CN108229173A - The method and device that system starts - Google Patents
The method and device that system starts Download PDFInfo
- Publication number
- CN108229173A CN108229173A CN201611146818.XA CN201611146818A CN108229173A CN 108229173 A CN108229173 A CN 108229173A CN 201611146818 A CN201611146818 A CN 201611146818A CN 108229173 A CN108229173 A CN 108229173A
- Authority
- CN
- China
- Prior art keywords
- digital signature
- operating system
- rom
- read
- partitioning
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/575—Secure boot
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/4401—Bootstrapping
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/445—Program loading or initiating
- G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Stored Programmes (AREA)
- Storage Device Security (AREA)
Abstract
The disclosure is directed to the method and device that a kind of system starts, for improving the safety of operating system.The method includes：Run operating system read-only memory bootstrap；System partitioning verification information is preset in the operating system read-only memory bootstrap；Pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system；By traversing the system partitioning, safety verification is carried out to operating system using the system partitioning verification information；Safety verification by when, start-up operation system.
Description
Technical field
This disclosure relates to communicate and method and device that computer disposal field more particularly to system start.
Background technology
With the development of electronic technology, mobile terminal is commonly used.Major mobile terminal manufacturer all releases more every year
The mobile terminal of a model.Operating system is the core of mobile terminal.The safety of operating system also becomes the coke paid close attention in the industry
Point.
Invention content
To overcome the problems in correlation technique, the disclosure provides the method and device that a kind of system starts.
According to the embodiment of the present disclosure in a first aspect, provide a kind of method that system starts, including：
Run operating system read-only memory bootstrap；System partitioning verification letter is preset in the operating system read-only memory bootstrap
Breath；
Pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system；
By traversing the system partitioning, safety verification is carried out to operating system using the system partitioning verification information；
Safety verification by when, start-up operation system.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment is in start-up operation system
Safety verification, the start-up operation system when being verified are carried out to operating system using the system partitioning verification information before system
System increases the safety of operating system, reduces the possibility that operating system is tampered.
In one embodiment, it is described by traversing the system partitioning, using the system partitioning verification information to behaviour
Make system and carry out safety verification, including：
By traversing the system partitioning, the first digital signature is generated according to operating system；
By first digital signature of generation and the second digital signature matches；The system partitioning verification information is described
Second digital signature；
When first digital signature of generation is consistent with the second digital signature matches, determine that safety verification passes through.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment is in Ergodic Theory point
The first digital signature is generated while area, improves treatment effeciency.So that verification process to startup time of operating system almost
Without influence.
In one embodiment, it is described that first digital signature is generated according to operating system, including：
First digital signature is generated according to the file location information of operating system；
The system partitioning verification information is the number generated previously according to initial release operating system file location information
Signature, i.e. the second digital signature.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment passes through operating system
File location information generate the first digital signature, can simplify generation the first digital signature process, and by position whether
Modification can also check whether operating system has and be changed, and improve safety.
In one embodiment, second digital signature is stored in the system partitioning where operating system.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment signs the second number
Name is stored in system partitioning, that is, the second digital signature is read when facilitating verification, and facilitates and the is updated in operating system update
Two digital signature.
In one embodiment, before operating system read-only memory bootstrap is run, the method further includes：
Run ROM programs；
By running ROM programs, ROM subregions are traversed；ROM subregion verification informations are preset in the ROM programs；
By traversing ROM subregions, safety is carried out to operating system read-only memory bootstrap using the ROM subregions verification information
Verification；
Safety verification by when, start the operating system read-only memory bootstrap.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment is in start-up operation system
Read-only memory bootstrap of uniting carries out safety verification, the start-up operation system when being verified to operating system read-only memory bootstrap before
Read-only memory bootstrap increases the safety of operating system read-only memory bootstrap, reduces what operating system read-only memory bootstrap was tampered
It may.
In one embodiment, it is described by traversing ROM subregions, safety verification is carried out to operating system read-only memory bootstrap,
Including：
By traversing the ROM subregions, third digital signature is generated according to operating system read-only memory bootstrap；
By the third digital signature of generation and the 4th digital signature matches；The ROM subregions verification information is described
4th digital signature；
When the third digital signature of generation is consistent with the 4th digital signature matches, determine that safety verification passes through.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment divides in traversal ROM
Third digital signature is generated while area, improves treatment effeciency.So that verification process to startup time of operating system almost
Without influence.
In one embodiment, it is described that third digital signature is generated according to operating system read-only memory bootstrap, including：
Third digital signature is generated according to the file location information of operating system read-only memory bootstrap；
The ROM subregions verification information is previously according to initial release operating system read-only memory bootstrap file location information
The digital signature of generation, i.e. the 4th digital signature.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment passes through operating system
The file location information generation third digital signature of read-only memory bootstrap, can simplify the process of generation third digital signature, and lead to
Whether can also check whether operating system read-only memory bootstrap have changed, improve safety if crossing position and change.
In one embodiment, the 4th digital signature is stored in ROM subregions.
The technical scheme provided by this disclosed embodiment can include the following benefits：The present embodiment signs the 4th number
Name is stored in system partitioning, that is, the 4th digital signature is read when facilitating verification, and facilitates and the is updated in operating system update
Four digital signature.
According to the second aspect of the embodiment of the present disclosure, the device that a kind of system starts is provided, including：
Load operating module, for running operating system read-only memory bootstrap；It is pre- in the operating system read-only memory bootstrap
It is equipped with system partitioning verification information；
System spider module, for passing through the system where the operating system read-only memory bootstrap traversing operation system point
Area；
System authentication module traverses the system partitioning for passing through, using the system partitioning verification information to operation
System carries out safety verification；
System starting module, for safety verification by when, start-up operation system.
In one embodiment, the system authentication module includes：
First generation submodule, the system partitioning is traversed for passing through, and the first digital signature is generated according to operating system；
First matched sub-block, for first digital signature and the second digital signature matches that will be generated；The system
Subregion verification information of uniting is second digital signature；
First determination sub-module, for when first digital signature of generation is consistent with the second digital signature matches,
Determine that safety verification passes through.
In one embodiment, the first generation submodule is according to the first number of the file location information of operating system generation
Word is signed；The system partitioning verification information is that the number generated previously according to initial release operating system file location information is signed
Name, i.e. the second digital signature.
In one embodiment, second digital signature is stored in the system partitioning where operating system.
In one embodiment, described device further includes：
ROM runs module, for running ROM programs；
ROM spider modules run ROM programs for passing through, and traverse ROM subregions；ROM points are preset in the ROM programs
Area's verification information；
Authentication module is loaded, ROM subregions are traversed for passing through, using the ROM subregions verification information to operating system ROM
Bootstrap carries out safety verification；
Load starting module, for safety verification by when, start the operating system read-only memory bootstrap.
In one embodiment, the loading authentication module includes：
Second generation submodule, the ROM subregions are traversed for passing through, according to operating system read-only memory bootstrap generation the
Three digital signature；
Second matched sub-block, for the third digital signature and the 4th digital signature matches that will be generated；The ROM
Subregion verification information is the 4th digital signature；
Second determination sub-module, for when the third digital signature of generation is consistent with the 4th digital signature matches,
Determine that safety verification passes through.
In one embodiment, the second generation submodule is believed according to the document location of operating system read-only memory bootstrap
Breath generation third digital signature；The ROM subregions verification information is previously according to initial release operating system read-only memory bootstrap text
The digital signature of part location information generation, i.e. the 4th digital signature.
In one embodiment, the 4th digital signature is stored in ROM subregions.
According to the third aspect of the embodiment of the present disclosure, the device that a kind of system starts is provided, including：
Processor；
For storing the memory of processor-executable instruction；
Wherein, the processor is configured as：
Run operating system read-only memory bootstrap；System partitioning verification letter is preset in the operating system read-only memory bootstrap
Breath；
Pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system；
By traversing the system partitioning, safety verification is carried out to operating system using the system partitioning verification information；
Safety verification by when, start-up operation system.
It should be understood that above general description and following detailed description are only exemplary and explanatory, not
The disclosure can be limited.
Description of the drawings
Attached drawing herein is incorporated into specification and forms the part of this specification, shows the implementation for meeting the disclosure
Example, and for explaining the principle of the disclosure together with specification.
Fig. 1 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment.
Fig. 2 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment.
Fig. 3 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment.
Fig. 4 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment.
Fig. 5 is the block diagram of the device started according to a kind of system shown in an exemplary embodiment.
Fig. 6 is the block diagram according to a kind of system authentication module shown in an exemplary embodiment.
Fig. 7 is the block diagram of the device started according to a kind of system shown in an exemplary embodiment.
Fig. 8 is the block diagram according to a kind of loading authentication module shown in an exemplary embodiment.
Fig. 9 is the block diagram according to a kind of device shown in an exemplary embodiment.
Figure 10 is the block diagram according to a kind of device shown in an exemplary embodiment.
Specific embodiment
Here exemplary embodiment will be illustrated in detail, example is illustrated in the accompanying drawings.Following description is related to
During attached drawing, unless otherwise indicated, the same numbers in different attached drawings represent the same or similar element.Following exemplary embodiment
Described in embodiment do not represent all embodiments consistent with the disclosure.On the contrary, they be only with it is such as appended
The example of the consistent device and method of some aspects be described in detail in claims, the disclosure.
In the relevant technologies, mobile terminal first installs ROM (firmware code memory) program of factory's version, factory before manufacture
The operating system of the operating system read-only memory bootstrap (bootloader) of version and factory's version.Startup test is carried out to operating system,
If can start, test passes through.After test passes through, the ROM programs of formal version, the operating system ROM of formal version are reinstalled
The operating system of bootstrap and formal version.
Wherein, the operating system read-only memory bootstrap of the ROM programs of factory's version and factory's version is all scaled-down version, is only verified
Whether operating system can start, and not carry out safety inspection to operating system.The set system is possible to illegally be usurped and pacified by other people
Dress, safety be not high.
To solve the problems, such as this, embodiment adds the verification process to operating system, to improve safety, reduce by him
The possibility that people usurps and distorts.
Fig. 1 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment, as shown in Figure 1, should
Method can be realized by mobile terminal, be included the following steps：
In a step 101, operating system read-only memory bootstrap is run.It is preset in the operating system read-only memory bootstrap and is
System subregion verification information.
In a step 102, pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system.
In step 103, by traversing the system partitioning, using the system partitioning verification information to operating system into
Row safety verification.
At step 104, safety verification by when, start-up operation system.
Safety verification not by when, not start-up operation system can send out alarm prompt or automatic shutdown etc..
The present embodiment improves operating system read-only memory bootstrap, is realized by operating system read-only memory bootstrap to operation
The safety verification of system.
The present embodiment runs operating system read-only memory bootstrap in mobile terminal-opening or when restarting.Pass through operating system
Read-only memory bootstrap using the system partitioning verification information to operating system carry out safety verification, safety verification by when open
Dynamic operating system.Improve safety.If other people ripping operation systems, safety verification can not be passed through.If be tampered, also without
Method passes through safety verification.Also, the present embodiment is to operation using the system partitioning verification information in Ergodic Theory subregion
System carries out safety verification, and two processes, which synchronize, to be carried out, and the startup time of operating system is had little influence on.Improve processing effect
Rate.
In one embodiment, step 103 includes：Step A1- steps A3.
In step A1, by traversing the system partitioning, the first digital signature is generated according to operating system.
In step A2, by first digital signature of generation and the second digital signature matches.The system partitioning is tested
Card information is second digital signature.
In step A3, when first digital signature of generation is consistent with the second digital signature matches, safety is determined
It is verified.
In the present embodiment, in installation operation system, operating system is packaged.While being packaged, the second number of generation
Signature.By the second digital signature and the equal writing system subregion of operating system being packaged.Mobile terminal-opening or when restarting, traversal system
System subregion, checks whether the data of operating system are complete.Meanwhile Ergodic Theory subregion is also the mistake for generating the first digital signature
Journey.First digital signature of generation is matched with pre-stored second digital signature.If matching is consistent, safety is tested
Card passes through.It can be with start-up operation system.If matching is inconsistent, safety verification failure, not start-up operation system can be automatic
Shutdown etc..It, will be with second according to the first digital signature that the operating system after distorting is generated if operating system is tampered
Digital signature matches are inconsistent.Therefore, the present embodiment can improve safety, can find to be tampered, and prevent it from normal in time
It uses.
In one embodiment, step A1 includes：
First digital signature is generated according to the file location information of operating system；
The system partitioning verification information is the number generated previously according to initial release operating system file location information
Signature, i.e. the second digital signature.
The present embodiment generates the first digital signature by the file location information of operating system, can simplify the first number of generation
The process of signature, and whether changed by position and can also check whether operating system has and changed, improve safety.
In one embodiment, step A1 includes：Step A11.
In step A11, according to operating system and existing first public key, the first digital signature is generated.
The present embodiment uses rivest, shamir, adelman.In installation operation system, according to preset first private key and operation
System generates the second digital signature.In safety verification, according to operating system and existing first public key, the first number of generation
Signature.So that the first digital signature and the second digital signature improve safety by encryption, reduce be tampered can
Energy.Even if being tampered, also can safety verification do not pass through.
In one embodiment, first public key and second digital signature are stored in the system where operating system
Subregion.
Operating system can be constantly updated in the later stage, it is therefore desirable to regenerate the second number according to updated operating system
Signature, so that safety verification can be normally carried out after operating system update.Second digital signature is stored in system partitioning, is convenient for
The update of second digital signature.
In one embodiment, before operating system read-only memory bootstrap is run, the method further includes：Step B1- is walked
Rapid B4.
In step bl is determined, ROM programs are run.
In step B2, by running ROM programs, ROM subregions are traversed.The verification of ROM subregions is preset in the ROM programs
Information.
In step B3, by traversing ROM subregions, using the ROM subregions verification information to operating system rom boot journey
Sequence carries out safety verification.
In step B4, safety verification by when, start the operating system read-only memory bootstrap.
The embodiment of front realizes the safety verification to operating system.In order to further improve the security, the present embodiment
ROM programs are improved, the safety verification to operating system read-only memory bootstrap is realized by ROM programs.The present embodiment is in movement
Starting up of terminal or after restarting, also carries out safety verification to operating system read-only memory bootstrap.By ROM programs to operating system ROM
Bootstrap carry out safety verification, safety verification by when start-up operation system read-only memory bootstrap.Improve safety.Such as
Other people ripping operation system read-only memory bootstraps of fruit, can not pass through safety verification.If be tampered, it can not also pass through safety verification.
Also, the present embodiment carries out safety verification, two same steppings of process when traversing ROM subregions to operating system read-only memory bootstrap
Row, has little influence on the startup time of operating system read-only memory bootstrap.Improve treatment effeciency.
In one embodiment, step B3 includes：Step B31- steps B33.
In step B31, by traversing the ROM subregions, third number label are generated according to operating system read-only memory bootstrap
Name.
In step B32, by the third digital signature of generation and the 4th digital signature matches.The ROM subregions are tested
Card information is the 4th digital signature.
In step B33, when the third digital signature of generation is consistent with the 4th digital signature matches, safety is determined
It is verified.
In the present embodiment, in installation operation system read-only memory bootstrap, operating system read-only memory bootstrap is packaged.It is beating
While packet, the 4th digital signature is generated.By the 4th digital signature and the burned ROM of operating system read-only memory bootstrap being packaged
Subregion.Mobile terminal-opening or when restarting, traverses ROM subregions, checks whether the data of operating system read-only memory bootstrap are complete.
Meanwhile it is also the process for generating third digital signature to traverse ROM subregions.By the third digital signature of generation and pre-stored the
Four digital signature are matched.If matching is consistent, safety verification passes through.It can be with start-up operation system read-only memory bootstrap.Such as
Fruit matching is inconsistent, then safety verification fails, and not start-up operation system read-only memory bootstrap can be with automatic shutdown etc..If operation
System read-only memory bootstrap is tampered, then the third digital signature that the operating system read-only memory bootstrap after basis is distorted is generated will
It is inconsistent with the 4th digital signature matches.Therefore, the present embodiment can improve safety, can find to be tampered, and make it not in time
It can normal use.
In one embodiment, step B31 includes：
Third digital signature is generated according to the file location information of operating system read-only memory bootstrap；
The ROM subregions verification information is previously according to initial release operating system read-only memory bootstrap file location information
The digital signature of generation, i.e. the 4th digital signature.
In one embodiment, step B31 includes：Step B311.
In step B311, according to operating system read-only memory bootstrap and existing second public key, third number label are generated
Name.
The present embodiment uses rivest, shamir, adelman.In installation operation system, according to preset second private key and operation
System read-only memory bootstrap generates the 4th digital signature.It is raw according to operating system and existing second public key in safety verification
Into third digital signature.So that third digital signature and the 4th digital signature improve safety by encryption, reduce
The possibility being tampered.Even if being tampered, also can safety verification do not pass through.
In one embodiment, second public key and the 4th digital signature are stored in ROM subregions.
Operating system read-only memory bootstrap does not update generally in the later stage, therefore the 4th digital signature will not update.By second
Public key and the 4th digital signature are stored in ROM subregions, not easily modified.Improve safety.
Realization process is discussed in detail below by several embodiments.
Fig. 2 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment, as shown in Fig. 2, should
Method can be realized by mobile terminal, be included the following steps：
In step 201, operating system read-only memory bootstrap is run.
In step 202, pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system.
In step 203, by traversing the system partitioning, the first digital signature is generated according to operating system.
In step 204, by first digital signature of generation and the second digital signature matches.Described the of generation
When one digital signature is consistent with the second digital signature matches, determine that safety verification passes through.Safety verification by when, continue step
205；Safety verification not by when, continue step 206.
In step 205, start-up operation system.
In step 206, not start-up operation system, automatic shutdown.
Fig. 3 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment, as shown in figure 3, should
Method can be realized by mobile terminal, be included the following steps：
In step 301, ROM programs are run.
In step 302, by running ROM programs, ROM subregions are traversed.
In step 303, by traversing ROM subregions, safety verification is carried out to operating system read-only memory bootstrap.In safety
It is obstructed out-of-date to verify, continues step 304；Safety verification by when, continue step 305.
In step 304, not start-up operation system read-only memory bootstrap, automatic shutdown.
In step 305, start the operating system read-only memory bootstrap.
Within step 306, operating system read-only memory bootstrap is run.
In step 307, pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system.
In step 308, by traversing the system partitioning, according to operating system and existing first public key, generation the
One digital signature.
In a step 309, by first digital signature of generation and the second digital signature matches.Described the of generation
When one digital signature is consistent with the second digital signature matches, determine that safety verification passes through.Safety verification by when, continue step
310；Safety verification not by when, continue step 311.
In the step 310, start-up operation system.
In step 311, not start-up operation system, automatic shutdown.
Fig. 4 is the flow chart of the method started according to a kind of system shown in an exemplary embodiment, as shown in figure 4, should
Method can be realized by mobile terminal, be included the following steps：
In step 401, ROM programs are run.
In step 402, by running ROM programs, ROM subregions are traversed.
In step 403, by traversing the ROM subregions, third number label are generated according to operating system read-only memory bootstrap
Name.
In step 404, by the third digital signature of generation and the 4th digital signature matches.Described the of generation
When three digital signature are consistent with the 4th digital signature matches, determine that safety verification passes through.In the third digital signature of generation
With the 4th digital signature matches it is inconsistent when, determine that safety verification does not pass through.It is obstructed out-of-date in safety verification, continue step 405；
Safety verification by when, continue step 406.
In step 405, not start-up operation system read-only memory bootstrap, automatic shutdown.
In a step 406, start the operating system read-only memory bootstrap.
In step 407, operating system read-only memory bootstrap is run.
In a step 408, pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system.
In step 409, by traversing the system partitioning, using the system partitioning verification information to operating system into
Row safety verification.Safety verification by when, continue step 410；Safety verification not by when, continue step 411.
In step 410, start-up operation system.
In step 411, not start-up operation system, automatic shutdown.
Above-described embodiment can carry out various combinations according to actual needs.
By the realization process described above for having understood system and having started, which is realized by mobile terminal or computer, under
Face is introduced for the internal structure and function of equipment.
Fig. 5 is the schematic device started according to a kind of system shown in an exemplary embodiment.With reference to Fig. 5, the device
Including：Load operating module 501, system spider module 502, system authentication module 503 and system starting module 504.
Load operating module 501, for running operating system read-only memory bootstrap.In the operating system read-only memory bootstrap
Preset system partitioning verification information.
System spider module 502, for passing through the system where the operating system read-only memory bootstrap traversing operation system
Subregion.
System authentication module 503 traverses the system partitioning for passing through, using the system partitioning verification information to behaviour
Make system and carry out safety verification.
System starting module 504, for safety verification by when, start-up operation system.
In one embodiment, as shown in fig. 6, the system authentication module 503 includes：First generation submodule 601, the
One matched sub-block 602 and the first determination sub-module 603.
First generation submodule 601, the system partitioning is traversed for passing through, and is signed according to the first number of operating system generation
Name.
First matched sub-block 602, for first digital signature and the second digital signature matches that will be generated.It is described
System partitioning verification information is second digital signature.
First determination sub-module 603, it is consistent with the second digital signature matches for first digital signature in generation
When, determine that safety verification passes through.
In one embodiment, the first generation submodule 601 is according to the file location information of operating system generation the
One digital signature；The system partitioning verification information is the number generated previously according to initial release operating system file location information
Word is signed, i.e. the second digital signature.
In one embodiment, the first generation submodule 601 is according to operating system and existing first public key, generation
First digital signature.
In one embodiment, second digital signature is stored in the system partitioning where operating system.
In one embodiment, as shown in fig. 7, described device further includes：ROM operations module 701, ROM spider modules
702nd, authentication module 703 and loading starting module 704 are loaded.
ROM runs module 701, for running ROM programs.
ROM spider modules 702 run ROM programs for passing through, and traverse ROM subregions.ROM is preset in the ROM programs
Subregion verification information.
Authentication module 703 is loaded, ROM subregions are traversed for passing through, carrying out safety to operating system read-only memory bootstrap tests
Card.
Load starting module 704, for safety verification by when, start the operating system read-only memory bootstrap.
In one embodiment, as shown in figure 8, the loading authentication module 703 includes：Second generation submodule 801, the
Two matched sub-blocks 802 and the second determination sub-module 803.
Second generation submodule 801, traverses the ROM subregions for passing through, is generated according to operating system read-only memory bootstrap
Third digital signature.
Second matched sub-block 802, for the third digital signature and the 4th digital signature matches that will be generated.It is described
ROM subregions verification information is the 4th digital signature.
Second determination sub-module 803, it is consistent with the 4th digital signature matches for the third digital signature in generation
When, determine that safety verification passes through.
In one embodiment, described second document location of the submodule 801 according to operating system read-only memory bootstrap is generated
Information generates third digital signature；The ROM subregions verification information is previously according to initial release operating system read-only memory bootstrap
The digital signature of file location information generation, i.e. the 4th digital signature.
In one embodiment, the second generation submodule 801 is according to operating system read-only memory bootstrap and existing the
Two public keys generate third digital signature.
In one embodiment, the 4th digital signature is stored in ROM subregions.
About the device in above-described embodiment, wherein modules perform the concrete mode of operation in related this method
Embodiment in be described in detail, explanation will be not set forth in detail herein.
Fig. 9 is the block diagram according to a kind of device 900 started for system shown in an exemplary embodiment.For example, dress
It can be mobile phone to put 900, computer, digital broadcast terminal, messaging devices, game console, tablet device, medical treatment
Equipment, body-building equipment, personal digital assistant etc..
With reference to Fig. 9, device 900 can include following one or more components：Processing component 902, memory 904, power supply
Component 906, multimedia component 908, audio component 910, the interface 912 of input/output (I/O), sensor module 914 and
Communication component 916.
The integrated operation of 902 usual control device 900 of processing component, such as with display, call, data communication, phase
Machine operates and record operates associated operation.Processing component 902 can refer to including one or more processors 920 to perform
It enables, to perform all or part of the steps of the methods described above.In addition, processing component 902 can include one or more modules, just
Interaction between processing component 902 and other assemblies.For example, processing component 902 can include multi-media module, it is more to facilitate
Interaction between media component 908 and processing component 902.
Memory 904 is configured as storing various types of data to support the operation in device 900.These data are shown
Example includes the instruction of any application program or method for being operated on device 900, contact data, and telephone book data disappears
Breath, picture, video etc..Memory 904 can be by any kind of volatibility or non-volatile memory device or their group
It closes and realizes, such as static RAM (SRAM), electrically erasable programmable read-only memory (EEPROM) is erasable to compile
Journey read-only memory (EPROM), programmable read only memory (PROM), read-only memory (ROM), magnetic memory, flash
Device, disk or CD.
Power supply module 906 provides power supply for the various assemblies of device 900.Power supply module 906 can include power management system
System, one or more power supplys and other generate, manage and distribute power supply associated component with for device 900.
Multimedia component 908 is included in the screen of one output interface of offer between described device 900 and user.One
In a little embodiments, screen can include liquid crystal display (LCD) and touch panel (TP).If screen includes touch panel, screen
Curtain may be implemented as touch screen, to receive input signal from the user.Touch panel includes one or more touch sensings
Device is to sense the gesture on touch, slide, and touch panel.The touch sensor can not only sense touch or sliding action
Boundary, but also detect duration and pressure associated with the touch or slide operation.In some embodiments, more matchmakers
Body component 908 includes a front camera and/or rear camera.When device 900 is in operation mode, such as screening-mode or
During video mode, front camera and/or rear camera can receive external multi-medium data.Each front camera and
Rear camera can be a fixed optical lens system or have focusing and optical zoom capabilities.
Audio component 910 is configured as output and/or input audio signal.For example, audio component 910 includes a Mike
Wind (MIC), when device 900 is in operation mode, during such as call model, logging mode and speech recognition mode, microphone by with
It is set to reception external audio signal.The received audio signal can be further stored in memory 904 or via communication set
Part 916 is sent.In some embodiments, audio component 910 further includes a loud speaker, for exports audio signal.
I/O interfaces 912 provide interface between processing component 902 and peripheral interface module, and above-mentioned peripheral interface module can
To be keyboard, click wheel, button etc..These buttons may include but be not limited to：Home button, volume button, start button and lock
Determine button.
Sensor module 914 includes one or more sensors, and the state for providing various aspects for device 900 is commented
Estimate.For example, sensor module 914 can detect opening/closed state of device 900, and the relative positioning of component, for example, it is described
Component is the display and keypad of device 900, and sensor module 914 can be with detection device 900 or a group of device 900
The position change of part, the existence or non-existence that user contacts with device 900,900 orientation of device or acceleration/deceleration and device 900
Temperature change.Sensor module 914 can include proximity sensor, be configured to examine without any physical contact
Survey presence of nearby objects.Sensor module 914 can also include optical sensor, such as CMOS or ccd image sensor, for
It is used in imaging applications.In some embodiments, which can also include acceleration transducer, and gyroscope passes
Sensor, Magnetic Sensor, pressure sensor or temperature sensor.
Communication component 916 is configured to facilitate the communication of wired or wireless way between device 900 and other equipment.Device
900 can access the wireless network based on communication standard, such as WiFi, 2G or 3G or combination thereof.In an exemplary implementation
In example, communication component 916 receives broadcast singal or broadcast related information from external broadcasting management system via broadcast channel.
In one exemplary embodiment, the communication component 916 further includes near-field communication (NFC) module, to promote short range communication.Example
Such as, NFC module can be based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra wide band (UWB) technology,
Bluetooth (BT) technology and other technologies are realized.
In the exemplary embodiment, device 900 can be believed by one or more application application-specific integrated circuit (ASIC), number
Number processor (DSP), digital signal processing appts (DSPD), programmable logic device (PLD), field programmable gate array
(FPGA), controller, microcontroller, microprocessor or other electronic components are realized, for performing the above method.
In the exemplary embodiment, a kind of non-transitorycomputer readable storage medium including instructing, example are additionally provided
Such as include the memory 904 of instruction, above-metioned instruction can be performed to complete the above method by the processor 920 of device 900.For example,
The non-transitorycomputer readable storage medium can be ROM, random access memory (RAM), CD-ROM, tape, floppy disk
With optical data storage devices etc..
The device that a kind of system starts, including：
Processor；
For storing the memory of processor-executable instruction；
Wherein, the processor is configured as：
Run operating system read-only memory bootstrap；System partitioning verification letter is preset in the operating system read-only memory bootstrap
Breath；
Pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system；
By traversing the system partitioning, safety verification is carried out to operating system using the system partitioning verification information；
Safety verification by when, start-up operation system.
The processor can be additionally configured to：
It is described by traversing the system partitioning, using the system partitioning verification information to operating system carry out safety test
Card, including：
By traversing the system partitioning, the first digital signature is generated according to operating system；
By first digital signature of generation and the second digital signature matches；The system partitioning verification information is described
Second digital signature；
When first digital signature of generation is consistent with the second digital signature matches, determine that safety verification passes through.
The processor can be additionally configured to：
It is described that first digital signature is generated according to operating system, including：
First digital signature is generated according to the file location information of operating system；
The system partitioning verification information is the number generated previously according to initial release operating system file location information
Signature, i.e. the second digital signature.
The processor can be additionally configured to：
Second digital signature is stored in the system partitioning where operating system.
The processor can be additionally configured to：
Before operating system read-only memory bootstrap is run, the method further includes：
Run ROM programs；
By running ROM programs, ROM subregions are traversed；ROM subregion verification informations are preset in the ROM programs；
By traversing ROM subregions, safety is carried out to operating system read-only memory bootstrap using the ROM subregions verification information
Verification；
Safety verification by when, start the operating system read-only memory bootstrap.
The processor can be additionally configured to：
It is described that safety verification is carried out to operating system read-only memory bootstrap by traversing ROM subregions, including：
By traversing the ROM subregions, third digital signature is generated according to operating system read-only memory bootstrap；
By the third digital signature of generation and the 4th digital signature matches；The ROM subregions verification information is described
4th digital signature；
When the third digital signature of generation is consistent with the 4th digital signature matches, determine that safety verification passes through.
The processor can be additionally configured to：
It is described that third digital signature is generated according to operating system read-only memory bootstrap, including：
Third digital signature is generated according to the file location information of operating system read-only memory bootstrap；
The ROM subregions verification information is previously according to initial release operating system read-only memory bootstrap file location information
The digital signature of generation, i.e. the 4th digital signature.
The processor can be additionally configured to：
4th digital signature is stored in ROM subregions.
A kind of non-transitorycomputer readable storage medium, when the instruction in the storage medium is by the processing of mobile terminal
When device performs so that mobile terminal is able to carry out a kind of method that system starts, the method includes：
Run operating system read-only memory bootstrap；System partitioning verification letter is preset in the operating system read-only memory bootstrap
Breath；
Pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system；
By traversing the system partitioning, safety verification is carried out to operating system using the system partitioning verification information；
Safety verification by when, start-up operation system.
Instruction in the storage medium can also include：
It is described by traversing the system partitioning, using the system partitioning verification information to operating system carry out safety test
Card, including：
By traversing the system partitioning, the first digital signature is generated according to operating system；
By first digital signature of generation and the second digital signature matches；The system partitioning verification information is described
Second digital signature；
When first digital signature of generation is consistent with the second digital signature matches, determine that safety verification passes through.
Instruction in the storage medium can also include：
It is described that first digital signature is generated according to operating system, including：
First digital signature is generated according to the file location information of operating system；
The system partitioning verification information is the number generated previously according to initial release operating system file location information
Signature, i.e. the second digital signature.
Instruction in the storage medium can also include：
Second digital signature is stored in the system partitioning where operating system.
Instruction in the storage medium can also include：
Before operating system read-only memory bootstrap is run, the method further includes：
Run ROM programs；
By running ROM programs, ROM subregions are traversed；ROM subregion verification informations are preset in the ROM programs；
By traversing ROM subregions, safety is carried out to operating system read-only memory bootstrap using the ROM subregions verification information
Verification；
Safety verification by when, start the operating system read-only memory bootstrap.
Instruction in the storage medium can also include：
It is described that safety verification is carried out to operating system read-only memory bootstrap by traversing ROM subregions, including：
By traversing the ROM subregions, third digital signature is generated according to operating system read-only memory bootstrap；
By the third digital signature of generation and the 4th digital signature matches；The ROM subregions verification information is described
4th digital signature；
When the third digital signature of generation is consistent with the 4th digital signature matches, determine that safety verification passes through.
Instruction in the storage medium can also include：
It is described that third digital signature is generated according to operating system read-only memory bootstrap, including：
Third digital signature is generated according to the file location information of operating system read-only memory bootstrap；
The ROM subregions verification information is previously according to initial release operating system read-only memory bootstrap file location information
The digital signature of generation, i.e. the 4th digital signature.
Instruction in the storage medium can also include：
4th digital signature is stored in ROM subregions.
Figure 10 is the block diagram according to a kind of device 1000 started for system shown in an exemplary embodiment.For example,
Device 1000 may be provided as a computer.With reference to Figure 10, device 1000 includes processing component 1022, further comprises one
A or multiple processors and as the memory resource representated by memory 1032, can be by processing component 1022 for storing
The instruction of execution, such as application program.The application program stored in memory 1032 can include one or more every
One module for corresponding to one group of instruction.In addition, processing component 1022 is configured as execute instruction, to perform above method system
Start.
Device 1000 can also include a power supply module 1026 and be configured as the power management of executive device 1000, one
Wired or wireless network interface 1050 is configured as device 1000 being connected to network and input and output (I/O) interface
1058.Device 1000 can be operated based on the operating system for being stored in memory 1032, such as Windows ServerTM, Mac
OS XTM, UnixTM, LinuxTM, FreeBSDTM or similar.
Those skilled in the art will readily occur to the disclosure its after considering specification and putting into practice invention disclosed herein
Its embodiment.This application is intended to cover any variations, uses, or adaptations of the disclosure, these modifications, purposes or
Person's adaptive change follows the general principle of the disclosure and including the undocumented common knowledge in the art of the disclosure
Or conventional techniques.Description and embodiments are considered only as illustratively, and the true scope and spirit of the disclosure are by following
Claim is pointed out.
It should be understood that the present disclosure is not limited to the precise structures that have been described above and shown in the drawings, and
And various modifications and changes may be made without departing from the scope thereof.The scope of the present disclosure is only limited by appended claim.
Claims (17)
1. a kind of method that system starts, which is characterized in that including：
Run operating system read-only memory bootstrap；System partitioning verification information is preset in the operating system read-only memory bootstrap；
Pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system；
By traversing the system partitioning, safety verification is carried out to operating system using the system partitioning verification information；
Safety verification by when, start-up operation system.
2. the method that system according to claim 1 starts, which is characterized in that it is described by traversing the system partitioning,
Safety verification is carried out to operating system using the system partitioning verification information, including：
By traversing the system partitioning, the first digital signature is generated according to operating system；
By first digital signature of generation and the second digital signature matches；The system partitioning verification information is described second
Digital signature；
When first digital signature of generation is consistent with the second digital signature matches, determine that safety verification passes through.
3. the method that system according to claim 2 starts, which is characterized in that described according to the first number of operating system generation
Word is signed, including：
First digital signature is generated according to the file location information of operating system；
The system partitioning verification information is the digital signature generated previously according to initial release operating system file location information,
That is the second digital signature.
4. the method that system according to claim 3 starts, which is characterized in that second digital signature is stored in operation
System partitioning where system.
5. the method that system according to claim 1 starts, which is characterized in that in operation operating system read-only memory bootstrap
Before, the method further includes：
Run ROM programs；
By running ROM programs, ROM subregions are traversed；ROM subregion verification informations are preset in the ROM programs；
By traversing ROM subregions, safety verification is carried out to operating system read-only memory bootstrap using the ROM subregions verification information；
Safety verification by when, start the operating system read-only memory bootstrap.
6. the method that system according to claim 5 starts, which is characterized in that it is described by traversing ROM subregions, to operation
System read-only memory bootstrap carries out safety verification, including：
By traversing the ROM subregions, third digital signature is generated according to operating system read-only memory bootstrap；
By the third digital signature of generation and the 4th digital signature matches；The ROM subregions verification information is the described 4th
Digital signature；
When the third digital signature of generation is consistent with the 4th digital signature matches, determine that safety verification passes through.
7. the method that system according to claim 6 starts, which is characterized in that described according to operating system rom boot journey
Sequence generates third digital signature, including：
Third digital signature is generated according to the file location information of operating system read-only memory bootstrap；
The ROM subregions verification information is to be generated previously according to initial release operating system read-only memory bootstrap file location information
Digital signature, i.e. the 4th digital signature.
8. the method that system according to claim 7 starts, which is characterized in that the 4th digital signature is stored in ROM subregions.
9. a kind of device that system starts, which is characterized in that including：
Load operating module, for running operating system read-only memory bootstrap；It is preset in the operating system read-only memory bootstrap
System partitioning verification information；
System spider module, for passing through the system partitioning where the operating system read-only memory bootstrap traversing operation system；
System authentication module traverses the system partitioning for passing through, using the system partitioning verification information to operating system
Carry out safety verification；
System starting module, for safety verification by when, start-up operation system.
10. the device that system according to claim 9 starts, which is characterized in that the system authentication module includes：
First generation submodule, the system partitioning is traversed for passing through, and the first digital signature is generated according to operating system；
First matched sub-block, for first digital signature and the second digital signature matches that will be generated；The system point
Area's verification information is second digital signature；
First determination sub-module, for when first digital signature of generation is consistent with the second digital signature matches, determining
Safety verification passes through.
11. the device that system according to claim 10 starts, which is characterized in that the first generation submodule is according to behaviour
The file location information for making system generates the first digital signature；The system partitioning verification information is to be grasped previously according to initial release
Make the digital signature of system file locations information generation, i.e. the second digital signature.
12. the device that system according to claim 11 starts, which is characterized in that second digital signature is stored in behaviour
Make the system partitioning where system.
13. the device that system according to claim 9 starts, which is characterized in that described device further includes：
ROM runs module, for running ROM programs；
ROM spider modules run ROM programs for passing through, and traverse ROM subregions；ROM subregions are preset in the ROM programs to test
Demonstrate,prove information；
Authentication module is loaded, ROM subregions are traversed for passing through, using the ROM subregions verification information to operating system rom boot
Program carries out safety verification；
Load starting module, for safety verification by when, start the operating system read-only memory bootstrap.
14. the device that system according to claim 13 starts, which is characterized in that the loading authentication module includes：
Second generation submodule, the ROM subregions are traversed for passing through, and third number is generated according to operating system read-only memory bootstrap
Word is signed；
Second matched sub-block, for the third digital signature and the 4th digital signature matches that will be generated；The ROM subregions
Verification information is the 4th digital signature；
Second determination sub-module, for when the third digital signature of generation is consistent with the 4th digital signature matches, determining
Safety verification passes through.
15. the device that system according to claim 14 starts, which is characterized in that the second generation submodule is according to behaviour
Make the file location information generation third digital signature of system read-only memory bootstrap；The ROM subregions verification information be previously according to
The digital signature of initial release operating system read-only memory bootstrap file location information generation, i.e. the 4th digital signature.
16. the device that system according to claim 15 starts, which is characterized in that the 4th digital signature is stored in ROM points
Area.
17. a kind of device that system starts, which is characterized in that including：
Processor；
For storing the memory of processor-executable instruction；
Wherein, the processor is configured as：
Run operating system read-only memory bootstrap；System partitioning verification information is preset in the operating system read-only memory bootstrap；
Pass through the system partitioning where the operating system read-only memory bootstrap traversing operation system；
By traversing the system partitioning, safety verification is carried out to operating system using the system partitioning verification information；
Safety verification by when, start-up operation system.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611146818.XA CN108229173B (en) | 2016-12-13 | 2016-12-13 | System starting method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611146818.XA CN108229173B (en) | 2016-12-13 | 2016-12-13 | System starting method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108229173A true CN108229173A (en) | 2018-06-29 |
| CN108229173B CN108229173B (en) | 2022-08-19 |
Family
ID=62638184
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611146818.XA Active CN108229173B (en) | 2016-12-13 | 2016-12-13 | System starting method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108229173B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109542518A (en) * | 2018-10-09 | 2019-03-29 | 华为技术有限公司 | The method of chip and bootrom |
| CN110489963A (en) * | 2019-08-09 | 2019-11-22 | 四川虹美智能科技有限公司 | A kind of Android system smart machine guard method and device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104200153A (en) * | 2014-09-12 | 2014-12-10 | 北京赛科世纪数码科技有限公司 | Start verification method and system |
| KR20150000652A (en) * | 2013-06-25 | 2015-01-05 | 현대중공업 주식회사 | Apparatus and method of downloding operating program |
| CN105095767A (en) * | 2015-07-27 | 2015-11-25 | 四川长虹电器股份有限公司 | System and method for secure startup checked based on file data block |
| CN105224875A (en) * | 2015-11-13 | 2016-01-06 | 上海斐讯数据通信技术有限公司 | A kind of secure startup system of terminal and method |
| CN105975864A (en) * | 2016-04-29 | 2016-09-28 | 北京小米移动软件有限公司 | Operation system starting method and device, and terminal |
-
2016
- 2016-12-13 CN CN201611146818.XA patent/CN108229173B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| KR20150000652A (en) * | 2013-06-25 | 2015-01-05 | 현대중공업 주식회사 | Apparatus and method of downloding operating program |
| CN104200153A (en) * | 2014-09-12 | 2014-12-10 | 北京赛科世纪数码科技有限公司 | Start verification method and system |
| CN105095767A (en) * | 2015-07-27 | 2015-11-25 | 四川长虹电器股份有限公司 | System and method for secure startup checked based on file data block |
| CN105224875A (en) * | 2015-11-13 | 2016-01-06 | 上海斐讯数据通信技术有限公司 | A kind of secure startup system of terminal and method |
| CN105975864A (en) * | 2016-04-29 | 2016-09-28 | 北京小米移动软件有限公司 | Operation system starting method and device, and terminal |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109542518A (en) * | 2018-10-09 | 2019-03-29 | 华为技术有限公司 | The method of chip and bootrom |
| CN109542518B (en) * | 2018-10-09 | 2020-12-22 | 华为技术有限公司 | Chip and method for starting chip |
| CN110489963A (en) * | 2019-08-09 | 2019-11-22 | 四川虹美智能科技有限公司 | A kind of Android system smart machine guard method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108229173B (en) | 2022-08-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104484200B (en) | The method and device upgraded to firmware | |
| CN104391635B (en) | Solve the device and method of lock screen | |
| CN105807873B (en) | Temprature control method and device | |
| CN104216742B (en) | Brush machine control method and device based on password | |
| CN105975864A (en) | Operation system starting method and device, and terminal | |
| US20170185988A1 (en) | Mpayment method and apparatus | |
| CN104951377B (en) | The abnormality eliminating method and device of intelligent household terminal | |
| CN109214187B (en) | Method and device for controlling computer to start and electronic equipment | |
| CN104484593B (en) | terminal verification method and device | |
| CN107491681B (en) | Fingerprint information processing method and device | |
| CN111199039B (en) | Application security verification method and device and terminal equipment | |
| EP3367286A1 (en) | Methods, apparatuses, computer program and recording medium for protecting information | |
| CN106503537B (en) | Verification method and device based on flexible display screen | |
| CN107766701A (en) | Electronic equipment, dynamic library file guard method and device | |
| KR20150045205A (en) | Electronic device and control method thereof | |
| CN106295363B (en) | Startup calibration method and device | |
| CN106537288B (en) | The method and device of self-starting is applied in control | |
| CN107819740A (en) | Verification method, terminal device, audio amplifier and the server of terminal device | |
| CN106709284A (en) | Root package validation method and device | |
| CN108229173A (en) | The method and device that system starts | |
| CN104239095A (en) | Operating-system starting method, device and terminal equipment | |
| CN107506636A (en) | The guard method of pre-installed applications program and device | |
| CN106534083B (en) | Brush machine Tool validation method and device | |
| CN106062762B (en) | Using encryption method and device | |
| CN108228263A (en) | The method and device that system starts |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |