WO2018072442A1

WO2018072442A1 - System initialization method and device, and storage medium

Info

Publication number: WO2018072442A1
Application number: PCT/CN2017/085790
Authority: WO
Inventors: 薛明星
Original assignee: 深圳市中兴微电子技术有限公司
Priority date: 2016-10-17
Filing date: 2017-05-24
Publication date: 2018-04-26
Also published as: CN107958155A

Abstract

Provided in an embodiment of the present invention is a system initialization method, comprising: using a preset first initialization program to initialize a communication port, establishing communication with an external server by means of the communication port, and performing mutual authentication with the external server; and upon successful authentication, acquiring an activation program pre-stored in the external server, and executing the activation program to complete system activation. Also provided in the embodiment of the present invention are a system initialization device and a storage medium.

Description

System initialization method and device, storage medium

Cross-reference to related applications

The present application is based on a Chinese patent application filed on Jan. 17, 2016, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present invention relates to embedded system security technologies, and in particular, to a system initialization method and apparatus, and a storage medium.

Background technique

With the development of society, embedded control and processing systems are more and more widely used. For example, in the fields of communication, medical care, and smart home appliances, the needs of users are constantly increasing; therefore, the functions of embedded systems are becoming more and more abundant. People's lives are increasingly dependent on a variety of embedded systems; embedded systems represent personalization, mobility, and intelligence; at the same time, embedded systems also introduce a series of new problems, such as easy introduction of malicious code implantation, easy Obtained super administrator rights (root) and other issues; users require embedded systems to provide reliable services, embedded system security has also become a new research topic, in which the embedded system security is the embedded system reliable work The key first step.

In the embedded system, the system startup starts from the execution hardware initialization and the operating system initialization. This part mainly completes the initialization of the software and hardware to the normal working state, which is divided into two phases: the first phase, the processor (CPU), the memory control Hardware initialization, copy code to random access memory (RAM, Random Access Memory) space, initialization stack and other information; the second stage, jump to the beginning of the first stage code, flash (Flash), system memory, Hardware initialization such as the network, copy the operating system kernel from Flash to RAM space, set the operating system kernel boot parameters and call the kernel. In the security management of the initialization program of the embedded system and the initialization process of the embedded system, there are two stages involved in the handling and execution of the code. The initialization process of the embedded system requires the security management of this part of the program, which can complete the whole process. Security protection of the embedded system initialization process.

In a typical embedded system, a partial read-only memory (ROM, Read Only Memory) space is used to store an initialization program of the startup program, and a Flash space stores an application for starting the program; the disadvantage of this method is that the initialization program is saved in a single operation, and there is no backup. If malicious code is implanted, the system will not start properly, or after the startup, the criminals will steal user data. There are also some embedded systems that support Flash startup, put the startup program such as the initialization program into Flash, and support the error checking and correction technology (ECC) to verify the validity of the code in Flash; the disadvantage of this method: the startup program Occupy system space, ECC check code is easily falsified, resulting in invalid system startup, verification overhead; In addition, Flash space is large, large, and increased the cost of embedded systems.

Therefore, there is no effective solution to how to improve the security of embedded system initialization and reduce the cost of embedded systems.

Summary of the invention

Embodiments of the present invention are expected to provide a system initialization method and apparatus, and a storage medium, which can improve the security of the embedded system system initialization and reduce the cost of the embedded system.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

An embodiment of the present invention provides a system initialization method, where the method includes:

Initializing a communication port by using a preset first initialization program, establishing communication with an external storage device through the communication port, and performing mutual authentication with the external storage device;

After the authentication succeeds, the startup program pre-stored in the external storage device is acquired, and the startup program is executed to complete the system startup.

In the above solution, the mutually authenticating with the external storage device includes:

Presetting the encrypted information, and transmitting the first digital certificate and the encrypted information to an external storage device;

Verifying that the external storage device verifies the encrypted information and the second digital certificate sent after the first digital certificate is successful.

In the above solution, the preset encryption information includes:

Pre-stored encrypted information; and/or,

The encrypted information input device is initialized by the first initialization program, and the information acquired by the encrypted information input device.

In the above solution, the acquiring the startup program pre-stored in the external storage device includes:

And according to the second public key in the second digital certificate, encrypting and transmitting the startup program request information by using an asymmetric cryptosystem;

Acquiring the startup program from the external storage device, the startup program being encrypted and stored by the external storage device using a first public key in the first digital certificate and an asymmetric cryptosystem.

In the above solution, the startup program includes at least one of the following: a second initialization program; a first stage code; and a second stage code.

In the above solution, the acquiring a startup program pre-stored in the external storage device, and executing the startup program includes: acquiring and executing the second initialization program, the first phase code, and the second phase At least one of the codes.

The embodiment of the present invention further provides a system initialization device, where the device includes: a communication establishment module and a startup control module;

The communication establishing module is configured to initialize a communication port by using a preset first initialization program, establish communication with an external storage device through the communication port, and perform mutual authentication with the external storage device;

The startup control module is configured to acquire an startup program pre-stored in the external storage device after the authentication succeeds, and execute the startup program to complete system startup.

In the above solution, the communication establishing module is specifically configured as:

In the above solution, the communication establishing module is specifically configured to: acquire pre-stored encrypted information; and/or initialize the encrypted information input device by the first initialization program, and the information obtained by the encrypted information input device.

In the above solution, the startup control module is specifically configured as follows:

In the above solution, the startup program includes: at least one of a second initialization program, a first stage code, and a second stage code;

The startup control module is specifically configured to: sequentially acquire and execute at least one of the second initialization program, the first phase code, and the second phase code.

The embodiment of the invention provides a storage medium, which stores an executable program, and the executable program is implemented by the processor to implement the system initialization method provided by the embodiment of the invention.

The embodiment of the invention provides a system initialization device, including:

a memory for storing an executable program;

a processor configured to execute the executable program stored in the memory to implement the present invention The system initialization method provided by the embodiment.

The system initialization method and device and the storage medium provided by the embodiment of the present invention initialize a communication port by using a preset first initialization program, establish communication with an external storage device through the communication port, and perform mutual authentication with the external storage device. After the authentication succeeds, the startup program pre-stored in the external storage device is acquired, and the startup program is executed to complete the system startup. In this way, the startup program is stored in the external storage device, the problem of being implanted with malicious code or re-rooting is reduced, and the security of the embedded system initialization is improved; since the startup program is stored in the external server, the embedding can be reduced. The system is used to store the memory of the boot program, reducing the cost of the embedded system.

DRAWINGS

1 is a schematic flowchart of a system initialization method according to an embodiment of the present invention;

2 is a schematic flowchart of authentication according to an embodiment of the present invention;

3 is a schematic structural diagram of an embedded system initialization system according to an embodiment of the present invention;

4 is a schematic flowchart of an initialization process of an embedded system in an embedded system initialization system according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a system initialization apparatus according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a system initialization apparatus according to an embodiment of the present invention.

detailed description

In the embodiment of the present invention, the communication port is initialized by using a preset first initialization program, communication with the external storage device is established through the communication port, and mutual authentication is performed with the external storage device; after the authentication is successful, the pre-storage is acquired. Launching a program in the external storage device and executing the startup program to complete system startup.

The present invention will be further described in detail below with reference to the embodiments.

The system initialization method provided by the embodiment of the present invention is as shown in FIG. 1 , and the method includes:

Step 110: Initialize a communication port by using a preset first initialization program, establish communication with an external storage device through the communication port, and perform mutual authentication with the external storage device.

Here, a small-capacity ROM or Flash may be disposed in the embedded system to store the first initialization program; the communication port may include: a wired network port, a wireless compatibility authentication (WiFi) interface, a wireless communication air interface, and the like. Various communication interfaces that can be used for data transmission; the external storage device can include an external server or the like that can be used for storing and performing secure data transfer; the first initialization program is configured to store a program for initializing a communication port, etc. After the embedded system is powered on, the part of the code is automatically moved, and an initialization operation such as initializing the communication port device is performed; after the physical connection with the external server is established by initializing the communication port, authentication can be performed to improve data communication with the external server. safety.

Optionally, as shown in FIG. 2, the specific steps of the authentication include:

Step 1101: The embedded system acquires preset encryption information, and sends its first digital certificate and the encrypted information to an external server.

Here, the encrypted information may be encrypted information such as a password pre-stored in the small-capacity ROM or Flash, or may be initialized and input to the encrypted information input device of the embedded system by the first initialization program. The encrypted information input device may be a fingerprint input device, and the encrypted information input device may be fingerprint information;

Generally, a digital certificate includes a digital signature and a public key, and the digital signature is used to verify the identity of the sender of the digital certificate;

Step 1102: The external server completes the verification of the encrypted information, and parses the first digital certificate of the embedded system, and saves the first public key in the first digital certificate of the embedded system;

Step 1103: The server sends a verification result of the first digital certificate of the embedded system, and carries a second digital certificate of the external server.

Step 1104: If the embedded system verifies the second digital certificate, the second public key of the digital certificate of the server is saved, and the authentication succeeds.

Step 120: After the authentication succeeds, acquiring an startup program pre-stored in the external storage device, and executing the startup program to complete system startup;

Here, after the authentication succeeds, the embedded system successfully establishes communication with the external server, and the pre-stored startup program of the embedded system may be obtained from the external server, and the startup program is directly transported to the In the RAM of the embedded system; the embedded system runs the boot program directly in the RAM. Since the startup program is stored in the external server, since the startup program is not stored on the embedded system, illegal malicious implantation of the startup program on the embedded system can be prevented, and the security is improved; optionally, The security of the startup program is improved, and the startup program may be obtained by using an asymmetric key cryptosystem in a public key in the first digital certificate and the second digital certificate; wherein the asymmetric password is obtained. The system includes: RSA public key encryption algorithm;

For example, the embedded system encrypts the initiator request with the second public key of the external server and sends it to the external server; after obtaining the initiator request, the external server uses its own and the second public key The corresponding private key decrypts the request of the embedded system; the external server encrypts the stored startup program by using the first public key of the embedded system, and sends the startup program to the embedded system; the embedded system directly stores the encrypted startup program in the RAM, The encrypted boot program is decrypted with its own private key corresponding to the first public key, and the boot program is executed.

Optionally, the startup program may include: an initialization program (second initialization program), and/or a first stage code, and/or a second stage code; wherein the second initialization program is used to initialize the embedded system CPU speed, clock frequency, etc. of the terminal; the first stage code for initializing system memory, NAND flash initialization, etc.; the second stage code for initializing the code of the operating system kernel, ie, the kernel Mirror code; the second initialization program is the basis of the first stage code operation, and the first stage code operation is the basis of the second stage code operation; therefore, the second initialization program, the first stage code, and the a two-stage code, after acquiring the second initialization program and running, acquiring the first-stage code, After acquiring the first stage code after running the first stage code, obtaining the second initialization program, or at least one of the first stage code and the second stage code, the asymmetric password may be used. The system carries out data transmission.

The positive effects produced by the present invention will be further described in detail below with reference to specific examples;

As shown in FIG. 3, the embedded system initialization system includes: an embedded system terminal 31, a server 32, and a network 33 connecting the embedded system terminal and the server; wherein

The embedded system terminal 31 is provided with a ROM, and the ROM is provided with a first initialization program, which is mainly to initialize a network port or an air interface, and the first part code executed after the embedded system terminal is powered on;

The server 32 is provided with a key management module and a stored startup program; wherein the startup program comprises: a second initialization program, a first stage (Stage1) code, a second stage (Stage2) code, and a key management module responsible for the key. The generation and management, maintenance and verification of the encrypted information of the embedded system terminal 31; the second initialization program, which mainly completes the initialization code of the hardware, such as the CPU speed of the embedded system terminal 31, the clock frequency, and the like. The Stage1 code mainly completes the related code of hardware initialization, such as the embedded system terminal 31 initializing the system memory, the NAND flash initialization, etc.; the Stage2 code is mainly the kernel image of the operating system of the embedded system terminal 31;

The network 33 may be a wired network or a wireless communication air interface or the like.

The specific working steps and interaction process of the embedded system initialization system, as shown in FIG. 4, include:

Step 401: The system resetting operation of the embedded system terminal 31 calls the first initialization procedure of initializing the network port or the air interface in the ROM.

The embedded system terminal 31 performs a power-on reset operation, copies the first initialization program in the ROM space to the RAM, and then executes the first initialization program to complete the initialization of the network port or the air interface;

Step 402: The user inputs a fingerprint, sends it to the server 32, and carries the embedded system terminal. 31 digital certificate;

Step 403: The server 32 completes the verification of the fingerprint, and parses the digital certificate of the embedded system terminal 31, and saves the public key of the embedded system terminal 31;

Step 404: The server 32 sends the digital certificate verification result to the embedded system terminal 31, and carries the digital certificate of the server 32.

Step 405: The embedded system terminal 31 performs digital certificate verification of the server 32, and if the verification is passed, saves the public key of the digital certificate of the server 32;

Step 406: The embedded system terminal 31 encrypts and sends a request for the second initialization procedure using the public key of the server 32;

Step 407: The server 32 decrypts the request of the embedded system terminal 31 by using its own private key;

Step 408: The server 32 encrypts the second initialization program using the public key of the embedded system client, and sends it to the embedded system terminal 31;

Step 409: The embedded system terminal 31 uses its own private key to decrypt the second initialization program sent by the server 32, executes the second initialization procedure, completes hardware initialization, device exception vector table, memory controller and the like;

Step 410: The embedded system terminal 31 encrypts and sends a Stage1 code request using the public key of the server 32;

Step 411: The server 32 decrypts the Stage1 code request using its own private key;

Step 412: The server 32 encrypts the code of the Stage1 using the public key of the embedded system terminal 31, and sends it to the embedded system terminal 31;

Step 413: The embedded system terminal 31 decrypts using the private key, executes the Stage1 code, and completes initializing the system memory, displaying, and the like;

Step 414: The embedded system terminal 31 encrypts and sends a Stage2 code request using the public key of the server 32;

Step 415: The server 32 decrypts the Stage2 code request by using its own private key.

Step 416: The server 32 encrypts the Stage2 code using the public key of the embedded system terminal 31, and sends it to the embedded system terminal 31;

Step 417: The embedded system terminal 31 decrypts using the private key, jumps to the Stage2 code entry point, and starts the kernel.

The system initialization device provided by the embodiment of the present invention, as shown in FIG. 5, the device includes: a communication establishment module 51 and a startup control module 52;

The communication establishing module 51 is configured to initialize a communication port by using a preset first initialization program, establish communication with an external storage device through the communication port, and perform mutual authentication with the external storage device;

Here, a small-capacity ROM or Flash may be set in the embedded system to store the first initialization program; the communication port may include: a wired network port, a WiFi, a wireless communication air interface, and the like, which can be used for data transmission. a communication interface; the external storage device may include an external server or the like configured to store and perform secure data transfer; the first initialization program is configured to store a program for initializing a communication port, etc., automatically after the embedded system is powered on The part of the code is moved, and an initialization operation such as initializing the communication port device is performed; after the physical connection with the external server is established by initializing the communication port, authentication can be performed to improve the security of data communication with the external server.

Typically, a digital certificate contains a digital signature and a public key that is used to verify the number. The identity of the sender of the certificate;

The startup control module 52 is configured to acquire an startup program pre-stored in the external storage device after the authentication succeeds, and execute the startup program to complete system startup;

Here, after the authentication succeeds, the embedded system successfully establishes communication with the external server, and the pre-stored startup program of the embedded system may be obtained from the external server, and the startup program is directly transported to the In the RAM of the embedded system; the embedded system runs the boot program directly in the RAM. Since the startup program is stored in the external server, since the startup program is not stored on the embedded system, illegal malicious implantation of the startup program on the embedded system can be prevented, and the security is improved;

Optionally, in order to improve security in the process of transmitting the startup program, the startup program may be obtained by using an asymmetric key cryptosystem encryption method by using a public key in the first digital certificate and the second digital certificate; The asymmetric cryptosystem includes: an RSA public key encryption algorithm;

Optionally, the startup program may include: an initialization program (second initialization program), At least one of a first stage code and a second stage code; wherein the second initialization program is used to initialize a CPU speed of the embedded system terminal, a clock frequency, etc.; the first stage code is used to initialize system memory, NAND Flash initialization, etc.; the second stage code is used to initialize the code of the operating system kernel, that is, the kernel image code; the second initialization program is the basis of the first stage code operation, and the first stage code operation is the second stage code The basis of the operation; therefore, the second initialization program, the first stage code, and the second stage code may be sequentially acquired, and the first stage code is acquired after the second initialization program is acquired and executed, and then The second stage code is obtained and run after the first stage code is acquired; when at least one of the second initialization program, the first stage code, and the second stage code is obtained, the asymmetric transmission cryptosystem can be used for data transmission.

In practical applications, the communication establishing module 51 and the startup control module 52 can be implemented by a CPU, a microprocessor (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA) in an embedded system. .

For example, FIG. 6 is a schematic diagram of a hardware structure of a device for initializing a system according to an embodiment of the present invention, including: at least one processor 601 and a memory 602, and communication Interface 603. The various components in the system initialized device are coupled together by a bus system 604. It will be appreciated that bus system 604 is used to implement connection communication between these components. The bus system 604 includes a power bus, a control bus, and a status signal bus in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 604 in FIG.

It will be appreciated that memory 602 can be either volatile memory or non-volatile memory, and can include both volatile and nonvolatile memory. The non-volatile memory may be a ROM, a Programmable Read-Only Memory (PROM), or an Erasable Programmable Read-Only Memory (EPROM). The memory 602 described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types. Memory.

The memory 602 in the embodiment of the present invention is used to store various types of data to support the operation of the system initialized device. Examples of such data include any computer program for operating on a system initialized device, such as operating system 6021 and program 6022. The operating system 6021 includes various system programs, such as a framework layer, a core library layer, a driver layer, and the like, for implementing various basic services and processing hardware-based tasks. The program 6022 can include various programs, and the program for implementing the system initialization method of the embodiment of the present invention can be included in the program 6022.

The communication interface 603 is used for communication between the system initialization device and other devices in a wired or wireless manner. The system initialization device can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof.

The method disclosed in the foregoing embodiments of the present invention may be applied to the processor 601 or implemented by the processor 601. Processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 601 or an instruction in a form of software. The processor 601 described above may be a general purpose processor, a DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or the like. The processor 601 can implement or execute the system initialization method, steps, and logic block diagrams described in the embodiments of the present invention. A general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiment of the present invention may be directly implemented as a hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium located in memory 602, and processor 601 reads the information in memory 602, in conjunction with its hardware, to perform the steps of system initialization described above.

In an exemplary embodiment, the system initialization device may be configured by one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), and Complex Programmable Logic Devices (CPLDs). , Complex Programmable Logic Device), FPGA, General Purpose Processor, Controller, Microcontroller Implemented by a Micro Controller Unit (MCU), a microprocessor (Microprocessor), or other electronic components for performing the aforementioned system initialization method.

Embodiments of the present invention further provide a storage medium storing an executable program, and the executable program is implemented by a processor to implement a system initialization method, such as the system initialization method shown in any of FIGS. 1, 2, and 4. The storage medium may be the various types of non-volatile storage media described above.

The above is only the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included. Within the scope of protection of the present invention.

Industrial applicability

An embodiment of the present invention provides a system initialization method, which uses a preset first initialization procedure to initialize a communication port, establishes communication with an external server through the communication port, and performs mutual authentication with the external server; after successful authentication And acquiring a startup program pre-stored in the external server, and executing the startup program to complete system startup. The embodiment of the invention further provides a system initialization device and a storage medium. By implementing the invention, the security of the embedded system system initialization can be improved, and the cost of the embedded system can be reduced.

Claims

A system initialization method, the method comprising:

Initializing a communication port by using a preset first initialization program, establishing communication with an external storage device through the communication port, and performing mutual authentication with the external storage device;

After the authentication succeeds, the startup program pre-stored in the external storage device is acquired, and the startup program is executed to complete the system startup.
The method of claim 1 wherein said authenticating with said external storage device comprises:

Presetting the encrypted information, and transmitting the first digital certificate and the encrypted information to an external storage device;

Verifying that the external storage device verifies the encrypted information and the second digital certificate sent after the first digital certificate is successful.
The method of claim 2, wherein the preset encryption information comprises:

Pre-stored encrypted information; and/or,

The encrypted information input device is initialized by the first initialization program, and the information acquired by the encrypted information input device.
The method of claim 2, wherein the obtaining an activation program pre-stored in the external storage device comprises:

And according to the second public key in the second digital certificate, encrypting and transmitting the startup program request information by using an asymmetric cryptosystem;

Acquiring the startup program from the external storage device, the startup program being encrypted and stored by the external storage device using a first public key in the first digital certificate and an asymmetric cryptosystem.
The method according to any one of claims 1 to 4, wherein the startup program comprises at least one of: a second initialization program; a first stage code; a second stage code.
The method of claim 5, wherein the obtaining is pre-stored on the outside The booting program in the storage device and executing the booting program includes:

Acquiring and executing at least one of the second initialization program, the first stage code, and the second stage code.
A system initialization device, the device comprising: a communication establishment module and a startup control module; wherein

The communication establishing module is configured to initialize a communication port by using a preset first initialization program, establish communication with an external storage device through the communication port, and perform mutual authentication with the external storage device;

The startup control module is configured to acquire an startup program pre-stored in the external storage device after the authentication succeeds, and execute the startup program to complete system startup.
The device according to claim 7, wherein the communication establishing module is specifically configured to:

Presetting the encrypted information, and transmitting the first digital certificate and the encrypted information to an external storage device;

Verifying that the external storage device verifies the encrypted information and the second digital certificate sent after the first digital certificate is successful.
The device according to claim 8, wherein the communication establishing module is specifically configured to: acquire pre-stored encrypted information; and/or initialize an encrypted information input device by using the first initialization program, and the encrypted information input device Information obtained.
The device according to claim 8, wherein the startup control module is specifically configured to:

And according to the second public key in the second digital certificate, encrypting and transmitting the startup program request information by using an asymmetric cryptosystem;

Acquiring the startup program from the external storage device, the startup program being encrypted by the external storage device using a first public key in the first digital certificate and an asymmetric cryptosystem storage.
The apparatus according to any one of claims 7 to 10, wherein the startup program comprises: at least one of a second initialization program, a first stage code, and a second stage code;

The startup control module is specifically configured to: sequentially acquire and execute at least one of the second initialization program, the first phase code, and the second phase code.
A storage medium storing an executable program, the executable program being executed by a processor to implement the system initialization method according to any one of claims 1 to 6.
A system initialization device includes:

a memory for storing an executable program;

The processor, configured to execute the executable program stored in the memory, implements the system initialization method of any one of claims 1 to 6.