Chip security starting method based on variable credential

Abstract

The invention belongs to the technical field of chip security, and particularly relates to a chip security starting method based on variable credentials, which comprises the following steps of: blocking illegal algorithm calling and border-crossing public key access by solidifying key parameters such as an algorithm type, a public key table hash value and the like in one time programmable (OTP) and combining a bit fusing mechanism of a public key state flag; based on a dynamic key derivation mechanism of a firmware decryption base key and a salt value, remote (FOTA) updating of a symmetric key is realized, and the leakage risk of an OTP direct storage key is avoided; the OTP state flag is updated through linkage of a public key revocation mask, multi-public-key one-way revocation and chained verification of a firmware hash value table are supported, and a multi-level firmware starting scene is adapted. Finally, dynamic replacement and multi-dimensional legality verification of the public key and the secret key are realized while the irreversible security characteristic of the OTP is guaranteed, and the anti-attack capability and the expandability of the system are improved.

Description

Technical Field

[0001] The present invention belongs to the field of chip security technology, and in particular relates to a chip security startup method based on variable credentials. Background Art

[0002] In existing chip security boot technology, a fixed root of trust mechanism is usually adopted, such as solidifying the verification public key or public key hash value in the OTP (one-time programmable memory) inside the chip. However, if the private key corresponding to the public key is leaked, due to the unmodifiable nature of the OTP, the root of trust cannot be dynamically replaced, causing the system to face long-term security risks. To address this problem, existing technologies (such as Chinese patent CN114065218A) propose storing a hash value containing multiple public keys in the OTP, and storing the public key table in an external Flash, and selecting the currently used public key by the public key number. However, this solution still has the following defects:

[0003] Security risks: Fields such as the hash algorithm type and number of public keys stored in the Flash memory are easily tampered with. Attackers can trick the chip into using a less secure algorithm or access the public key table beyond its bounds, leading to key forgery or memory overflow attacks.

[0004] Insufficient scalability: It only supports single firmware verification and cannot adapt to multi-level firmware chain boot scenarios. In addition, public key revocation relies on the revocation number stored in the OTP, and it cannot dynamically add revocation identifiers.

[0005] Key replacement limitations: The firmware decryption key is directly stored in the OTP and cannot be replaced after being leaked, which lacks flexibility. Summary of the Invention

[0006] The purpose of the present invention is to provide a chip secure startup method based on variable credentials, which, while ensuring the irreversible security characteristics of OTP, realizes the dynamic replacement of public keys and secret keys and multi-dimensional legitimacy verification, improves the system's anti-attack capability and scalability, and solves the problems raised in the above background technology.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: a chip secure boot method based on variable credentials, comprising the following steps:

[0008] S1: The host computer initializes the burning algorithm type flag, public key table hash value, public key status flag and firmware decryption base key in the OTP area inside the chip through the chip burning tool; and burns the public key table, selected public key number, firmware hash value table, salt value, boot configuration data signature and encrypted firmware into the Flash through the Flash burning tool;

[0009] S2: reading the public key table hash value in the OTP after the chip is powered on, and verifying whether the public key table hash value in the Flash is consistent with the public key table hash value;

[0010] S3: if consistent, reading the selected public key number in the Flash, and checking whether the selected public key number exists in the public key table;

[0011] S4: if exists, checking whether the public key corresponding to the public key number is not revoked according to the public key state flag in the OTP;

[0012] S5: if not revoked, selecting the public key corresponding to the selected public key number in the public key table as the security public key, verifying the boot configuration data signature, and determining the legality of the field data in the Flash according to the verification result.

[0013] Preferably, the algorithm type flag includes the types of hash algorithm, public key algorithm and symmetric algorithm; the public key table hash value is calculated by the upper computer through the hash algorithm on the public key table; the public key state flag records the revocation state of each public key in the form of bit coding; and the firmware decryption base key is used to generate a symmetric key after being spliced with a salt value.

[0014] Preferably, each public key in the public key table includes a public key number, a public key value and a public key revocation mask; and the public key revocation mask specifies other public keys that need to be revoked synchronously when the current public key is activated.

[0015] Preferably, the verification of the boot configuration data signature includes:

[0016] reading the spliced data from the public key table to the salt value in the Flash, and calculating a first hash value thereof;

[0017] decrypting the boot configuration data signature through the security public key to obtain a second hash value;

[0018] if the first hash value is consistent with the second hash value, confirming that the spliced data is legal.

[0019] Preferably, the method further includes: S6: updating the public key state flag in the OTP according to the public key revocation mask corresponding to the selected public key number in the public key table, so as to revoke the specified public key.

[0020] Preferably, the updating of the public key state flag is realized through bitwise XOR operation, and specifically includes: XORing the public key state flag with the public key revocation mask and then burning to the OTP.

[0021] Preferably, the symmetric key is generated through the hash algorithm on the spliced data of the firmware decryption base key and the salt value, and is used to decrypt the encrypted firmware.

[0022] Preferably, the method further comprises: S7: reading each firmware from the Flash in the starting order, and verifying whether the hash value of each firmware after being decrypted by using the symmetric key is consistent with the corresponding hash value in the firmware hash value table.

[0023] Preferably, the method further comprises: S8: when it is necessary to revoke the public key or replace the symmetric key, updating the selected public key number, the salt value, the boot configuration data signature and the re-encrypted firmware in the Flash through the FOTA mechanism.

[0024] Preferably, the FOTA mechanism comprises: the upper computer generates a new selected public key number and / or a salt value, re-computes a boot configuration data signature and encrypts a firmware; packages the updated data into an FOTA upgrade package, performs an overwriting write into the Flash and triggers a chip restart to perform a new starting process.

[0025] Technical effects and advantages of the present application: the chip security starting method based on variable credentials provided by the present application has the following advantages compared with the prior art.

[0026] The present application effectively overcomes the security and flexibility defects of the prior art chip security starting scheme, and in view of the algorithm tampering and key leakage risk of the traditional fixed trusted root and external storage public key table scheme, the present application solidifies the algorithm type, the public key table hash value and other key parameters in the OTP, and combines the bit fusing mechanism of the public key state flag to block illegal algorithm calling and out-of-bound public key access; based on the dynamic key derivation mechanism of the firmware decryption base key and the salt value, the symmetric key is remotely (FOTA) updated, and the leakage risk of the OTP directly storing the key is avoided; the public key revocation mask is linked to update the OTP state flag, supports one-way revocation of multiple public keys and chain verification of the firmware hash value table, and adapts to multi-level firmware starting scenarios. Finally, while ensuring the irreversible security characteristics of the OTP, the dynamic replacement of the public key and the key and the multi-dimensional legality verification are realized, and the system attack resistance and the scalability are improved. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 The flowchart of the chip security starting method based on variable credentials of the present application is shown in the figure.

[0028] Figure 2 The field initialization structure diagram of the OTP area in the chip of the present application is shown in the figure.

[0029] Figure 3 The field and data initialization structure diagram in the Flash of the present application is shown in the figure. DETAILED DESCRIPTION

[0030] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. The specific embodiments described here are only used to explain the present application, and are not used to limit the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work belong to the scope of protection of the present application.

[0031] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. The specific embodiments described here are only used to explain the present application, and are not used to limit the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work belong to the scope of protection of the present application. Figure 1 The present embodiment shows a flow chart of a chip security startup method based on variable credentials.

[0032] Specifically, the present application proposes a chip security startup method based on variable credentials, which comprises the following steps:

[0033] The host computer initializes and burns the following fields in the chip internal OTP area through a chip burning tool: algorithm type flag, public key table hash value, public key state flag, and firmware decryption base key.

[0034] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. The specific embodiments described here are only used to explain the present application, and are not used to limit the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work belong to the scope of protection of the present application. Figure 2 To understand the initialization structure of the chip internal OTP area field shown in the embodiments of the present application.

[0035] Further, the algorithm type flag records the specific types of the hash algorithm, the public key algorithm and the symmetric algorithm used in the chip security startup process. Each algorithm type is determined by the host computer from the set of supported cryptographic algorithms of the chip. In the present embodiment, the length of the algorithm type flag is set to 1 byte, and the big-end bit sequence is arranged. Among them, the values of bit0 to bit1 are 10, indicating that the hash algorithm type is SHA-256; the values of bit2 to bit3 are 01, indicating that the public key algorithm type is ECDSA (P256 curve); the values of bit4 to bit5 are 11, indicating that the symmetric algorithm is AES-CBC-256.

[0036] The public key table hash value records the hash value of the public key table calculated by the host computer using the SHA-256 hash algorithm, and the length is 256 bits.

[0037] The public key state flag records the state of each public key in the public key table determined by the host computer. The state of the public key has two kinds: revoked or not revoked.

[0038] In the embodiment, the length of the public key status flag is set to 1 byte, and the big-end bit sequence is adopted. The bit0 represents the status of the first public key in the public key table, the bit1 represents the status of the second public key, and so on. If each bit is 1, it means that the corresponding public key has not been revoked. If each bit is 0, it means that the corresponding public key has been revoked. Therefore, if the values of the bits 0 to 7 are 11111111, it means that the public key table contains 8 public keys, and all the public keys have not been revoked.

[0039] The firmware decryption base key records the base key for generating the symmetric key of the chip for decrypting the firmware determined by the host computer, and the key is not directly used for the firmware encryption operation of the host computer and the firmware decryption operation in the chip security start process. The longer the length of the firmware decryption base key is, the higher the security is generally. The present application does not limit the specific length. In the embodiment, the length of the firmware decryption base key is set to 256 bits.

[0040] The host computer burns the following fields and data in the Flash through the Flash burning tool: the public key table, the selected public key number, the firmware hash value table, the salt value, the boot configuration data signature, and each encrypted firmware.

[0041] Please refer to the Flash field and data initialization structure shown in the embodiment of the present application in the attached drawings of the present application. Figure 3 In order to better understand the Flash field and data initialization structure shown in the embodiment of the present application.

[0042] Further, the public key table is provided by the host computer, which records the public key number, the public key value and the public key revocation mask of each public key. The public key revocation mask specifies the public keys that should be revoked synchronously when the corresponding public key is activated. The activation refers to the first selection of using a certain public key. The revocation refers to permanently discarding a certain public key and not using it any more.

[0043] In the embodiment, the length of the public key number and the public key revocation mask corresponding to each public key is 1 byte, and the big-end bit sequence is adopted. In the public key revocation mask, the bit with the value of 1 means that the corresponding public key needs to be revoked.

[0044] The selected public key number records the public key number corresponding to the public key selected by the host computer from the public key table. In the embodiment, the selected public key number is 00000001, which means that the host computer has selected the public key with the number 00000001 in the public key table.

[0045] The firmware hash value table records the hash value of each firmware calculated by the host computer using the SHA-256 hash algorithm. The hash values of each firmware are arranged in the firmware hash value table in the order of the startup and loading of each firmware, and the hash value of the first startup and loading firmware is located at the head of the firmware hash value table. In this embodiment, the chip startup process needs to load firmware 1 and firmware 2 in turn, and therefore the hash values of firmware 1 and firmware 2 are recorded in the firmware hash value table in turn, and the length of each hash value is 256 bits.

[0046] The salt value is provided by the host computer and can be a random number. The longer the length of the salt value, the higher the security, and the specific length is not limited in the present application. In this embodiment, the length of the salt value is 256 bits.

[0047] The boot configuration data signature is a signature obtained by the host computer using the private key corresponding to the selected public key to calculate the hash value of the spliced data of all fields from the public key table to the salt value through the ECDSA (P256 curve) public key algorithm.

[0048] The hash value of the spliced data of all fields is a hash value calculated by the host computer using the SHA-256 hash algorithm on the spliced data of all fields from the public key table to the salt value. In this embodiment, the calculation method of the boot configuration data signature is: ECDSA-P256 (private key, SHA-256 (public key table || selected public key number || firmware hash value table || salt value)), wherein || represents data splicing; because the public key algorithm used is ECDSA (P256 curve), the length of the boot configuration data signature is 520 bits.

[0049] The encrypted firmware is the firmware encrypted by the host computer using the symmetric key through the AES-CBC-256 symmetric key algorithm. The symmetric key is the hash value calculated by the host computer using the SHA-256 hash algorithm on the spliced data of the firmware decryption base key and the salt value, which is used as the symmetric key. In this embodiment, the hash algorithm is SHA-256, and therefore the length of the symmetric key is 256 bits, which is suitable for the symmetric algorithm AES-CBC-256.

[0050] After the chip is powered on, the algorithm type flag, the public key table hash value, the public key state flag, and the firmware decryption base key are read from the OTP inside the chip.

[0051] The chip reads the public key table from the Flash and checks whether the hash value calculated by using the SHA-256 hash algorithm on the public key table is consistent with the public key table hash value read from the OTP. If consistent, it can be confirmed that the public key table in the Flash is legal; otherwise, the chip terminates the startup process.

[0052] The chip reads the selected public key number from the Flash, and checks whether the selected public key number exists in the public key table. If it exists, it can be confirmed that the selected public key number in the Flash is legal; otherwise the chip terminates the startup process. In this embodiment, the selected public key number 00000001 matches the public key number of the first public key in the public key table, so the selected public key number is legal.

[0053] The chip checks the status of the public key corresponding to the selected public key number using the public key status flag. If the public key corresponding to the selected public key number is not revoked, it can be confirmed that the corresponding public key is legal; otherwise the chip terminates the startup process. In this embodiment, the chip can confirm whether the corresponding public key is legal by checking whether the result of performing a bitwise AND operation using the selected public key number and the public key status flag is equal to the selected public key number itself: 00000001 AND 11111111 = 00000001, so the status of the public key corresponding to the selected public key number 00000001 is not revoked, and the corresponding public key is legal.

[0054] The chip selects the public key corresponding to the selected public key number from the public key table as the security public key for this security startup process. In this embodiment, the first public key in the public key table is selected as the security public key.

[0055] The chip reads the data including all fields from the public key table to the salt value in the Flash, calculates the hash value of this data using the SHA-256 hash algorithm, and takes it as the first hash value.

[0056] The chip reads the boot configuration data signature from the Flash, and performs an inverse signature operation on the signature using the security public key through the ECDSA (P256 curve) public key algorithm to obtain the second hash value.

[0057] The chip checks whether the second hash value is consistent with the first hash value. If it is consistent, it is confirmed that all the data including all fields from the public key table to the salt value are legal; otherwise the chip terminates the startup process.

[0058] The chip checks whether the public key status flag needs to be updated using the public key corresponding to the selected public key number in the public key table and the public key revocation mask. If it needs to be updated, the public key status flag in the OTP area is updated, thereby revoking the corresponding public key.

[0059] In this embodiment, the chip can determine whether the public key status flag needs to be updated by checking whether the result of performing a bitwise XOR operation using the public key status flag and the public key revocation mask is equal to the public key status flag itself: 11111111 XOR 00000000 = 11111111, and the result of the bitwise XOR operation is equal to the public key status flag, so the result of the check is that the public key status flag does not need to be updated.

[0060] The chip uses the SHA-256 hash algorithm to calculate the spliced data of the firmware decryption base key and the salt value, and takes the calculated hash value as the symmetric key.

[0061] The chip reads each firmware from the Flash in turn according to the startup loading sequence and verifies the legality. Further, the chip uses the symmetric key to perform a decryption operation on the firmware through the AES-CBC-256 symmetric algorithm, then calculates the hash value of the decrypted firmware using the SHA-256 hash algorithm, and checks whether it is consistent with the corresponding hash value in the firmware hash value table. If consistent, it can be confirmed that the firmware is legal, and the next firmware is read and verified, until all firmware is verified; otherwise the chip terminates the startup process. In this embodiment, the chip first reads and decrypts firmware 1, calculates the hash value of firmware 1 and compares it with the hash value of firmware 1 in the firmware hash value table. If the comparison is consistent, it is confirmed that firmware 1 is legal, and firmware 2 is read and decrypted and verified.

[0062] Optionally, if the private key corresponding to the public key selected by the host computer or the symmetric key used to encrypt the firmware is leaked, the public key needs to be revoked or the symmetric key needs to be replaced. The process of revoking the public key or replacing the symmetric key can be triggered by the FOTA (Firmware Over The Air) mechanism. The FOTA mechanism includes:

[0063] If the public key needs to be revoked, the host computer should select the next public key number in the public key table as the new selected public key number, and the boot configuration data signature needs to be updated.

[0064] If the symmetric key needs to be replaced, the host computer should select a new salt value, and use the new symmetric key calculated from the new salt value to re-encrypt the firmware.

[0065] The host computer packs the public key table, the selected public key number, the firmware hash value table, the salt value, the boot configuration data signature, and each encrypted firmware into a FOTA upgrade package, and performs upgrade package pushing, unpacking, and overwriting into the original fields and data in the Flash through a secure upgrade process, and then powers on the chip again. The secure upgrade process is a well-known technology to developers in the field, and considering that the main purpose of the present application is secure startup, it will not be described in detail here.

[0066] In this embodiment, it is assumed that the public key needs to be revoked and the symmetric key needs to be replaced due to key leakage. The host computer first selects the next public key number 00000010 in the public key table as the new selected public key number, and then selects a new salt value and uses the new symmetric key calculated from the new salt value to re-encrypt firmware 1 and firmware 2. Finally, the host computer recalculates the boot configuration data signature.

[0067] The host computer packs the public key table, the new selected public key number, the firmware hash value table, the new salt value, the boot configuration data signature, and each encrypted firmware into a FOTA upgrade package, and performs upgrade package pushing, unpacking, and overwriting of the original fields and data in the Flash through a secure upgrade process, and then causes the chip to be powered on again. The following focuses on the differences between the process after the chip is powered on again and the previous power-on process, and the remaining steps that are not different are omitted.

[0068] In the step of checking by the chip whether the selected public key number exists in the public key table, the selected public key number 00000010 matches the public key number of the second public key in the public key table, so the selected public key number is legal.

[0069] In the step of checking the status of the public key corresponding to the selected public key number by the chip using the public key status flag, the chip confirms whether the corresponding public key is legal by using the selected public key number and the public key status flag to perform a bitwise AND operation, and checking whether the result is equal to the selected public key number itself:

[0070] 00000010 AND 11111111 = 00000010, so the status of the public key corresponding to the selected public key number 00000010 is not revoked, and the corresponding public key is legal.

[0071] In the step of selecting a secure public key by the chip, the second public key in the public key table is selected as the secure public key.

[0072] In the step of checking by the chip whether the public key status flag needs to be updated, the chip judges whether the public key status flag needs to be updated by using the public key status flag and the public key revocation mask to perform a bitwise XOR operation, and checking whether the result is equal to the public key status flag itself: 11111111 XOR 00000001 = 11111110, the bitwise XOR operation result is not equal to the public key status flag, so the check result is that the public key status flag needs to be updated. The chip performs a high-voltage write operation on the address of the OTP region public key status flag to burn the bitwise XOR operation result 11111110 into the OTP, so that bit0 of the public key status flag is fused from 1 to 0, achieving the goal of permanently revoking the public key corresponding to bit0.

[0073] In the process of calculating the symmetric key by the chip, the SHA-256 hash algorithm is used to process the combined data of the firmware decryption base key and the new salt value, and the calculated hash value will be used as the symmetric key. In the next step of decrypting firmware 1 and firmware 2, this symmetric key is used to perform decryption, thereby achieving the update of the symmetric key.

[0074] Terminology explanation:

[0075] Credentials: In the field of cryptography, credentials are digitized information used to verify identity or authority, including secret credentials (such as passwords / symmetric keys) and public key credentials (asymmetric public / private keys).

[0076] In summary, the method proposed in the present application has at least the following beneficial effects:

[0077] 1. The key information such as hash algorithm type, public key algorithm type, and symmetric algorithm type is stored in OTP (0ne-Time Programmable), effectively avoiding the tampering risk that these sensitive data may suffer when stored in Flash.

[0078] 2. By firmware decryption, combined with base key and random salt value, a symmetric key is dynamically generated. The base key itself is not directly used in the decryption process, while the salt value can be dynamically updated with FOTA (Firmware Over-The-Air) upgrade. This method effectively solves the problem of directly storing firmware decryption keys in OTP (0ne-Time Programmable) in the prior art, i.e. the difficulty of replacing the key once it is compromised.

[0079] 3. Each public key in the public key table is associated with a revocation mask, and the public key state flag in OTP is updated through the mask when the public key is activated, realizing one-way irreversible revocation and solving the limitation of dynamic expansion caused by the fixed revocation number of public key revocation relying on OTP storage in the prior art.

[0080] 4. The OTP update operation mode is clearly defined: the bit is fused by high-voltage write operation, which conforms to the physical characteristics of OTP and avoids the logical contradiction of OTP un-updatable in the prior art.

[0081] 5. Multi-dimensional public key legality verification is supported, which includes double-checking: public key number existence checking and public key state checking. This solves the security problem caused by the defect of public key number legality checking.

[0082] 6. Multi-level firmware chain verification is realized through the firmware hash value table, and the firmware verification process includes closed-loop operations of decryption, hash, and comparison. According to the startup order, multiple firmwares are verified in turn to build a chain of trust, effectively overcoming the limitation of supporting only a single firmware.

[0083] 7. It clearly supports international standard algorithm combination, is compatible with mainstream cryptography framework, reduces integration difficulty, and improves the problem of not defining algorithm type and combination in detail in the prior art, eliminating the ambiguity that may arise during implementation.

[0084] 8. The public key table structure realizes the forced binding of public key number, public key value and public key revocation mask, verifies the integrity by comparing the hash algorithm with the OTP storage value, protects the full field data from the public key table to the salt value by combining the public key signature, and forms double verification.

[0085] 9. The public key rotation and symmetric key replacement are realized by supporting FOTA (Firmware Over-The-Air) upgrade. In the case of key leakage, the old public key can be revoked and the new key can be replaced by remote upgrade without physical contact with the chip.

[0086] 10. The OTP field adopts bit-level encoding, the algorithm type flag and the public key state flag adopt compact design, 8 bits can manage 8 public key states, and the OTP space is effectively saved.

[0087] Finally, it should be noted that: the above only for the preferred embodiments of the present application, and not for limiting the present application, although the foregoing embodiments of the present application are described in detail, for those skilled in the art, it still can be modified, or part of the technical features of the equivalent replacement, within the spirit and principles of the present application, any modification, equivalent replacement, improvement, etc., should be included in the protection scope of the present application.

Claims

1. A chip secure boot method based on variable credentials, characterized in that: The following steps are involved: S1: The host computer initializes the burning algorithm type flag, public key table hash value, public key status flag and firmware decryption base key in the OTP area inside the chip through the chip burning tool; and burns the public key table, selected public key number, firmware hash value table, salt value, boot configuration data signature and encrypted firmware into the Flash through the Flash burning tool; S2: After the chip is powered on, the public key table hash value in the OTP is read, and the hash value of the public key table in the Flash is verified to be consistent with the public key table hash value; S3: If they are consistent, read the selected public key number in the Flash and check whether the selected public key number exists in the public key table; S4: If so, check whether the public key corresponding to the public key number has not been revoked according to the public key status flag in the OTP; S5: If not revoked, select the public key corresponding to the selected public key number from the public key table as the security public key, verify the boot configuration data signature, and determine the legitimacy of the field data in the Flash according to the verification result.

2. A chip secure boot method based on variable credentials according to claim 1, characterized in that: The algorithm type flag includes the types of hash algorithm, public key algorithm and symmetric algorithm; the hash value of the public key table is calculated by the host computer through the hash algorithm on the public key table; the public key status flag records the revocation status of each public key in bit encoding; the firmware decryption base key is used to generate a symmetric key after splicing with the salt value.

3. The chip secure boot method based on variable credentials according to claim 1, characterized in that: Each public key in the public key table includes a public key number, a public key value and a public key revocation mask; the public key revocation mask specifies other public keys that need to be revoked synchronously when the current public key is activated.

4. The chip secure boot method based on variable credentials according to claim 1, characterized in that: The verification of the boot configuration data signature includes: Read the concatenated data from the public key table to the salt value in the Flash and calculate its first hash value; Decrypting the boot configuration data signature using the secure public key to obtain a second hash value; If the first hash value is consistent with the second hash value, the spliced ​​data is confirmed to be legal.

5. The chip secure boot method based on variable credentials according to claim 1, characterized in that: The method further comprises: S6: Update the public key status flag in the OTP according to the public key revocation mask corresponding to the selected public key number in the public key table to revoke the specified public key.

6. A chip secure boot method based on variable credentials according to claim 5, characterized in that: Updating the public key status flag is achieved through a bitwise XOR operation, specifically including: performing XOR operation on the public key status flag and the public key revocation mask and then burning the result into the OTP.

7. The chip secure boot method based on variable credentials according to claim 1, characterized in that: The symmetric key is generated by calculating the concatenation of the firmware decryption base key and the salt value through a hash algorithm, and is used to decrypt the encrypted firmware.

8. The chip secure boot method based on variable credentials according to claim 1, characterized in that: The method further comprises: S7: Read each firmware from the Flash in the boot order, decrypt it using the symmetric key, and verify whether its hash value is consistent with the corresponding hash value in the firmware hash value table.

9. The chip secure boot method based on variable credentials according to claim 1, characterized in that: The method further comprises: S8: When the public key needs to be revoked or the symmetric key needs to be replaced, the selected public key number, salt value, boot configuration data signature, and re-encrypted firmware in the Flash are updated through the FOTA mechanism.

10. A chip secure boot method based on variable credentials according to claim 9, characterized in that: The FOTA mechanism includes: The host computer generates a new selected public key number and / or salt value, recalculates the boot configuration data signature and encrypts the firmware; The updated data is packaged into a FOTA upgrade package, written to the Flash, and the chip is restarted to execute the new boot process.

Images