A security protection method for an internet of things device firmware update vulnerability

Abstract

The application relates to a security protection method for an Internet of Things device firmware update vulnerability, comprising the following steps: respectively constructing authenticity watermark, compatibility watermark and integrity watermark; embedding the authenticity watermark, the compatibility watermark and the integrity watermark into firmware; performing watermark detection on the firmware, and only when the watermark detection passes, executing firmware update. Compared with the prior art, the application uses implicitly defined watermark to provide security protection, and uses the authenticity watermark, the compatibility watermark and the integrity watermark to provide the firmware with protection capability for multiple types of firmware update vulnerabilities, and has the advantages of high reliability, high robustness and high generalization.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a security protection method for firmware update vulnerabilities in IoT devices. Background Technology

[0002] IoT devices are widely used in many fields such as autonomous driving systems, industrial control systems, medical auxiliary systems, wearable devices, and smart homes. As a core component, the firmware of IoT devices can provide many functions including user interaction, network communication, and security protection.

[0003] In practical applications, IoT device firmware is often updated to add new features and maintain security. However, due to design and implementation flaws in firmware update mechanisms, many IoT device firmwares contain firmware update vulnerabilities, such as integrity vulnerabilities, authenticity vulnerabilities, and compatibility vulnerabilities. These vulnerabilities provide hackers with a large attack surface, threatening both the firmware update mechanism and the security of IoT devices, and also negatively impacting the security of the IoT device supply chain.

[0004] Currently, protection against firmware update vulnerabilities in IoT devices mainly relies on verification algorithms built into the firmware by IoT device manufacturers. However, as resource-constrained devices, IoT devices do not have the ability to carry complex verification algorithms. Therefore, existing verification algorithms are easily bypassed by hackers and cannot play a reliable protective role. Summary of the Invention

[0005] The purpose of this invention is to overcome the defects of the prior art and provide a security protection method for firmware update vulnerabilities in Internet of Things (IoT) devices, which can provide reliable security protection for firmware update vulnerabilities in IoT devices.

[0006] The objective of this invention can be achieved through the following technical solution: a security protection method for firmware update vulnerabilities in Internet of Things (IoT) devices, comprising the following steps: Construct authenticity watermarks, compatibility watermarks, and integrity watermarks respectively; The authenticity watermark, compatibility watermark, and integrity watermark are embedded into the firmware respectively; Perform watermark detection on the firmware, and only perform firmware update if the watermark detection passes.

[0007] Furthermore, the authenticity watermark is specifically constructed based on the publisher information, transmission information, receiver information, and mirror information in the firmware information.

[0008] Furthermore, the process of constructing the authentic watermark includes: Hash operations are performed on publisher information and mirror information, and HMAC operations are performed on transmission information and receiver information to obtain four types of information fingerprints; For the four types of information fingerprints, a unified encoding is performed according to the information fingerprint type, length, and content. Then, the unified encoding of the four types of information fingerprints is obtained, and they are merged to obtain the unified encoding of the authenticity information fingerprint. The authenticity information fingerprint is digitally signed using a unified encoding method, and then the unified encoding method and the signature result are concatenated to obtain the authenticity watermark.

[0009] Furthermore, the compatibility watermark is specifically constructed based on device information, version information, device compatibility information, and version compatibility information in the firmware information.

[0010] Furthermore, the process of constructing a compatible watermark includes: The four types of information—device information, version information, device compatibility information, and version compatibility information—are tupled to obtain information fingerprints. Then, they are uniformly encoded according to the information fingerprint type, length, and content to obtain a unified code for the four types of information fingerprints. These are then merged to obtain a unified code for the compatibility information fingerprint. The compatibility information fingerprint is digitally signed using a unified encoding method, and then the unified encoding method and the signature result are concatenated to obtain the compatibility watermark.

[0011] Furthermore, the integrity watermark is specifically constructed based on the original byte stream of each component in the firmware.

[0012] Furthermore, the process of constructing the integrity watermark includes: The raw byte stream of each component in the firmware is divided into data blocks, and then hash operations are performed to obtain the digest of each data block. The Merkle root is calculated as the original information fingerprint of the component. Construct extended information fingerprints for each component, including the component's original information fingerprint, metadata, and context; For the extended information fingerprints of each component, they are uniformly encoded according to the information fingerprint type, length, and content to obtain the unified encoding of the extended information fingerprints of each component; The firmware information fingerprint is obtained by hashing the unified encoding of the extended information fingerprint of each component, and then unified encoding is performed to obtain the unified encoding of the firmware information fingerprint. The unified encoding of extended information fingerprints of each component is combined with the unified encoding of firmware information fingerprints to obtain the unified encoding of integrity information fingerprints; The integrity information fingerprint is digitally signed using a unified encoding method, and the integrity information fingerprint is concatenated with the signature result to obtain an integrity watermark.

[0013] Furthermore, the process of embedding the authenticity watermark, compatibility watermark, and integrity watermark into the firmware respectively includes: Q1. For genuine watermarks, they are segmented and encapsulated to form watermark fragments, which are then embedded in the firmware's bootloader, kernel, device tree, and file system. Q2. For compatibility watermarks, embed the compatibility watermark in the reserved area of ​​the manifest file and firmware header that are distributed synchronously with the firmware. Q3. For integrity watermarks, embed integrity watermarks in the manifest file, the reserved area of ​​the firmware header, and the file system during firmware synchronization, and embed anchor points pointing to integrity watermarks in the bootloader, kernel, and device tree. Q4. After embedding the above three types of watermarks, recalculate the firmware metadata and re-digitally sign the firmware.

[0014] Furthermore, Q1 specifically involves dividing the authenticity watermark into multiple watermark raw data blocks according to a set length, then linearly encoding the watermark raw data blocks to obtain watermark data redundancy blocks, and encapsulating header data for each watermark raw data block and watermark data redundancy block, including a unique identifier, the watermark type, and a check code, ultimately forming watermark fragments. A distributed embedding method is used to embed some watermark fragments in the read-only data area, data padding area, and data extension area of ​​the firmware bootloader, kernel, and device tree, and to embed some watermark fragments in the comments, unreachable branch code, and redundant strings of files in the firmware's file system.

[0015] Furthermore, the watermark detection process includes: J1. For genuine watermarks, watermark fragments are located in each component of the firmware to splice them together to obtain a genuine watermark. The digital signature and the unified encoding of the genuine information fingerprint of the spliced ​​genuine watermark are verified. If the verification is passed, the genuine watermark detection is considered to have passed. J2. For compatibility watermarks, locate the compatibility watermark in the reserved area of ​​the manifest file and firmware header that are synchronously distributed in the firmware. Verify the digital signature and compatibility information fingerprint of the located compatibility watermark, and perform consistency verification on the two compatibility watermarks. If all the above verifications are passed, the compatibility watermark detection is considered to have passed. J3. For integrity watermarks, the integrity watermark anchor point is located in the bootloader, kernel, and device tree, and a consistency check is performed. Then, the integrity watermark is located in the manifest file, the reserved area of ​​the firmware header, and the file system that are distributed synchronously with the firmware. A matching check is performed on the integrity watermark anchor point and the integrity watermark. For integrity watermarks that pass the check, their digital signature and integrity information fingerprint are checked for unified encoding. Finally, a consistency check is performed. If all the above checks pass, the integrity watermark detection is considered to have passed.

[0016] Compared with the prior art, the present invention has the following advantages: This invention constructs authenticity watermarks, compatibility watermarks, and integrity watermarks respectively, and then embeds these watermarks into the firmware. Subsequently, watermark detection is used to determine whether to perform a firmware update operation. This invention uses implicitly defined watermarks to provide security protection. Compared with the explicit verification algorithm method of the prior art, implicitly defined watermarks are difficult to locate precisely, thus providing more reliable security protection. Furthermore, the three types of watermarks can provide firmware with protection against various types of firmware update vulnerabilities and effectively resist malicious attacks based on these firmware update vulnerabilities.

[0017] This invention constructs an authenticity watermark based on publisher information, transmission information, receiver information, and mirror information in firmware information, which can protect against authenticity vulnerabilities in firmware updates and resist authenticity verification bypass attacks. This invention also constructs a compatibility watermark based on device information, version information, device compatibility information, and version compatibility information in firmware information, which can protect against compatibility vulnerabilities in firmware updates and resist version rollback and bricking attacks. Finally, this invention constructs an integrity watermark based on the raw byte stream of each component in the firmware, which can protect against integrity vulnerabilities in firmware updates and resist integrity verification bypass attacks and firmware tampering attacks.

[0018] This invention, when embedding watermarks, segments and encapsulates genuine watermarks into watermark fragments, which are then embedded in the firmware's bootloader, kernel, device tree, and file system. For compatibility watermarks, they are embedded in the manifest file and reserved areas of the firmware header, which are distributed synchronously with the firmware. For integrity watermarks, they are embedded in the manifest file, reserved areas of the firmware header, and file system, and anchor points pointing to the integrity watermarks are embedded in the bootloader, kernel, and device tree. This allows for the embedding of multiple watermark copies, fragments, and anchor points within the firmware, ensuring protection against firmware update vulnerabilities even if some watermark copies are deleted by attackers.

[0019] This invention designs corresponding detection for authenticity watermarks, compatibility watermarks, and integrity watermarks. Only when the firmware passes the detection of the three types of watermarks is it determined that the firmware has the ability to protect against authenticity vulnerabilities, compatibility vulnerabilities, and integrity vulnerabilities, and only then can the firmware be updated, which can fully ensure the security of firmware updates. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram illustrating the process of constructing three types of watermarks in this embodiment. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0022] Example like Figure 1 As shown, a security protection method for firmware update vulnerabilities in IoT devices includes the following steps: Construct authenticity watermarks, compatibility watermarks, and integrity watermarks respectively; The authenticity watermark, compatibility watermark, and integrity watermark are embedded into the firmware respectively; Perform watermark detection on the firmware, and only perform firmware update if the watermark detection passes.

[0023] This embodiment applies the above scheme, and the main process includes constructing three types of watermarks (such as...). Figure 2 As shown), three types of watermarks are embedded in the firmware, and watermark detection is performed. Specifically: (1) Construction of Authentic Watermark (1.1) Authenticity watermarks are used to protect against authenticity vulnerabilities in firmware update vulnerabilities in order to resist authenticity verification bypass attacks. Authenticity watermarks are constructed based on publisher information, transmission information, receiver information, and mirror information. These four types of information are shown in Table 1.

[0024] Table 1 (1.2) Perform hash operations on publisher information and mirror information, and perform HMAC operations on transmission information and receiver information to obtain four types of information fingerprints; The publisher information includes three types of information: publisher certificate, key, and manufacturer. The publisher certificate is the signing certificate held by the firmware publisher, the publisher key is the key used by the publisher to encrypt the firmware, and the manufacturer is the IoT device manufacturer to which the publisher belongs. The publisher information fingerprint is obtained by hashing the publisher certificate, key, and manufacturer information. The transmission information includes two types of information: transmission channel and distribution node. The transmission channel is the transmission channel used after the firmware is released, and the distribution node is the intermediate forwarding node used in the transmission process, which is generally CDN or PoP. The transmission information fingerprint is obtained by performing HMAC operation on the two types of information: transmission channel and distribution node. Receiver information includes receiver identifier and permission identifier. Receiver identifier is the unique identifier of the firmware receiver, and permission identifier is the firmware receiver's firmware acquisition permission. HMAC operation is performed on the receiver identifier and permission identifier to obtain the receiver information fingerprint. The image information includes image content, image source, and image distribution node. The image content is the firmware header data and firmware body data of the distributed firmware image. The image source is the original data source of the distributed firmware image. The image distribution node is the intermediate forwarding node through which the distributed firmware image passes. The image information fingerprint is obtained by performing a hash operation on the three types of information: image content, image source, and image distribution node.

[0025] (1.3) For the four types of information fingerprints obtained in (1.2), they are uniformly encoded according to the information fingerprint type, length and content, and then the unified encoding of the four types of information fingerprints is obtained. They are further merged to obtain the unified encoding of the authenticity information fingerprint. First, a unique category code is assigned to each type of information fingerprint identifier. Then, the length and content of the information fingerprint are obtained and concatenated to obtain a unified code for each type of information fingerprint. Finally, the unified codes of the four types of information fingerprints are merged to obtain a unified code for the authenticity information fingerprint.

[0026] (1.4) Digitally sign the unified code of the authenticity information fingerprint obtained in (1.3). A digital signature algorithm (such as RSA) can be used for digital signature. Then, the unified code of the authenticity information fingerprint and its signature result are concatenated to obtain the authenticity watermark.

[0027] (2) Construction of compatibility watermark (2.1) Compatibility watermarks are used to protect against compatibility vulnerabilities in firmware updates, in order to resist version rollback and bricking attacks. The compatibility watermark is constructed based on device information, version information, device compatibility information, and version compatibility information. These four types of information are shown in Table 2.

[0028] (2.2) In order to preserve the data comparison capability of information, the four types of information in (2.1) are tupled to obtain information fingerprints. Then, they are uniformly encoded according to the information fingerprint type, length and content to obtain the unified encoding of the four types of information fingerprints. They are then merged to obtain the unified encoding of the compatibility information fingerprint.

[0029] (2.3) Digitally sign the unified encoding of the compatibility information fingerprint obtained in (2.2). A digital signature algorithm (such as RSA) can be used for digital signature. Then, the unified encoding of the compatibility information fingerprint and the signature result are concatenated to obtain the compatibility watermark.

[0030] Table 2 (3) Construction of integrity watermark: (3.1) Integrity watermarks are used to protect against integrity vulnerabilities in firmware updates, in order to resist integrity verification bypass attacks and firmware tampering attacks. Integrity watermarks are constructed based on the original byte streams of each component in the firmware (bootloader, kernel, device tree, file system, etc.).

[0031] (3.2) For the raw byte stream of each component in the firmware, the data block is divided into blocks of a set fixed length. Depending on the firmware size, the data block size is usually 16KB-64KB. Then, a hash operation is performed on each data block to obtain a digest of each data block. The Merkle root is calculated as the original information fingerprint of the component.

[0032] (3.3) Construct extended information fingerprints for each component, including the original information fingerprint, metadata and context of the component. The extended information fingerprints of each component are obtained by extending the original information fingerprints of each component. The metadata records the original byte stream length, data block size and hash algorithm applied for each component. The context includes the component version number, compatible device series, compatible device model and compatible hardware version.

[0033] (3.4) For the extended information fingerprints of each component obtained in (3.3), they are uniformly encoded according to the information fingerprint type, length and content to obtain the unified encoding of the extended information fingerprints of each component; In this embodiment, the original information fingerprint, meta information, and context identifier of each component are uniquely categorized and encoded. Then, their length and content are obtained, and then they are concatenated to obtain the unified encoding of the extended information fingerprint of each component.

[0034] (3.5) For the extended information fingerprint of each component obtained in (3.4) unified encoding, hash operation is performed again to obtain firmware information fingerprint, and then unified encoding is performed to obtain firmware information fingerprint unified encoding.

[0035] (3.6) The unified encoding of extended information fingerprints of each component obtained in (3.4) is combined with the unified encoding of firmware information fingerprints obtained in (3.5) to obtain the unified encoding of integrity information fingerprints.

[0036] (3.7) Digitally sign the unified code of the integrity information fingerprint obtained in (3.6). A digital signature algorithm (such as RSA) can be used to perform the digital signature. Then, the unified code of the integrity information fingerprint and the signature result are concatenated to obtain the integrity watermark.

[0037] (4) Watermark embedding: (4.1) For genuine watermarks, they are segmented and encapsulated to form watermark fragments, which are then embedded in the firmware's bootloader, kernel, device tree, and file system. In this embodiment, the authentic watermark is divided into multiple original watermark data blocks according to a fixed length, and then linearly encoded to obtain watermark data redundancy blocks. Each original watermark data block and watermark data redundancy block is encapsulated with header data, including a unique identifier, the watermark type, and a check code, and finally watermark fragments are formed. The embedding method of the authenticity watermark fragments is distributed. Specifically, some watermark fragments are embedded in the read-only data area, data padding area, and data extension area of ​​the bootloader, kernel, and device tree in the firmware, and some watermark fragments are embedded in the comments, unreachable branch code, and redundant strings of files in the file system of the firmware.

[0038] (4.2) For compatibility watermarks, embed compatibility watermarks in the reserved area of ​​the manifest file and firmware header that are distributed synchronously with the firmware.

[0039] (4.3) For integrity watermarks, embed integrity watermarks in the manifest file, the reserved area of ​​the firmware header, and the file system in the firmware synchronously distributed, and embed anchor points pointing to integrity watermarks in the bootloader, kernel, and device tree. This embodiment embeds an integrity watermark in the reserved area of ​​the manifest file and firmware header that are distributed synchronously with the firmware. A new independent file is added to the read-only directory of the file system, and its content is the integrity watermark. Verification logic for this file is added, and the firmware update is terminated when the file is missing. In addition, anchor points pointing to the integrity watermark in the manifest file, firmware header reserved area and file system that are distributed synchronously with the firmware are embedded in the bootloader, kernel and device tree.

[0040] (4.4) After embedding the above three types of watermarks, recalculate the firmware length, check code and other metadata, and re-digitally sign the firmware.

[0041] (5) Watermark detection: (5.1) For the authenticity watermark, the watermark fragments are located in each component of the firmware and then spliced ​​together to obtain the authenticity watermark. The digital signature and the unified encoding of the authenticity information fingerprint are checked. If the check passes, the authenticity watermark is considered to have passed the detection. This embodiment scans each component of the firmware, locates the watermark fragments scattered in each component based on the unique identifier in the watermark fragment, then extracts the verification code to verify the integrity of the watermark fragment, splices the watermark fragments that pass the verification to obtain the authentic watermark, then verifies the digital signature of the authentic watermark, and after the verification is passed, it parses the unified fingerprint code of the authenticity information, and checks the unified fingerprint codes of various information. If the check is passed, it is considered to have passed the authentic watermark detection.

[0042] (5.2) For compatibility watermarks, locate the compatibility watermark in the reserved area of ​​the manifest file and firmware header that are synchronously distributed in the firmware, check its digital signature and compatibility information fingerprint unified encoding, and check the consistency of the two compatibility watermarks. If all the above checks are passed, the compatibility watermark detection is considered to have passed. This embodiment scans the manifest file and the reserved area of ​​the firmware header that are distributed synchronously with the firmware. It locates the compatibility watermark based on the unique category code of the information fingerprint identifier, and then verifies the digital signature of the two compatibility watermarks. After the verification is successful, it parses out the unified code of the compatibility information fingerprint and checks the unified codes of various information fingerprints. Finally, it performs a consistency check on the two compatibility watermarks. If all the above checks pass, the compatibility watermark detection is considered successful.

[0043] (5.3) For integrity watermarks, locate the integrity watermark anchor point in the bootloader, kernel, and device tree, and perform consistency checks. Then, locate the integrity watermark in the manifest file, the reserved area of ​​the firmware header, and the file system that are distributed synchronously with the firmware. Perform a matching check between the integrity watermark anchor point and the integrity watermark. For integrity watermarks that pass the check, check their digital signature and integrity information fingerprint unified encoding. Finally, perform a consistency check. If all the above checks pass, the integrity watermark detection is considered to have passed. This embodiment locates the integrity watermark anchor points by scanning the bootloader, kernel, and device tree. Consistency checks are performed on the three integrity watermark anchor points. After passing the checks, the manifest file, the reserved area of ​​the firmware header, and the file system, which are synchronously distributed with the firmware, are scanned to locate the integrity watermark. A matching check is then performed on the three integrity watermark anchor points and the three integrity watermarks. The digital signature of the integrity watermark that passes the matching check is verified. After successful verification, the unified fingerprint encoding of the integrity information is parsed out. The unified fingerprint encodings of the extended information of each component and the unified fingerprint encoding of the firmware information are then checked. Finally, a consistency check is performed on the integrity watermark that passes the matching check. If all the above checks pass, the integrity watermark detection is considered successful.

[0044] (5.4) Once the firmware passes the watermark detection in (5.1), (5.2), and (5.3), it is determined that the firmware has the ability to protect against authenticity vulnerabilities, compatibility vulnerabilities, and integrity vulnerabilities, and then the firmware can be updated.

[0045] In summary, compared with existing technologies, this solution has the following significant advantages: First, it has high reliability. Unlike explicitly defined verification algorithms, implicitly defined watermarks are difficult to locate precisely, and the security protection they provide is more reliable. Second, it has high robustness. Multiple watermark copies, watermark fragments, and watermark anchors are embedded in the firmware. Even if some watermark copies are deleted by attackers, it can still retain the ability to protect against firmware update vulnerabilities. Third, it has high generalization ability. The three types of watermarks provide firmware with protection against various types of firmware update vulnerabilities and can effectively resist malicious attacks based on these firmware update vulnerabilities.

Claims

1. A security protection method for firmware update vulnerabilities in Internet of Things (IoT) devices, characterized in that, Includes the following steps: Construct authenticity watermarks, compatibility watermarks, and integrity watermarks respectively; The authenticity watermark, compatibility watermark, and integrity watermark are embedded into the firmware respectively; Perform watermark detection on the firmware, and only perform firmware update if the watermark detection passes.

2. The security protection method for firmware update vulnerabilities in IoT devices according to claim 1, characterized in that, The authenticity watermark is specifically constructed based on the publisher information, transmission information, receiver information, and mirror information in the firmware information.

3. The security protection method for firmware update vulnerabilities in IoT devices according to claim 2, characterized in that, The process of constructing an authentic watermark includes: Hash operations are performed on publisher information and mirror information, and HMAC operations are performed on transmission information and receiver information to obtain four types of information fingerprints; For the four types of information fingerprints, a unified encoding is performed according to the information fingerprint type, length, and content. Then, the unified encoding of the four types of information fingerprints is obtained, and they are merged to obtain the unified encoding of the authenticity information fingerprint. The authenticity information fingerprint is digitally signed using a unified encoding method, and then the unified encoding method and the signature result are concatenated to obtain the authenticity watermark.

4. The security protection method for firmware update vulnerabilities in IoT devices according to claim 1, characterized in that, The compatibility watermark is specifically constructed based on device information, version information, device compatibility information, and version compatibility information in the firmware information.

5. The security protection method for firmware update vulnerabilities in IoT devices according to claim 4, characterized in that, The process of constructing a compatible watermark includes: The four types of information—device information, version information, device compatibility information, and version compatibility information—are tupled to obtain information fingerprints. Then, they are uniformly encoded according to the information fingerprint type, length, and content to obtain a unified code for the four types of information fingerprints. These are then merged to obtain a unified code for the compatibility information fingerprint. The compatibility information fingerprint is digitally signed using a unified encoding method, and then the unified encoding method and the signature result are concatenated to obtain the compatibility watermark.

6. The security protection method for firmware update vulnerabilities in IoT devices according to claim 1, characterized in that, The integrity watermark is specifically constructed based on the original byte stream of each component in the firmware.

7. The security protection method for firmware update vulnerabilities in IoT devices according to claim 6, characterized in that, The process of constructing the integrity watermark includes: The raw byte stream of each component in the firmware is divided into data blocks, and then hash operations are performed to obtain the digest of each data block. The Merkle root is calculated as the original information fingerprint of the component. Construct extended information fingerprints for each component, including the component's original information fingerprint, metadata, and context; For the extended information fingerprints of each component, they are uniformly encoded according to the information fingerprint type, length, and content to obtain the unified encoding of the extended information fingerprints of each component; The firmware information fingerprint is obtained by hashing the unified encoding of the extended information fingerprint of each component, and then unified encoding is performed to obtain the unified encoding of the firmware information fingerprint. The unified encoding of extended information fingerprints of each component is combined with the unified encoding of firmware information fingerprints to obtain the unified encoding of integrity information fingerprints; The integrity information fingerprint is digitally signed using a unified encoding method, and the integrity information fingerprint is concatenated with the signature result to obtain an integrity watermark.

8. The security protection method for firmware update vulnerabilities in IoT devices according to claim 1, characterized in that, The process of embedding the authenticity watermark, compatibility watermark, and integrity watermark into the firmware includes: Q1. For genuine watermarks, they are segmented and encapsulated to form watermark fragments, which are then embedded in the firmware's bootloader, kernel, device tree, and file system. Q2. For compatibility watermarks, embed the compatibility watermark in the reserved area of ​​the manifest file and firmware header that are distributed synchronously with the firmware. Q3. For integrity watermarks, embed integrity watermarks in the manifest file, the reserved area of ​​the firmware header, and the file system during firmware synchronization, and embed anchor points pointing to integrity watermarks in the bootloader, kernel, and device tree. Q4. After embedding the above three types of watermarks, recalculate the firmware metadata and re-digitally sign the firmware.

9. A security protection method for firmware update vulnerabilities in IoT devices according to claim 8, characterized in that, Specifically, Q1 involves dividing the authentic watermark into multiple original watermark data blocks according to a set length, then linearly encoding the original watermark data blocks to obtain redundant watermark data blocks, and encapsulating header data for each original watermark data block and redundant watermark data block, including a unique identifier, the watermark type, and a check code, ultimately forming watermark fragments. A distributed embedding method is used to embed some watermark fragments in the read-only data area, data padding area, and data extension area of ​​the firmware bootloader, kernel, and device tree, and to embed some watermark fragments in the comments, unreachable branch code, and redundant strings of files in the firmware's file system.

10. A security protection method for firmware update vulnerabilities in IoT devices according to claim 8, characterized in that, The watermark detection process includes: J1. For genuine watermarks, watermark fragments are located in each component of the firmware to splice them together to obtain a genuine watermark. The digital signature and the unified encoding of the genuine information fingerprint of the spliced ​​genuine watermark are verified. If the verification is passed, the genuine watermark detection is considered to have passed. J2. For compatibility watermarks, locate the compatibility watermark in the reserved area of ​​the manifest file and firmware header that are synchronously distributed in the firmware. Verify the digital signature and compatibility information fingerprint of the located compatibility watermark, and perform consistency verification on the two compatibility watermarks. If all the above verifications are passed, the compatibility watermark detection is considered to have passed. J3. For integrity watermarks, the integrity watermark anchor point is located in the bootloader, kernel, and device tree, and a consistency check is performed. Then, the integrity watermark is located in the manifest file, the reserved area of ​​the firmware header, and the file system that are distributed synchronously with the firmware. A matching check is performed on the integrity watermark anchor point and the integrity watermark. For integrity watermarks that pass the check, their digital signature and integrity information fingerprint are checked for unified encoding. Finally, a consistency check is performed. If all the above checks pass, the integrity watermark detection is considered to have passed.

Images