A wifi router online upgrade security check method and system

Abstract

The present application relates to the field of device security verification, in particular to a wifi router online upgrade security verification method and system. A wifi router online upgrade security verification system comprises a firmware package construction module, a firmware package verification module and a guarantee activation module. The present application forms a firmware package head protection logic closed loop through the innovative design of a multi-stage composite verification structure and an anti-offset signature positioning architecture. The system can detect nanoscale tampering of the length identifier field by attackers in real time, and when the verification fails, it can cut off the flash controller power supply and erase the data buffer at a hardware fuse level response speed, which improves the response efficiency compared with the traditional scheme.

Description

Technical Field

[0001] The present invention relates to the field of device security verification, and particularly to a method and system for online upgrade security verification of a Wi-Fi router. Background Art

[0002] Currently, there are common key security defects in the online upgrade process of Wi-Fi routers. Most firmware transmissions rely on basic encryption protocols, making it difficult to resist firmware tampering caused by man-in-the-middle attacks. Attackers can implant malicious code to hijack the device control right. Traditional verification schemes lack protection for the firmware package structure, and the length identification field is vulnerable to buffer overflow attacks, leading to signature verification bypass. At the same time, signature positioning lacks an anti-offset mechanism, and attackers can forge legal signatures to trigger areas by modifying the field offset. After the verification fails on the device side, there is no hardware-level linkage response. Abnormal power-off or malicious flashing is likely to cause both dual-boot partitions to be damaged simultaneously, resulting in permanent device failures.

[0003] The prior art has not effectively solved the challenges of multi-level threat linkage: the firmware package structure lacks self-verification ability and is difficult to identify fine tampering of header fields; the hash verification process does not combine real-time hardware status, and environmental changes such as high temperature may reduce the security threshold; there is no pre-boot diagnosis for wireless modules and file systems during device startup, and persistent attacks implanted in memory cannot be blocked. These defects make the upgrade process vulnerable to supply chain attacks, and there is an urgent need to establish a full-chain protection system covering transmission encryption, strong structure verification, hardware fusing, and startup diagnosis. Therefore, the present invention proposes a method and system for online upgrade security verification of a Wi-Fi router. Summary of the Invention

[0004] The present invention forms a firmware header protection logic closed-loop through an innovatively designed multi-stage composite verification structure body and an anti-offset signature positioning architecture. This system can detect nanoscale tampering of the length identification field by attackers in real time, and when the verification fails, cut off the power supply of the flash controller and erase the data buffer at the hardware fusing-level response speed. Compared with traditional schemes, the response efficiency is improved.

[0005] A method for online upgrade security verification of a Wi-Fi router includes:

[0006] Calculating the cryptographic hash value H1 of the original firmware, signing H1 using the manufacturer's private key with an elliptic curve algorithm to generate a digital signature Sign; constructing a structured firmware package, which sequentially includes an N-byte firmware length identification field, a continuous L1-byte original firmware data body, an M-byte signature length identification field, a continuous L2-byte digital signature Sign, and an anti-tampering verification structure body;

[0007] After the router device obtains the firmware package through the encrypted transmission channel, it reads the first N bytes from the beginning of the firmware package and parses them into the firmware length value L1. It then extracts consecutive L1 bytes starting from the offset position of the Nth byte as the original firmware copy. Based on a preset elliptic curve algorithm type, it determines the expected signature length value L2_exp. After verifying the tamper-proof structure, it reads consecutive M bytes from the L2_exp+M bytes from the end of the firmware package and parses them into the signature length identifier value L2. If L2 and L2_exp are inconsistent, the process terminates; otherwise, it extracts consecutive L2 bytes from the L2 bytes from the end of the firmware package as signature data. It decrypts the signature data using a preset public key to obtain a reference hash value H1'. It then performs the same cryptographic hash operation as in the cloud on the original firmware copy using a parallel segmented hashing strategy to obtain the local hash value H2. The firmware is deemed legitimate if and only if H1' and H2 completely match and the signature verification passes.

[0008] After successful verification, the original firmware copy is written to the spare partition of the storage and then the system boots. Pre-boot diagnostics are performed, and kernel signals are monitored. If successful, the spare partition is activated; otherwise, the system automatically rolls back to the original partition and restarts.

[0009] Preferably, the specific operations for generating and verifying the anti-tampering verification structure include:

[0010] When constructing the firmware package in the cloud, a multi-level checksum synthesis operation is performed. First, the first-level bitwise XOR operation is performed by extracting the first valid bit segment of the firmware length identifier field and the second valid bit segment of the signature length identifier field. The result of the operation is then combined with the preset hardware architecture feature code to perform a second-level logical AND operation. Finally, the device model cyclic redundancy check value is superimposed to form a composite checksum structure that is not symmetrically embedded in the firmware package.

[0011] Preferably, the verification of the tamper-proof structure includes the following specific operations:

[0012] After the device extracts the firmware copy, it triggers the verification coprocessor to generate a dynamic verification code. When the similarity between the composite verification structure and the dynamic verification code is lower than the preset dynamic security threshold, hardware-level fuse protection is activated: the power supply to the flash controller write channel is cut off first, then the data partition to be verified in the transmission buffer is erased, and at the same time, dangerous operation events containing the complete firmware packet header hash value, the bitmap of the verification failure location and the clock stamp are recorded in the kernel audit log.

[0013] Preferably, the process of locating and extracting the signature data adopts a dual verification architecture resistant to address offset, and the specific operation is as follows:

[0014] Before parsing the signature length identifier value L2, the device starts the digital signature pre-inspection module. This module calculates the theoretical storage area boundary address of the signature data based on the preset elliptic curve algorithm type and creates a restricted access sandbox area in the flash memory controller through reverse memory mapping technology.

[0015] When performing tail addressing, a two-stage positioning process is initiated simultaneously: the first stage reads the L2 identifier value according to the offset calculation strategy of L2_exp+M; the second stage dynamically scans the feature header identifier of the digital signature Sign in the sandbox area through the cryptographically secure pointer; the signature data copying channel is activated only when both the L2 value and the Sign feature header size verification pass.

[0016] A continuous verification mechanism is introduced in the signature extraction stage. The first 4 bits of binary data at the beginning of the digital signature Sign are protected by parity check and (7,4) Hamming code. The Hamming code check bits occupy 3 bits of storage space. If a single bit error is detected, it is corrected immediately. If multiple bit errors exceeding the error correction capability limit are detected, the signature verification process is interrupted and the error vector register in the secure storage area is marked.

[0017] Preferably, the specific details of the parallel segmented hashing strategy are as follows:

[0018] The device initializes a dynamic block partitioning engine, which determines the optimal sub-block partitioning parameters based on the current total free memory, the number of processor cores, and the product factor of the original firmware copy. It then creates a multi-threaded computing array with a ring-shaped buffer topology, where each thread is bound to a dedicated processor core and connected to a dedicated memory pool via a high-speed interconnect bus. During the hash calculation startup phase, the main scheduler cuts the firmware data stream into multi-dimensional data slices aligned to cache lines and allocates them to worker threads. Each thread executes a three-stage hash pipeline operation in a pipelined manner: the first stage preprocessing rearranges the bits of the input data block, the second stage executes multiple rounds of hash compression function iterations, and the final stage generates a hash intermediate value digest with a timestamp. A global monitor detects thread status in real time and implements failover: when a thread's computation delay exceeds the dynamic response window, its task is immediately assigned to an adjacent processing unit within the same processor core for takeover computation, while the cache area of ​​the abnormal thread is locked for memory error diagnosis scanning.

[0019] Preferably, pre-boot diagnostics are performed, and kernel signals are monitored. The specific operations are as follows:

[0020] During the initial boot phase of the device from the backup partition, the hierarchical diagnostic controller is initiated to execute a verification operation chain: the first-level hardware root of trust verification stage verifies the digital certificate chain in the kernel header and matches the signature policy matrix; the second-level wireless hardware self-test stage sends a customized diagnostic command sequence to the RF module while monitoring the signal spectrum integrity; the third-level file system static analysis stage initiates offline media scanning to calculate double-end redundancy check values ​​for critical partitions; each diagnostic level has an independent circuit breaker mechanism: hardware verification failure will lock the boot decryption module, wireless anomalies trigger the RF module power closed-loop control, and file system verification errors activate the bad block remapping engine; any persistent failure at any level will trigger a diagnostic interrupt vector injection into the processor's non-maskable interrupt line, which is physically connected to the processor's non-maskable interrupt line, forcibly jumping to the partition rollback microcode execution environment.

[0021] A WiFi router online upgrade security verification system includes:

[0022] The firmware package building module is used to calculate the cryptographic hash value H1 of the original firmware, use the elliptic curve algorithm to sign H1 with the manufacturer's private key to generate a digital signature Sign; construct a structured firmware package, which includes an N-byte firmware length identifier field, a continuous L1-byte original firmware data body, an M-byte signature length identifier field, a continuous L2-byte digital signature Sign, and a tamper-proof verification structure.

[0023] The firmware package verification module is used to read the first N bytes of the firmware package from the beginning of the package after the router device obtains the firmware package through the encrypted transmission channel. This is parsed into a firmware length value L1, and the first N bytes (starting from the offset position of the Nth byte) are extracted as the original firmware copy. Based on a preset elliptic curve algorithm type, the expected signature length value L2_exp is determined. After verifying the tamper-proof structure, the module reads M bytes (starting from the L2_exp+M bytes from the end of the firmware package) and parses them into a signature length identifier value L2. If L2 and L2_exp are inconsistent, the process terminates; otherwise, the module extracts the first L2 bytes (starting from the L2 bytes from the end of the firmware package) as signature data. The signature data is decrypted using a preset public key to obtain a reference hash value H1'. A parallel segmented hashing strategy is used to perform the same cryptographic hash operation as on the cloud on the original firmware copy to obtain a local hash value H2. The firmware is deemed legitimate only if H1' and H2 completely match and the signature verification passes.

[0024] The activation module is used to write a copy of the original firmware to the spare partition of the storage after successful verification, and then boot the system. It also performs pre-boot diagnostics, listens for kernel signals, and activates the spare partition if successful, and automatically rolls back to the original partition and restarts if the timeout occurs.

[0025] The present invention has the following advantages:

[0026] 1. This invention forms a closed-loop firmware header protection logic through an innovatively designed multi-level composite verification structure and an anti-offset signature positioning architecture. This system can detect nanometer-level tampering of the length identifier field by attackers in real time, and cut off the power to the flash controller and erase the data buffer at a hardware fuse-level response speed when the verification fails. Compared with traditional solutions, the response performance is improved.

[0027] 2. When performing segmented verification using a multi-threaded hash array with a ring buffer topology, this invention combines a three-level pre-boot diagnostic and circuit breaker-redirect linkage system. When encountering upgrade anomalies, this mechanism forms a failure protection depth through hardware-level isolation and a microcode-level rollback engine, which can maintain the minimum operational state of the device even in extreme scenarios where dual-boot partitions are damaged simultaneously. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the structure of the Wi-Fi router online upgrade security verification system used in an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of this invention.

[0030] Example 1: A method for online upgrade security verification of a WiFi router, comprising:

[0031] Calculate the cryptographic hash value H1 of the original firmware, and use the elliptic curve algorithm to sign H1 with the manufacturer's private key to generate a digital signature Sign; construct a structured firmware package, which includes an N-byte little-endian encoded firmware length identifier field, a continuous L1-byte original firmware data body (the value L1 is the original firmware byte length), an M-byte little-endian encoded signature length identifier field, a continuous L2-byte digital signature Sign, and a tamper-proof verification structure, where the value of L2 is determined by the elliptic curve algorithm type, and the elliptic curve P-256 corresponds to 64 bytes;

[0032] Among them, the hash value provides a benchmark for verifying the integrity of the firmware itself; any data tampering will cause the hash value to change drastically. The digital signature uses a private key to encrypt and bind the manufacturer's identity, ensuring that the firmware source is trustworthy and cannot be forged by third parties.

[0033] After the router device obtains the firmware packet through the encrypted transmission channel, it reads the first N bytes from the beginning of the firmware packet and parses them into the firmware length value L1. It then extracts consecutive L1 bytes starting from the offset position of the Nth byte as a copy of the original firmware. Based on a preset elliptic curve algorithm type, it determines the expected signature length value L2_exp (L2_exp=64 for P-256 algorithm, L2_exp=96 for P-384 algorithm). After performing header integrity verification based on the anti-tampering verification structure, it reads consecutive M bytes from the L2_exp+M byte from the end of the firmware packet and parses them into the signature length identifier value L2. If L2 and L2_exp are not... If they match, the process terminates; otherwise, extract consecutive L2 bytes from the L2 byte from the end of the firmware packet as signature data. Decrypt the signature data using a preset public key to obtain a reference hash value H1'. Perform the same cryptographic hash operation as on the cloud using a parallel segmented hashing strategy on the original firmware copy to obtain a local hash value H2. The firmware is deemed legitimate if and only if H1' and H2 completely match and the signature verification passes. The tail-end reverse signature extraction mechanism of this invention is immune to firmware expansion and overwrite attacks. At the same time, the anti-tampering structure prior packet header integrity → signature length and value dual verification → hash-signature dual-factor authentication form a three-level progressive defense.

[0034] After successful verification, the original firmware copy is written to the spare partition of the storage. After the writing is completed, the boot flag in the boot configuration area is updated to point to the spare partition. The system is then restarted to boot the device from the spare partition. When the device boots from the spare partition, a pre-boot diagnostic sequence is executed, a timeout monitoring window is opened, and the operating system kernel ready signal is listened for during the window period. If a valid signal is captured, the spare partition is permanently activated. If the window times out, the boot pointer of the original active partition is automatically reset according to the multi-stage transaction flag status, and a rollback restart process is triggered.

[0035] The specific operations for generating and verifying the anti-tampering verification structure include:

[0036] When constructing a firmware package in the cloud, a multi-level checksum synthesis operation is performed. First, the first-level bitwise XOR operation is performed by extracting the first valid bit segment of the firmware length identifier field and the second valid bit segment of the signature length identifier field. The result of the operation is then combined with the preset hardware architecture feature code to perform a second-level logical AND operation. Finally, the cyclic redundancy check value of the device model identifier is superimposed to form a composite checksum structure. This structure is embedded in a strategic position of the firmware package in an asymmetric manner.

[0037] During the device-side parsing process, the verification coprocessor is triggered immediately after the firmware copy is extracted. It generates a dynamic verification code through the same multi-stage operation process. When the similarity between the composite verification structure and the dynamic verification code is lower than the preset dynamic security threshold (the threshold is determined by experts based on the current temperature), hardware-level fuse protection is activated: the power supply to the flash controller write channel is cut off first, and then the data partition to be verified in the transmission buffer is erased. At the same time, dangerous operation events containing the complete firmware packet header hash value, the bitmap of the verification failure location, and the clock stamp are recorded in the kernel audit log.

[0038] The process of locating and extracting the signature data adopts a dual verification architecture that is resistant to address offsets. The specific operation is as follows:

[0039] Before parsing the signature length identifier value L2, the device starts the digital signature pre-inspection module. This module calculates the theoretical storage area boundary address of the signature data based on the preset elliptic curve algorithm type and creates a restricted access sandbox area in the flash memory controller through reverse memory mapping technology.

[0040] When performing tail addressing, a two-stage positioning process is initiated simultaneously: the first stage reads the L2 identifier value according to the offset calculation strategy of L2_exp+M; the second stage dynamically scans the feature header identifier of the digital signature Sign in the sandbox area through the cryptographically secure pointer; the signature data copying channel is activated only when both the L2 value and the Sign feature header size verification pass.

[0041] A continuous verification mechanism is introduced in the signature extraction stage. The first 4 bits of binary data at the beginning of the digital signature Sign are protected by parity check and (7,4) Hamming code. The Hamming code check bits occupy 3 bits of storage space. If a single bit error is detected, it is corrected immediately. If multiple bit errors exceeding the error correction capability limit are detected, the signature verification process is interrupted and the error vector register in the secure storage area is marked.

[0042] The specific details of the parallel segmented hashing strategy are as follows:

[0043] The device initializes a dynamic block partitioning engine, which determines the optimal sub-block partitioning parameters based on the current total free memory, the number of processor cores, and the product factor of the original firmware copy. It then creates a multi-threaded computing array with a ring-shaped buffer topology, where each thread is bound to a dedicated processor core and connected to a dedicated memory pool via a high-speed interconnect bus. During the hash calculation startup phase, the main scheduler cuts the firmware data stream into multi-dimensional data slices aligned to cache lines and allocates them to worker threads. Each thread executes a three-stage hash pipeline operation in a pipelined manner: the first stage preprocessing rearranges the bits of the input data block, the second stage executes multiple rounds of hash compression function iterations, and the final stage generates a hash intermediate value digest with a timestamp. A global monitor detects thread status in real time and implements failover: when a thread's computation delay exceeds the dynamic response window, its task is immediately assigned to an adjacent processing unit within the same processor core for takeover computation, while the cache area of ​​the abnormal thread is locked for memory error diagnosis scanning.

[0044] The establishment and maintenance of the encrypted transmission channel includes a hardware-enhanced two-way authentication system. Before the router initiates an upgrade request, the pre-activated cryptographic coprocessor in the secure boot engine first generates a true random number sequence based on a quantum noise source. Specifically, it can call the TRNG module (GM / T0062 standard) in the router's built-in SM4 chip to generate a true random number sequence, extract key fragments as instantaneous session factors, and simultaneously collect the device's unique DNA code stored in the hardware trusted module and perform a one-way hash transformation. A multi-layer encapsulated transmission frame is constructed through a deeply integrated network security processing unit. The core layer is structured business data containing the original firmware request, the middle layer is an authentication header embedding the instantaneous session factor and DNA hash value, and the outer layer is encapsulated as an IPSec security association tunnel with dynamic key rotation. When a response is received from the cloud, the tunnel decapsulation module first verifies the timeliness of the session factor and its temporal correlation characteristics with the original request, and then performs chain authentication of the device identity through DNA hash value comparison. If any verification fails, the transmission channel self-destruct sequence will be triggered: destroying all copies of the current session key seed, resetting the network protocol stack state machine to the initial security baseline, and clearing the intermediate operation cache of the cryptographic coprocessor.

[0045] The pre-guided diagnostic sequence integrates a multi-dimensional failure protection strategy, the details of which are as follows:

[0046] During the initial boot phase from the backup partition, the hierarchical diagnostic controller executes a verification operation chain: the first-level hardware root of trust verification stage verifies the digital certificate chain in the kernel header and matches the signature policy matrix, which is pre-stored in the secure storage area; the second-level wireless hardware self-test stage sends a customized diagnostic command sequence to the RF module while monitoring the signal spectrum integrity; the third-level file system static analysis stage initiates offline media scanning to calculate double-end redundancy check values ​​for critical partitions; each diagnostic level has an independent circuit breaker mechanism: hardware verification failure will lock the boot decryption module, wireless anomalies trigger the RF module power closed-loop control, and file system verification errors activate the bad block remapping engine; any persistent fault at any level will trigger a diagnostic interrupt vector injection into the processor's non-maskable interrupt line, specifically by sending a reset signal to the CPU through the INT_NMI pin of the hardware watchdog module, which is physically connected to the processor's non-maskable interrupt line, forcibly jumping to the partition rollback microcode execution environment.

[0047] Example 2: A WiFi router online upgrade security verification system, such as... Figure 1 As shown, it includes:

[0048] The firmware package construction module is used to calculate the cryptographic hash value H1 of the original firmware, use the elliptic curve algorithm to sign H1 with the manufacturer's private key to generate a digital signature Sign; construct a structured firmware package, which includes an N-byte little-endian encoded firmware length identifier field, a continuous L1-byte original firmware data body (the value L1 is the original firmware byte length), an M-byte little-endian encoded signature length identifier field, a continuous L2-byte digital signature Sign, and a tamper-proof verification structure, where the value of L2 is determined by the elliptic curve algorithm type, and the elliptic curve P-256 corresponds to 64 bytes;

[0049] The firmware package verification module is used to read the first N bytes of the firmware package after the router device obtains the firmware package through the encrypted transmission channel. This first N bytes are parsed into a firmware length value L1. A continuous L1 byte starting from the offset position of the Nth byte is extracted as the original firmware copy. Based on a preset elliptic curve algorithm type, the expected signature length value L2_exp is determined (L2_exp=64 for P-256 algorithm, L2_exp=96 for P-384 algorithm). After performing header integrity verification based on the anti-tampering verification structure, a continuous M bytes starting from the L2_exp+M byte from the end of the firmware package are read and parsed into a signature length identifier value L2. If L2 and L2_exp are inconsistent, the process terminates; otherwise, a continuous L2 byte is extracted from the L2 byte from the end of the firmware package as signature data. The signature data is decrypted using a preset public key to obtain a reference hash value H1'. The original firmware copy is then subjected to the same cryptographic hash operation as the one performed on the cloud using a parallel segmented hashing strategy to obtain a local hash value H2. The firmware is deemed legitimate if and only if H1' and H2 completely match and the signature verification passes.

[0050] The activation module ensures that, after successful verification, it writes a copy of the original firmware to the spare partition of the storage. After writing, it updates the boot flag in the boot configuration area to point to the spare partition. It triggers a system reboot to boot the device from the spare partition. When the device boots from the spare partition, it executes a pre-boot diagnostic sequence, opens a timeout monitoring window, and listens for the operating system kernel ready signal during the window period. If a valid signal is captured, the spare partition is permanently activated. If the window times out, it automatically resets the boot pointer of the original active partition according to the multi-stage transaction flag status and triggers a rollback and reboot process.

[0051] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims. Parts not described in detail in this specification are prior art known to those skilled in the art.

Claims

1. A method for online upgrade security verification of a Wi-Fi router, characterized in that, include: Calculate the cryptographic hash value H1 of the original firmware, and use the elliptic curve algorithm to sign H1 with the manufacturer's private key to generate a digital signature Sign; Construct a structured firmware package, which includes an N-byte firmware length identifier field, a continuous L1-byte raw firmware data body, an M-byte signature length identifier field, a continuous L2-byte digital signature Sign, and a tamper-proof verification structure. After the router device obtains the firmware package through the encrypted transmission channel, it reads the first N bytes from the beginning of the firmware package and parses them into the firmware length value L1. It then extracts consecutive L1 bytes starting from the offset position of the Nth byte as the original firmware copy. Based on a preset elliptic curve algorithm type, it determines the expected signature length value L2_exp. After verifying the tamper-proof structure, it reads consecutive M bytes from the L2_exp+M bytes from the end of the firmware package and parses them into the signature length identifier value L2. If L2 and L2_exp are inconsistent, the process terminates; otherwise, it extracts consecutive L2 bytes from the L2 bytes from the end of the firmware package as signature data. It decrypts the signature data using a preset public key to obtain a reference hash value H1'. It then performs the same cryptographic hash operation as in the cloud on the original firmware copy using a parallel segmented hashing strategy to obtain the local hash value H2. The firmware is deemed legitimate if and only if H1' and H2 completely match and the signature verification passes. After successful verification, the original firmware copy is written to the spare partition of the storage and then the system boots. Pre-boot diagnostics are performed, and kernel signals are monitored. If successful, the spare partition is activated; otherwise, the system automatically rolls back to the original partition and restarts.

2. The online upgrade security verification method for a Wi-Fi router according to claim 1, characterized in that, The specific operations for generating and verifying the anti-tampering verification structure include: When constructing the firmware package in the cloud, a multi-level checksum synthesis operation is performed. First, the first-level bitwise XOR operation is performed by extracting the first valid bit segment of the firmware length identifier field and the second valid bit segment of the signature length identifier field. The result of the operation is then combined with the preset hardware architecture feature code to perform a second-level logical AND operation. Finally, the device model cyclic redundancy check value is superimposed to form a composite checksum structure that is not symmetrically embedded in the firmware package.

3. The online upgrade security verification method for a Wi-Fi router according to claim 2, characterized in that, Verifying the tamper-proof structure involves the following steps: After the device extracts the firmware copy, it triggers the verification coprocessor to generate a dynamic verification code. When the similarity between the composite verification structure and the dynamic verification code is lower than the preset dynamic security threshold, hardware-level fuse protection is activated: the power supply to the flash controller write channel is cut off first, then the data partition to be verified in the transmission buffer is erased, and at the same time, dangerous operation events containing the complete firmware packet header hash value, the bitmap of the verification failure location and the clock stamp are recorded in the kernel audit log.

4. The online upgrade security verification method for a Wi-Fi router according to claim 3, characterized in that, The process of locating and extracting the signature data adopts a dual verification architecture that is resistant to address offsets. The specific operation is as follows: Before parsing the signature length identifier value L2, the device starts the digital signature pre-inspection module. This module calculates the theoretical storage area boundary address of the signature data based on the preset elliptic curve algorithm type and creates a restricted access sandbox area in the flash memory controller through reverse memory mapping technology. When performing tail addressing, a two-stage positioning process is initiated simultaneously: the first stage reads the L2 identifier value according to the offset calculation strategy of L2_exp+M; the second stage dynamically scans the feature header identifier of the digital signature Sign in the sandbox area through the cryptographically secure pointer; the signature data copying channel is activated only when both the L2 value and the Sign feature header size verification pass. A continuous verification mechanism is introduced in the signature extraction stage. The first 4 bits of binary data at the beginning of the digital signature Sign are protected by parity check and (7,4) Hamming code. The Hamming code check bits occupy 3 bits of storage space. If a single bit error is detected, it is corrected immediately. If multiple bit errors exceeding the error correction capability limit are detected, the signature verification process is interrupted and the error vector register in the secure storage area is marked.

5. The online upgrade security verification method for a Wi-Fi router according to claim 4, characterized in that, The specific details of the parallel segmented hashing strategy are as follows: The device initializes a dynamic block partitioning engine, which determines the optimal sub-block partitioning parameters based on the current total amount of free memory, the number of processor cores, and the product factor of the original firmware copy. It then creates a multi-threaded computing array with a ring buffer topology, where each thread is bound to a dedicated processor core and connected to a dedicated memory pool via a high-speed interconnect bus. During the hash calculation startup phase, the main scheduler cuts the firmware data stream into multi-dimensional data slices according to the cache line alignment method and allocates them to worker threads. Each thread executes a three-level hash pipeline operation in a pipeline mode: the first level preprocessing performs bit rearrangement on the input data block, the second level executes multiple rounds of hash compression function iteration, and the final level generates a hash intermediate value digest with timestamps. The global monitor detects thread status in real time and implements failover: when the computation delay of a thread exceeds the dynamic response window, its task is immediately assigned to an adjacent arithmetic unit within the same processor core for takeover computation, while the cache area of ​​the abnormal thread is locked for memory error diagnosis and scanning.

6. The online upgrade security verification method for a Wi-Fi router according to claim 5, characterized in that, Perform pre-boot diagnostics and listen for kernel signals. The specific steps are as follows: During the initial boot phase of the device from the backup partition, the hierarchical diagnostic controller is initiated to execute a verification operation chain: the first-level hardware root of trust verification stage verifies the digital certificate chain in the kernel header and matches the signature policy matrix; the second-level wireless hardware self-test stage sends a customized diagnostic command sequence to the RF module while monitoring the signal spectrum integrity; the third-level file system static analysis stage initiates offline media scanning to calculate double-end redundancy check values ​​for critical partitions; each diagnostic level has an independent circuit breaker mechanism: hardware verification failure will lock the boot decryption module, wireless anomalies trigger the RF module power closed-loop control, and file system verification errors activate the bad block remapping engine; any persistent failure at any level will trigger a diagnostic interrupt vector injection into the processor's non-maskable interrupt line, which is physically connected to the processor's non-maskable interrupt line, forcibly jumping to the partition rollback microcode execution environment.

7. A Wi-Fi router online upgrade security verification system, characterized in that, The system is applied to the online upgrade security verification method for a Wi-Fi router as described in any one of claims 1-6, comprising: The firmware package building module is used to calculate the cryptographic hash value H1 of the original firmware, use the elliptic curve algorithm to sign H1 with the manufacturer's private key to generate a digital signature Sign; construct a structured firmware package, which includes an N-byte firmware length identifier field, a continuous L1-byte original firmware data body, an M-byte signature length identifier field, a continuous L2-byte digital signature Sign, and a tamper-proof verification structure. The firmware package verification module is used to read the first N bytes of the firmware package from the beginning of the package after the router device obtains the firmware package through the encrypted transmission channel. This is parsed into a firmware length value L1, and the first N bytes (starting from the offset position of the Nth byte) are extracted as the original firmware copy. Based on a preset elliptic curve algorithm type, the expected signature length value L2_exp is determined. After verifying the tamper-proof structure, the module reads M bytes (starting from the L2_exp+M bytes from the end of the firmware package) and parses them into a signature length identifier value L2. If L2 and L2_exp are inconsistent, the process terminates; otherwise, the module extracts the first L2 bytes (starting from the L2 bytes from the end of the firmware package) as signature data. The signature data is decrypted using a preset public key to obtain a reference hash value H1'. A parallel segmented hashing strategy is used to perform the same cryptographic hash operation as on the cloud on the original firmware copy to obtain a local hash value H2. The firmware is deemed legitimate only if H1' and H2 completely match and the signature verification passes. The activation module is used to write a copy of the original firmware to the spare partition of the storage after successful verification, and then boot the system. It also performs pre-boot diagnostics, listens for kernel signals, and activates the spare partition if successful, and automatically rolls back to the original partition and restarts if the timeout occurs.

Images