be made to the relevant part of the method embodiment for the relevant content.

[0125] The block diagrams of the devices, systems, apparatuses, and systems involved in the present invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, apparatuses, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open-ended words meaning "including but not limited to" and can be used interchangeably with each other. The word "or" and "and" used herein refer to the word "and / or" and can be used interchangeably with each other unless the context clearly indicates otherwise. The phrase "such as" used herein refers to the phrase "such as but not limited to" and can be used interchangeably with each other.

[0126] The methods and systems of the present invention can be implemented in many ways. For example, the methods and systems of the present invention can be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of the steps for the methods is for illustration only, and the steps of the methods of the present invention are not limited to the specific order described above unless otherwise specifically stated. In addition, in some embodiments, the present invention can also be implemented as a program recorded in a recording medium, and these programs include machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers a recording medium storing a program for executing the methods according to the present invention.

[0127] It should also be noted that in the systems, apparatuses, and methods of the present invention, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the present invention. Therefore, the present invention is not intended to be limited to the aspects shown herein, but rather to the broadest scope consistent with the principles and novel features disclosed herein.

[0128] The above description has been given for purposes of illustration and description. In addition, this description is not intended to limit the embodiments of the present invention to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions, and sub-combinations thereof.

Claims

1. A secure startup method for the microprocessor of a second-generation power equipment with independent control and reliability, characterized in that Including: Separately generating signature application programs or key files for all microprocessors of secondary power equipment offline from a program release server. The microprocessors include: a first microprocessor, a second microprocessor, and a third microprocessor. Among them, the first microprocessor runs a management task application program based on an operating system mode; the second microprocessor runs a strong real-time task application program based on a bare-metal core mode; the third microprocessor runs a real-time communication service application program based on a bare-metal core mode, and a first trusted chip is deployed on the program release server; Transferring the signature application program or key file into the secondary power equipment, obtaining a first signature code from the signature application program or key file through the first microprocessor, and calculating a first digest value of each signature application program or key file using a software national cryptography algorithm. A second trusted chip is deployed on the secondary power equipment; Performing a signature verification operation on the first signature code and the first digest value of each signature application program or key file through the second trusted chip, and updating the application program or key file of each microprocessor of the secondary power equipment when the signature verification passes; After all application programs or key files of the secondary power equipment are updated, restarting the device, and performing a trusted boot measurement on the operating system running environment of the first microprocessor through the second trusted chip; When the trusted boot measurement of the first microprocessor passes, performing a trusted boot measurement on the bare-metal core running environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor, and achieving secure boot of all microprocessors of the secondary power equipment when the trusted boot measurements of the second microprocessor and the third microprocessor pass.

2. The method according to claim 1, wherein Separately generating signature application programs or key files for all microprocessors of secondary power equipment offline from a program release server, including: Using the offline tool of the program release server to call the function interface of the first trusted chip to generate a pair of public and private keys inside the first trusted chip; Storing the private key in the pair of public and private keys inside the first trusted chip, and exporting the public key in the pair of public and private keys to the second trusted chip of the secondary power equipment; Transferring the application programs or key files to be signed of all microprocessors of the secondary power equipment to the program release server; Calculating the signature code of the application program or key file to be signed through the private key and attaching it to a specific position of the application program or key file to be signed, generating the signature application program or key file with signature information for all microprocessors.

3. The method according to claim 1, wherein Performing a signature verification operation on the first signature code and the first digest value of each signature application program or key file, including: When the signature verification fails, prohibiting the update and upgrade of the application program or key file of the microprocessor of the secondary power equipment.

4. The method according to claim 1, wherein After all application programs or key files of the secondary power equipment are updated, restart the equipment, and perform a trusted boot measurement on the operating environment of the first microprocessor by the second trusted chip, including: Obtain the first signature code for each of the signed application programs or key files on the first microprocessor and calculate the first digest value; Transmit the first signature code and the first digest value of the first microprocessor to the second trusted chip; Call the function interface of the second trusted chip, and use the pre-stored public key to perform signature verification operations on the first signature code and the first digest value of each of the signed application programs or key files on the first microprocessor.

5. The method according to claim 2, wherein Perform a trusted boot measurement on the bare-metal operating environments of the second microprocessor and the third microprocessor by the second trusted chip and the first microprocessor, including: Start the second microprocessor and the third microprocessor and run the static measurement program to read the signed application programs or key files of the second microprocessor and the third microprocessor, and obtain the second signature code; Calculate the second digest value for the signed application programs or key files of the second microprocessor and the third microprocessor by using the software national cryptography algorithm; Transmit the second signature code and the second digest value to the second trusted chip through the first microprocessor that has been successfully measured; Call the function interface of the second trusted chip, and use the pre-stored public key to perform signature verification operations on the second signature code and the second digest value of each signed application program or key file; Determine whether the bare-metal operating environments of the second microprocessor and the third microprocessor pass the trusted boot measurement according to the signature verification result.

6. An autonomous and controllable microprocessor safety startup device for secondary power equipment, characterized in that, Including: A generation module, configured to separately generate offline the signed application programs or key files of all microprocessors of the secondary power equipment from a program release server. The microprocessors include: a first microprocessor, a second microprocessor, and a third microprocessor. The first microprocessor runs a management task application program based on an operating system mode; the second microprocessor runs a strong real-time task application program based on a bare-metal mode; the third microprocessor runs a real-time communication service application program based on a bare-metal mode, and a first trusted chip is deployed on the program release server; A calculation module, configured to transmit the signed application programs or key files into the secondary power equipment, obtain the first signature code from the signed application programs or key files through the first microprocessor, and calculate the first digest value of each of the signed application programs or key files by using the software national cryptography algorithm, where a second trusted chip is deployed on the secondary power equipment; A signature verification module, configured to perform signature verification operations on the first signature code and the first digest value of each of the signed application programs or key files through the second trusted chip, and update the application programs or key files of each microprocessor of the secondary power equipment when the signature verification passes. A measurement module, which is used to restart the device after all application programs or key files of the secondary power equipment are updated, and perform a trusted boot measurement on the operating environment of the first microprocessor through the second trusted chip; A boot module, which is used to perform a trusted boot measurement on the bare-metal operating environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor when the trusted boot measurement of the first microprocessor passes, and realize the secure boot of all microprocessors of the secondary power equipment when the trusted boot measurements of the second microprocessor and the third microprocessor pass.

7. The device according to claim 6, characterized in that, A generation module, including: A first generation sub-module, which is used to call the function interface of the first trusted chip by using the offline tool of the program release server to generate a pair of public and private keys inside the first trusted chip; An export sub-module, which is used to store the private key in the pair of public and private keys inside the first trusted chip, and export the public key in the pair of public and private keys to the second trusted chip of the secondary power equipment; A first incoming sub-module, which is used to transfer all the application programs or key files to be signed of all microprocessors of the secondary power equipment to the program release server; A second generation sub-module, which is used to calculate the signature code of the application program or key file to be signed through the private key and attach it to a specific position of the application program or key file to be signed, and generate the signed application program or key file with signature information of all microprocessors.

8. The device according to claim 6, characterized in that The verification module performs a verification operation on the first signature code and the first digest value of each of the signed application programs or key files, and further includes: A prohibition module, which is used to prohibit the update and upgrade of the application programs or key files of the microprocessors of the secondary power equipment when the verification fails.

9. The device according to claim 1, wherein A measurement module, including: A first calculation sub-module, which is used to obtain the first signature code of each of the signed application programs or key files on the first microprocessor and calculate the first digest value; A second incoming sub-module, which is used to transfer the first signature code and the first digest value of the first microprocessor to the second trusted chip; A first verification sub-module, which is used to call the function interface of the second trusted chip and use the pre-stored public key to perform a verification operation on the first signature code and the first digest value of each of the signed application programs or key files on the first microprocessor.

10. The device according to claim 7, characterized in that, The boot module performs a trusted boot measurement on the bare-metal operating environments of the second microprocessor and the third microprocessor through the second trusted chip and the first microprocessor, including: A reading sub-module, which is used to start the second microprocessor and the third microprocessor and run the static measurement program to read the signed application programs or key files of the second microprocessor and the third microprocessor to obtain the second signature code; A second calculation sub-module, which is used to calculate the second digest value of the signed application programs or key files of the second microprocessor and the third microprocessor by using the national cryptographic algorithm for software; A transmission sub-module, configured to transmit the second signature code and the second digest value to the second trusted chip through the first microprocessor that has been successfully measured; A second signature verification sub-module, configured to call the function interface of the second trusted chip and perform a signature verification operation on the second signature code and the second digest value of each signature application or key file using the pre-stored public key; A decision sub-module, configured to determine whether the second microprocessor and the bare-metal running environment of the third microprocessor pass the trusted boot measurement according to the signature verification result.

11. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program is used to execute the method according to any one of claims 1-5 above.

12. An electronic device, characterized in that, The electronic device includes: A processor; A memory for storing executable instructions of the processor; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method according to any one of claims 1-5 above.

Images