Starting method, system and device of embedded system and storage medium

Abstract

The invention discloses a starting method, system and device of an embedded system and a storage medium. The starting method comprises the steps that initialization is conducted according to a starting instruction, and a bootstrap program is loaded to a memory; loading an encryption starting block, obtaining first authentication information, and authenticating the encryption starting block according to the first authentication information; if the authentication of the encryption starting block is passed, loading an encryption bootstrap program, obtaining second authentication information, and authenticating the encryption bootstrap program according to the second authentication information; and if the authentication of the encrypted bootstrap program is passed, creating a system encryption layer, and mounting an operating system kernel and a file system based on the encryption layer to finish starting. According to the embodiment of the invention, the security of the starting process of the embedded system can be improved, and the method can be widely applied to the technical field of embedded systems.

Description

Technical Field

[0001] The present invention relates to the technical field of embedded systems, and in particular to a startup method, system, device and storage medium for an embedded system. Background Art

[0002] Embedded systems are widely used in various electronic devices, such as smartphones, automobiles, and IoT devices. System security and boot process protection are crucial in embedded systems. During the boot process, the embedded system's file system must be loaded without malicious tampering or unauthorized access to prevent potential attackers from exploiting vulnerabilities and attacking the system. File system security typically relies on encryption technologies, such as encrypting files on storage devices to protect system data from unauthorized reading or modification. However, even if the file system itself is encrypted, it cannot effectively prevent malicious code from loading in the event of a physical attack or direct access to the system, leaving the boot process vulnerable to attacks. For example, an attacker could copy the file system partition, bypassing encrypted access permissions, and obtain sensitive data or inject malicious code. Summary of the Invention

[0003] In view of this, an object of the embodiments of the present invention is to provide a startup method, system, device and storage medium for an embedded system, which can improve the security of the startup process of the embedded system.

[0004] In one aspect, an embodiment of the present invention provides a method for starting an embedded system, wherein a boot area of the embedded system is provided with an encrypted boot block, and the method includes:

[0005] Initialize according to the startup instructions and load the boot program into the memory;

[0006] loading an encrypted boot block, obtaining first authentication information, and authenticating the encrypted boot block according to the first authentication information;

[0007] If the encrypted boot block passes authentication, loading the encrypted boot program, obtaining second authentication information, and authenticating the encrypted boot program according to the second authentication information;

[0008] If the encryption boot program passes the authentication, a system encryption layer is created, and the operating system kernel and file system are mounted based on the encryption layer to complete the startup.

[0009] Optionally, authenticating the encrypted boot block according to the first authentication information includes:

[0010] determining a first authentication request according to the first authentication information;

[0011] If the first authentication request is verified to be valid, obtaining first verification information of the first authentication information;

[0012] If the first authentication information matches the first verification information, the encrypted boot block authentication passes; otherwise, the encrypted boot block authentication fails.

[0013] Optionally, authenticating the encrypted boot program according to the second authentication information includes:

[0014] determining a second authentication request according to the second authentication information;

[0015] If the second authentication request is verified to be valid, obtaining second verification information of the second authentication information;

[0016] If the second authentication information matches the second verification information, the encrypted boot program authentication succeeds; otherwise, the encrypted boot program authentication fails.

[0017] Optionally, mount the file system using the following method:

[0018] Mounting the file system to the encryption layer;

[0019] Requesting authentication of the file system;

[0020] If the file system authentication passes, the file system is decrypted, the decrypted file system is mounted, and the file system is started successfully.

[0021] Optionally, decrypting the file system includes:

[0022] The key blocks of the file system are decrypted, and a complete file system is synthesized according to the decrypted key blocks to obtain a decrypted file system.

[0023] Optionally, the startup method further includes:

[0024] If the file system authentication fails, the file system startup fails.

[0025] Optionally, the startup method further includes:

[0026] If the encrypted boot block authentication fails or the encrypted boot program authentication fails, the boot is stopped.

[0027] On the other hand, an embodiment of the present invention provides a startup system for an embedded system, wherein a boot area of the embedded system is provided with an encrypted startup block, and the startup system includes:

[0028] The first module is used to initialize according to the startup instruction and load the boot program into the memory;

[0029] A second module is configured to load an encrypted boot block, obtain first authentication information, and authenticate the encrypted boot block according to the first authentication information;

[0030] A third module is configured to load an encrypted boot program if the encrypted boot block passes authentication, obtain second authentication information, and authenticate the encrypted boot program according to the second authentication information;

[0031] The fourth module is used to create a system encryption layer if the encryption boot program passes authentication, and mount the operating system kernel and file system based on the encryption layer to complete the startup.

[0032] On the other hand, an embodiment of the present invention provides a startup device for an embedded system, comprising:

[0033] at least one processor;

[0034] at least one memory for storing at least one program;

[0035] When the at least one program is executed by the at least one processor, the at least one processor implements the above-mentioned startup method.

[0036] On the other hand, an embodiment of the present invention provides a computer-readable storage medium storing a program executable by a processor. When the program is executed by the processor, it is used to perform the above method.

[0037] The implementation of the embodiment of the present invention includes the following beneficial effects: During the startup process, this embodiment authenticates the encrypted startup block and the encrypted boot program in sequence. After the encrypted startup block and the encrypted boot program are authenticated, the operating system kernel and the file system are mounted, and a special encryption block is added to the file system boot area to ensure that unauthenticated access cannot start the system, thereby ensuring the integrity and confidentiality of the system, thereby effectively preventing the risk of the boot process being bypassed or maliciously tampered with. That is, by closely integrating the encryption mechanism with the boot process, various files in the startup process are encrypted to ensure that data is protected during storage, transmission and execution, and to ensure that the file system cannot be accessed or tampered with without authorization during startup, thereby preventing the injection of malicious code and improving the security of the embedded system startup process. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a schematic diagram of the structure of an encrypted boot block provided by an embodiment of the present invention;

[0039] Figure 2 This is a schematic flow chart of steps of a method for starting an embedded system provided by an embodiment of the present invention;

[0040] Figure 3This is a schematic flow chart of steps of another method for starting an embedded system provided by an embodiment of the present invention;

[0041] Figure 4 This is a schematic flow chart of steps for authenticating an encrypted boot block based on first authentication information provided by an embodiment of the present invention;

[0042] Figure 5 This is a flowchart of steps for authenticating an encrypted boot program according to second authentication information provided by an embodiment of the present invention; mounting the file system

[0043] Figure 6 This is a flowchart of steps for mounting the file system provided by an embodiment of the present invention;

[0044] Figure 7 This is a structural block diagram of a startup system of an embedded system provided by an embodiment of the present invention;

[0045] Figure 8 This is a structural block diagram of a startup device for an embedded system provided by an embodiment of the present invention;

[0046] Figure 9 This is a structural block diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The step numbers in the following embodiments are provided for ease of description only and do not limit the order of the steps. The order of execution of the steps in the embodiments can be adaptively adjusted based on the understanding of those skilled in the art.

[0048] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flow chart. The terms "first", "second", etc. in the specification and claims and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0050] A dedicated encrypted boot block is added to the boot sector of the embedded system's file system. The encrypted boot block is responsible for storing the preliminary code of the system boot program and necessary boot information. The encrypted boot block will be loaded first during the system startup process, but it is encrypted and can only be decrypted after authentication, allowing the boot program to continue executing. The boot block encryption method is determined according to the actual application and is not specifically limited in this embodiment. For example, an asymmetric encryption algorithm (such as SM2) is used to encrypt the encrypted boot block. When the system starts, the correct key must be provided to decrypt the block. See Figure 1 The encrypted boot block consists of two parts: the encrypted boot code and the location for creating the key information for the file system startup process. The boot program also consists of two parts: creating an encryption layer to load the encrypted file system, and decrypting the file system through the encryption layer to continue loading and running. The encrypted boot block ensures that even if an attacker obtains the device's storage media, they cannot obtain the boot program without proper authentication. The boot program ensures that even if a program obtains the boot block, it cannot load the file system without the encryption layer.

[0051] like Figure 2 As shown, an embodiment of the present invention provides a method for starting an embedded system, wherein the boot area of the embedded system is provided with an encrypted startup block, and the method for starting the embedded system includes:

[0052] S100: Initialize according to the startup instruction and load the boot program into the memory.

[0053] The startup instruction refers to the startup instruction command of the embedded system, including but not limited to the power-on startup instruction. Initialization includes but is not limited to the initialization of software or hardware.

[0054] S200: Load an encrypted boot block, obtain first authentication information, and authenticate the encrypted boot block according to the first authentication information.

[0055] The first authentication information refers to boot block authentication information input externally or obtained internally. Specifically, after loading the encrypted boot block, the first authentication information is obtained, and the encrypted boot block is authenticated based on the first authentication information. The method for authenticating the encrypted boot block depends on the actual encryption algorithm and is not specifically limited in this embodiment.

[0056] S300: If the encrypted boot block passes authentication, load the encrypted boot program, obtain second authentication information, and authenticate the encrypted boot program according to the second authentication information.

[0057] The second authentication information refers to boot program authentication information input from the outside or obtained internally.

[0058] If the encrypted boot block authentication fails, it indicates that there is a risk in the early stage of system startup, and the startup is stopped. If the encrypted boot block authentication passes, it indicates that the early stage of system startup is safe, and the encrypted boot program continues to load and is authenticated based on the second authentication information. The method for authenticating the encrypted boot program is determined by the actual encryption algorithm and is not specifically limited in this embodiment.

[0059] S400: If the encrypted boot program passes authentication, a system encryption layer is created, and the operating system kernel and file system are mounted based on the encryption layer to complete the startup.

[0060] If the encrypted boot program passes authentication, it indicates that there is a risk in booting the program, and the startup is stopped. If the encrypted boot program passes authentication, it indicates that the boot program is safe to start, and the system encryption layer is created. The system kernel and file system are mounted based on the encryption layer to complete the startup.

[0061] Integrating an encrypted bootloader with the file system encryption scheme ensures encryption protection throughout the entire process, from boot to file system mounting, preventing attackers from compromising system security by tampering with the bootloader or file system. The system's bootloader not only decrypts the file system but also ensures encryption protection throughout the entire process, from boot to file system loading. The bootloader itself is encrypted, and once loaded, all file reads and writes during the boot process pass through an encrypted layer. During the boot process, all encryption operations are performed by a centrally managed encrypted boot module, which ensures efficient and secure encryption and decryption.

[0062] See Figure 3 ,The following describes the startup process of an embedded system with a specific ,implementation.

[0063] After the computer is turned on, the hardware is initialized, the boot program is loaded into the memory, the encrypted boot block is loaded, and the encrypted boot block is authenticated. If the encrypted boot block authentication fails, the boot is stopped. If the encrypted boot block authentication passes, the encrypted boot program is loaded and authenticated. If the encrypted boot program authentication fails, the boot is stopped. If the encrypted boot program authentication passes, an encryption layer is created, and the operating system kernel and file system are mounted based on the encryption layer.

[0064] Optionally, authenticating the encrypted boot block according to the first authentication information includes:

[0065] S210: Determine a first authentication request according to the first authentication information;

[0066] S220. If the first authentication request is verified to be valid, obtain first verification information of the first authentication information;

[0067] S230. If the first authentication information matches the first verification information, the encrypted boot block authentication passes; otherwise, the encrypted boot block authentication fails.

[0068] To ensure the security of the encrypted boot block, a key management mechanism has been designed. Software manages key storage and verification, ensuring that the boot block can be decrypted only after proper authentication. Keys are stored in a dedicated storage area within the embedded system. Keys must be authenticated before they can be retrieved from the secure storage area. During system startup, the key's validity is first verified through hardware or software authentication.

[0069] It should be noted that the authentication information storage space in the encrypted boot block can be divided into multiple areas, one of which can be used to store the authentication module program, and another of which can be used to store the information management module program. The authentication module is responsible for generating authentication request information and performing operations such as authenticating the authentication information. The information management module is responsible for verifying the validity of the authentication request information and, if the verification request information is valid, extracting verification information that matches the authentication information from the authentication information storage space.

[0070] Specifically, see Figure 4 The authentication module determines the first authentication request based on the first authentication information; the information management module performs validity authentication on the first authentication request. If the first authentication request is verified to be valid, the first verification information of the first authentication information is obtained and the first verification information is sent to the authentication module; the authentication module authenticates the first verification information. If the first authentication information matches the first verification information, the encryption boot block authentication passes; otherwise, the encryption boot block authentication fails.

[0071] Optionally, authenticating the encrypted boot program according to the second authentication information includes:

[0072] S310: Determine a second authentication request according to the second authentication information;

[0073] S320: If the second authentication request is verified to be valid, obtain second verification information of the second authentication information;

[0074] S330. If the second authentication information matches the second verification information, the encryption boot program authentication succeeds; otherwise, the encryption boot program authentication fails.

[0075] Specifically, see Figure 5The authentication module determines the second authentication request based on the second authentication information; the information management module performs validity authentication on the second authentication request. If the second authentication request is verified to be valid, the second verification information of the second authentication information is obtained and sent to the authentication module; the authentication module authenticates the second verification information. If the second authentication information matches the second verification information, the encryption boot program authentication is passed; otherwise, the encryption boot program authentication fails.

[0076] Optionally, mount the file system via:

[0077] S410, mounting the file system to the encryption layer;

[0078] S420: Requesting authentication of the file system;

[0079] S430: If the file system authentication passes, decrypt the file system, mount the decrypted file system, and the file system is started successfully.

[0080] Specifically, see Figure 6 , mount the file system to the encryption layer, request the authentication module to authenticate the file system, if the file system authentication fails, the file system startup fails, and the startup ends; if the file system authentication passes, decrypt the file system, mount the decrypted file system, the file system startup succeeds, and the startup ends.

[0081] Optionally, decrypt the file system, including:

[0082] S431. Decrypt the key blocks of the file system, and synthesize a complete file system based on the decrypted key blocks to obtain a decrypted file system.

[0083] It should be noted that the key blocks are determined based on actual applications and are not specifically limited in this embodiment. For example, the key blocks include but are not limited to metadata, directory structure, and core configuration of the system, which are crucial to the normal operation of the file system. After decrypting the key blocks, the system can continue to decrypt more data; next, the system will continue to decrypt the entire file system. This decryption process usually relies on keys stored in a secure location, and only authorized users or systems can obtain these keys to ensure the confidentiality of the data. After the decryption is completed, all data in the file system becomes accessible, and the system can read and write this data normally. Finally, the file system is mounted to the operating system and can begin to be used normally. At this point, the operating system can access the files and data stored in the file system, and users and applications can perform normal file operations such as reading, writing, and modifying. The entire process ensures that every link of the encrypted file system from startup to availability is not maliciously interfered with, maintaining the confidentiality and integrity of the data.

[0084] See Figure 7An embodiment of the present invention provides a startup system for an embedded system. The boot area of the embedded system is provided with an encrypted startup block. The startup system includes:

[0085] The first module is used to initialize according to the startup instruction and load the boot program into the memory;

[0086] The second module is configured to load the encrypted boot block, obtain first authentication information, and authenticate the encrypted boot block according to the first authentication information;

[0087] The third module is used to load the encrypted boot program if the encrypted boot block authentication passes, obtain the second authentication information, and authenticate the encrypted boot program according to the second authentication information;

[0088] The fourth module is used to create a system encryption layer if the encryption boot program authentication is passed, mount the operating system kernel and file system based on the encryption layer, and complete the startup.

[0089] It can be seen that the contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0090] See Figure 8 , an embodiment of the present invention provides a startup device for an embedded system, comprising:

[0091] at least one processor;

[0092] at least one memory for storing at least one program;

[0093] When at least one program is executed by at least one processor, the at least one processor implements the above-mentioned startup method.

[0094] Among them, the memory is a non-transient computer-readable storage medium that can be used to store non-transient software programs and non-transient computer executable programs. The memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory optionally includes a remote memory remotely arranged relative to the processor, and these remote memories can be connected to the processor via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0095] It can be seen that the contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0096] In addition, the embodiments of the present application further disclose a computer program product or computer program, which is stored in a computer-readable storage medium. The processor of a computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the above-mentioned method. Similarly, the contents of the above-mentioned method embodiment are all applicable to the present storage medium embodiment, and the functions specifically implemented by the present storage medium embodiment are the same as those of the above-mentioned method embodiment, and the beneficial effects achieved are also the same as those achieved by the above-mentioned method embodiment.

[0097] An embodiment of the present invention further provides a computer-readable storage medium, which stores a program executable by a processor. The program executable by the processor is used to implement the above method when executed by the processor.

[0098] It is understood that all or some steps, systems in the disclosed method above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those of ordinary skill in the art, the term computer storage medium is included in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data) and is volatile and non-volatile, removable and non-removable. Computer storage media includes but is not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0099] Specifically, see Figure 9The computer device 900 may include an RF (Radio Frequency) circuit 910, a memory 920 including one or more computer-readable storage media, an input unit 930, a display unit 940, a sensor 950, an audio circuit 960, a short-range wireless transmission module 970, a processor 980 including one or more processing cores, and a power supply 990. It will be understood by those skilled in the art that Figure 9 The device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0100] The RF circuit 910 can be used to receive and transmit signals during information transmission or calls. Specifically, it receives downlink information from the base station and transmits it to one or more processors 980 for processing. It also transmits uplink data to the base station. Typically, the RF circuit 910 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a subscriber identity module (SIM) card, a transceiver, a coupler, an LNA (low noise amplifier), a duplexer, and the like. Furthermore, the RF circuit 910 can communicate with the network and other devices via wireless communication. Wireless communication can utilize any communication standard or protocol, including but not limited to GSM (Global System of Mobile Communications), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), email, and SMS (Short Messaging Service).

[0101] The memory 920 can be used to store software programs and modules. The processor 980 executes various functional applications and data processing by running the software programs and modules stored in the memory 920. The memory 920 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the device 900 (such as audio data, a phone book, etc.), etc. In addition, the memory 920 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory 920 may also include a memory controller to provide the processor 980 and the input unit 930 with access to the memory 920. Although Figure 9 The RF circuit 910 is shown, but it is understandable that it is not an essential component of the device 900 and can be omitted as needed without changing the essence of the invention.

[0102] The input unit 930 can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical, or trackball signal input related to user settings and function control. Specifically, the input unit 930 may include a touch-sensitive surface 931 and other input devices 932. The touch-sensitive surface 931, also known as a touch display or touchpad, can detect user touch operations on or near it (for example, operations performed by a user using a finger, stylus, or any other suitable object or accessory on or near the touch-sensitive surface 931) and drive corresponding connected devices according to a pre-set program. Optionally, the touch-sensitive surface 931 may include a touch detection device and a touch controller. The touch detection device detects the user's touch position and detects signals generated by the touch operation, transmitting the signals to the touch controller. The touch controller receives the touch information from the touch detection device, converts it into touch point coordinates, and then sends it to the processor 980. It can also receive and execute commands from the processor 980. In addition, the touch-sensitive surface 931 can be implemented using various types, including resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 931, the input unit 930 may further include other input devices 932. Specifically, the other input devices 932 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, power keys, etc.), a trackball, a mouse, and a joystick.

[0103] The display unit 940 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the control 900, which can be composed of graphics, text, icons, videos and any combination thereof. The display unit 940 may include a display panel 941. Optionally, the display panel 941 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like. Furthermore, the touch-sensitive surface 931 may be covered on the display panel 941. When the touch-sensitive surface 931 detects a touch operation on or near it, it is transmitted to the processor 980 to determine the type of touch event. Subsequently, the processor 980 provides corresponding visual output on the display panel 941 according to the type of touch event. Although in Figure 9 In the embodiment, the touch-sensitive surface 931 and the display panel 941 are implemented as two independent components to implement input and output functions, but in some embodiments, the touch-sensitive surface 931 and the display panel 941 can be integrated to implement input and output functions.

[0104] The computer device 900 may also include at least one sensor 950, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 941 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 941 and / or the backlight when the device 900 is moved to the ear. As a type of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that recognize the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that the device 900 can also be configured with, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be described in detail here.

[0105] Audio circuit 960, speaker 961, and microphone 962 provide an audio interface between the user and device 900. Audio circuit 960 can convert received audio data into electrical signals and transmit them to speaker 961, which then converts them into sound signals for output. Microphone 962, on the other hand, converts collected sound signals into electrical signals, which are then received by audio circuit 960 and converted into audio data. The audio data is then processed by output processor 980 and sent to another control device via RF circuit 910, or the audio data is output to memory 920 for further processing. Audio circuit 960 may also include an earphone jack to allow external headphones to communicate with device 900.

[0106] The short-range wireless transmission module 970 may be a WIFI (wireless fidelity) module, a Bluetooth module, an infrared module, etc. The device 900 may transmit information to a wireless transmission module provided on a competing device via the short-range wireless transmission module 970 .

[0107] Processor 980 is the control center of device 900. It connects the various components of the entire control device using various interfaces and circuits. By running or executing software programs and / or modules stored in memory 920 and accessing data stored in memory 920, it performs various functions of device 900 and processes data, thereby providing overall monitoring of the control device. Optionally, processor 980 may include one or more processing cores. Alternatively, processor 980 may integrate an application processor and a modem processor, with the application processor primarily handling the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 950.

[0108] The device 900 also includes a power supply 990 (e.g., a battery) for supplying power to the various components. Preferably, the power supply can be logically connected to the processor 980 via a power management system, thereby enabling the power management system to manage charging, discharging, and power consumption. The power supply 990 can also include one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and other arbitrary components.

[0109] Although not shown, the device 900 may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0110] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0112] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0113] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for starting an embedded system, characterized in that: The boot area of the embedded system is provided with an encrypted boot block, and the boot method includes: Initialize according to the startup instructions and load the boot program into the memory; loading an encrypted boot block, obtaining first authentication information, and authenticating the encrypted boot block according to the first authentication information; If the encrypted boot block passes authentication, loading the encrypted boot program, obtaining second authentication information, and authenticating the encrypted boot program according to the second authentication information; If the encryption boot program passes the authentication, a system encryption layer is created, and the operating system kernel and file system are mounted based on the encryption layer to complete the startup.

2. The startup method according to claim 1, characterized in that: authenticating the encrypted boot block according to the first authentication information, including: determining a first authentication request according to the first authentication information; If the first authentication request is verified to be valid, obtaining first verification information of the first authentication information; If the first authentication information matches the first verification information, the encrypted boot block authentication passes; otherwise, the encrypted boot block authentication fails.

3. The startup method according to claim 1, characterized in that: The authenticating the encrypted boot program according to the second authentication information includes: determining a second authentication request according to the second authentication information; If the second authentication request is verified to be valid, obtaining second verification information of the second authentication information; If the second authentication information matches the second verification information, the encrypted boot program authentication succeeds; otherwise, the encrypted boot program authentication fails.

4. The startup method according to claim 1, characterized in that: Mount the file system in question via: Mounting the file system to the encryption layer; Requesting authentication of the file system; If the file system authentication passes, the file system is decrypted, the decrypted file system is mounted, and the file system is started successfully.

5. The startup method according to claim 4, characterized in that: The decrypting the file system comprises: The key blocks of the file system are decrypted, and a complete file system is synthesized according to the decrypted key blocks to obtain a decrypted file system.

6. The startup method according to claim 4, characterized in that: The startup method further includes: If the file system authentication fails, the file system startup fails.

7. The startup method according to any one of claims 1 to 6, characterized in that: The startup method further includes: If the encrypted boot block authentication fails or the encrypted boot program authentication fails, the boot is stopped.

8. A startup system for an embedded system, characterized in that: The boot area of the embedded system is provided with an encrypted boot block, and the boot system includes: The first module is used to initialize according to the startup instruction and load the boot program into the memory; A second module is configured to load an encrypted boot block, obtain first authentication information, and authenticate the encrypted boot block according to the first authentication information; A third module is configured to load an encrypted boot program if the encrypted boot block passes authentication, obtain second authentication information, and authenticate the encrypted boot program according to the second authentication information; The fourth module is used to create a system encryption layer if the encryption boot program passes authentication, and mount the operating system kernel and file system based on the encryption layer to complete the startup.

9. A startup device for an embedded system, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a program executable by a processor, characterized in that: The processor-executable program is configured to perform the method according to any one of claims 1 to 7 when executed by the processor.

Images