TWI773430B - Security activating system and method thereof - Google Patents

Abstract

A security activating system includes a microcontroller, a random number generator and a clock trim register. The microcontroller includes a bootloader, and the bootloader activates the boot process during the first activation time based on the first frequency. The random number generator transmits the random number. The clock trim register is disposed between the random number generator and the bootloader. The clock trim register adjust the first frequency to the second frequency based on the random number and transmits the second frequency to the bootloader. When the bootloader wants to execute the secure boot process , the bootloader activates the secure boot process at the second time point of the second activation time based on the second frequency. By randomly adjusting frequency, the attack to the microcontroller is prevented.

Description

Safe boot system and method therefor

The present invention relates to a safe starting system and method for changing the working time point by means of random adjustment.

In a protected security system, the bootloader determines whether subsequent programs can be executed after the system is powered on. Wherein, the launcher starts the verification of the executable program to judge the security of the executable program, and the security of the system can be ensured only after the executable program that has passed the verification is executed. However, if the step of executing the boot verification on the launcher is attacked and the executable program is not executed, the security of the system cannot be ensured.

For example, Fault Injection Attack is one of the attack methods that can attack the key commands of the launcher. If a hacker can predict the execution time point of a key command, they can attack the launcher at this time point, thereby causing potentially unsafe programs to be activated. Therefore, the fixed execution time of the launcher is one of the favorable attack conditions for hackers, and the more fixed the execution time is, the more insecure the execution environment is.

In view of the foregoing, the inventors of the present invention have considered and designed a safe boot system and a method thereof, in order to improve the deficiencies of the prior art, thereby enhancing the implementation and utilization in the industry.

In view of the above-mentioned conventional problems, an object of the present invention is to provide a safe booting system and a method thereof to solve the problems faced in the prior art.

Based on the above object, the present invention provides a safe boot system, which includes a program execution module and a frequency generation module. When the secure boot system is powered on, the program execution module executes the boot procedure according to the first frequency, and executes the security procedure at the first time point in the execution time of the boot procedure. When the safe boot system is powered on, the frequency generating module generates the first frequency according to the random number to randomly change the first time point.

Optionally, each time the secure boot system is powered on, the first time point corresponds to a different random number, thereby preventing the secure boot system from being attacked without executing the security program.

Based on the above object, the present invention provides a safe booting system, which includes a microprocessor, and the microprocessor includes a starter, a random number adjuster and a frequency adjuster. The starter executes the start-up procedure at the first start-up time according to the first frequency. The random number adjuster sends random numbers. The frequency adjuster is connected between the random number adjuster and the starter. When the starter wants to execute the safety program, the frequency adjuster adjusts the first frequency to the second frequency according to the random number and transmits it to the starter, and the starter according to the first frequency. The safety procedure is executed at the second time point of the second activation time at the second frequency.

Optionally, the second frequency is higher than the first frequency, and the second activation time is shorter than the first activation time.

Optionally, the second frequency is lower than the first frequency, and the second activation time is longer than the first activation time.

A safe starting method, comprising: (1) providing a starter to execute a starting procedure at a first time point of a first starting time according to a first frequency. (2) When the starter wants to execute the safety program, According to the random number, the control frequency adjuster adjusts the first frequency to the second frequency and transmits it to the starter. (3) According to the second frequency, the starter is controlled to execute the safe start procedure at the second time point of the second start time.

Optionally, the second frequency is higher than the first frequency, the second activation time is shorter than the first activation time, and the second time point is earlier than the first time point.

Optionally, the second frequency is lower than the first frequency, the second activation time is longer than the first activation time, and the second time point is later than the first time point.

As mentioned above, the secure boot system and method of the present invention, through the random adjustment of the first time point by the frequency adjuster, prevent hackers from being unable to accurately attack the second time point when the microprocessor actually executes the operation.

10: Launcher

20: Random Number Adjuster

30: Frequency adjuster

40: clock generator

f1, FE1: the first frequency

f2: second frequency

FG: Frequency generation module

MCU: Microprocessor

PE: program execution module

RN: random number

T0, AT1: first start time

T1, T2: Second start time

TA,FT: The first time point

TA1, TA2: the second time point

S1~S5: Steps

FIG. 1 is a block diagram of a first embodiment of the secure boot system of the present invention.

FIG. 2 is a block diagram of a second embodiment of the secure boot system of the present invention.

FIG. 3A is a schematic diagram of the starter at the first start-up time.

Figure 3B is a schematic diagram of the launcher being attacked.

FIG. 3C is a schematic diagram of an embodiment of the present invention of the starter at the second start-up time.

FIG. 3D is a schematic diagram of a second start-up time of the starter according to another embodiment of the present invention.

FIG. 4 is a flow chart of the secure boot method of the present invention.

The advantages, features, and technical means of achieving the present invention will be more easily understood by being described in more detail with reference to the exemplary embodiments and the accompanying drawings, and the present invention may be implemented in different forms, so it should not be construed as being limited to what is described herein. The stated embodiments, on the contrary, are commonly known in the art The embodiments are provided so that this disclosure will be thorough, complete and complete to convey the scope of the invention to those skilled in the art, and the invention will only be defined by the appended claims.

It will be understood that although the terms "first", "second", etc. may be used herein to describe various elements, components, regions, layers and/or sections, these elements, components, regions, layers and/or sections You should not be limited by these terms. These terms are only used to distinguish one element, component, region, layer and/or section from another element, component, region, layer and/or section. Thus, "first element", "first feature", "first region", "first layer" and/or "first portion" discussed below may be referred to as "second element", "second feature" , "Second Area", "Second Layer" and/or "Second Section" without departing from the spirit and teachings of the present invention.

Additionally, the terms "comprising" and/or "comprising" refer to the presence of stated features, regions, integers, steps, operations, elements and/or components, but do not exclude one or more other features, regions, integers, steps, operations , elements, components and/or the presence or addition of combinations thereof.

Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be construed as having definitions consistent with their meanings in the context of the related art and the present invention, and will not be construed as idealized or overly formal meaning, unless expressly defined as such herein.

Please refer to FIG. 1 , which is a block diagram of a first embodiment of the secure boot system of the present invention. As shown in FIG. 1, the safe boot system of the present invention includes a program execution module PE and a frequency generation module FG. When the secure boot system is powered on, the program execution module PE executes the boot procedure according to the first frequency, and executes the security procedure at the first time point in the execution time of the boot procedure. When the safe boot system is powered on, the frequency generation module FG generates the first frequency FE1 according to the random number RN to randomly change the first frequency point in time. Each time the secure boot system is powered on, the first time point is different corresponding to the random number RN, thereby preventing the secure boot system from being attacked without executing the security program.

Please refer to FIG. 2 and FIG. 3A , which are a block diagram of a second embodiment of the safe boot system of the present invention and a schematic diagram of the starter at the first startup time. As shown in FIG. 1 and FIG. 2A , the secure boot system of the present invention includes a microprocessor MCU, a random number regulator (or random number generator) 20 and a frequency regulator 30 . The microprocessor MCU has a starter 10, and the starter 10 executes the start-up procedure at the first start-up time according to the first frequency f1. Generally speaking, when the starter 10 wants to execute the safety procedure, the starter 10 executes the start-up procedure at the first start-up time T0. At the first point of time, the TA executes the security program to activate the legal program, and the legal program is an application program that has been verified by security and is used to perform the user's work. The random number adjuster 20 sends the random number RN. The frequency adjuster 30 is connected between the random number adjuster 20 and the initiator 10. When the initiator 10 wants to execute the safety program, the frequency adjuster 30 adjusts the first frequency f1 to the second frequency f2 according to the random number RN and transmits it to The launcher 10, the launcher 10 executes the safety program at the second time point TA1 or TA2 of the second activation time T1 or T2 according to the second frequency f2, and the launcher 10 executes the safety program and then executes the legal program. Certified program. The adjustment of the first frequency f1 is during the period when the starter 10 wants to execute the safety program after the microprocessor MCU is powered on. Every time the starter 10 wants to execute the safety program, the random number RN is different each time, so that the second The value of the frequency f2 is random each time, so that the value of the second frequency f2 is different each time, and the second frequency f2 is different from the first frequency f1. The frequency adjuster 30 may be, for example, a clock trim register.

See Figure 3B, which is a schematic diagram of the launcher being attacked. As shown in Fig. 3B, combined with Fig. 2 and Fig. 3A, since the first frequency f1 of the general microprocessor MCU is fixed, after the microprocessor MCU is powered on, the starter 10 is at a fixed The fixed first time point TA of the first startup time T0 executes the secure startup procedure, so that the first time point TA is easily pre-judged and attacked by hackers, thereby causing hackers to Start the illegal program so that the launcher 10 does not operate completely according to the set first time point TA, so that the microprocessor MCU cannot operate as expected. security mechanisms or access to protected data.

Please refer to FIG. 3C , which is a schematic diagram of the starter at the second start-up time according to an embodiment of the present invention. As shown in FIG. 3C, and in conjunction with FIG. 2, when the starter 10 wants to execute the safety program, the frequency adjuster 30 adjusts the first frequency f1 to the second frequency f2 according to the random number RN. At this time, the random number RN is less than 1. The frequency adjuster multiplies the original first frequency f1 and the random number RN to reduce the first frequency f1 to the second frequency f2, so that the second frequency f2 is lower than the first frequency f1 (for example, the first frequency f1 is 3.2 GHz, the The second frequency is 2.5GHz), due to the configuration of the second frequency f2, the original first start-up time T0 is further extended, resulting in the second start-up time T1 being longer than the first start-up time T0 (that is, the magnitude of the second start-up time T1 greater than the first start time T0), since the relative position of the first time point TA at the first start time T0 and the relative position of the second time point TA1 at the second start time T1 are the same, the second time point TA1 changes accordingly. , so that the second time point TA1 is later than the first time point TA (that is, the magnitude of the second time point TA1 is greater than the magnitude of the first time point TA); if the hacker still attacks at the first time point TA, after After the adjustment of the frequency adjuster 30, the starter 10 executes the security program at the second time point TA1 of the second start time T1. Because the second time point TA1 is later than the first time point TA, the hacker fails to attack the microprocessor MCU. At the second time point TA1 of the actual operation, the launcher 10 can still normally start the safety program.

Please refer to FIG. 3D , which is a schematic diagram of a second start-up time of the starter according to another embodiment of the present invention. As shown in FIG. 3D, and in conjunction with FIG. 1, when the starter 10 wants to execute the safety program, the frequency adjuster 30 adjusts the first frequency f1 to the second frequency f2 according to the random number RN. At this time, the random number RN is greater than 1. The frequency adjuster multiplies the original first frequency f1 and the random number RN to amplify the first frequency f1 to the second frequency f2, so that the second frequency f2 is higher than the first frequency f1 (for example, the first frequency f1 is 3.2 GHz, the The second frequency f2 is 5GHz), due to the configuration of the second frequency f2, the original first start-up time T0 is shortened, causing the second start-up time T2 to be shorter than the first start-up time T0 (that is, the magnitude of the second start-up time T2 is smaller than the first start-up time T0 Start time T0), because the relative position of the first time point TA at the first start time T0 and the relative position of the second time point TA2 at the second start time T2 are the same, the second time point TA2 is earlier than the first time point point TA (that is, the magnitude of the second time point TA1 is smaller than the magnitude of the first time point TA); if the hacker is still attacking at the first time point TA, after the adjustment of the frequency adjuster 30, the starter 10 starts at the first time point TA. 2. The second time point TA2 of the startup time T2 executes the security program. Because the second time point TA2 is earlier than the first time point TA, the hacker fails to successfully attack the second time point TA2 when the microprocessor MCU is actually operating. The launcher 10 The safety program can still be started normally.

Because of the configuration of the random number RN, the first frequency f1 becomes a random second frequency f2 (that is, the value of the random number RN is different each time), and the second frequency f2 received by the initiator 10 is random each time The second frequency f2 is different each time, so the second time point TA2 is different each time. Therefore, the second time point TA2 is difficult to be predicted and attacked by hackers, which makes the working environment of the microprocessor MCU more secure. With the enhancement, the launcher 10 can normally execute the secure boot procedure and then execute the legitimate procedure.

Please refer to FIG. 4 , which is a flowchart of the secure boot method of the present invention. As shown in Fig. 4, together with Fig. 1, Fig. 2A, Fig. 2C and Fig. 2D, the safe booting method of the present invention is described as follows:

Step S1: A microprocessor MCU with an initiator 10 is provided.

Step S2: As shown in FIG. 2A, the starter 10 executes the start-up procedure at the first start-up time T0 according to the first frequency f1, and executes the safety procedure at the first time point TA of the first start-up time T0, and the frequency regulator 30 measures the and obtain the first frequency f1.

Step S3 : when the initiator 10 wants to execute the safety program, the random number adjuster 20 transmits the random number RN to the frequency adjuster 30 .

Step S4: According to the random number RN, the frequency adjuster 30 is controlled to adjust the first frequency f1 to a second frequency f2 and transmit it to the starter 10, and the second frequency f2 is different from the first frequency f1.

Step S5: According to the second frequency f2, the starter 10 is controlled to execute the safe start-up procedure at the second time point TA1 or TA2 of the second start-up time T1 or T2. Wherein, if the second frequency f2 is higher than the first frequency f1, as shown in Figure 2D, the second start-up time T2 is shorter than the first start-up time T0, and the second time point TA2 is earlier than the first time point TA; The frequency f2 is lower than the first frequency f1. As shown in FIG. 2C, the second start-up time T1 is longer than the first start-up time T0, and the second time point TA1 is later than the first time point TA.

According to the safe start method of the present invention, the operating frequency of the starter 10 is adjusted to a random frequency (that is, the second frequency f2 is random), and the second time point TA1 or TA2 of the second start time T1 or T2 is also random. , in order to achieve the purpose of random startup time, therefore, it is difficult for hackers to predict the second time point TA1 or TA2 to attack.

Based on the above, in the secure boot system and method of the present invention, the random adjustment of the first time point TA by the frequency adjuster 30 prevents hackers from being unable to accurately attack the second time point TA2 when the microprocessor MCU is actually running. or TA1.

The above description is exemplary only, not limiting. Any equivalent modifications or changes that do not depart from the spirit and scope of the present invention shall be included in the appended patent application scope.

10: Launcher

20: Random Number Adjuster

30: Frequency adjuster

f1: the first frequency

f2: second frequency

MCU: Microprocessor

RN: random number

Claims (9)

A safe boot system, comprising: a program execution module, when the safe boot system is powered on, the program execution module executes a boot program according to a first frequency, and at a first time in the execution time of the boot program A safety program is executed at a time point, the first time point is fixed at the relative position of the start-up program; and a frequency generation module, when the safety start-up system is powered on, the frequency generation module generates the first time according to a random number a frequency to randomly change the first time point. The secure boot system according to claim 1, wherein each time the secure boot system is powered on, the first time point is different from the random number, thereby preventing the secure boot system from being attacked and not executing the security program. A safe booting system, comprising: a starter, the starter executes a start-up procedure at a first time point of a first start-up time according to a first frequency; a random number adjuster sends a random number; and A frequency adjuster is connected between the random number adjuster and the starter. When the starter wants to execute a safety program, the frequency adjuster adjusts the first frequency to a second frequency according to the random number and adjusts it to a second frequency. It is transmitted to the initiator, which executes the safety program according to the second frequency at a second time point of a second activation time, the relative position of the first time point at the first activation time and the first activation time. The relative positions of the two time points to the second activation time are the same. The safe boot system of claim 3, wherein the second frequency is higher than the first frequency a frequency, the second activation time is shorter than the first activation time. The safe activation system of claim 3, wherein the second frequency is lower than the first frequency, and the second activation time is longer than the first activation time. The secure boot system of claim 3, wherein the initiator, the random number adjuster and the frequency adjuster are integrated into a processor. A safety startup method, comprising: providing a starter to execute a start-up procedure at a first time point of a first start-up time according to a first frequency; when the starter wants to execute a safety procedure, according to a random number , controlling a frequency regulator to adjust the first frequency to a second frequency and transmitting it to the starter; and according to the second frequency, controlling the starter to execute the starter at a second time point of a second start time In the safety program, the relative position of the first time point to the first activation time and the relative position of the second time point to the second activation time are the same. The safe activation method of claim 7, wherein the second frequency is higher than the first frequency, the second activation time is shorter than the first activation time, and the second time point is earlier than the first time point. The safe activation method of claim 7, wherein the second frequency is lower than the first frequency, the second activation time is longer than the first activation time, and the second time point is later than the first time point.

Images