Boot Loader Kernel Security Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for starting smart mobile devices lack robust security, as they rely on external security units and general mobile communications terminals do not provide external interfaces, leading to potential unauthorized starts and low kernel starting security.
Innovation Solution
A trusted kernel starting method that involves a security boot module boot loader to measure the platform configuration register PCR partition, kernel code, and boot loader for trustworthiness using predefined measurement algorithms and values, ensuring only trusted components are initialized and started.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an external security unit is used to verify kernel starting, then kernel starting security is improved, but device complexity increases and adaptability decreases because general mobile communications terminals do not provide external interfaces
Solution Approach 1:
The patent extracts the security verification function from an external security unit and integrates it directly into the boot loader. The boot loader now contains the security algorithm and measurement value storage, eliminating the need for separate external security hardware while maintaining security functionality.
Solution Approach 2:
The boot loader is transformed into a multi-functional component that combines both bootstrapping and security verification functions. By integrating the security algorithm and measurement value storage within the boot loader, the system achieves universal functionality without requiring external security units.
2Reliability
If external security unit verification is performed, then kernel starting security is improved, but adaptability decreases because general mobile communications terminals do not provide external interfaces
Solution Approach 1:
The security verification capability is extracted from external hardware dependencies and embedded within the boot loader software. This allows any mobile communication terminal, regardless of hardware configuration, to perform security verification using the boot loader's integrated measurement value storage and security algorithm.
Solution Approach 2:
The boot loader becomes a universal component that works across different mobile communication terminals. By incorporating the security algorithm and measurement value storage directly in the boot loader, the system achieves broad adaptability without requiring device-specific external security interfaces.
3Ease of operation
If simple existence verification of external security unit is performed, then starting process is simplified, but security reliability decreases allowing unauthorized starting to bypass security unit
Solution Approach 1:
The patent implements preliminary action by storing measurement values in advance within the boot loader before kernel loading. The boot loader calculates and stores the measurement value of the kernel code and compares it with the stored value, performing security verification before the kernel starts, thus preventing unauthorized starting while maintaining a simple process.
Solution Approach 2:
The system implements feedback by comparing the calculated measurement value of the kernel code with the pre-stored measurement value in the boot loader. This feedback mechanism provides clear verification results, allowing the system to confirm whether the kernel code is authorized before permitting startup, thereby enhancing security without complicating the user experience.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A trusted kernel starting method and apparatus are provided. The method includes: starting a security boot module boot loader (201); invoking the boot loader to measure, according to a first security algorithm, whether a platform configuration register PCR partition is trusted (202); if the PCR partition is trusted, invoking the boot loader to read kernel code into a memory, and invoking the boot loader to measure, according to a first complete algorithm and a kernel code standard measurement value prestored in the PCR partition, whether the kernel code is trusted (203); initializing, if the kernel code is trusted, the kernel code to trigger an initialized kernel to measure, according to a second complete algorithm, whether the boot loader is trusted (204); and starting the kernel if the boot loader is trusted (205). Kernel starting security is improved.