CN116910709A - Firmware acquisition method, firmware encryption method, electronic device and storage medium - Google Patents

Firmware acquisition method, firmware encryption method, electronic device and storage medium Download PDF

Info

Publication number
CN116910709A
CN116910709A CN202310825620.8A CN202310825620A CN116910709A CN 116910709 A CN116910709 A CN 116910709A CN 202310825620 A CN202310825620 A CN 202310825620A CN 116910709 A CN116910709 A CN 116910709A
Authority
CN
China
Prior art keywords
firmware
key
chip
encryption
encrypted
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310825620.8A
Other languages
Chinese (zh)
Inventor
陈顺庆
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Rockchip Electronics Co Ltd
Original Assignee
Rockchip Electronics Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Rockchip Electronics Co Ltd filed Critical Rockchip Electronics Co Ltd
Priority to CN202310825620.8A priority Critical patent/CN116910709A/en
Publication of CN116910709A publication Critical patent/CN116910709A/en
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/121—Restricting unauthorised execution of programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/08—Randomization, e.g. dummy operations or using noise
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/60—Digital content management, e.g. content distribution

Abstract

The invention discloses a firmware acquisition method, a firmware encryption method, electronic equipment and a storage medium, wherein an encryption key and an encryption firmware are read; acquiring a chip unique parameter of a chip associated with the encrypted firmware; decrypting the encryption key using the chip unique parameter to obtain a first key; and decrypting the encrypted firmware using the first key to obtain first decrypted firmware. The invention encrypts the firmware to obtain the corresponding encryption key, decrypts the encryption key by using the unique parameter of the chip to obtain the first key, and decrypts the encryption firmware by using the first key to obtain the first decryption firmware, so that the unique parameter of the chip participates in the encryption process, thereby ensuring the uniqueness of the firmware, enabling different clients with the same chip to be not universal, and reducing the theft risk.

Description

Firmware acquisition method, firmware encryption method, electronic device and storage medium
Technical Field
The present invention relates to the field of firmware encryption technologies, and in particular, to a firmware obtaining method, a firmware encrypting method, an electronic device, and a storage medium.
Background
DWC HDCP 2.X provides an Embedded Security Module (ESM) firmware packaging tool that can cryptographically package firmware via PKf (platform key)/DUK (device unique key); and HDCP 2.Xkey is also packaged into firmware at the same time. Then, after the high-bandwidth digital content protection technology (HDCP) controller loads the firmware, it is decrypted with PKf/DUK, PKf/DUK is burned to OTP at the time of chip shipment.
However, because the one-time programmable memory (OTP) programmed PKf/DUK of the same chip is the same, the firmware packaged by different customers with the same chip is generic and there is a risk of theft.
Disclosure of Invention
The invention aims to provide a firmware acquisition method, a firmware encryption method, electronic equipment and a storage medium, which can ensure the uniqueness of firmware so that different clients with the same chip cannot be commonly used.
In one aspect of the invention, a firmware acquisition method is provided. The method comprises the following steps: reading an encryption key and encryption firmware; acquiring a chip unique parameter of a chip associated with the encrypted firmware; decrypting the encryption key using the chip unique parameter to obtain a first key; and decrypting the encrypted firmware using the first key to obtain first decrypted firmware.
In yet another aspect of the present invention, a firmware encryption method is provided. The method comprises the following steps: in response to the start of the firmware packaging process, the firmware is encrypted and packaged according to a preset encryption algorithm to generate first encrypted firmware, and the first encrypted firmware is encrypted and packaged by using a first key to generate second encrypted firmware; encrypting the first key with a chip unique parameter of a chip associated with the firmware to generate an encrypted transmission key; and transmitting the second encrypted firmware and the encrypted transmission key to a memory partition of a device associated with the firmware.
In yet another aspect of the present invention, an electronic device is provided. The device includes a memory configured to store a computer program; and a processor configured to execute the computer program to perform the firmware acquisition method or the firmware encryption method described above.
In yet another aspect of the present invention, a storage medium is provided. The medium has stored thereon a computer program that is executed by a processor to implement the firmware acquisition method or the firmware encryption method described above.
According to the embodiment of the invention, the firmware is encrypted to obtain the corresponding encryption key, the encryption key is required to be decrypted by using the unique chip parameter to obtain the first key, and then the encryption firmware is decrypted by using the first key to obtain the first decryption firmware, so that the unique chip parameter participates in the encryption process, the uniqueness of the firmware is ensured, different clients with the same chip cannot be commonly used, and the theft risk is reduced.
Drawings
FIG. 1 is a step schematic diagram illustrating a firmware acquisition method according to an embodiment of the present disclosure;
FIG. 2 is a step schematic diagram illustrating a firmware encryption method according to an embodiment of the present disclosure;
FIG. 3 is a flow chart illustrating a firmware encryption and decryption method based on DWS ESM performed between devices according to an embodiment of the present invention;
FIG. 4 is a flow chart illustrating a firmware encryption and decryption method based on DWS ESM performed between operation spaces according to an embodiment of the present invention;
fig. 5 is a schematic diagram showing an electronic device according to an embodiment of the present invention.
Detailed Description
In order to describe the technical contents, the achieved objects and effects of the present invention in detail, the following description will be made with reference to the embodiments in conjunction with the accompanying drawings.
In the prior art, firmware packaged by different clients with the same chip is universal, so that the risk of being stolen exists.
In order to solve at least the above technical problems, the present disclosure provides a firmware acquisition and encryption scheme. According to the present disclosure, the encryption key needs to be decrypted by using the unique chip parameter to obtain the first key, and then the encryption firmware is decrypted by using the first key to obtain the first decrypted firmware. In this way, embodiments according to the present disclosure can ensure that each firmware is unique and not misappropriated by customers who own the same chip.
Hereinafter, a technical scheme according to the present disclosure will be described with reference to specific embodiments and with reference to the accompanying drawings.
Fig. 1 is a schematic diagram illustrating steps of a firmware acquisition method 100 according to an embodiment of the present disclosure. Referring to fig. 1, the method 100 includes the following steps 102-108.
In step S102, the encryption key and the encryption firmware are read. In this way, the key used to encrypt the firmware is also subjected to encryption processing. In some embodiments, the encryption key and encryption firmware are stored in a vendor partition and a vendor storage partition, respectively, of the Android device. And when the encrypted firmware is obtained, reading the encrypted firmware from the vendor partition of the Android device, and reading the first encryption key from the vendor storage partition.
In step S104, a chip unique parameter of a chip associated with the encrypted firmware is acquired. In some embodiments, the chip unique parameters are obtained from the one-time programmable memory of the chip. The unique chip parameter can be a chip identity number or the like.
In step S106, the encryption key is decrypted using the chip unique parameter to obtain the first key. In this way, the first key can only be obtained by the chip unique parameter, thereby effectively preventing others from stealing the firmware.
In some embodiments, the random number is drawn from a predetermined location of the encryption key to generate a predetermined number of bits of the key to be decrypted, and the key to be decrypted is decrypted using the chip unique parameter as a key to obtain a first key associated with AES. In this way, the key of the firmware is encrypted in a random number insertion manner, ensuring secure transmission of the key.
In step S108, the encrypted firmware is decrypted using the first key to obtain first decrypted firmware.
In some embodiments, a second key associated with the high bandwidth digital content protection HDCP service is obtained and the first decrypted firmware is decrypted using the second key to obtain a second decrypted firmware. In some other embodiments, a second key associated with the PKF/DUK is obtained from a one-time programmable memory of the chip. In this way, the second decrypted firmware can be obtained by decrypting the first decrypted firmware with the second key associated with the high bandwidth digital content protection HDCP service, ensuring the security of the HDCP service of the firmware.
In some embodiments, after the operation of decrypting the first decrypted firmware by the second key is completed, the HDCP service is initialized and authentication associated with the HDCP service is performed based on the second decrypted firmware. In this way, the firmware can be normally put into use, and the safety is high.
Fig. 2 is a schematic diagram illustrating steps of a firmware encryption method 200 according to an embodiment of the present disclosure. Referring to fig. 2, the method 200 includes the following steps 202 through 206.
In step 202, in response to initiation of the firmware packaging process, the firmware is cryptographically packaged according to a preset encryption algorithm to generate a first encrypted firmware, and the first encrypted firmware is cryptographically packaged with a first key to generate a second encrypted firmware.
In some embodiments, a first key corresponding to the firmware is configured and the first key is stored in a configuration file during a firmware packaging process. The process of cryptographically packaging the first cryptographic firmware with the first key may use a symmetric key encryption algorithm. In this way, the first key is used in the encryption and decryption processes of the symmetric key encryption algorithm, so that the calculation amount is small, and the encryption efficiency is high. The first key may be automatically configurable, ensuring uniqueness. In addition, using the non-open source code to store and configure the first key, others cannot obtain these configuration codes through legal means.
In other embodiments, the predetermined encryption algorithm is selected as the encryption algorithm of the packaging tool itself.
In step 204, the first key is encrypted with a chip unique parameter of a chip associated with the firmware to generate an encrypted transmission key.
In some embodiments, a chip identification number of a chip associated with the firmware is obtained, and the first key is encrypted using the chip identification number as a key for generating an encrypted transmission key. In this way, the decryption key of the first key corresponding to each firmware has uniqueness, so that other people cannot easily steal the firmware and use the firmware in decryption.
In some embodiments, the first key is encrypted using the chip unique parameter as a key to generate an intermediate encryption key, and the random number is inserted into a predetermined fixed location of the intermediate encryption key to obtain the encrypted transmission key. In this way, the encrypted transmission key is obtained by inserting the random number, so that the intermediate encryption key is not easy to intercept in the transmission process, and the security is improved.
At step 206, the second encrypted firmware and the encrypted transmission key are sent to a memory partition of a device associated with the firmware.
Hereinafter, an application scenario of a firmware encryption and decryption acquisition method according to an embodiment of the present invention will be described by way of example.
Fig. 3 is a flowchart illustrating a firmware encryption and decryption method based on DWS ESM performed between devices according to an embodiment of the invention. Fig. 4 is a flow chart illustrating a firmware encryption and decryption method based on DWS ESM performed between the operation spaces according to an embodiment of the invention.
In order to clearly illustrate the entire encryption flow, each technical term referred to in the drawings is explained as follows.
DWC: the design wire core is provided based on a Synopsys DesignWare platform, which is a digital circuit design tool set that includes various tools and software for digital circuit design, verification and testing.
ESM: embedded Security Module, an embedded security module.
PKF: platform Key,16 byte Platform Key, is used to protect firmware and HDCP Key.
DUK: device Unique Key,16 byte device unique KEY, which serves as an additional KEY for protecting HDCP RX KEY.
HDCP2 services run at the application layer, mainly to load firmware, boot into Embedded Security Modules (ESMs), and also to handle authentication logic.
The firmware of a DWC ESM is an important component of an ESM that is responsible for supporting ESM functions, managing ESM keys, and updating ESM firmware. These functions all provide important support for ensuring the security of digital content.
DWC HDMP 2.X provides ESM firmware packaging tools, which can encrypt and package firmware through PKf/DUK, and HDMP 2.X KEY is also packaged into firmware.
The vendor (device manufacturer) partition is typically part of the operating system for storing vendor specific data and drivers. The vendor partition is typically located under a device/vendor directory, which contains a number of files and directories, including device drivers, vendor-supplied applications, and other related resources.
First, the present embodiment further performs one more AES encryption on the encrypted firmware 1 based on the PKf/DUK encryption described above. The AES key used for AES encryption, i.e., the first key, is configured into the configuration file at the time of packaging the firmware. The first key may be automatically configurable, ensuring uniqueness.
Referring to fig. 3 and 4, the AES encrypted and packaged firmware 2 is stored in the vendor storage partition, and the AES key 1 generated by encrypting the AES key is stored in the vendor storage partition.
Specifically, a Serial number of 8Bytes is acquired from CPU INFO (processor information), then the Serial is used as a key for encrypting the AES key, and a random number is inserted into a fixed position after encryption to generate an AES key 1 of 20 Bytes.
Then, when the device runs, the user space loads the HDCP service and is responsible for the authentication procedure of HDCP 2. X. The service will first download firmware 2 from the vendor storage space and read AES key 1 from the vendor storage and read the Serial number of CPU INFO. Then, the random number of the fixed position of the AES key 1 is extracted, and then decrypted by using the Serial number to obtain the AES key.
Subsequently, the firmware 2 is decrypted using the AES key, resulting in decrypted firmware 1. The firmware 1 is passed to the kernel HDCP controller driver, which decrypts the firmware 1 again with the PKf/DUK chip. After decryption is successful, the HDCP service is successfully initialized, enters a Ready state and waits for authentication of HDCP 2. X.
According to another aspect of the invention, fig. 5 is a schematic diagram illustrating an electronic device 500 according to an embodiment of the invention. Referring to fig. 5, the electronic device 500 includes a memory 502, a processor 504, and a program stored on the memory and executable on the processor, which when executed implements the steps of the firmware acquisition method or the firmware encryption method as described above.
According to yet another aspect of the present invention, a computer-readable medium is provided. The computer readable medium has stored thereon a computer program that is executed by a processor to implement the firmware acquisition method or the firmware encryption method as described above.
In summary, the invention provides a firmware obtaining method, a firmware encrypting method, an electronic device and a storage medium, which are used for encrypting firmware to obtain a corresponding encryption key, decrypting the encryption key by using a unique chip parameter to obtain a first key, decrypting the encryption firmware by using the first key to obtain a first decryption firmware, ensuring the uniqueness of the firmware, so that different clients with the same chip cannot be commonly used, and encrypting the first key in the encryption process to generate an intermediate encryption key; and inserting the random number into a preset fixed position of the intermediate encryption key to obtain the encryption transmission key, so that the encryption key cannot be intercepted in the transmission process, and the theft risk is reduced.
The foregoing description is only illustrative of the present invention and is not intended to limit the scope of the invention, and all equivalent changes made by the specification and drawings of the present invention, or direct or indirect application in the relevant art, are included in the scope of the present invention.

Claims (12)

1. A firmware acquisition method, comprising:
reading an encryption key and encryption firmware;
acquiring a chip unique parameter of a chip associated with the encrypted firmware;
decrypting the encryption key using the chip unique parameter to obtain a first key; and
decrypting the encrypted firmware using the first key to obtain first decrypted firmware.
2. The firmware acquisition method according to claim 1, characterized by further comprising:
acquiring a second key associated with the high bandwidth digital content protection HDCP service; and
decrypting the first decrypted firmware using the second key to obtain second decrypted firmware.
3. The firmware acquisition method according to claim 2, characterized by further comprising:
initializing the HDCP service; and
authentication associated with the HDCP service is performed based on the second decryption firmware.
4. The method for acquiring firmware according to claim 1, wherein,
reading the encryption key and the encryption firmware includes: reading the encrypted firmware from a vendor partition of the Android device, and reading the first encryption key from a vendor storage partition,
acquiring the chip unique parameters of the chip associated with the encrypted firmware includes: the unique chip parameters are obtained from the one-time programmable memory of the chip.
5. The firmware acquisition method of claim 1, wherein decrypting the encryption key with the chip unique parameter to obtain a first key comprises:
drawing a random number from a predetermined position of the encryption key to generate a key to be decrypted of a predetermined number of bits; and
and decrypting the key to be decrypted by using the unique chip parameter as a key to obtain the first key associated with AES.
6. The firmware acquisition method according to claim 1, wherein acquiring the second key associated with the high-bandwidth digital content protection HDCP service includes: the second key associated with PKF/DUK is retrieved from one-time programmable memory of the chip.
7. A firmware encryption method, comprising:
in response to the start of a firmware packaging process, the firmware is encrypted and packaged according to a preset encryption algorithm to generate first encrypted firmware, and the first encrypted firmware is encrypted and packaged by using a first key to generate second encrypted firmware;
encrypting the first key with a chip unique parameter of a chip associated with the firmware to generate an encrypted transmission key; and
the second encrypted firmware and the encrypted transmission key are sent to a memory partition of a device associated with the firmware.
8. The method as recited in claim 7, further comprising:
configuring the first key corresponding to the firmware; and
the first key is stored in a configuration file in the firmware packaging process.
9. The method of claim 7, wherein encrypting the first key with a chip unique parameter of a chip associated with the firmware to generate an encrypted transmission key comprises:
acquiring a chip identity number of a chip associated with the firmware; and
and encrypting the first key by using the chip identity number as a key, so as to generate the encrypted transmission key.
10. The method of claim 7, wherein encrypting the first key with a chip unique parameter of a chip associated with the firmware to generate an encrypted transmission key comprises:
encrypting the first key by using the unique chip parameter as a key to generate an intermediate encryption key; and
and inserting a random number into a preset fixed position of the intermediate encryption key to obtain the encryption transmission key.
11. An electronic device, comprising:
a memory configured to store an executable program; and
a processor configured to execute the executable program to perform the firmware acquisition method according to any one of claims 1 to 6 or the firmware encryption method according to any one of claims 7 to 10.
12. A computer-readable storage medium having stored thereon a computer program, characterized in that the computer program is executed to implement the firmware acquisition method according to any one of claims 1 to 6 or the firmware encryption method according to any one of claims 7 to 10.
CN202310825620.8A 2023-07-06 2023-07-06 Firmware acquisition method, firmware encryption method, electronic device and storage medium Pending CN116910709A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310825620.8A CN116910709A (en) 2023-07-06 2023-07-06 Firmware acquisition method, firmware encryption method, electronic device and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310825620.8A CN116910709A (en) 2023-07-06 2023-07-06 Firmware acquisition method, firmware encryption method, electronic device and storage medium

Publications (1)

Publication Number Publication Date
CN116910709A true CN116910709A (en) 2023-10-20

Family

ID=88367544

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310825620.8A Pending CN116910709A (en) 2023-07-06 2023-07-06 Firmware acquisition method, firmware encryption method, electronic device and storage medium

Country Status (1)

Country Link
CN (1) CN116910709A (en)

Similar Documents

Publication Publication Date Title
US7313828B2 (en) Method and apparatus for protecting software against unauthorized use
EP2506488B1 (en) Secure dynamic on-chip key programming
US7117376B2 (en) Platform and method of creating a secure boot that enforces proper user authentication and enforces hardware configurations
US20110126023A1 (en) Systems And Methods For Data Security
US20150095652A1 (en) Encryption and decryption processing method, apparatus, and device
US8843766B2 (en) Method and system for protecting against access to a machine code of a device
CN111611593A (en) Secure data processing apparatus
US20100011221A1 (en) Secured storage device with two-stage symmetric-key algorithm
CN115442032A (en) Data processing method, system on chip and readable storage medium
CN107925574B (en) Secure programming of secret data
CN109598105B (en) Method and device for safely loading firmware by microcontroller, computer equipment and storage medium
CN110704814B (en) Anti-copy method and device, and storage medium
CN107992760B (en) Key writing method, device, equipment and storage medium
CN109889334A (en) Embedded firmware encrypting method, apparatus, wifi equipment and storage medium
CN111159726B (en) UEFI (unified extensible firmware interface) environment variable-based full-disk encryption and decryption method and system
CN110932853B (en) Key management device and key management method based on trusted module
CN110674525A (en) Electronic equipment and file processing method thereof
CN114785503B (en) Cipher card, root key protection method thereof and computer readable storage medium
CN116910709A (en) Firmware acquisition method, firmware encryption method, electronic device and storage medium
CN113761598B (en) Electronic device and method for operating the same
CN111542050B (en) TEE-based method for guaranteeing remote initialization safety of virtual SIM card
CN109286488B (en) HDCP key protection method
US20230058046A1 (en) Apparatus and Method for Protecting Shared Objects
CN110909391A (en) RISC-V based safe storage method
CN110855434A (en) Key processing method, device, terminal equipment and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination