Secure Boot Hash Verification via Program Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In embedded devices, the large size of OS and firmware programs leads to significant processing load during secure boot, causing prolonged startup times due to the need for calculating hash values, which is inefficient given the limited processing capacity of CPUs in these devices.
Innovation Solution
A secure boot method that divides programs into partial programs, calculates and stores partial hash values, and verifies these values during startup to ensure authenticity, reducing the computational load on the CPU by only processing partial hash values instead of the entire program.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hash values are calculated for the entire OS program during secure boot, then program authenticity is verified, but startup time becomes excessively long due to large program size and limited CPU processing capacity
Solution Approach 1:
The patent divides the large OS program into multiple smaller partial programs, and correspondingly divides the hash verification into multiple partial hash calculations. Instead of calculating one large hash value for the entire OS program, the system calculates several smaller partial hash values for each partial program, then combines these partial hash values to verify the complete program. This segmentation reduces the computational burden on the CPU during startup while maintaining verification reliability.
2Reliability
If the CPU processes the entire large program for hash calculation, then complete verification is achieved, but processing load becomes too high for embedded device capabilities
Solution Approach 1:
The patent segments the verification process into multiple smaller operations. The large program is divided into partial programs, and the hash calculation is performed separately on each partial program. The partial hash values are then combined through a sequential hash function to produce the final verification result. This approach maintains complete verification reliability while distributing the processing load across multiple smaller, more manageable operations that are better suited for embedded device CPUs.
Solution Approach 2:
The patent performs preliminary division of the program into partial programs and pre-calculates partial hash values that can be stored. During startup, only the combination of these pre-prepared partial hash values needs to be performed, rather than calculating the entire hash from scratch. This preliminary preparation reduces the real-time processing load on the CPU during the critical startup phase.
Data Source
AI summary
A secure boot method for a system, the system including a processor and a storage medium configured to store a program, a plurality of first partial hash values calculated based on a plurality of first partial programs into which the program is divided, and a first legitimate hash value which is a hash value calculated based on a plurality of first legitimate partial hash values, the plurality of first legitimate partial hash values being calculated based on a plurality of legitimate partial programs. The secure boot method includes calculating, a second calculated hash value based on the plurality of first partial hash values, and determining, whether or not the second calculated hash value matches the first legitimate hash value to continue the start-up processing of the system when the determination indicates match, and suspend the start-up processing of the system when the determination does not indicate match.