TW201106197A - Verifiable embedded system and the verification method thereof - Google Patents

Abstract

A verifiable embedded system and the verification method thereof are provided to ensure a program is executed under a predetermined embedded system environment. The method includes: providing a certification information with plurality of default identification data; executing a verification program of the application program for reading several system elements' applied identification data of the elements of the embedded system; comparing the applied identification data with the default identification data to see if they are identical; and approving of executing a content program in the embedded system while the identification data and the default data are the same.

Description

201106197, invention: [Technical Field] The present invention relates to a system and a verification method thereof, and in particular to a method for verifying that an application operates in a predetermined embedded system environment. [Prior Art] The embedded system is an arithmetic system set for specific application functions. Most of the software used in the embedded system is also developed separately for the applicable application functions, so that the R&D vendors pay more attention to protecting their development. The program software and hardware are not separated and copied to other hardware devices. Among the technologies for preventing illegal copying of software programs, one of them adopts a binding software program and a specific hard-for-money method to generate an effect that can only be performed on a specific hardware. System integrity and protection applications. In the known practice, when the software program is executed at the beginning, the identification device of the device in which the software is loaded is first set, and the manufacturer identification code of the (PCI) (v吟叨, judgment_software= Lazy, so that is: the same device of the second production of Wei business _ _ _ installed two r: hard replacement, the hardware implementation of the system, because the purpose of a predetermined embedded integrity can not be achieved. The present invention provides an embedded system verification method and a verifiable blocking system for ensuring that an application operates in a preset embedded system environment, preventing the program from being copied to other programs. Executing in the device; also achieving the effect of maintaining the integrity of the system in which the deer program is located. • and a storage device coupled to the processor having a storage device identification data; wherein, in the embedded system of the embodiment of the present invention At startup, the processor executes a verification program to read a network unit identification data, a storage device identification data, and an operating system identification data, and implement the identification data with the present invention. Example of embedded line multiple presets to know the job, if the preset ^

And the preset identification data; if both match, the system is executed. Embodiments of the present invention provide a verifiable embedded system that is equipped with an operating system. The verifiable embedded system of the embodiment of the present invention comprises: a processor; a network unit connected to the processor, having a network unit identification data; a music collection material; and the identification data (4) identification (4) _ identification The data system is embedded in the embedded system 201106197 according to the embodiment of the present invention. [Embodiment] The verification method and the verification method thereof are successfully performed on the embedded system. Detailed: Equation ^ Description. The method is as shown in the figure below, and the block diagram is in the form of an invented

攸f money 1 consists of a number of system components, including the first storage wear = storage, network unit 14, where == storage; = save money 1G fortune - job button (10), the second contains the application m . Although the present embodiment stores the operating system (10) and the application separately in two separate storage devices, it should be understood that the two can actually be stored in the same storage device. - The network unit 14 of this embodiment is, for example, a built-in network card. The network unit 14 has a mac addfess as a means of identifying the network element 14 on the network.

The operating system 100 is stored in the first storage device 1 (e.g., a shirt), and the identification data of the operating system 1 includes the creation date and version number of the image of the operating system. Embedded system 1 commonly used operating system 100 includes: Windows CE, Windows XP embedded,

Embedded Linux, VxWorks, etc. The date and version of the different operating systems are also different. In addition, the second storage device 12 of the loading application 120 also has its unique device serial number, which is different from the Weishang identification code. 6 201106197, the serial number of each device is different, so it does not occur. More than two devices have the same situation. The program 12G includes two parts: the verification program 12GG and the content program. Verification (4) is the application interface (API) used to call the function in the library (Lib) to verify the various components in the embedded system, whether the application 120 is in the The pre-set system environment towel. The content program body is the _software service that the application program 12G actually wants to provide, such as file editing, event recording, and network information. The service of this part will be used by the user after the verification is completed. In the example of the present invention, a verification data is recorded in the unit 18, which includes a pre-designated default identification data of the system. The embodiment includes, for example, a preset media access control address, a preset device serial number, a preset job date, and a version number. The above identification data may be manufactured or sold by the mourner system 1 after the software and hardware of the embedded system 1 are installed, and the software program is used to read out: (1) Media access control of the network unit Address; (2) the storage device serial number of the storage device; and (3) the image financial date and version number of the work line. The above-mentioned read data is then used as the preset identification data 'write to the system configuration file (systejnregistry) of the δ recall unit 18 as the verification material for confirming the constituent elements of the original embedded system. Wherein, the unit 18 can be a random access memory or a non-volatile memory. In addition, the embodiment includes a verification program 12, which is loaded in the application 120 of the embedded system 1. When the application program is executed, the processor 16 executes the verification program 1200 first, that is, calls a specific function 'to read the software and hardware identification data of the embedded system 1 at that time, for example: (j) 201106197 The media access control address of the network unit 14; (2) the storage device serial number of the second storage device 12, and (3) the image file creation period and version number of the operating system 100. In addition, the verification program 1200 also reads the preset verification data stored in the system setting file of the memory unit 18, and performs the matching with the previously read identification data. The verification program 1200 of the embodiment can be designed to read the identification data in order according to the structure in which the verification data is recorded, so as to compare with the preset identification data to determine whether the corresponding identification data matches, for example, the comparison Whether the serial number of the storage device I2 is different from the preset storage device number, it can be known that the application 120 is not loaded in the original preset storage device of the embedded system. The comparison of the other two types of identification data is also the same. If the verification data indicates that the read_ship access control address is different from the preset media access control address, or the image of the Tao (10) is established and the version number is The preset material, system date and version number are different, which means that the system component has been replaced, or the application program 12 has been restored to other systems. ^ After the verification program mo compares the identification data in the verification data and the data, if there is any inconsistency in the item-item data, it is not allowed to continue. The line content program 1202 'For example: by the verification program 12_ please the entire application Program 12G. The content program 1202 will only be executed if each item of the item is in compliance with Na Ying's identification information. According to the above method, it can be ensured that the application 12 can only be successfully loaded in the preset embedded system 1 to protect the application 120 from being copied or moved to other applications; Also, the integrity of the embedded system 1 is verified simultaneously for multiple system components of the embedded system 1. In the above embodiment, the identification data of the media access control address, the operating system and the second storage device is taken as an example in that the verification program 12 in the application 120 verifies the above. The identification data of the system components can completely protect the hardware, software and intermediary media of the embedded system 1. Please refer to the second figure. The composition of the embedded system la can be divided into hardware 40 level, software 44 level, and between the two, using ^ to manage and coordinate the distribution of soft and hardware resources. . Verifying the media access control address of the network unit 14 and the storage sequence φ 唬, that is, protecting the hardware 40 layer of the embedded system 1a (eg, the processor 16 and each storage device); verifying the operating system 1〇 〇The image creation date and version number ensure the correctness of the mediator controlling the operation of the entire embedded system la; and the system environment of the embedded system is verified by the verification program 12, which protects the embedded system. The software 44 level of the system la (eg, application 120). By simultaneously verifying the system software, hardware and mediation media, even if only one of the system components is replaced, the application 12 can not provide the result of the application service, and the application 12 is greatly increased. The difficulty of executing on other devices or systems can prevent the application 12 from being separated or copied from the preset embedded system la more than the conventional means. It also ensures the integrity of the embedded system. . See the third diagram of another verifiable embedded system embodiment shown in Figure 3, which includes the base-in system (Bl〇s) 2存放 stored in non-volatile memory. In the embodiment, the preset identification data may be recorded in the system registration file of the memory unit 18, and is also written in the basic wheel entry and exit system. When the embedded system lb is powered on, the above-mentioned preset identification data will be read. The verification program 1200 can call the function to read the preset identification data into the basic input/output system 20. II201106197 The fourth figure is a flow chart of an embodiment of an embedded system verification method provided by the present invention. The method for comprehensively verifying an embedded system in which a protected application is installed is used to confirm that the application is in an unexisting manner. Program execution is allowed in a modified embedded system. First, a set of verification data (S401) including a plurality of preset identification data is provided in an embedded system, and the verification data in the embodiment includes a preset media access control address, a preset device serial number, and a preset. Operating system date and version number. The verification data can be pre-recorded in the system configuration file of the embedded system or the basic input and output system. The application consists of two parts: one is the verification program and the other is the content program. When the application is executed, the verification program can read the function from the library call function to read the identification data of the system component of the then lost system (S403). Identification data contains identifying data for the soft, hard or intermediate media that make up the embedded system. The identification data in the embodiment includes: a media access control address of the embedded system network unit, a storage device serial number of the second storage device in which the embedded system stores the application, and an operating system image file embedded in the embedded system. The date of creation and the version number. The above identification data are unique identification data of the system components, and can be used as a feature for discriminating the "identity" of each system component. Then the verification program compares the identification data with the corresponding preset identification data (S405) to determine whether the identification data obtained by the verification program conforms to the record in the preset identification data when the application is executed (s4〇) 7). If the result of the comparison finds that any one of them does not match, it means that the application is not installed on the preset embedded system, so it is not allowed to execute the subsequent internal spears (S409), and vice versa. After the comparison, each identification data is read to correspond to the preset identification data', then the cancer application system is installed in the preset 10 201106197 embedded system, and the content program of the application application is allowed to continue (S411 ).

Taking the preset identification data and the identification data of the embodiment as an example, in the step of determining whether the identification data matches the preset identification data (S407), the verification program will perform the following comparisons one by one (refer to the fifth figure): Whether the network unit self-access control control address is the same as the preset media access control address (S4070), if not the same, the subsequent program is stopped (§4〇9); if the same, the storage device of the storage device is compared Whether the serial number and the preset device serial number are the same (S4072) 'If they are not the same, stop (S4〇9); if they are still the same, continue to compare the operating system image file creation date, the version number and the default operating system date and version number are completely consistent. (S4〇74), if it is different, it is necessary to stop (S409). If the same is true, all the comparison determinations are completed, and the execution of the content program is allowed (S411). However, the execution order of the above steps S4070 to S4074 is limited, as long as it is determined that the three types of identification data are verified, and the comparison finds that there is a mismatch, and in addition to stopping the execution of the subsequent program, a warning tone can be issued to prompt. The identification data used to verify the system components is not limited to the above-mentioned embodiments, and the execution environment in which the application is located is not transferred, and the processor can be embedded into a unique control code. And the processor's preset processor control code is also used as one of the verification # materials, and the processor is read (four), and the device is replaced by other equipments. = outside 'the verification can be used in the embedded wrinkle, ie login = $ ^! library ^ not shown) #_, embedded fine processor execution filial 'connected to the remote data via the network unit The library reads the corresponding pre-201106197 data and compares them. Through the above-mentioned enemies-based system verification method and verifiable embedded system, the hands and devices of the soft, hardware and intermediate media of the embedded system can be comprehensively verified, in addition to ensuring that the application is not illegally copied and moved. In addition, the integrity of the embedded system is also guaranteed, and the system is prevented from being replaced by other alternative devices, which affects the operational efficiency and safety of the system. The items, components, and the like disclosed in the above embodiments are merely illustrative of the implementation of the present invention, and are intended to limit the scope of the invention, and if the invention is in accordance with the spirit of the invention, The technical means of the invention are within the scope of protection covered by the invention. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram of an embodiment of a verifiable embedded embedding embodiment provided by the present invention; FIG. 2 is a schematic diagram of an embodiment of a verifiable embedded embedding data structure provided by the present invention; The first figure is a block diagram of another embodiment of the verifiable embedded embedding embodiment provided by the present invention; the fourth figure is a flow chart of the embodiment of the method for verifying the bribe; and the embodiment of the data source Flow chart. [Main component symbol description] l la-b embedded system 10 first storage device 12 201106197 100 operating system 12 second storage device 120 application

1200 Verification Program 1202 Content Program 14 Network Unit 16 Processor 18 Memory Unit 20 Basic Input and Output System 40 Hardware 42 Intermediary Media 44 Software S401~S411 Process Steps S4070~S4074 Process Steps

3 13

Claims (1)

201106197 VII. Patent application scope: 1. An embedded system verification method, the embedded system is equipped with an operation system, the embedded system includes a network unit, a processor, and a storage device, and the method includes: providing the a plurality of preset identification data of the embedded system; executing a verification program to read one of the network unit identification data, a storage device identification data, and an operation system identification data in the embedded system; The data and the preset identification data; and if the identification data matches the preset identification data, executing a content program. 2. The method of claim 1, wherein the network element identification data is a media access control address of the network element. 3. The method of claim 1, wherein the storage device identification data is a storage device serial number of the storage device. 4. The method of claim 1, wherein the operating system identification data is an image creation date and a version number of the operating system. 5. The method of claim 1, wherein the preset identification data comprises: a preset media access control address, a preset device serial number, and a preset operating system date and version number . 6. The method of claim 1, wherein the method further comprises controlling a code and a predetermined processor control code. 7. The method of claim 1, wherein the method further comprises: stopping execution of the application if more than one of the identification data does not match the corresponding identification data corresponding thereto. 201106197 8. If the patent application is documented in the method of the embedded item, wherein the preset identification is as follows: The method is described in the method of embedding, wherein the preset identification resources are input into the system as a basic output of the spit system. 10·# ί June Patent Scope The data inventory is taken from the 箄=1 item escape method, which further includes a remote end 11 1 by the χ temple preset identification data. 11. The method of claim 2, wherein the verification program is stored in the storage compartment privately with the Shibuya. Package = 耿 耿 耿 ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' a processor having a storage device identification data; wherein, when the embedded system is booted, the processor executes a verification program to read the network unit identification data, the storage device identification data, and the operating system The operating system identifies the data, and compares the identification data with the plurality of preset identification data of the embedded system. If the preset identification data and the identification data are all consistent, performing an execution on the embedded system Content program. 13. The system of claim 12, wherein the network element identification data is a media access control address of the network element. 14. The system of claim 12, wherein the storage device is a storage device serial number of the storage device. The system of claim 12, wherein the operating system identification data is an image creation date and version number of one of the operating systems. 16. The system of claim 12, wherein the preset identification data comprises: a predetermined media access control address, a preset device serial number, and a preset operating system date and version number. 17. The system of claim 12, wherein the verification program and the content program are stored in the storage device. 18. The system of claim 12, wherein the embedded system further comprises: a basic input and output system, the preset identification data being stored in the basic input and output system. 19. The system of claim 12, wherein the embedded system further comprises: a memory unit, wherein the predetermined verification data is stored in the memory unit in a system registration format. 20. The system of claim 12, wherein the embedded system retrieves the preset identification data via the network unit to a remote data repository. 16