Bootloader Key Data Verification via Segmented Hash Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current system partition security mechanisms, such as DM-verity, are inadequate as they cannot encrypt the entire system partition due to its large size, making it vulnerable to data breaches, which compromises the entire system's security when key data files are tampered with.
Innovation Solution
A protection method and system that uses a verification table with digital signatures, block addresses, and hash values to verify key data integrity during the bootloader startup, decrypting digital signatures using public or private keys, and comparing generated verification values to ensure the system's integrity before loading, thereby reducing boot time and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire system partition is encrypted to ensure security, then security is improved, but the system becomes too complex and time-consuming to verify due to the large size of the system partition
Solution Approach 1:
The patent divides the system partition verification into segments by creating a verification table that contains only the key data blocks that need to be verified. Instead of verifying the entire system partition, the solution segments the verification process to focus only on critical key data blocks, thereby reducing verification complexity while maintaining security.
Solution Approach 2:
The patent extracts the essential security-critical elements (key data blocks) from the entire system partition and places them in a separate verification table. This extraction allows the verification process to operate on a small, manageable subset of data rather than the complete system partition, resolving the contradiction between security and verification complexity.
2Reliability
If the entire system partition is verified during boot, then security is improved, but the boot time increases significantly due to the large amount of data to be read and verified
Solution Approach 1:
The verification process is segmented to only include critical key data blocks in the verification table, excluding non-critical system files. This segmentation dramatically reduces the amount of data that needs to be read and verified during boot, thereby reducing boot time while maintaining integrity verification for security-critical data.
Solution Approach 2:
The patent extracts only the essential key data blocks from the system partition and places them in a separate verification table. This extraction enables the boot process to verify only the necessary security-critical data rather than scanning the entire system partition, thus significantly reducing boot time while preserving data integrity verification.
3Reliability
If key data files are cracked in the system partition, then system security is compromised, but encrypting the entire system partition is not feasible due to its large size
Solution Approach 1:
The patent segments the protection scope to focus only on key data blocks rather than the entire system partition. By identifying and isolating critical key data blocks in a verification table, the solution provides targeted protection for security-critical elements without the complexity of encrypting and verifying the complete system partition.
Solution Approach 2:
The patent extracts key data blocks from the system partition and places them in a separate verification table that can be independently verified. This extraction enables focused protection of security-critical data without requiring encryption of the entire large system partition, thus achieving key data protection with reduced complexity.
Data Source
AI summary
Disclosed are a protection method and a protection system of system partition key data and a terminal. The protection method includes: obtaining a verification table corresponding to key data carried in a system partition file when a bootloader is started, and decrypting a digital signature by using a preset public key or a private key to obtain a first verification value; generating a second verification value according to a block address and a hash value, and comparing the first verification value with the second verification value; and starting a system if the first verification value is consistent with the second verification value.