Verification method and system

Abstract

The invention discloses a verification method and system, and the method comprises the steps: determining a first hash value based on a target operation region in a target electronic component through a processing unit disposed in a storage module, and storing the target electronic component in the storage module; a second hash value is obtained, the second hash value is obtained based on signature information of the target electronic component, and the signature information corresponds to the target electronic component; determining a comparison result based on the first hash value and the second hash value; and determining a verification result of the target electronic component based on the comparison result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a verification method and system. BACKGROUND

[0002] In modern computers, the processor will verify the target electronic components in the storage chip before running the target electronic components in the storage chip.

[0003] This requires reading and verifying the data in the storage chip before running the target electronic components in the storage chip. As the data to be read increases, the speed of starting and running the target electronic components in the storage chip becomes slower and slower. SUMMARY

[0004] Therefore, the present application provides a verification method and system, and the specific solutions are as follows:

[0005] A verification method comprises:

[0006] A processing unit arranged in a storage module determines a first hash value based on a target running area in a target electronic component, wherein the target electronic component is stored in the storage module;

[0007] A second hash value is obtained, wherein the second hash value is obtained based on signature information of the target electronic component, and the signature information corresponds to the target electronic component;

[0008] Based on the first hash value and the second hash value, a comparison result is determined;

[0009] Based on the comparison result, a verification result of the target electronic component is determined.

[0010] Further, the second hash value is obtained by:

[0011] A second hash value output by a controller is obtained, wherein the second hash value is obtained by the controller by reading signature information of the target electronic component and verifying the signature information.

[0012] Further, the second hash value is obtained by:

[0013] A decoding unit in the storage module reads signature information of the target electronic component from the storage module, wherein the signature information comprises a signature value corresponding to data in the target electronic component and public key information used for verifying the signature value;

[0014] Based on the signature value and the public key information, the signature information is verified to obtain a second hash value.

[0015] Further, the processing unit disposed in the storage module determines the first hash value based on the target running area in the target electronic component, including:

[0016] When the storage condition is met, the processing unit disposed in the storage module determines and stores the first hash value based on the target running area in the target electronic component;

[0017] The second hash value is obtained, including:

[0018] When the verification condition is met, the stored first hash value is obtained, and the second hash value is obtained.

[0019] Further, when the storage condition is met, the processing unit disposed in the storage module determines and stores the first hash value based on the target running area in the target electronic component, including at least one of the following:

[0020] If it is determined that the storage module is powered on and running, the processing unit determines and stores the first hash value based on the target running area in the target electronic component;

[0021] If it is detected that the target electronic component is upgraded, the processing unit determines and stores the first hash value based on the target running area in the target electronic component.

[0022] A verification method, comprising:

[0023] Obtain a first hash value, the first hash value is determined by a processing unit disposed in a storage module based on a target running area in a target electronic component, the target electronic component is stored in the storage module;

[0024] Obtain a second hash value, the second hash value is obtained based on signature information of the target electronic component, the signature information corresponds to the target electronic component;

[0025] Based on the first hash value and the second hash value, determine the comparison result;

[0026] Based on the comparison result, determine the verification result of the target electronic component.

[0027] Further, the first hash value is obtained, including:

[0028] Read the first hash value by the controller, the first hash value is the first hash value determined and stored by the processing unit disposed in the storage module when the storage condition is met, based on the target running area in the target electronic component.

[0029] Further, the second hash value is obtained, including:

[0030] read, by a controller, signature information of the target electronic component from the storage module, the signature information comprising a signature value corresponding to data in the target electronic component and public key information used for verifying the signature value;

[0031] verify the signature information based on the signature value and the public key information to obtain a second hash value.

[0032] A verification system comprises:

[0033] a processing unit arranged in a storage module, configured to determine a first hash value based on a target running area in a target electronic component, the target electronic component being stored in the storage module, obtain a second hash value, determine a comparison result based on the first hash value and the second hash value, and determine a verification result of the target electronic component based on the comparison result.

[0034] a target device configured to determine a second hash value based on signature information of the target electronic component, the signature information corresponding to the target electronic component.

[0035] The target device is a controller or a decoding unit in the storage module.

[0036] A verification system comprises:

[0037] a processing unit arranged in a storage module, configured to determine a first hash value based on a target running area in a target electronic component, the target electronic component being stored in the storage module.

[0038] a controller configured to obtain the first hash value, obtain a second hash value based on signature information of the target electronic component, the signature information corresponding to the target electronic component, determine a comparison result based on the first hash value and the second hash value, and determine a verification result of the target electronic component based on the comparison result. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0040] Figure 1 a flowchart of a verification method disclosed in the embodiments of the present application;

[0041] Figure 2A flowchart of a verification method disclosed by an embodiment of the present application;

[0042] Figure 3 A flowchart of a verification method disclosed by an embodiment of the present application;

[0043] Figure 4 A flowchart of a verification method disclosed by an embodiment of the present application;

[0044] Figure 5 A structure diagram of a non-volatile memory SPI FLASH inside a storage module disclosed by an embodiment of the present application;

[0045] Figure 6 A flowchart of a verification method disclosed by an embodiment of the present application;

[0046] Figure 7 A structure diagram of a verification system disclosed by an embodiment of the present application;

[0047] Figure 8 A structure diagram of a verification system disclosed by an embodiment of the present application;

[0048] Figure 9 A complete structure diagram of a verification system disclosed by an embodiment of the present application. DETAILED DESCRIPTION

[0049] The embodiments of the present application are described below in conjunction with the accompanying drawings. The terms used in the embodiment part of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0050] The embodiments of the present application are described below in conjunction with the accompanying drawings. It is known to those of ordinary skill in the art that, as technology develops and new scenarios appear, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0051] The terms “first”, “second”, and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the terms used in this way can be interchanged under appropriate circumstances, which is only a distinguishing way used in the description of the embodiments of the present application to describe the objects with the same attributes. In addition, the terms “include” and “have” and any variations thereof are intended to cover non-exclusive inclusion, so that the processes, methods, systems, products or equipment containing a series of units do not necessarily limit to those units, but can include other units not clearly listed or inherent to these processes, methods, products or equipment.

[0052] The present application discloses a verification method, and a flowchart thereof is as followsFigure 1 As shown, comprising:

[0053] Step S11, determining a first hash value based on a target running area in the target electronic component by a processing unit arranged in the storage module, the target electronic component being stored in the storage module;

[0054] Step S12, obtaining a second hash value, the second hash value being obtained based on signature information of the target electronic component, the signature information corresponding to the target electronic component;

[0055] Step S13, determining a comparison result based on the first hash value and the second hash value;

[0056] Step S14, determining a verification result of the target electronic component based on the comparison result.

[0057] In a modern computer, a processor will verify a target electronic component in a storage chip before running the target electronic component. This requires reading and verifying data in the storage chip before running the target electronic component in the storage chip. As more and more data needs to be read, the speed of starting and running the target electronic component in the storage chip becomes slower and slower.

[0058] Based on this, in the present scheme, when verification is needed, the verification result of the target electronic component in the storage module is determined based on the comparison result of the first hash value and the second hash value. The first hash value is determined based on the target running area in the target electronic component, and the second hash value is obtained based on the signature information of the target electronic component. In this process, only the first hash value is determined based on the target running area in the target electronic component, and the second hash value is obtained based on the signature information of the target electronic component. The data in the target electronic component does not need to be read one by one through the low-speed serial peripheral interface bus, reducing the amount and length of data that needs to be read in the verification process, improving the verification efficiency of the target electronic component, and shortening the consumption time of the target electronic component startup.

[0059] Specifically, the verification method disclosed in the embodiment can be applied to a processing unit in a storage module. The first hash value is determined by the processing unit in the storage module, and the second hash value is obtained. The first hash value and the second hash value are compared by the processing unit in the storage module, so as to determine the verification result of the target electronic component in the storage module based on this, and to verify the target electronic component.

[0060] The electronic device comprises a storage module, and the storage module comprises a target electronic component. The target electronic component is an electronic component that is powered on in response to a power-on instruction of the electronic device, for example: the target electronic component can be a firmware;

[0061] The target running area is a core area in which the target electronic component stores the start code, and the target running area is used to guide the electronic device to complete the initialization after power-on and perform the necessary environment configuration for the subsequent program execution. The target running area can be specifically the first start block of the target electronic component, which usually stores the first-stage boot code of the system, is the first area read by the target electronic component at runtime, is responsible for initializing the hardware (such as clock, memory controller, etc.), configuring the communication parameters, and loading the subsequent stage boot program or operating system kernel into the random access memory (RAM).

[0062] In addition, the storage module in the embodiment can further include a processing unit in addition to the target electronic component, and the processing unit is used to perform at least part of the data processing operation in the storage module, such as calculating the hash value of the target running area in the target electronic component, or checking the target electronic component. Of course, the processing unit in the storage module can also perform other processing operations, which are not limited here.

[0063] Based on this, in the embodiment, the first hash value of the target running area in the target electronic component is determined by the processing unit in the storage module. The first hash value is a digest of the binary data of the target running area compressed to a fixed length. The target electronic component is checked by the first hash value. When the first hash value passes the check, it means that the target electronic component passes the check, and there is no need to read and check all the data in the target electronic component, which saves the data reading time and improves the efficiency of the check.

[0064] In addition, in the embodiment, the first hash value of the target running area in the target electronic component in the storage module is calculated by the processing unit of the storage module itself, without the need to send the data in the target electronic component in the storage module to other terminals or devices, which improves the efficiency and security of the first hash value calculation.

[0065] In addition, the second hash value also needs to be obtained, and the second hash value is obtained based on the signature information of the target electronic component. The signature information corresponds to the target electronic component, and different target electronic components in the storage module have different signature information. The second hash value is obtained based on the signature information of the target electronic component, so the second hash values corresponding to different target electronic components are different.

[0066] The signature information of the target electronic component can be a hash value after encryption, and is usually placed in an upgrade package used for upgrading the target electronic component. Specifically, the hash value unique to the target electronic component can be generated by processing original data in the target electronic component, and the hash value is encrypted by using a private key. The signature information of the target electronic component can be used to verify whether the target electronic component is tampered with or damaged during transmission or storage, and can also be used to confirm that the target electronic component comes from a trusted publisher rather than a malicious third party.

[0067] After obtaining the first hash value and the second hash value, the first hash value of the target running area in the target electronic component is compared with the second hash value of the target electronic device based on the signature information to determine a comparison result of the first hash value and the second hash value, which represents whether the first hash value and the second hash value match.

[0068] If the comparison result represents that the first hash value and the second hash value match, it is determined that the verification result of the target electronic component passes the verification. If the comparison result represents that the first hash value and the second hash value do not match, it is determined that the verification result of the target electronic component fails the verification.

[0069] The first hash value is obtained by hashing the data in the target running area of the target electronic component, and the second hash value is obtained by the signature information of the target electronic component. Only when the content in the target electronic component is not tampered with and the signature information is legally generated for the target electronic component, the first hash value matches the second hash value. If the two do not match, it is determined that the content in the target running area of the target electronic component is tampered with, the integrity of the target electronic component is damaged, or it is determined that the signature information of the target electronic component is illegal, and the legality of the target electronic component is questionable.

[0070] The first hash value of the target running area in the target electronic component is compared with the second hash value obtained by the signature information by using the processing unit of the storage module, so that the legality and integrity of the target electronic component are verified by the processing unit of the storage module. Therefore, the fast verification and security verification of the target electronic component are completed in the storage module, which avoids the problem of low verification efficiency caused by outputting the data in the storage module to other devices outside the storage module through a low-speed serial peripheral interface bus and performing the verification process by the other devices. The verification is directly performed in the storage module, and the verification efficiency is effectively improved.

[0071] The storage module in the embodiment can be specifically a non-volatile memory SPI FLASH, the processing unit in the storage module can be specifically a serial peripheral interface controller SPI Controller in the non-volatile memory SPI FLASH, and the target electronic component in the storage module is a firmware in the non-volatile memory SPI FLASH, and the target running area is a fixed area in the firmware, such as an initial boot block (IBB, Initial Boot Block).

[0072] The verification method disclosed in the embodiment determines a first hash value based on a target running area in a target electronic component through a processing unit arranged in a storage module, the target electronic component is stored in the storage module; obtains a second hash value, the second hash value is obtained based on signature information of the target electronic component, the signature information corresponds to the target electronic component; determines a comparison result based on the first hash value and the second hash value, and determines a verification result of the target electronic component based on the comparison result. The scheme determines the verification result of the target electronic component in the storage module through comparison of the first hash value and the second hash value, the first hash value is determined based on the target running area in the target electronic component, and the second hash value is obtained based on the signature information of the target electronic component. This process does not need to read data in the storage module one by one through a low-speed serial peripheral interface bus, reduces the amount and time of data to be read in the verification process, improves the verification speed of the target electronic component in the storage module, and improves the start speed of the target electronic component in the storage module.

[0073] The embodiment discloses a verification method, a flowchart of which is shown in Figure 2 The embodiment discloses a verification method, a flowchart of which is shown in

[0074] In step S21, a first hash value is determined based on a target running area in a target electronic component through a processing unit arranged in a storage module, the target electronic component is stored in the storage module.

[0075] In step S22, a second hash value output by the controller is obtained, the second hash value is obtained by the controller by reading signature information of the target electronic component and verifying the signature information.

[0076] In step S23, a comparison result is determined based on the first hash value and the second hash value.

[0077] In step S24, a verification result of the target electronic component is determined based on the comparison result.

[0078] The processing unit in the storage module determines the first hash value based on a target running area in the target electronic component, obtains the second hash value, and compares the first hash value with the second hash value, thereby determining the verification result of the target electronic component in the storage module, so that the processing unit in the storage module itself calculates the first hash value and compares the first hash value with the second hash value, without reading data in the storage module through the low-speed serial peripheral interface bus, thereby reducing the amount and time of data to be read in the verification process.

[0079] Further, the second hash value can be obtained as follows: obtaining the second hash value output by the controller, that is, the second hash value is determined by the controller. When the target electronic component in the storage module needs to be verified, the controller sends the second hash value to the processing unit in the storage module, so that the processing unit performs the verification process based on the first hash value and the second hash value, thereby reducing the amount of data processed by the processing unit in the verification process.

[0080] The controller can be a controller of the electronic device, and the electronic device can include the storage module and the controller. When the electronic device is powered on, the target electronic component in the storage module needs to be verified. In this embodiment, the verification process of the target electronic component can be performed by the controller of the electronic device.

[0081] The controller can be a central processing unit (CPU) in the electronic device, an embedded controller (Embedded Controller), or a root of trusted boot read-only memory (Root of Trusted Boot ROM) in a system on chip (SOC) in the electronic device (such as a field programmable gate array (FPGA)). The root of trusted boot read-only memory (Root of Trusted Boot ROM) is a section of unchangeable and most trusted code embedded in a chip read-only memory (ROM), and its core task is to verify the integrity and authenticity of subsequent system software (such as the target electronic component in the storage module) to be loaded.

[0082] The controller reads the signature information of the target electronic component in the storage module and obtains the second hash value after verifying the signature information.

[0083] The signature information of the target electronic component read by the controller includes not only the signature value corresponding to the data in the target electronic component, but also the public key information used to verify the signature value. After obtaining the signature information of the target electronic component, the controller verifies the signature information using the signature value and the public key information, thereby obtaining the second hash value corresponding to the signature information of the target electronic component, to ensure the accuracy of the second hash value determined by the controller.

[0084] Specifically, the flowchart of the verification method disclosed in this embodiment can be shown as follows: Figure 3 As shown, the system includes a controller, a processing unit, and a target electronic component. Both the processing unit and the target electronic component are internal units of the storage module, while the controller is a system controller independent of the storage module. Specifically, the processing unit determines a first hash value; the controller reads the signature information of the target electronic component from the storage module; the controller verifies the signature information to obtain a second hash value; the processing unit obtains the second hash value output by the controller; the processing unit compares the first hash value with the second hash value to obtain a comparison result, and determines the verification result of the target electronic component based on the comparison result.

[0085] In this embodiment, the step of determining the second hash value is performed by the controller, which reduces the amount of data that the processing unit needs to process when verifying the target electronic component. This can effectively improve the efficiency of the processing unit in verifying the target electronic component and avoid the problem that the processing unit not only needs to determine the first hash value, but also the second hash value, and further compares the first hash value with the second hash value, which leads to a large amount of data processing and thus reduces the verification efficiency.

[0086] The verification method disclosed in this embodiment, through a processing unit located in the storage module, determines a first hash value based on the target operating area in the target electronic component, which is stored in the storage module; obtains a second hash value output by the controller, which is obtained by the controller after reading and verifying the signature information of the target electronic component; determines a comparison result based on the first hash value and the second hash value, and determines the verification result of the target electronic component based on the comparison result. This scheme determines the verification result of the target electronic component in the storage module by comparing the first hash value and the second hash value. The first hash value is determined based on the target operating area in the target electronic component, and the second hash value is obtained by the controller based on the signature information of the target electronic component. This process does not require reading the data in the storage module one by one through the low-speed serial peripheral interface bus, reducing the amount of data and time required to read during the verification process. In addition, the first hash value is determined by the processing unit, and the second hash value is determined by the controller. The processing unit only needs to perform the comparison of the two hash values, which improves the verification speed of the target electronic component in the storage module and the startup speed of the target electronic component in the storage module.

[0087] Furthermore, in the verification method disclosed in this embodiment, obtaining the second hash value can also be:

[0088] The signature information of the target electronic component is read from the storage module by a decoding unit in the storage module, the signature information includes a signature value corresponding to the data in the target electronic component and public key information used for verifying the signature value, and the signature information is verified based on the signature value and the public key information to obtain a second hash value.

[0089] In the verification method disclosed in the embodiment, the second hash value is not determined by the processing unit in the storage module, nor is it determined by the controller of a system independent of the storage module, but is executed by the decoding unit in the storage module.

[0090] The decoding unit in the storage module can be a decoding unit that is originally provided in the storage module itself, which can be a unit only used for determining the second hash value, or a decoding function of other units in the storage module that is multiplexed to determine the second hash value, or a decoding engine added to the storage module for determining the second hash value.

[0091] The signature information of the target electronic component is read from the storage module by the decoding unit, and the second hash value is obtained after the signature information is verified, wherein the signature information can include a signature value corresponding to the data of the target electronic component, and can also include a public key used for verifying the signature value, so as to complete the verification of the signature value by the public key and obtain the second hash value.

[0092] In the embodiment, the step of determining the second hash value is executed by the decoding unit of the storage module, which reduces the amount of data that needs to be processed by the processing unit of the storage module when verifying the target electronic component, effectively improves the efficiency of the processing unit in verifying the target electronic component, and avoids the problem of large amount of data processing and low verification efficiency caused by the fact that the processing unit not only needs to determine the first hash value, but also needs to determine the second hash value and further compare the first hash value with the second hash value.

[0093] The embodiment discloses a verification method, a flowchart of which is shown in Figure 4 The verification method comprises the following steps.

[0094] In step S41, when the storage condition is met, a first hash value is determined and stored based on a target running area in the target electronic component by a processing unit provided in the storage module.

[0095] In step S42, when the verification condition is met, the stored first hash value and a second hash value are obtained, and the second hash value is obtained based on the signature information of the target electronic component.

[0096] In step S43, a comparison result is determined based on the first hash value and the second hash value.

[0097] Step S44, determining the verification result of the target electronic component based on the comparison result.

[0098] By setting the processing unit in the storage module, the first hash value is determined based on the target running area in the target electronic component, and after obtaining the second hash value, the first hash value and the second hash value are compared, thereby determining the verification result of the target electronic component in the storage module, so as to realize the calculation of the first hash value by the processing unit in the storage module itself, and the comparison with the second hash value, without reading the data in the storage module through the low-speed serial peripheral interface bus, thereby reducing the amount and time of data to be read in the verification process.

[0099] In this embodiment, the first hash value can be determined and stored in advance, and when the verification operation is needed, the first hash value can be directly read, thereby reducing the time required for determining the first hash value and improving the verification efficiency.

[0100] Specifically, the first hash value can be executed by the processing unit in the storage module, as long as the processing unit determines that the storage condition is met, the first hash value is determined based on the target running area in the target electronic component, and the first hash value is stored.

[0101] Wherein, the storage condition can be specifically: determining that the storage module is powered on and running. When the storage module is powered on and running, the data in the target running area of the target electronic component of the storage module has been determined, and during the process of this power-on and running, the data in the target running area no longer changes, therefore, the first hash value can be determined in advance and stored, so as to be directly read when verification is needed.

[0102] In addition, the storage condition can also be: detecting that the target electronic component is upgraded. After the target electronic component in the storage module is upgraded, the data in the target running area of the target electronic component of the storage module will change, while when it is not upgraded, the data in the target running area usually does not change, therefore, as long as it is determined that the target electronic component is upgraded, the first hash value of the target running area in the target electronic component needs to be determined again, so as to store the first hash value, thereby facilitating direct reading in subsequent verification.

[0103] The processing unit determines the first hash value, which can be specifically: when the storage condition is met, the processing unit controls the hardware hash operation engine to run, so as to perform hash calculation on the target running area in the target electronic component through the hardware hash operation engine to obtain the first hash value. That is, the hardware hash operation engine can be integrated in the storage module, so as to perform hardware hash calculation on the target running area, such as SHA256, SHA384, SHA512 or other hash algorithms, etc.

[0104] For example, the SHA256 hardware hash calculation is a process of executing the SHA-256 cryptographic hash algorithm on input data through a dedicated hardware hash operation engine, that is, the SHA-256 cryptographic hash algorithm is executed on the data in the target running area in the target electronic component through the hardware hash operation engine to obtain a first hash value. The core is to convert the mathematical logic of the algorithm into a parallel and pipelined hardware module to achieve high-speed and low-delay hash operation. Specifically, the input data is padded, blocked, and multi-round compressed to finally generate a 256-bit hash value.

[0105] Of course, the verification method disclosed in the embodiment can also use software hash calculation, but compared with software hash calculation, hardware hash calculation can complete hardware hash calculation in microseconds through parallel circuits, which is much faster than software hash calculation (milliseconds); in addition, the power consumption of the hardware hash operation engine is much less than the power consumption required for the processor CPU to execute software hash calculation; secondly, the logic of the hardware hash operation engine is encapsulated in the chip, which can effectively avoid the risk of side channel attack (such as timing attack, power consumption attack, etc.) caused by software implementation.

[0106] Satisfying the verification condition can be specifically: determining the target electronic component to be run in the storage module, that is, before the target electronic component in the storage module runs, the target electronic component needs to be verified, therefore, it can be determined that the verification condition is satisfied at this time.

[0107] In addition, when the storage condition is satisfied, the first hash value is obtained by calculation, and when the first hash value is obtained, the verification condition may not be satisfied, therefore, the first hash value needs to be stored, specifically, the first hash value can be stored in the buffer buffer, so that when the verification condition is satisfied, the processing unit can directly read the first hash value from the buffer buffer.

[0108] Specifically, when the storage module disclosed in the embodiment is a non-volatile memory SPI FLASH, the internal structure diagram of the non-volatile memory SPI FLASH can be as shown in Figure 5As shown, the storage module includes a plurality of serial input / output interfaces (SIO), a serial clock (SCLK), an address generator, an X-address decoder, a Y-address decoder, a data register, a static random memory buffer, a processing unit (mode logic), a clock generator, a state machine, a hardware hash operation engine, a high voltage generator, a sense amplifier, an output buffer, and a target electronic component, which can include an initial boot block (IBB), a storage structure for storing a public key and a signature, a memory array, and a page buffer.

[0109] Figure 5 The hardware hash operation engine in the storage module is configured to perform a hash calculation on a target running area in the target electronic component to obtain a first hash value. The data in the initial boot block of the firmware in the SPI FLASH is read by the address generator, the X-address decoder, and the Y-address decoder, and the read data is sent to the static random memory buffer through the data register and then transmitted to the hardware hash operation engine, so that the hardware hash operation engine determines the first hash value. After the first hash value is obtained, the first hash value is stored in the page buffer, so that when the firmware is verified, the first hash value stored in the page buffer is directly read without real-time calculation.

[0110] It should be noted that, Figure 5 In this embodiment, only the correspondence between the hardware hash operation engine and the target running area (initial boot block IBB) is described, and therefore the functions or connection relationships of other functional units in the storage module are not described herein.

[0111] The verification method disclosed in the embodiment meets the storage condition, determines and stores the first hash value based on the target running area in the target electronic component through the processing unit in the storage module, meets the verification condition, obtains the stored first hash value and obtains the second hash value, the second hash value is obtained based on the signature information of the target electronic component, and the verification result of the target electronic component is determined based on the first hash value and the second hash value. The scheme determines and stores the first hash value when the storage condition is met. Only when the verification condition is met, the first hash value and the second hash value are obtained for verification. Through the determination and storage of the first hash value in advance, when the verification condition is met and the verification operation needs to be performed, the first hash value does not need to be determined, and can be directly read, thereby reducing the time length required in the process of determining the first hash value, and improving the verification efficiency.

[0112] The verification method disclosed in the embodiment has a flowchart as shown in Figure 6 The verification method disclosed in the embodiment has a flowchart as shown in

[0113] Step S61, obtaining the first hash value, the first hash value being determined by the processing unit in the storage module based on the target running area in the target electronic component, the target electronic component being stored in the storage module;

[0114] Step S62, obtaining the second hash value, the second hash value being obtained based on the signature information of the target electronic component, the signature information corresponding to the target electronic component;

[0115] Step S63, determining the comparison result based on the first hash value and the second hash value;

[0116] Step S64, determining the verification result of the target electronic component based on the comparison result.

[0117] The verification method disclosed in the embodiment can be applied to other modules except the storage module, such as the controller of the system. The controller obtains the first hash value and the second hash value, and compares the first hash value and the second hash value to obtain the verification result of the target electronic component.

[0118] The first hash value is obtained by the controller from the storage module. The first hash value is determined by the processing unit in the storage module based on the target running area in the target electronic component. The target electronic component is stored in the storage module. That is, the processing unit in the storage module calculates the target running area in the target electronic component to obtain the first hash value. After obtaining the first hash value, the first hash value is sent to the controller so that the controller can obtain the first hash value.

[0119] Further, obtaining the first hash value can specifically be: when the controller determines that the check condition is met, outputting a first hash value reading instruction to the storage module, and the storage module determining the first hash value based on the first hash value reading instruction, that is, the storage module determines the first hash value based on the target running area in the target electronic component in response to the first hash value reading instruction, and outputs the first hash value to the controller, so that the controller can obtain the first hash value in time.

[0120] In addition, obtaining the first hash value can also be: when the controller determines that the check condition is met, outputting a first hash value reading instruction to the storage module, and the storage module outputting the first hash value determined and stored when the storage condition is met to the controller in response to the first hash value reading instruction, so that the controller can obtain the first hash value in time.

[0121] The check condition is met, that is, the controller determines that the target electronic component in the storage module is to be run, that is, before the target electronic component in the storage module runs, the target electronic component needs to be checked, therefore, it can be determined that the check condition is met at this time, and the first hash value needs to be obtained, so as to check the target electronic component based on the first hash value and the second hash value.

[0122] The storage condition can be that the processing unit of the storage module determines that the storage module is powered on and runs. When the storage module is powered on and runs, the data in the target running area in the target electronic component of the storage module has been determined, and during this power-on and running process, the data in the target running area no longer changes, therefore, the first hash value can be determined in advance and stored, so as to be directly read when verification is needed.

[0123] In addition, the storage condition can also be that the processing unit of the storage module detects that the target electronic component is upgraded. After the target electronic component in the storage module is upgraded, the data in the target running area in the target electronic component of the storage module will change, while when it is not upgraded, the data in the target running area usually does not change, therefore, as long as it is determined that the target electronic component is upgraded, the first hash value of the target running area in the target electronic component needs to be determined again, so as to store the first hash value, facilitating direct reading during subsequent checking.

[0124] After the processing unit of the storage module calculates the first hash value, it can be stored in the buffer, so that when the controller reads the first hash value, the first hash value stored in the buffer can be directly output to the controller, so as to reduce the time required for calculating the first hash value during checking.

[0125] The second hash value can be obtained by the controller through calculation, that is, when the controller determines that the target electronic component needs to be checked, the controller needs to obtain the first hash value from the storage module and also needs to obtain the second hash value through calculation.

[0126] Specifically, the controller reads the signature information of the target electronic component in the storage module, the signature information includes the signature value corresponding to the data in the target electronic component and the public key information used for verifying the signature value, and verifies the signature information based on the signature value and the public key information to obtain the second hash value.

[0127] In addition, the second hash value can also be obtained by the processing unit in the storage module through calculation, that is, when the processing unit in the storage module determines that the target electronic component needs to be checked, the processing unit reads the signature information of the target electronic component, verifies the signature information based on the signature value and the public key information in the signature information to obtain the second hash value, and then transmits the second hash value to the controller. In addition, when the processing unit in the storage module determines that the target electronic component needs to be checked, the processing unit also needs to transmit the first hash value to the controller, that is, the controller obtains the first hash value and the second hash value from the storage module.

[0128] Alternatively, the second hash value can also be obtained by the decryption unit in the storage module through calculation, that is, when the decryption unit in the storage module determines that the target electronic component needs to be checked, the decryption unit reads the signature information of the target electronic component, verifies the signature information based on the signature value and the public key information in the signature information to obtain the second hash value, and then transmits the second hash value to the controller so that the controller can obtain the second hash value.

[0129] After obtaining the second hash value, the controller compares the obtained first hash value and the second hash value, determines whether the first hash value matches the second hash value, and determines whether the target electronic component passes the check based on the comparison result of whether the first hash value matches the second hash value. If the first hash value matches the second hash value, it can be determined that the target electronic component passes the check, and if the first hash value does not match the second hash value, it can be determined that the target electronic component does not pass the check.

[0130] The verification method disclosed in the embodiment comprises the following steps: obtaining a first hash value, the first hash value being determined by a processing unit arranged in a storage module based on a target running area in a target electronic component stored in the storage module; obtaining a second hash value, the second hash value being obtained based on signature information of the target electronic component, the signature information corresponding to the target electronic component; determining a comparison result based on the first hash value and the second hash value; and determining a verification result of the target electronic component based on the comparison result. The verification result of the target electronic component in the storage module is determined by comparing the first hash value and the second hash value. The first hash value is determined based on the target running area in the target electronic component, and the second hash value is obtained based on the signature information of the target electronic component. This process does not need to read data in the storage module through a low-speed serial peripheral interface bus, thereby reducing the amount and time of data to be read in the verification process, improving the verification speed of the target electronic component in the storage module, and improving the starting speed of the target electronic component in the storage module.

[0131] The verification system disclosed in the embodiment comprises the following steps: Figure 7

[0132] The processing unit 71 and the target device 72.

[0133] The processing unit 71 is arranged in the storage module and is used to determine a first hash value based on a target running area in a target electronic component stored in the storage module; obtain a second hash value; determine a comparison result based on the first hash value and the second hash value; and determine a verification result of the target electronic component based on the comparison result.

[0134] The target device 72 is used to determine a second hash value based on signature information of the target electronic component, the signature information corresponding to the target electronic component.

[0135] The target device is a controller or a decoding unit in the storage module.

[0136] In the embodiment, the first hash value is determined by the processing unit in the storage module, the second hash value is determined by the controller or the decoding unit in the storage module, and then the processing unit in the storage module performs comparison between the first hash value and the second hash value to determine the verification result of the target electronic component.

[0137] Further, the processing unit is used to:

[0138] Obtain the second hash value output by the controller, the second hash value being obtained by the controller by reading the signature information of the target electronic component and verifying the signature information.

[0139] Further, the processing unit is used to: ​

[0140] read, by a decoding unit in the storage module, signature information of the target electronic component, the signature information including a signature value corresponding to data in the target electronic component and public key information used for verifying the signature value; verify the signature information based on the signature value and the public key information to obtain a second hash value.

[0141] Further, the processing unit is configured to:

[0142] determine and store, by the processing unit in the storage module, the first hash value based on a target running area in the target electronic component when the storage condition is met.

[0143] obtain the stored first hash value and obtain the second hash value when the verification condition is met.

[0144] Further, the processing unit is configured to determine and store, by the processing unit in the storage module, the first hash value based on a target running area in the target electronic component when the storage condition is met, including at least one of:

[0145] If it is determined that the storage module is powered on and running, the processing unit determines and stores the first hash value based on a target running area in the target electronic component; if it is detected that the target electronic component is upgraded, the processing unit determines and stores the first hash value based on a target running area in the target electronic component.

[0146] The verification system disclosed in this embodiment is implemented based on the verification method disclosed in the above embodiment, which will not be described here.

[0147] The verification system disclosed in this embodiment determines the first hash value based on a target running area in the target electronic component by the processing unit in the storage module, the target electronic component is stored in the storage module; obtains the second hash value, the second hash value is obtained based on the signature information of the target electronic component, the signature information corresponds to the target electronic component; determines the comparison result based on the first hash value and the second hash value, and determines the verification result of the target electronic component based on the comparison result. The present scheme determines the verification result of the target electronic component in the storage module through the comparison of the first hash value and the second hash value, the first hash value is determined based on the target running area in the target electronic component, and the second hash value is obtained based on the signature information of the target electronic component. This process does not need to read the data in the storage module one by one through the low-speed serial peripheral interface bus, reduces the amount and length of data that need to be read in the verification process, improves the verification speed of the target electronic component in the storage module, and improves the start speed of the target electronic component in the storage module.

[0148] The verification system disclosed in this embodiment has a structure as shown in Figure 8 The verification system disclosed in this embodiment has a structure as shown in

[0149] The processing unit 81 and the controller 82.

[0150] The processing unit 81 is arranged in the storage module and is configured to determine the first hash value based on a target running area in the target electronic component stored in the storage module.

[0151] The controller 82 is configured to obtain the first hash value, obtain a second hash value, the second hash value being obtained based on signature information of the target electronic component, the signature information corresponding to the target electronic component, determine a comparison result based on the first hash value and the second hash value, and determine a verification result of the target electronic component based on the comparison result.

[0152] In this embodiment, the first hash value is determined by the processing unit in the storage module, and the second hash value is determined by the controller, and then the comparison between the first hash value and the second hash value is performed to determine the verification result of the target electronic component.

[0153] Further, the controller obtains the first hash value, including:

[0154] The first hash value is read by the controller, and the first hash value is determined and stored by the processing unit arranged in the storage module based on the target running area in the target electronic component when the storage condition is met.

[0155] Further, the controller obtains the second hash value, including:

[0156] The signature information of the target electronic component is read by the controller from the storage module, the signature information includes a signature value corresponding to the data in the target electronic component and public key information used for verifying the signature value, and the signature information is verified based on the signature value and the public key information to obtain the second hash value.

[0157] Specifically, the structure diagram of the verification system disclosed in this embodiment can be as shown in Figure 9 The structure diagram of the verification system disclosed in this embodiment can be as shown in

[0158] Specifically, the processing unit 911 in the storage module 91 determines the first hash value based on the target running area in the target electronic component 912, the controller 92 reads the signature information of the target electronic component 912 and obtains the second hash value based on the signature information, the controller 92 sends the second hash value to the processing unit 911 in the storage module 91, the processing unit 911 compares the first hash value with the second hash value to obtain a comparison result, and determines a verification result of the target electronic component 912 based on the comparison result, so as to realize the verification of the target electronic component 912 by the processing unit 911 in the storage module 91;

[0159] Alternatively, the processing unit 911 in the storage module 91 can determine the first hash value based on the target running area in the target electronic component 912; the controller 92 reads the signature information of the target electronic component 912 and obtains the second hash value based on the signature information; the controller 92 also needs to read the first hash value determined by the processing unit 911 in the storage module 91, so as to compare the first hash value with the second hash value by the controller 92, obtain the comparison result, and determine the verification result of the target electronic component 912 based on the comparison result, so as to complete the verification of the target electronic component 912 by the controller 92.

[0160] In addition, the storage module 91 in the verification system disclosed in the embodiment can further include a decryption unit 913.

[0161] Specifically, the processing unit 911 in the storage module 91 determines the first hash value based on the target running area in the target electronic component 912; the decryption unit 913 in the storage module 91 reads the signature information of the target electronic component 912 and obtains the second hash value based on the signature information, and sends the determined second hash value to the processing unit 912; the processing unit 911 compares the first hash value with the second hash value, obtains the comparison result, and determines the verification result of the target electronic component 912 based on the comparison result, so as to complete the verification of the target electronic component 912 by the processing unit 911 in the storage module 91.

[0162] Alternatively, the processing unit 911 in the storage module 91 can determine the first hash value based on the target running area in the target electronic component 912; the decryption unit 913 in the storage module 91 reads the signature information of the target electronic component 912 and obtains the second hash value based on the signature information; the controller 92 reads the first hash value from the processing unit 911 in the storage module 91 (or, after the processing unit 911 determines the first hash value, the first hash value is stored in the buffer in the storage module 91, and then the controller 92 reads the first hash value from the buffer in the storage module 91), reads the second hash value from the decryption unit 913, and compares the first hash value with the second hash value by the controller 92, obtains the comparison result, and determines the verification result of the target electronic component 912 based on the comparison result, so as to complete the verification of the target electronic component 912 by the controller 92.

[0163] The verification system disclosed in the embodiment is realized based on the verification method disclosed in the above embodiment, which will not be described here.

[0164] The verification system disclosed in the embodiment obtains a first hash value, the first hash value being determined by a processing unit arranged in a storage module based on a target running area in a target electronic component stored in the storage module; a second hash value is obtained, the second hash value being obtained based on signature information of the target electronic component, the signature information corresponding to the target electronic component; a comparison result is determined based on the first hash value and the second hash value, and a verification result of the target electronic component is determined based on the comparison result. The scheme determines the verification result of the target electronic component in the storage module through comparison of the first hash value and the second hash value. The first hash value is determined based on the target running area in the target electronic component, and the second hash value is obtained based on the signature information of the target electronic component. This process does not need to read data in the storage module through a low-speed serial peripheral interface bus, reduces the amount and length of data to be read in the verification process, improves the verification speed of the target electronic component in the storage module, and improves the start speed of the target electronic component in the storage module.

[0165] In addition, it should be noted that the apparatus embodiments described above are merely illustrative, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. In addition, in the apparatus embodiment provided in the present application, the connection relationship between the modules indicates that there is a communication connection between them, which can be implemented as one or more communication buses or signal lines.

[0166] Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software and necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. Generally, functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure for implementing the same function can be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better embodiment. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer's floppy disk, U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc., including a plurality of instructions to make a computer device (which can be a personal computer, training device, or network device, etc.) execute the methods described in various embodiments of the present application.

[0167] In the above embodiments, the implementation can be wholly or partially by software, hardware, firmware, or any combination thereof. When implemented by software, the implementation can be wholly or partially in the form of a computer program product.

[0168] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are wholly or partially generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, training device or data center to another website, computer, training device or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. integrated with one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

Claims

1. A verification method, comprising: A first hash value is determined based on the target operating region in the target electronic component by a processing unit set in the storage module, wherein the target electronic component is stored in the storage module; A second hash value is obtained, which is based on the signature information of the target electronic component, and the signature information corresponds to the target electronic component; Based on the first hash value and the second hash value, the comparison result is determined; The verification result of the target electronic component is determined based on the comparison results.

2. The method according to claim 1, wherein obtaining the second hash value comprises: The controller outputs a second hash value, which is obtained by the controller after reading and verifying the signature information of the target electronic component.

3. The method according to claim 1, wherein obtaining the second hash value comprises: The signature information of the target electronic component is read from the storage module by the decoding unit in the storage module. The signature information includes a signature value corresponding to the data in the target electronic component, and public key information for verifying the signature value. Based on the signature value and the public key information, the signature information is verified to obtain a second hash value.

4. The method according to claim 1, wherein determining the first hash value based on the target operating region in the target electronic component by means of a processing unit disposed in the storage module comprises: When the storage conditions are met, the first hash value is determined and stored based on the target operating area in the target electronic component by the processing unit set in the storage module. Obtaining the second hash value includes: When the verification conditions are met, the first hash value stored is obtained, and the second hash value is obtained.

5. The method according to claim 4, wherein, when the storage conditions are met, determining and storing the first hash value based on the target operating region in the target electronic component by means of a processing unit disposed in the storage module, includes at least one of the following: If it is determined that the storage module is powered on and running, the processing unit determines and stores a first hash value based on the target operating region in the target electronic component; If an upgrade of the target electronic component is detected, the processing unit determines and stores a first hash value based on the target operating region in the target electronic component.

6. A verification method, comprising: A first hash value is obtained, which is determined by a processing unit set in the storage module based on a target operating region in a target electronic component, the target electronic component being stored in the storage module; A second hash value is obtained, which is based on the signature information of the target electronic component, and the signature information corresponds to the target electronic component; Based on the first hash value and the second hash value, the comparison result is determined; The verification result of the target electronic component is determined based on the comparison result.

7. The method according to claim 6, wherein obtaining the first hash value comprises: reading, by a controller, a first hash value, the first hash value being determined and stored by a processing unit disposed in a storage module based on a target running area in a target electronic component when a storage condition is met.

8. The method of claim 6, wherein the obtaining the second hash value comprises: reading, by a controller, signature information of the target electronic component from the storage module, the signature information comprising a signature value corresponding to data in the target electronic component and public key information for verifying the signature value; verifying the signature information based on the signature value and the public key information to obtain the second hash value.

9. A verification system comprising: a processing unit disposed in a storage module, configured to determine a first hash value based on a target running area in a target electronic component, the target electronic component being stored in the storage module; obtaining a second hash value; determining a comparison result based on the first hash value and the second hash value; determining a verification result of the target electronic component based on the comparison result; a target device configured to determine the second hash value based on signature information of the target electronic component, the signature information corresponding to the target electronic component; wherein the target device is a controller or a decoding unit in the storage module.

10. A verification system comprising: a processing unit disposed in a storage module, configured to determine a first hash value based on a target running area in a target electronic component, the target electronic component being stored in the storage module; a controller configured to obtain the first hash value; obtaining a second hash value, the second hash value being obtained based on signature information of the target electronic component, the signature information corresponding to the target electronic component; determining a comparison result based on the first hash value and the second hash value; and determining a verification result of the target electronic component based on the comparison result.

Images