Dual-Boot Firmware Verification to Prevent RoT Recovery Hangs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Verifying firmware through a Root of Trust (RoT) chip can cause system hangs when the loaded firmware fails verification, rendering the system inoperable.
Innovation Solution
A dual firmware verification and recovery mechanism involving a control circuit, first and second protection circuits, and memories, where the control circuit boots from a first memory, verifies secondary and primary boot firmware, and reboots to a second memory for further verification, with protection circuits ensuring firmware integrity by comparing signature keys and overwriting failed firmware with a verified standard image.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firmware verification is performed through a Root of Trust chip, then system security is improved, but system reliability deteriorates due to system hangs when verification fails
Solution Approach 1:
The system performs preliminary verification of the first firmware before using it as a reference for verifying the second firmware. By pre-verifying the first firmware through the RoT chip and storing its verification result, the system establishes a trusted baseline that enables subsequent verification without requiring repeated RoT chip operations, thus preventing system hangs while maintaining security
Solution Approach 2:
The first firmware acts as an intermediary between the RoT chip verification mechanism and the second firmware. Instead of directly verifying the second firmware through the RoT chip (which causes system hangs on failure), the system uses the already-verified first firmware as a mediator to perform the verification, thereby decoupling the verification process from the RoT chip and eliminating the system hang issue
2Reliability
If dual firmware verification is implemented, then system security is enhanced, but device complexity increases
Solution Approach 1:
The first firmware serves multiple functions: it is verified by the RoT chip for security, used as a reference for verifying the second firmware, and serves as a recovery source if the second firmware verification fails. This multi-functionality reduces the need for separate dedicated components, thereby enhancing security without proportionally increasing device complexity
Solution Approach 2:
The system uses its own first firmware as the verification reference for the second firmware, rather than requiring an external trusted reference. This self-service approach eliminates the need for additional external verification components, reducing device complexity while maintaining the dual firmware verification security enhancement
Data Source
AI summary
A firmware verification method for a management system including a control circuit, a first protection circuit, a second protection circuit, a first memory and a second memory. The first memory includes first firmware including first secondary boot firmware and first primary boot firmware. The second memory includes second firmware including second secondary boot firmware and second primary boot firmware. The firmware verification method includes: when the control circuit boots according to the first memory, the first protection circuit verifying the first secondary boot firmware; when the first secondary boot firmware passes the verification, the control circuit verifying the second primary boot firmware according to the first primary boot firmware; when the second primary boot firmware passes the verification, the control circuit rebooting according to the second memory; and when the control circuit boots according to the second memory, the second protection circuit verifying the second secondary boot firmware.