Program encryption and authentication method based on TEE and kernel integrity measurement
By importing symmetric and asymmetric key pairs at the device's factory and combining them with dual signatures of the CPU serial number, and using TEE for program encryption and authentication, the problems of high performance overhead and insufficient key management under the TrustZone architecture are solved. This achieves the binding operation of the program and the device and the scalability of key management, ensuring program security and efficiency.
Patent Information
- Application Number
- CN202511003790.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-21
- Publication Date
- 2025-11-18
AI Technical Summary
Existing program protection technologies under the ARM TrustZone architecture suffer from high performance overhead, insufficient scalability of key management, inability to efficiently handle large programs or frequent decryption requests, and the inability of encrypted programs to be universally compatible across different devices, making them unsuitable for large-scale software distribution scenarios.
By importing symmetric and asymmetric key pairs at the factory and performing dual signing with the CPU serial number, and using TEE for authentication and key management, the boot program calls the TEE interface for decryption and execution, ensuring that the program is not written to disk. A hierarchical key management strategy and dual signature structure are adopted, and a whitelist protects TEE interface access.
It enables the program to run in a bound manner with the device, ensuring program integrity and source trustworthiness, reducing the risk of key leakage, preventing program tampering and replay execution, and improving the scalability and system efficiency of key management.
Smart Images
Figure CN120974477A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of information security and trusted computing, in particular to a program encryption and authentication method based on TEE and kernel integrity measurement. BACKGROUND
[0002] Embedded devices are widely used in key fields such as power, transportation and industrial control. In these scenarios, software carries important control logic and business algorithms, and devices are widely distributed, with significant security risks. Unauthorized copying and tampering with software can lead to intellectual property leakage, harm to manufacturers, and increase the risk of system failure and security incidents, seriously affecting the stable operation and security of the industry.
[0003] Existing program protection technologies mainly use ARM TrustZone combined with a secure world (Secure World) to achieve program encryption and loading. This method first divides the secure world and the normal world (Normal World) under the TrustZone architecture, and the executable file of the program is saved in an encrypted form (such as AES-CBC encryption) when stored. The key is managed by a trusted application (TA) in the secure world. When the rich execution environment (REE) of the normal world needs to run the program, the secure decryption service is triggered through the secure monitor call (SMC) instruction, and the TA verifies the identity of the caller and uses a hardware key (such as a device unique key or a securely stored derived key) to decrypt the program code. The plaintext code is passed to the REE side through a dynamic memory area (such as "Secure RAM"), and the memory residue is immediately cleared after decryption is completed. At the same time, the TrustZone memory protection unit (TZMPU) ensures that the normal world cannot reverse or tamper with the decrypted code, and the TrustZone physical address space isolation (such as TZASC) prevents DMA attacks from stealing data. For key functions, further on-the-fly decryption execution (such as "On-the-Fly Decryption") can be used to implement instruction-by-instruction decryption, avoiding the exposure of complete code. This solution has been applied in mobile TEE implementations such as Qualcomm QSEE and Huawei iTrustee. However, this method has the following defects:
[0004] 1. The switching between the secure world and the normal world involves context saving and restoration, and frequent decryption requests can cause significant performance overhead, especially in multi-threaded or high-performance computing scenarios, where parallel execution efficiency is greatly reduced. The secure world storage space and computing resources are limited, and cannot efficiently handle large programs or frequent decryption requests, which may cause memory shortage or delay problems.
[0005] 2. The key management lacks scalability, relying on device hardware-bound keys, which makes encrypted programs not universal across different devices, making it difficult to adapt to large-scale software distribution scenarios. SUMMARY
[0006] In view of the defects of the prior art, the present application imports a symmetric key and an asymmetric key pair into a TEE at the time of factory shipment; realizes double signature of an issuing end and a device end in a program distribution stage, and binds a CPU serial number; in a running stage, a boot program calls the TEE to perform authentication, obtain a key and decrypt execution, so as to achieve the purpose of not falling on a disk of an executable program.
[0007] In order to achieve the above purpose, the present application provides a program encryption and authentication method based on TEE and kernel integrity measurement, comprising the following steps:
[0008] (1) In an initialization stage, an issuing end generates a symmetric key, an issuing end asymmetric key pair, and makes a device startup boot stage application program, the issuing end saves a private key in the symmetric key and the issuing end asymmetric key pair, and distributes the device startup boot stage application program, the symmetric key and a public key in the issuing end asymmetric key pair to a device end; the device end generates a device end asymmetric key pair, and the device end saves the symmetric key, the public key in the issuing end asymmetric key pair and the device end asymmetric key pair into a persistent storage area of the TEE;
[0009] (2) In a program distribution stage, the issuing end encrypts an executable program, adds a boot program in front of the executable program, the issuing end signs the boot program and splices the boot program to a rear end of the encrypted executable program, and sends the executable program to the device end; the device end calls a TEE interface to perform verification, signs the executable program with a private key of the device end, and splices the executable program to a rear end of the issuing end signature to complete the signature;
[0010] (3) In a program execution stage, the boot program is executed, the symmetric key is obtained after the issuing end signature and the device end signature verification are successful, the encrypted executable program is decrypted, and the executable program is executed.
[0011] Further, the behavior of calling the TEE interface is protected by a Linux kernel security module and an integrity measurement module, and a white list is preset in the Linux kernel, only programs allowed by the white list can access the TEE interface.
[0012] Further, the step (1) is specifically:
[0013] (1.1) The issuing end creates a symmetric key and an issuing end asymmetric key pair for a single batch of devices;
[0014] (1.2) The issuing end makes a device startup boot stage application program using the symmetric key and the public key in the issuing end asymmetric key pair, and sends the device startup boot stage application program, the symmetric key and the public key in the issuing end asymmetric key pair to the device end of the batch;
[0015] (1.3) the first time the device is started, the device startup boot phase application is executed, an interface provided by the TEE is called, a device-side asymmetric key pair is created, and the device-side asymmetric key pair, the symmetric key, and the public key in the issuer-side asymmetric key pair are saved to the persistent storage area of the TEE.
[0016] Further, after the step (1.3) is executed, the device startup boot phase application deletes itself and clears the data in the cache, and only the private key in the device-side asymmetric key pair is stored in the persistent storage area of the TEE.
[0017] Further, the step (2) is specifically:
[0018] (2.1) the issuer encrypts the executable program using the symmetric key;
[0019] (2.2) a boot program is attached in front of the encrypted executable program;
[0020] (2.3) the private key in the issuer-side asymmetric key pair is used to sign the digest value of the boot program + the encrypted executable program, to obtain an issuer signature, and the issuer signature is spliced at the back end of the encrypted executable program;
[0021] (2.4) the boot program, the encrypted executable program, and the issuer signature are packaged and distributed to the device side;
[0022] (2.5) the device side obtains the device CPU serial number, calculates the digest of the boot program and the encrypted executable program, and obtains the issuer signature;
[0023] (2.6) the TEE interface is called to pass the digest of the boot program and the encrypted executable program, the issuer signature, and the CPU serial number, and the application in the TEE verifies the issuer signature;
[0024] (2.7) after verification succeeds, the application in the TEE uses the private key in the device-side asymmetric key pair to sign the digest of the boot program and the encrypted executable program + the CPU serial number, to obtain a device signature, and the device signature is spliced at the back end of the issuer signature.
[0025] Further, the step (3) is specifically:
[0026] (3.1) when the program is executed, the boot program is executed first, the boot program calls the TEE interface to pass the digest of the boot program and the encrypted executable program, the issuer signature, the device signature, and the CPU serial number;
[0027] (3.2) the application in the TEE verifies the issuer signature using the public key in the issuer asymmetric key pair and verifies the device signature using the public key in the device asymmetric key pair;
[0028] (3.3) after the verification, the symmetric key is passed to the bootloader;
[0029] (3.4) the bootloader decrypts the encrypted executable program using the symmetric key to obtain the executable program;
[0030] (3.5) the bootloader loads and executes the executable program.
[0031] Further, the bootloader has an anti-debugging function.
[0032] The present application has the following advantages:
[0033] 1. The present application generates and persistently stores a device-unique asymmetric key based on TEE, and combines the device CPU serial number to sign, so as to realize the binding running of the executable program and the specific device.
[0034] 2. The present application uses a double signature structure, the issuer signature guarantees the program integrity and the source credibility, and the device signature realizes the running device binding, and all signature verifications are completed in the TEE.
[0035] 3. The present application uses the bootloader as the execution unit that is uniquely allowed to access the TEE key interface in the device running state, needs to pass the IMA hash check and the LSM whitelist verification, has the anti-debugging and runtime cleaning ability, dynamically requests the key through the TEE interface, and ensures that the key is not landed; the overall program structure adopts the format of "bootloader + encrypted main body + double signature", and a closed loop of encryption, authentication and decryption execution is constructed, so that the program is effectively prevented from being tampered with, analyzed or replayed.
[0036] 4. The present application adopts a layered key management strategy, uses independent symmetric keys for different product batches, generates independent asymmetric keys for each device, reduces the risk range of key leakage, and improves the tracing ability. BRIEF DESCRIPTION OF DRAWINGS
[0037] Figure 1 It is a program encryption and authentication method flowchart based on TEE and kernel integrity measurement of the embodiment of the present application.
[0038] Figure 2 It is an initial stage flowchart of the embodiment of the present application.
[0039] Figure 3 It is a program distribution stage flowchart of the embodiment of the present application.
[0040] Figure 4A flowchart of a procedure execution stage of an embodiment of the present application is shown. DETAILED DESCRIPTION
[0041] The present application is further explained and described with reference to the accompanying drawings and embodiments.
[0042] As shown in Figure 1 , an executable program encryption and authentication method based on a TEE (Trusted Execution Environment) and kernel integrity measurement is provided by the embodiment of the present application. The purpose of the method is to encrypt an executable program and bind the encrypted executable program on a device using some methods. When the encrypted executable program is executed, a boot program attached at the front end is actually executed. The boot program is responsible for decrypting, loading and running the encrypted executable program, so as to achieve the purpose of not falling on the disk. The method is divided into three stages according to the time sequence: an initialization stage, a program distribution stage and a procedure execution stage, and specifically includes the following steps:
[0043] S101, in the initialization stage, the issuer generates a symmetric key, an issuer asymmetric key pair, and makes a device startup boot stage application program. The issuer saves the symmetric key and the private key in the issuer asymmetric key pair, and distributes the device startup boot stage application program, the symmetric key and the public key in the issuer asymmetric key pair to the device end. The device end generates a device end asymmetric key pair, and the device end saves the symmetric key, the public key in the issuer asymmetric key pair and the device end asymmetric key pair.
[0044] As shown in Figure 2 , the specific process of the initialization stage is as follows:
[0045] (1) The issuer creates a symmetric key and an issuer asymmetric key pair for a single batch of devices.
[0046] The batch is encrypted with the symmetric key, and the issuer asymmetric key pair includes an issuer public key and an issuer private key.
[0047] (2) The issuer uses the symmetric key and the public key in the issuer asymmetric key pair to make a U-Boot (device startup boot) stage application program, and sends the device startup boot stage application program, the symmetric key and the public key in the issuer asymmetric key pair to the device end of the batch.
[0048] The application program will be integrated into the device end. When the device is started for the first time, the program will be called in the U-Boot stage.
[0049] (3) When the device is started for the first time, the device startup boot stage application program is executed, an interface provided by the TEE is called, a device end asymmetric key pair is created, and the device end asymmetric key pair, the symmetric key and the public key in the issuer asymmetric key pair are saved to the persistent storage area of the TEE.
[0050] The device-side asymmetric key pair includes a device-side public key and a device-side private key.
[0051] (4) After step (3) is executed, the device initiates the boot phase application program to delete itself and clear the data in the cache, and only the device-side private key is stored in the persistent storage area of the TEE.
[0052] S102, program distribution phase, the issuer encrypts the executable program, adds a boot program in front of the executable program, and then the issuer signs the issuer signature and splices it to the back end of the encrypted executable program, and packs and sends it to the device side; the device side calls the TEE interface to perform verification, and then signs with the device-side private key, and splices it to the back end of the issuer signature to complete the signing.
[0053] (1) The issuer encrypts the executable program using the symmetric key.
[0054] In the issuer, the symmetric key executable program created in S101 is used for encryption.
[0055] (2) Attach the boot program in front of the encrypted executable program.
[0056] The boot program is an executable program spliced in front of the encrypted executable program, responsible for obtaining the symmetric key, decrypting and loading the encrypted executable program. The boot program is a general program and is generally not modified.
[0057] (3) Use the private key of the issuer asymmetric key pair to sign the digest value of the boot program + encrypted executable program to obtain the issuer signature, and splice the issuer signature to the back end of the encrypted executable program.
[0058] (4) Pack the boot program, encrypted executable program, and issuer signature and distribute them to the device side.
[0059] (5) The device side obtains the device CPU serial number, calculates the digest of the boot program and the encrypted executable program, and obtains the issuer signature.
[0060] The device side needs to bind the program to the device after obtaining the package, so it needs to obtain the device CPU serial number, calculate the digest of the boot program and the encrypted executable program, and obtain the issuer signature.
[0061] (6) Call the TEE interface to pass the digest of the boot program and the encrypted executable program, the issuer signature, and the CPU serial number, and the application in the TEE verifies the issuer signature.
[0062] The behavior of accessing the TEE interface is protected by the Linux kernel security module and the integrity measurement module, and a whitelist is preset in the Linux kernel, only programs allowed by the whitelist can access the TEE interface. After verification, the application in the TEE checks the publisher signature.
[0063] (7) After verification, the application in the TEE uses the private key of the device asymmetric key pair to sign the digest of the boot program and the encrypted executable program + CPU serial number, obtains the device signature, and splices the device signature to the back end of the publisher signature.
[0064] If the signature is passed, the private key of the device asymmetric key pair is used to sign
digest + CPU serial number
[0065] S103, program execution phase, execute the boot program, call the TEE verification success, obtain the symmetric key, decrypt the encrypted executable program and execute.
[0066] (1) When the program is executed, the boot program is executed first, and the boot program calls the TEE interface to pass the digest of the boot program and the encrypted executable program, the publisher signature, the device signature, and the CPU serial number.
[0067] Similarly, the behavior of accessing the TEE interface is protected by the Linux kernel security module and the integrity measurement module, and a whitelist is preset in the Linux kernel, only programs allowed by the whitelist can access the TEE interface.
[0068] (2) The application in the TEE uses the public key of the publisher asymmetric key pair to verify the publisher signature, and uses the public key of the device asymmetric key pair to verify the device signature.
[0069] The application in the TEE uses the public key of the publisher asymmetric key pair preset in the initialization stage, and the device public key created in the initialization stage to verify the publisher signature and the device signature.
[0070] (3) After verification, the symmetric decryption key is passed to the boot program.
[0071] (4) The boot program uses the symmetric key to decrypt the encrypted executable program to obtain the executable program.
[0072] (5) The boot program loads and executes the executable program.
[0073] After execution is completed, the boot program cleans up the cache and exits, and the encrypted executable program remains running.
[0074] The boot program itself has an anti-debugging function, and an attacker cannot obtain the symmetric decryption key by modifying or debugging the boot program. The boot program is in the whitelist in the Linux kernel, and can be verified by the access control program (i.e. the Linux kernel security module + the integrity measurement module).
[0075] The above detailed description further illustrates the purpose, technical solutions and beneficial effects of the application. It should be understood that the above description is only a specific embodiment of the application and is not used to limit the protection scope of the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the protection scope of the application.
Claims
1. A program encryption and authentication method based on TEE and kernel integrity measurement, characterized in that, Includes the following steps: (1) During the initialization phase, the issuing end generates a symmetric key and an asymmetric key pair, and creates a device boot process application. The issuing end saves the private key in the symmetric key and the asymmetric key pair, and distributes the device boot process application, the symmetric key, and the public key in the asymmetric key pair to the device. The device generates a device-side asymmetric key pair, and the device saves the symmetric key, the public key from the issuing end's asymmetric key pair, and the device-side asymmetric key pair to the TEE's persistent storage area. (2) During the program distribution stage, the distributor encrypts the executable program, adds a bootloader to its front end, signs it, and appends it to the back end of the encrypted executable program. The program is then packaged and sent to the device. After the device successfully performs the verification by calling the TEE interface, it signs the program with its private key and appends it to the back end of the distributor's signature to complete the signing. (3) During the program execution phase, the boot program is executed. After the TEE interface is called to verify the signature of the issuing end and the signature of the device end, the symmetric key is obtained, the encrypted executable program is decrypted and executed.
2. The program encryption and authentication method based on TEE and kernel integrity measurement according to claim 1, characterized in that: Calling the TEE interface is protected by the Linux kernel security module and integrity measurement module. The whitelist is pre-configured in the Linux kernel, and only programs allowed by the whitelist can access the TEE interface.
3. The program encryption and authentication method based on TEE and kernel integrity collaboration according to claim 1, characterized in that, The specific steps (1) are as follows: (1.1) For a single batch of devices, the issuing end creates a symmetric key pair and an issuing end asymmetric key pair; (1.2) The issuing end uses the symmetric key and the public key in the issuing end's asymmetric key pair to create the device boot phase application, and sends the device boot phase application, the symmetric key and the public key in the issuing end's asymmetric key pair to the devices in this batch; (1.3) When the device starts for the first time, the device startup boot phase application is executed, calls the interface provided by TEE, creates a device asymmetric key pair, and saves the device asymmetric key pair, the symmetric key and the public key in the issuing asymmetric key pair to the persistent storage area of TEE.
4. The program encryption and authentication method based on TEE and kernel integrity measurement according to claim 2, characterized in that, After step (1.3) is executed, the application in the device boot phase will delete itself and clear the data in the cache. Only the persistent storage area of the TEE stores the private key in the device-side asymmetric key pair.
5. The program encryption and authentication method based on TEE and kernel integrity measurement according to claim 1, characterized in that, Step (2) specifically involves: (2.1) The issuing end uses a symmetric key to encrypt the executable program; (2.2) Attach a bootloader in front of the encrypted executable program; (2.3) Use the private key in the asymmetric key pair of the issuing end to sign the digest value of the bootstrap + encrypted executable program to obtain the issuing end signature, and then concatenate the issuing end signature to the back end of the encrypted executable program; (2.4) Package the bootloader, the encrypted executable program and the distribution end signature, and distribute them to the device. (2.5) The device side obtains the device CPU serial number, calculates the digest of the bootloader and the encrypted executable program, and obtains the issuer's signature; (2.6) Call the TEE interface to pass the digest of the bootloader and the encrypted executable program, the distribution end signature and the CPU serial number. The application in the TEE verifies the distribution end signature. (2.7) After successful verification, the application in the TEE uses the private key in the device-side asymmetric key pair to sign the digest of the bootloader and the encrypted executable program + CPU serial number to obtain the device-side signature, and then appends the device-side signature to the backend of the issuer's signature.
6. The program encryption and authentication method based on TEE and kernel integrity measurement according to claim 4, characterized in that, Step (3) specifically involves: (3.1) When the program is executed, the bootloader is executed first. The bootloader calls the TEE interface to pass the digest of the bootloader and the encrypted executable, the issuer signature, the device signature and the CPU serial number; (3.2) In the application of TEE, the public key in the asymmetric key pair of the issuing end is used to verify the issuing end signature, and the public key in the asymmetric key pair of the device end is used to verify the device end signature. (3.3) After all verifications are successful, the symmetric key is transmitted to the bootstrap program; (3.4) The bootloader uses the symmetric key to decrypt the encrypted executable program to obtain the executable program; (3.5) The bootloader loads and executes the executable program.
7. The program encryption and authentication method based on TEE and kernel integrity measurement according to claim 1, characterized in that: The bootloader has anti-debugging capabilities.