WO2023102757A1

WO2023102757A1 - Boot verification scheme employing risc-v-oriented architecture

Info

Publication number: WO2023102757A1
Application number: PCT/CN2021/136243
Authority: WO
Inventors: 常瑞; 戴勤明; 张行健; 苑子琦
Original assignee: 浙江大学
Priority date: 2021-12-08
Filing date: 2021-12-08
Publication date: 2023-06-15

Abstract

Designed in the present invention is a boot verification scheme employing a RISC-V-oriented architecture. In the boot verification method, after verification of a first stage boot loader is successful, verification is further performed with respect to a second stage boot loader. The present invention provides stage-by-stage protection for a multi-stage boot process, and adjust the security level and flexibility according to different application scenarios when designing verification mechanisms at various stages. The proposed verification policy is based on an information digest and a digital signature algorithm, and can be efficiently implemented on a field-programmable gate array chip, thereby improving the security and defense capability of a system at the boot stage.

Description

A startup verification scheme based on RISC-V architecture

technical field

The invention relates to a startup loading and startup verification process, in particular to a startup verification scheme based on RISC-V architecture.

Background technique

As a new type of reduced instruction set, RISC-V has the advantages of open source, openness, and modularization. However, the current RISC-V also has some clear problems, including imperfect software and hardware ecology, the proportion of high-quality open source processors and Limited quantities and more. Especially in the field of information security, RISC-V has not yet formed a set of recognized system security specifications at this stage, and the security processors for RISC-V are also very limited. Boot security, as a part of the system security mechanism, ensures that only certified operating systems or hardware drivers can be loaded on the motherboard, thereby preventing malicious software from intruding.

In this field, the more classic startup security method is the TrustZone security boot method for the ARM instruction set: by implementing a trust chain mechanism, starting from the first power-on procedure, each loaded component will verify the subsequent one or Trustworthiness and integrity of multiple modules and loading them without detecting anomalies. However, on the one hand, the startup security mechanism of TrustZone does not emphasize hardware-level protection; on the other hand, for RISC-V processors, there are still many factors that need to be considered in the actual trust chain design process, so it cannot be directly implemented. Corresponding transplantation.

Contents of the invention

The purpose of the present invention is to provide a startup verification scheme based on RISC-V architecture to address the deficiencies of the prior art.

The purpose of the present invention is specifically achieved by the following technical solutions: a startup verification scheme based on RISC-V architecture, comprising the steps of:

Step 1: constructing a system-on-chip SOC oriented to the RISC-V instruction set architecture, the system-on-chip SOC verifies the one-stage boot loader, and if the verification is successful, the one-stage boot loader is run;

Step 2: After the first-stage boot loader is run, the first-stage boot loader verifies the second-stage boot loader and the operating system kernel image. According to different loading sources, different verification methods are adopted, including three second-stage Startup verification method: local information digest verification method, remote transmission information digest verification method and local digital signature verification method.

Further, the specific actions of step 1 and step 2 are all implemented for the RISC-V instruction set architecture.

Further, the system-on-chip SOC runs on dedicated hardware independent of the central processing unit (CPU), and the dedicated hardware can use an information summary algorithm to complete the first-stage boot loader or the second-stage boot loader. Security verification to prevent it from being tampered with.

Further, the information digest algorithm includes MD5 or SHA-1 algorithm.

Further, the first step is specifically: after the device is powered on and before the central processing unit (CPU) runs, the system-on-chip SOC reads the corresponding code of the first-stage boot loader, and obtains the first-stage boot loader by using the information summary algorithm. The digest value of the loader is matched with the digest value pre-stored in the digest matching library. If the match is successful, the one-stage boot loader is allowed to run.

Further, the local information summary verification method described in step 2 is used for high security scenarios or high ecological closure scenarios, specifically, the first-stage boot loader reads the second-stage boot loader and the operating system kernel image from the local storage medium , and use the information digest algorithm to verify the loaded image. After the corresponding digest value is matched in the digest matching library, the two-stage boot loader is allowed to run, and then the operating system kernel image is started.

Further, the remote transmission information summary verification method described in step 2 is used for the application scenario where there is a need for remote unified startup and transmission, specifically, the first-stage boot loader receives the second-stage boot loader and the operating system kernel image from the network , and use the information digest algorithm to verify the loaded image. After matching the corresponding digest value in the digest matching library, the two-stage boot loader and the subsequent operating system kernel image are allowed to run.

Further, the local digital signature verification method described in step 2 is used to ensure the decoupling of software and hardware design under the premise of ensuring security to improve system flexibility, specifically:

Before the S1 device leaves the factory, the software provider uses its own private key to sign the two-stage boot loader and the operating system kernel image; the specific signing process is: first calculate the digest value of the two-stage boot loader and the operating system kernel image, and then use The 512-bit RSA private key encrypts the digest value, and the obtained ciphertext is the digital signature p;

S2 The software provider sends its own public key certificate, the second-stage boot loader, the operating system kernel image, and the digital signature p to the hardware provider, and the hardware provider stores the public key in the public key library, and the second-stage boot The loader, the operating system kernel image and the digital signature p are packaged and stored in the local storage medium;

When the S3 device is started, the first-stage boot loader reads the second-stage boot loader, the operating system kernel image and the corresponding digital signature p from the local storage medium, and uses the software provider's certificate pre-stored in the public key certificate store, Verify the digital signature p of the loaded image, so as to complete the identity verification of the software provider, and only the image that passes the signature verification is allowed to execute; the specific verification process is: the first-stage boot loader first uses the information of the packaged file, Select the corresponding software provider’s public key certificate from the public key library, and perform a real-time information digest calculation on the packaged file to generate an information digest m, and then use the public key in the corresponding public key certificate to decrypt the digital signature p to obtain the decrypted Information summary e, if m and e are consistent, the verification is passed.

The beneficial effects of the present invention are as follows:

The method of the present invention aims at the problem of RISC-V startup security, and designs a set of software-hardware cooperative startup trust chain, which can complete the step-by-step protection of the multi-level startup process, and in the design of verification mechanisms at all levels, according to the application scenario Different, there is a trade-off between security and flexibility. In the context that the RISC-V architecture has not yet formed a recognized startup security solution, a set of feasible verification solutions for the RISC-V architecture is provided to improve the security defense capabilities of the system startup phase.

Description of drawings

Fig. 1 is a kind of flow chart of the startup verification scheme based on RISC-V architecture;

Fig. 2 is a flowchart of a local digital signature verification method.

Detailed ways

As shown in Figure 1, the present invention proposes a startup verification scheme based on RISC-V architecture, including the following steps:

The first stage boot loader (First Stage Bootloader) is the first piece of code run by the central processing unit (CPU), which is related to the safety of the entire device and is one of the security foundations of the device; the first stage boot loader is solidified In the read-only storage hardware; in order to ensure that the integrity of the one-stage boot loader is not destroyed, add special hardware to check the integrity of the code in the device, and build a system-on-chip SOC on the special hardware for Verify the integrity of the one-stage boot loader.

The system-on-chip SOC runs on proprietary hardware independent of the central processing unit (CPU), and the proprietary hardware is functionally able to complete the first-stage boot loader or the second-stage boot loader using an information digest algorithm. In terms of performance, it uses a three-stage pipeline mechanism of memory access, buffering, and calculation. Before the verification is passed, the reset signal of the central processing unit (CPU) is locked. Only when the verification is passed, it matches the pre-sealed Only read-only digests of information stored in hardware are allowed to boot.

The information digest algorithm includes MD5 or SHA-1 algorithm, which extracts fingerprint information for all data to realize functions such as data integrity verification; the main feature of the message digest algorithm is that the encryption process does not require a key, and the obtained The data (summary value) cannot be decrypted, and the same digest value can only be obtained by entering the same plaintext data through the same message digest algorithm.

Step 1 is specifically realized through the following sub-steps:

(1.1) Before the device leaves the factory, the MD5 or SHA-1 digest value of the first-stage boot loader is calculated by the read-only storage hardware provider and stored in the digest value matching library.

(1.2) After the device is powered on and before the central processing unit (CPU) runs, the system-on-chip SOC running on the proprietary hardware reads the corresponding code of the one-stage bootloader, and uses the information summary algorithm to obtain the one-stage boot The digest value of the loader. Match the obtained digest value with the digest value pre-stored in the digest matching library. If the match is successful, the one-stage bootloader is allowed to run.

Step 2: After the first-stage boot loader is run, the first-stage boot loader verifies the second-stage boot loader and the operating system kernel image. According to different loading sources, different verification methods are adopted, including three second-stage Startup verification method: local information digest verification method, remote transmission information digest verification method and local digital signature verification method;

The second-stage boot loader (Second Stage Boot Loader) is the code loaded and executed by the first-stage boot loader, and is mainly used to further initialize necessary equipment hardware and guide the startup of the system kernel. During the secure boot process, it is generally verified by a one-stage boot loader.

The operating system kernel image is exactly the clone file of all data installed on the CD by the operating system, including all the content needed for an operating system to run; here the operating system kernel image is packaged and stored with the second-stage boot loader, reducing system An authentication step during the boot process, thereby enhancing security during the boot process.

The three two-stage startup verification methods are as follows:`

(2.1) The local information summary verification method is used for high security scenarios or high ecological closure scenarios. Specifically, the first-stage boot loader reads the second-stage boot loader and the operating system kernel image from the local storage medium, and uses the information summary The algorithm verifies the loaded image. The verification method is similar to step 1. After the corresponding digest value is matched in the digest matching library, the second-stage boot loader is allowed to run, and then the operating system kernel image is started;

The high-security scenario refers to devices and application scenarios that require extremely high security, such as related devices in aerospace and finance.

The high ecological closure scenario refers to a device with a closed operating environment that does not or rarely interacts with the outside world, such as electronic tokens. This type of device is characterized in that no firmware update is required from delivery to recycling and destruction.

(2.2) The remote transmission information summary verification method is used for application scenarios that require unified remote startup and transmission. Specifically, the first-stage boot loader receives the second-stage boot loader and operating system kernel image from the network, and uses the information summary The algorithm verifies the loaded image, and the second-stage boot loader and the subsequent operating system kernel image are allowed to run only after matching the corresponding digest value in the digest matching library;

The application scenario of the remote unified startup and transmission requirements refers to the application scenario of the terminal device being started by the control center and transmitting the firmware through the network. Such terminal devices often have no or very little local storage, and their startup needs to obtain firmware from outside. This mode is generally used in scenarios that require highly centralized and unified management of terminal devices.

(2.3) The local digital signature verification method is used to ensure the decoupling of software and hardware design under the premise of ensuring security to improve system flexibility. As shown in Figure 2, it specifically includes the following steps:

When the S3 device starts, the first-stage boot loader reads the second-stage boot loader, the operating system kernel image, and the corresponding digital signature from the local storage medium, and uses the certificate of the software provider pre-stored in the public key certificate library to The digital signature of the loaded image is verified to complete the identity verification of the software provider, and only the image that passes the signature verification is allowed to execute. The specific verification process is as follows: the first-stage boot loader first uses the information of the packaged file to select the corresponding software provider’s public key certificate from the public key storehouse, and performs a real-time information summary calculation on the packaged file to generate an information summary m, and then uses The digital signature p is decrypted corresponding to the public key in the public key certificate, and the decrypted information digest e is obtained. If m and e are consistent, the verification is passed.

The specific actions of the step 1 and step 2 are implemented for the RISC-V instruction set architecture.

Considering that the remote start of the network may bring complex security issues, the present invention strictly limits the verification method of the remote start of the network to the method of verifying the abstract of the remote transmission information.

Those of ordinary skill in the art can understand that the above description is only a single example of the invention, and is not intended to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, for those skilled in the art, it can still be understood. The technical methods recorded in the foregoing examples are modified, or some technical features are replaced equivalently. All modifications, equivalent replacements, etc. within the spirit and principles of the invention shall be included in the scope of protection of the invention.

Claims

A kind of startup verification scheme based on RISC-V architecture, it is characterized in that, comprising the following steps:

Step 1: constructing a system-on-chip SOC oriented to the RISC-V instruction set architecture, the system-on-chip SOC verifies the one-stage boot loader, and if the verification is successful, the one-stage boot loader is run;

Step 2: After the first-stage boot loader is run, the first-stage boot loader verifies the second-stage boot loader and the operating system kernel image. According to different loading sources, different verification methods are adopted, including three second-stage Startup verification method: local information digest verification method, remote transmission information digest verification method and local digital signature verification method.
A startup verification scheme based on RISC-V architecture according to claim 1, characterized in that the specific actions in step 1 and step 2 are all implemented for RISC-V instruction set architecture.
A kind of startup verification scheme based on RISC-V architecture according to claim 1, characterized in that, said system-on-chip SOC runs on proprietary hardware independent of central processing unit (CPU), said proprietary hardware There is hardware capable of verifying the integrity of a one-stage boot loader or two-stage boot loader using a message digest algorithm to prevent it from being tampered with.
The startup verification scheme based on RISC-V architecture according to claim 3, wherein the information digest algorithm includes MD5 or SHA-1 algorithm.
A startup verification scheme based on RISC-V architecture according to claim 1, wherein said step 1 is specifically: after the device is powered on and before the central processing unit (CPU) runs, the system-on-chip The SOC reads the corresponding code of the first-stage boot loader, uses the information summary algorithm to obtain the summary value of the first-stage boot loader, and matches the obtained summary value with the summary value pre-stored in the summary matching library. If the match is successful, then One-stage boot loaders are allowed to run.
A kind of startup verification scheme based on RISC-V architecture according to claim 1, characterized in that, the local information summary verification method described in step 2 is used for high security scenarios or high ecological closure scenarios, specifically a The stage boot loader reads the second-stage boot loader and the operating system kernel image from the local storage medium, and uses the information digest algorithm to verify the loaded image. After matching the corresponding digest value in the digest matching library, the second-stage boot The loader is allowed to run, and then the operating system kernel image is started.
A startup verification scheme based on RISC-V architecture according to claim 1, characterized in that, the remote transmission information digest verification method described in step 2 is used for application scenarios where remote unified startup and transmission requirements exist, Specifically, the first-stage boot loader receives the second-stage boot loader and the operating system kernel image from the network, and uses the information digest algorithm to verify the loaded image. After matching the corresponding digest value in the digest matching library, the second-stage boot The loader and subsequent operating system kernel images are allowed to run.
A kind of startup verification scheme based on RISC-V architecture according to claim 1, characterized in that, the local digital signature verification method described in step 2 is aimed at ensuring the decoupling of software and hardware design under the premise of ensuring safety. The situation to improve the flexibility of the system is used, specifically:

Before the S1 device leaves the factory, the software provider uses its own private key to sign the two-stage boot loader and the operating system kernel image; the specific signing process is: first calculate the digest value of the two-stage boot loader and the operating system kernel image, and then use The 512-bit RSA private key encrypts the digest value, and the obtained ciphertext is the digital signature p;

S2 The software provider sends its own public key certificate, the second-stage boot loader, the operating system kernel image, and the digital signature p to the hardware provider, and the hardware provider stores the public key in the public key library, and the second-stage boot The loader, the operating system kernel image and the digital signature p are packaged and stored in the local storage medium;

When the S3 device is started, the first-stage boot loader reads the second-stage boot loader, the operating system kernel image and the corresponding digital signature p from the local storage medium, and uses the software provider's certificate pre-stored in the public key certificate store, Verify the digital signature p of the loaded image, so as to complete the identity verification of the software provider, and only the image that passes the signature verification is allowed to execute; the specific verification process is: the first-stage boot loader first uses the information of the packaged file, Select the corresponding software provider’s public key certificate from the public key library, and perform a real-time information digest calculation on the packaged file to generate an information digest m, and then use the public key in the corresponding public key certificate to decrypt the digital signature p to obtain the decrypted Information summary e, if m and e are consistent, the verification is passed.