A software rollback prevention method and apparatus based on flash memory

Abstract

This invention discloses a software rollback prevention method and apparatus based on flash memory. The method includes partitioning the flash memory into a version number partition for storing device version numbers; during device startup, determining the validity of the main version number and backup version number based on a magic number, selecting the latest valid version number from the valid version numbers using an update count value, and synchronizing the main version number and backup version number based on this latest valid version number to ensure consistency; during software updates, obtaining the version number of the software update package, comparing the version number value of the software update package with the version number value of the currently valid device version number, allowing the update if the former is greater than or equal to the latter, otherwise rejecting the update; after the software update is completed, writing the version number value of the software update package and the incremented update count value into the main version number. This invention achieves software rollback prevention without requiring additional hardware such as OTP or security chips.

Description

Technical Field

[0001] This invention relates to the field of electronic device software upgrade technology, and specifically to a software rollback prevention method and apparatus based on flash memory. Background Technology

[0002] During the lifecycle of portable electronic devices, firmware or software upgrades are inevitable to fix vulnerabilities or add functionality. However, if a malicious or accidental version downgrade occurs during the upgrade process, attackers may exploit known vulnerabilities in the older version to gain control of the device, posing a serious security risk. Software rollback prevention technology is designed to address this risk. Its core principle is to securely save the current system's device version number and force the update package's version number to be greater than or equal to the current version number during updates, thereby preventing the possibility of rolling back to an older version.

[0003] Currently, the mainstream methods for storing device version numbers include one-time programmable regions (OTP), independent security chips, and secure storage areas based on security architectures (such as ARM TrustZone). While these solutions can effectively ensure unidirectional incrementing of version numbers or prevent tampering, they all rely on additional hardware resources or specific chip selections. For low-cost products, customized devices, or products already in mass production where hardware cannot be modified, increasing such hardware costs or replacing chip solutions is not feasible, making it difficult to deploy software rollback prevention features.

[0004] Therefore, how to achieve secure and reliable version number storage and anti-rollback mechanism without additional hardware cost has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a software rollback prevention method and apparatus based on flash memory, so as to at least solve the problems existing in the prior art.

[0006] The embodiments of the present invention provide the following technical solutions: This invention provides a software rollback prevention method based on flash memory, comprising: The flash memory is divided into version number partitions to store device version numbers. The device version number includes a magic number, a version number value, and an update count value. The device version number also includes a redundant main version number and a backup version number, which are stored at different addresses. When the device starts up, it determines the validity of the main version number and the backup version number based on the magic number, selects the latest valid version number from the valid version numbers using the update count value, and synchronizes the main version number and the backup version number based on the latest valid version number to make their contents consistent. When the device performs a software update, it obtains the version number of the software update package and compares the version number of the software update package with the version number of the currently valid device version. If the former is greater than or equal to the latter, the update is allowed; otherwise, the update is rejected. After the software update is completed, the version number of the software update package and the incremented update count value are written into the main version number, and the main version number is synchronized to the backup version number.

[0007] Preferably, the magic number and version number are written through a first operation, and the update count is written through a second operation, and the first operation and the second operation are independent of each other.

[0008] Preferably, the device version number is initialized when the device starts up, specifically including the following steps: Check if a valid primary version number or backup version number exists in the version number partition. If neither exists, create an initial primary version number. A valid primary version number or backup version number means that both the magic number and the update count value are valid. If the primary version number or the backup version number exists, then the primary version number and the backup version number are synchronized so that the content of the primary version number and the backup version number is the same.

[0009] Preferably, the initial major version number is created with a version number value of 0 and an update count value of 1, and written into the address corresponding to the major version number in the version number partition.

[0010] Preferably, synchronizing the major version number and the backup version number based on the latest valid version number includes: Copy the valid version number, which is the latest version number, to another version number so that both the primary version number and the backup version number are valid and have the same content.

[0011] Preferably, the step of determining the validity of the major version number and the backup version number based on the magic number, and selecting the latest valid version number from the valid version numbers using the update count value, includes: If both the primary version number and the backup version number are valid, then compare the update count values ​​of the primary version number and the backup version number. If the update count of the primary version number is greater than the update count of the backup version number, then the primary version number is copied to the backup version number; if the update count of the primary version number is less than the update count of the backup version number, then the backup version number is copied to the primary version number.

[0012] Preferably, writing the version number of the software update package and the incremented update count value into the major version number includes: Read the update count value of the major version number, erase the major version number, write the updated version number value of the software to the address corresponding to the major version number, and increment the read update count value by 1 and rewrite it to the address corresponding to the major version number.

[0013] Preferably, the version number of the software update package is pre-made and included in the software update package, and is protected by a digital signature.

[0014] Preferably, both the preset value of the magic number and the preset value of the update count are N-bit unsigned numbers, and the magic number and the update count are valid when they are not all 0s or all 1s.

[0015] This invention also provides a software rollback prevention device based on flash memory, comprising: A flash memory, which is divided into version number partitions for storing device version numbers, wherein the device version number includes a magic number, a version number value and an update count value, and the device version number includes a redundant main version number and a backup version number, which are stored at different addresses respectively. The startup processing module is used to determine the validity of the main version number and the backup version number based on the magic number when the device starts up, select the latest valid version number from the valid version numbers using the update count value, and synchronize the main version number and the backup version number based on the latest valid version number to make their contents consistent. The update judgment module is used to obtain the version number of the software update package when the device is undergoing a software update, compare the version number of the software update package with the version number of the currently valid device version number, and allow the update if the former is greater than or equal to the latter; otherwise, the update is rejected. The update writing module is used to write the version number of the software update package and the incremented update count value into the main version number after the software update is completed, and to synchronize the main version number to the backup version number.

[0016] Compared with the prior art, the beneficial effects that the at least one technical solution adopted in the embodiments of the present invention can achieve include at least: This invention presents a software rollback prevention method based on flash memory. Utilizing the device's existing flash memory as the version number storage medium, it achieves software rollback prevention without requiring additional hardware such as OTP or security chips. By writing the version number and update counter independently in stages, it effectively solves the problem of version number loss or corruption due to unexpected power outages or other anomalies during the writing process. Simultaneously, by employing a redundant storage mechanism for the primary and backup version numbers, even if a single write operation fails or a copy is corrupted, a valid version number can still be recovered through a synchronization mechanism. This method provides fault tolerance and security while offering significant advantages in terms of low cost and ease of deployment, making it particularly suitable for products where additional hardware cannot be added or where cost is a concern. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a software rollback prevention method based on flash memory according to an embodiment of the present invention. Figure 2 This is a schematic diagram illustrating the partitioning of device version numbers on a flash memory according to an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of the structure in which the version number of an embodiment of the present invention is stored on a flash memory.

[0020] Figure 4 This is a schematic diagram of the process for initializing the device version number according to an embodiment of the present invention.

[0021] Figure 5 This is a schematic diagram of the process for creating the initial device major version number according to an embodiment of the present invention.

[0022] Figure 6 This is a flowchart illustrating the method for synchronizing the main version number and the backup version number according to an embodiment of the present invention.

[0023] Figure 7 This is a schematic diagram illustrating the process of copying the source version number to the destination version number according to an embodiment of the present invention.

[0024] Figure 8 This is a schematic diagram illustrating the process of writing the version number value into the device version number according to an embodiment of the present invention. Detailed Implementation

[0025] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0026] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this application, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number and aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0028] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. The drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0029] Additionally, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that practice can be carried out without these specific details.

[0030] Portable electronic devices typically use flash memory as a non-volatile storage device. The software image or firmware of portable electronic devices is usually stored in flash memory.

[0031] During the lifecycle of portable electronic devices, firmware or software upgrades are necessary for various reasons, such as fixing problems, patching vulnerabilities, and adding new features. If the firmware or software is maliciously or accidentally downgraded to an older version during the upgrade process, it can introduce security risks to the system. For example, an attacker could downgrade the system to a vulnerable version and exploit known vulnerabilities to gain control of the system. Therefore, a security mechanism is needed during firmware or software upgrades to ensure that the firmware or software is not maliciously or accidentally downgraded to an older version. Software rollback prevention is one such technical measure.

[0032] The core of software rollback prevention is the ability to securely store the current system's device version number on portable electronic devices. When a portable electronic device undergoes a software update, the current device version number is compared with the software update package version number. The update package version number is required to be greater than or equal to the device version number on the portable electronic device before the software update is allowed, thus preventing the firmware or software from being updated to an older version.

[0033] Common methods for saving device version numbers in portable electronic devices include: 1. One-Time Programmable (OTP) area, such as eFuse. OTP typically consists of a series of bits, initially set to 0. Each bit can be modified once, changing from 0 to 1. Once modified to 1, it cannot be modified again. The advantage is that the version number is guaranteed to only increase through hardware. The disadvantages are that it requires additional hardware resources and has a limited number of bits, supporting only a limited number of versions; for example, 256 bits can only support a maximum of 256 versions.

[0034] 2. Independent security chip. The advantage is that it can prevent tampering, but the disadvantage is that it requires additional security chip hardware.

[0035] 3. Secure storage area. Requires a chip that supports a secure architecture, such as Arm TrustZone. The advantages are the same as a standalone secure chip: prevention of tampering. The disadvantage is that the chip needs to support a secure isolation architecture.

[0036] All of the above methods share a common drawback: they require additional hardware resources or have specific requirements for chip selection. For low-cost products, customized products, or products already in mass production, adding this additional hardware is not feasible. These types of products cannot retain their device version number using these methods, and therefore cannot achieve software rollback protection.

[0037] Based on this, the embodiments of this specification propose a processing solution: such as Figure 1As shown, this invention stores the device version number in a dual-copy format ("main version number + backup version number") by dividing the flash memory into dedicated partitions. Each version number consists of three parts: a magic number, a numerical value, and an update counter. During writing, a step-by-step strategy of "writing the numerical value first, then the counter" is adopted to prevent damage due to power failure. At startup, the validity of the dual copies is verified by the magic number and the counter, and automatic synchronization is performed to ensure the version number is always available. During upgrades, the version number value is compared to determine whether an update is allowed. This entire concept solves the problem of traditional solutions relying on hardware in a purely software-based manner, achieving a low-cost, highly fault-tolerant rollback prevention mechanism.

[0038] The technical solutions provided by the various embodiments of this application are described below with reference to the accompanying drawings.

[0039] like Figure 1-8 As shown in the figure, an embodiment of the present invention provides a software rollback prevention method based on flash memory, comprising: Step S102: Divide the flash memory into a version number partition to store the device version number. The device version number includes a magic number, a version number value, and an update count value (update counter). The device version number contains a redundant main version number and a backup version number, which are stored at different addresses.

[0040] like Figure 2 As shown, the device version number contains two identical entities: the main version number and the backup version number. These are stored in different addresses within the version number partition to facilitate easy access by applications.

[0041] In this method, the magic number and version number are written through the first operation, and the update count is written through the second operation. The first and second operations are independent of each other to improve the fault tolerance of the anti-rollback method of the present invention.

[0042] For example, the magic number and version number can be written in one write operation, while the update counter can be written in another independent operation. The two write operations are independent of each other and do not affect each other.

[0043] Specifically, by writing the magic number, version number, and update counter in stages, the problem of version number corruption caused by unexpected power loss during the writing process can be solved. That is, if a power loss occurs after the first step of writing is completed, the system can still identify the version number status through the validity judgment at startup because the counter in the second step has not yet been updated, thereby avoiding data loss or corruption. This demonstrates that the present invention improves the storage reliability of version number at zero hardware cost.

[0044] Furthermore, both the magic number preset value and the update count preset value are N-bit unsigned numbers, and the magic number and the update count value are valid when they are not all 0s or all 1s.

[0045] Specifically, such as Figure 3As shown, in step S102, for NOR Flash, the main version number and backup version number are stored in two different sectors (the basic unit of erasure). The magic number and version number value are stored in the first page of the sector (the basic unit of read and write), and the update counter is stored in the last page of the sector. The erasure unit for NOR Flash is a sector, and the write unit is a page. This arrangement ensures that the version number is completely erased in one operation when it is erased. When saving the version number, the magic number and version number value are written first, and then the update counter is written. The two writes are completely independent. The situation is similar for eMMC and NOR Flash. For NAND Flash, the main version number and backup version number are stored in two different blocks. The erasure unit for NAND Flash is a block, and the write unit is a page. This arrangement ensures that the version number is completely erased in one operation when it is erased. When saving the version number, the magic number and version number value are written first, and then the update counter is written. The two writes are completely independent. Therefore, the storage structure of the device version number is applicable to NOR Flash, eMMC, and NAND Flash.

[0046] Furthermore, the erased values ​​differ depending on the flash memory; they may be all 32 bits of zeros or all 32 bits of one. Therefore, the valid value of the update flag is a 32-bit unsigned number that is neither all zeros nor all one. The version number check refers to reading the major version number and backup version number from the device version number partition and selecting the valid device version number. A valid version number is one where both the magic number and the update counter within the version number are valid values.

[0047] Step S102 specifies the data structure (magic number, value, counter) and redundant storage method (primary and backup dual replicas) for the device version number. This lays an operational foundation for subsequent core steps such as startup synchronization, write fault tolerance, and upgrade comparison.

[0048] Step S104: When the device starts up, the validity of the main version number and the backup version number is determined according to the magic number, and the latest valid version number is selected from the valid version numbers using the update count value. The main version number and the backup version number are synchronized based on the latest valid version number to make their contents consistent.

[0049] like Figure 4 As shown, when the device starts up, the device version number is initialized to load the device version number into memory. The initialization process includes the following steps: Check if a valid major version number or backup version number exists in the version number partition. If neither exists, create an initial major version number. A valid major version number or backup version number means that both the magic number and the update count value are valid. If a major version number or a backup version number exists, the major version number and the backup version number are synchronized to make the contents of the major version number and the backup version number identical. Finally, the contents of the major version number are read and loaded into memory.

[0050] In this context, a valid version number refers to a version number where both the magic number and the update count are valid values. Selecting a valid version number involves reading the major version number and the backup version number, and determining whether either is a valid version number. If either the major or backup version number is valid, then a valid version number exists; otherwise, no valid version number exists.

[0051] like Figure 5 As shown, the steps for creating an initial major version number include: creating an initial major version number with a version number value of 0 and an update count value of 1, and writing it into the address corresponding to the major version number in the version number partition.

[0052] Furthermore, synchronizing the main version number and backup version number based on the latest valid version number includes: copying the valid version number with the latest content to another, so that both the main version number and the backup version number are valid and have the same content.

[0053] like Figure 7 As shown, copying a version number refers to completely copying the contents of a specified source version number to a specified destination version number. The specific steps include: first, reading the version number value and update flag value from the source version number; then, erasing the destination version number; and finally, storing this version number value and update counter value at the specified destination version number address. After the version number copy is complete, the contents of the source and destination version numbers are identical.

[0054] like Figure 6 As shown, the step of determining the validity of the major version number and the backup version number based on the magic number, and selecting the latest valid version number from the valid version numbers using the update count value, includes: If both the major version number and the backup version number are valid, then compare the update count values ​​of the major version number and the backup version number. If the update count of the primary version number is greater than the update count of the backup version number, then the primary version number is copied to the backup version number; if the update count of the primary version number is less than the update count of the backup version number, then the backup version number is copied to the primary version number.

[0055] Because the update counter is updated separately, if the update counter is written successfully, it means that the previously written version number value must also have been written successfully. Therefore, if the update counters in the primary version number and the backup version number are inconsistent, it means that the smaller value was not written successfully, and the version number value may also have not been written successfully, making this version number invalid. After the version number synchronization is complete, both the primary version number and the backup version number are valid and have identical content.

[0056] Furthermore, if both the major and backup version numbers are invalid, an initial major version number is created, and then the major version number is copied to the backup version number. If the major version number is valid and the backup version number is invalid, the major version number is copied to the backup version number. If the major version number is invalid and the backup version number is valid, the backup version number is copied to the major version number.

[0057] Step S104 verifies the validity of the two replicas using the magic number, then uses the size of the update counter to determine which replica is the most recently written, and finally synchronizes the latest valid version number to the other replica. This solves the problem of inconsistent version numbers between the primary and backup replicas due to power failure or abnormality during writing, ensuring that both replicas are valid and have consistent content after each startup.

[0058] Step S106: When the device performs a software update, obtain the version number of the software update package, compare the version number of the software update package with the version number of the currently valid device version number. If the former is greater than or equal to the latter, the update is allowed; otherwise, the update is rejected.

[0059] When a device is undergoing a software update, the version number of the software update package is loaded into memory (meaning that after device initialization, the version number value of the major version number is loaded into memory), and then compared with the device version number. If the version number of the software update package is greater than or equal to the device version number, the software update is allowed; otherwise, the software update is rejected.

[0060] The version number of the software update package is pre-created and included within the package, and is protected by a digital signature. Specifically, the version number is generated based on the number of software updates and is protected by a digital signature to prevent tampering with the version number.

[0061] If the version number of a software update package is tampered with after the update package is released, it will be detected when verifying the legality of the software update package. The device will then refuse to use the tampered update package to achieve the software rollback prevention function proposed in this application.

[0062] Step S106 compares the upgrade package version number with the device's current valid version number. Only when the "greater than or equal to" condition is met is the update allowed, thereby preventing the software from being maliciously or accidentally downgraded to an older version.

[0063] Step S108: After the software update is completed, write the version number of the software update package and the incremented update count value into the main version number, and synchronize the main version number to the backup version number.

[0064] Writing the software update package version number and the incremented update count to the major version number includes: Read the update count value of the major version number, erase the major version number, write the updated version number value of the software to the address corresponding to the major version number, and increment the read update count value by 1 and rewrite it to the address corresponding to the major version number.

[0065] For example, such as Figure 8 As shown, first, the update counter value of the major version number is read, then the major version number is erased, the version number of the software update package is written into the major version number, the update counter value is incremented by 1 and then written into the major version number. Finally, the major version number is copied to the backup version number.

[0066] Step S108 involves first reading and incrementing the original update counter, then writing the new value and counter step by step, and finally synchronizing it to the backup copy. This ensures that even if an anomaly such as a power outage occurs during the version number update process, the data can still be recovered through the validity check at startup, while maintaining consistency between the two copies, thus closing the entire anti-rollback process.

[0067] This invention utilizes the existing flash memory in portable electronic devices as the medium for storing device version numbers, achieving software update rollback prevention without requiring additional hardware. The version number uses a special storage structure, coupled with read, write, synchronize, and update methods, to increase its reliability. This special storage structure can easily adapt to NOR Flash, NAND Flash, and eMMC. An update counter within the version number resolves the inconsistency between the primary and backup version numbers. Writing the version number value and the update counter in two independent steps prevents corruption of the version number due to write failures, including unexpected power outages. The primary and backup version number mechanism enhances storage robustness. Compared to storing only a single device version number value, this significantly improves the security and reliability of the device version number. This invention provides a relatively secure method for storing device version numbers with zero additional hardware cost, and implements a software rollback prevention mechanism based on this method. The proposed method is low-cost and widely applicable, particularly suitable for products where additional hardware is undesirable (low cost) or cannot be added (already in mass production).

[0068] This invention also provides a software rollback prevention device based on flash memory, including a flash memory, a boot processing module, an update judgment module, and an update writing module. The flash memory is divided into version number partitions to store the device version number. The device version number includes a magic number, a version number value, and an update count value. The device version number also includes a redundant main version number and a backup version number, stored at different addresses. The boot processing module determines the validity of the main and backup version numbers based on the magic number during device startup, selects the latest valid version number from the valid version numbers using the update count value, and synchronizes the main and backup version numbers based on this latest valid version number to ensure consistency. The update judgment module obtains the version number of the software update package during software updates, compares the version number value of the software update package with the version number value of the currently valid device version number. If the former is greater than or equal to the latter, the update is allowed; otherwise, the update is rejected. The update writing module writes the version number value of the software update package and the incremented update count value to the main version number after the software update is completed, and synchronizes the main version number to the backup version number.

[0069] In this specification, the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the product embodiments described later, since they correspond to the methods, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions in the system embodiments.

[0070] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A software rollback prevention method based on flash memory, characterized in that, include: The flash memory is divided into version number partitions to store device version numbers. The device version number includes a magic number, a version number value, and an update count value. The device version number also includes a redundant main version number and a backup version number, which are stored at different addresses. When the device starts up, it determines the validity of the main version number and the backup version number based on the magic number, selects the latest valid version number from the valid version numbers using the update count value, and synchronizes the main version number and the backup version number based on the latest valid version number to make their contents consistent. When the device performs a software update, it obtains the version number of the software update package and compares the version number of the software update package with the version number of the currently valid device version. If the former is greater than or equal to the latter, the update is allowed; otherwise, the update is rejected. After the software update is completed, the version number of the software update package and the incremented update count value are written into the main version number, and the main version number is synchronized to the backup version number.

2. The software rollback prevention method according to claim 1, characterized in that, The magic number and version number are written through a first operation, and the update count is written through a second operation, with the first operation and the second operation being independent of each other.

3. The software rollback prevention method according to claim 2, characterized in that, When the device starts up, the device version number is initialized, which specifically includes the following steps: Check if a valid primary version number or backup version number exists in the version number partition. If neither exists, create an initial primary version number. A valid primary version number or backup version number means that both the magic number and the update count value are valid. If the primary version number or the backup version number exists, then the primary version number and the backup version number are synchronized so that the content of the primary version number and the backup version number is the same.

4. The software rollback prevention method according to claim 3, characterized in that, The initial major version number is created with a version number value of 0 and an update count value of 1, and written to the address corresponding to the major version number in the version number partition.

5. The software rollback prevention method according to claim 1 or 3, characterized in that, The process of synchronizing the major version number and the backup version number based on the latest valid version number includes: Copy the valid version number, which is the latest version number, to another version number so that both the primary version number and the backup version number are valid and have the same content.

6. The software rollback prevention method according to claim 1, characterized in that, The step of determining the validity of the major version number and the backup version number based on the magic number, and selecting the latest valid version number from the valid version numbers using the update count value, includes: If both the primary version number and the backup version number are valid, then compare the update count values ​​of the primary version number and the backup version number. If the update count of the primary version number is greater than the update count of the backup version number, then the primary version number is copied to the backup version number; if the update count of the primary version number is less than the update count of the backup version number, then the backup version number is copied to the primary version number.

7. The software rollback prevention method according to claim 1, characterized in that, The step of writing the version number of the software update package and the incremented update count value into the major version number includes: Read the update count value of the major version number, erase the major version number, write the updated version number value of the software to the address corresponding to the major version number, and increment the read update count value by 1 and rewrite it to the address corresponding to the major version number.

8. The software rollback prevention method according to claim 1, characterized in that, The version number of the software update package is pre-created and included in the software update package, and is protected by a digital signature.

9. The software rollback prevention method according to claim 1, characterized in that, Both the preset values ​​of the magic number and the update count are N-bit unsigned numbers, and the magic number and the update count are valid when they are not all 0s or all 1s.

10. A software rollback prevention device based on flash memory, characterized in that, include: A flash memory, which is divided into version number partitions for storing device version numbers, wherein the device version number includes a magic number, a version number value and an update count value, and the device version number includes a redundant main version number and a backup version number, which are stored at different addresses respectively. The startup processing module is used to determine the validity of the main version number and the backup version number based on the magic number when the device starts up, select the latest valid version number from the valid version numbers using the update count value, and synchronize the main version number and the backup version number based on the latest valid version number to make their contents consistent. The update judgment module is used to obtain the version number of the software update package when the device is undergoing a software update, compare the version number of the software update package with the version number of the currently valid device version number, and allow the update if the former is greater than or equal to the latter; otherwise, the update is rejected. The update writing module is used to write the version number of the software update package and the incremented update count value into the main version number after the software update is completed, and to synchronize the main version number to the backup version number.

Images