WO2020088516A1

WO2020088516A1 - Firmware security authentication method, device and payment terminal

Info

Publication number: WO2020088516A1
Application number: PCT/CN2019/114321
Authority: WO
Inventors: 刘绍海; 李坚强
Original assignee: 百富计算机技术（深圳）有限公司
Priority date: 2018-10-30
Filing date: 2019-10-30
Publication date: 2020-05-07
Also published as: CN109508535A; CN109508535B

Abstract

A firmware security authentication method, device and payment terminal, which are applicable to the technical field of terminal processing. The method comprises: acquiring the security level of a firmware file to be downloaded, and determining whether the security level of the firmware file to be downloaded satisfies a preset security level (S101); downloading the firmware file when the security level of the firmware file to be downloaded satisfies the preset security level, wherein the firmware file comprises a BOOT file or an OS file (S102); starting the BOOT file, and acquiring the security level of the BOOT file (S103); determining whether the security level of the OS file satisfies the security level of the BOOT file, and if so, starting the OS file according to the BOOT file (S104). The described solution may guarantee that a firmware file may be switched from a lower version to a higher version, and that the firmware file cannot be downgraded from a higher version to a lower version; moreover, the described solution may prevent the firmware file from being tampered with, thereby improving the security of a system.

Description

Firmware safety authentication method, device and payment terminal

Technical field

The invention belongs to the technical field of terminal processing, and particularly relates to a firmware security authentication method, device and payment terminal.

Background technique

With the development of the habit of swiping cards, POS (Point Of Sale, payment terminal) has become more and more widely used. At the same time, more and more people are beginning to study POS and use POS loopholes to obtain illegal benefits. In order to improve the security of the entire POS, China UnionPay has proposed an authorization scheme. After adding the authorization function, it brings high cost to after-sales maintenance, debugging and repair when upgrading the software, and some customers will choose unauthorized software. Because unauthorized software and authorized software coexist for a long time, it provides a switch for illegal personnel The possibility of firmware reduces the security of POS.

technical problem

In view of this, the embodiments of the present invention provide a firmware security authentication method, device, and payment terminal, to solve the problem that the firmware in the POS is easily switched in the prior art, resulting in low POS security.

Technical solution

A first aspect of the embodiments of the present invention provides a firmware security authentication method, including:

Obtain the security level of the firmware file to be downloaded, and determine whether the security level of the firmware file to be downloaded meets the preset security level;

Download the firmware file when the security level of the firmware file to be downloaded meets the preset security level, where the firmware file includes a BOOT file or an OS file;

Start the BOOT file to obtain the security level of the BOOT file;

It is determined whether the security level of the OS file meets the security level of the BOOT file, and if it is satisfied, the OS file is started according to the BOOT file.

Optionally, the firmware security authentication method further includes:

When the security level of the firmware file to be downloaded meets the preset security level, the firmware file is written into the Flash area.

Optionally, the downloading of the firmware file when the security level of the firmware file to be downloaded meets the preset security level includes:

When the security level of the BOOT file is greater than the preset security level, the security level of the BOOT file is written into the Fuse area, and the security level in the Fuse area is set to the preset security level.

Optionally, the firmware security authentication method further includes:

If the downloaded firmware file has vulnerabilities, increase the security level of the firmware file to be downloaded currently.

A second aspect of an embodiment of the present invention provides a firmware security authentication device, including:

The security level judgment module is used to obtain the security level of the firmware file to be downloaded, and determine whether the security level of the firmware file to be downloaded meets the preset security level;

A firmware download module, configured to download the firmware file when the security level of the firmware file to be downloaded meets the preset security level, where the firmware file includes a BOOT file or an OS file;

BOOT file startup module, used to start the BOOT file and obtain the security level of the BOOT file;

The OS file startup module is used to determine whether the security level of the OS file meets the security level of the BOOT file, and if it is satisfied, start the OS file according to the BOOT file.

Optionally, the firmware download module is also used to:

Optionally, the firmware download module is specifically used to:

Optionally, the firmware download module is also used to:

A third aspect of the embodiments of the present invention provides a payment terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, when the processor executes the computer program Steps to implement the firmware security authentication method as described in any one of the above.

A fourth aspect of the embodiments of the present invention provides a computer-readable storage medium that stores a computer program, and when the computer program is executed by a processor, implements the firmware security authentication method described in any one of the above A step of.

Beneficial effect

Compared with the prior art, the beneficial effects of the embodiments of the present invention are: obtaining the security level of the firmware file to be downloaded, and comparing the security level of the firmware file to be downloaded with the preset security level, only when the first security level is greater than or equal to The firmware file is downloaded when the security level is preset, which ensures that the firmware file can be switched from the low version to the high version, and cannot be rolled back from the high version to the low version; then, when the firmware file is started, it is judged whether the security level of the OS file meets the BOOT file The security level can only start the OS file according to the BOOT file if it meets the requirement, avoiding the firmware file being tampered and unable to start the system, which improves the security of the machine.

BRIEF DESCRIPTION

In order to more clearly explain the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required in the embodiments or the description of the prior art. Obviously, the drawings in the following description are only for the invention. In some embodiments, for those of ordinary skill in the art, without paying creative labor, other drawings may be obtained based on these drawings.

1 is a schematic diagram of an implementation process of a firmware security authentication method provided by an embodiment of the present invention;

2 is a schematic flowchart of a specific implementation of step S103 and step S104 in FIG. 1;

3 is a schematic structural diagram of a firmware security authentication device provided by an embodiment of the present invention;

4 is a schematic diagram of a payment terminal provided by an embodiment of the present invention.

Embodiments of the invention

In the following description, for the purpose of illustration rather than limitation, specific details such as a specific system structure and technology are proposed to thoroughly understand the embodiments of the present invention. However, those skilled in the art should understand that the present invention can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary details.

In order to explain the technical solutions of the present invention, the following will be described with specific embodiments.

Example one

This embodiment provides a firmware security authentication method, which is applicable to POS. The POS mainly includes a firmware file and a central processor (Central Processing Unit, CPU), etc. The central processor may include a Fuse (fuse) area and a Flash (flash memory) area, but is not limited to include a Fuse area and a Flash area. Among them, the Fuse area is a one-time program writing area, and subsequent modification is not allowed.

Referring to Figure 1, an implementation flow of the firmware security authentication method is detailed as follows:

Step S101: Obtain the security level of the firmware file to be downloaded, and determine whether the security level of the firmware file to be downloaded meets the preset security level.

Each system file in the firmware file defines a corresponding security level variable. The security level variable represents the security level of the firmware file. When the security level variable of the firmware file is 0, it represents an unauthorized version of the firmware file. The firmware file When the security level variable is greater than 0, it indicates an authorized version of the firmware file. The larger the security level variable value, the higher the security level of the firmware file.

In practical applications, the software system in POS mainly includes: BOOTROM file, BOOT file, OS file and application program (APP), etc. Before downloading the application program, the firmware file (BOOTROM file, BOOT file and OS file) needs to be signed Verification, BOOTROM file verification BOOT file signature, after verification, load BOOT file to run; BOOT file verification OS file signature, after verification pass, load OS file to run; OS file verification APP signature, verification can only run APP.

Step S102: When the security level of the firmware file to be downloaded meets the preset security level, download the firmware file, where the firmware file includes a BOOT file or an OS file.

Among them, the security level in the Fuse area is set to the preset security level, and the initial value of the security level in the Fuse area is set to 0 or 1.

For example, if the security level in the Fuse area of the POS is 1, the security level 1 in the Fuse area is used as the preset security level, so that the POS can only download the BOOT file that is not less than the security level 1; or in the POS In the factory setting state, the security level in the Fuse area is 0, so as long as the security level of the firmware file to be downloaded is greater than 0, the firmware file is allowed to be downloaded. The security level in the Fuse area is set to the preset security level, which can prevent tampering with the security level in the Fuse area, and ensure that the firmware file can be switched from the low version (low security level) to the high version (high security level), and cannot be returned from the high version Back to the lower version.

In this embodiment, when the firmware security level does not meet the preset security level, the system will pop up a window warning that the firmware file to be downloaded is illegal.

In one embodiment, when the security level of the firmware file to be downloaded meets the preset security level, the firmware file is written into the Flash area.

For example, when the security level of the BOOT file meets the preset security level, write the BOOT file to the Flash area; or when the security level of the OS file meets the preset security level, write the OS file Flash area. Writing the firmware file to the Flash area can ensure that even if an illegal person downloads a firmware of a low version by writing the Flash and causes a loophole, the system cannot be started normally.

In an embodiment, the specific implementation process of downloading the firmware file when the security level of the firmware file to be downloaded meets the preset security level in step S102 may include:

In practical applications, the preset security level is written in the Fuse area. The initial value of the preset security level may be 0. According to the above process, the preset security level can only be written from 0 to 1, not from 1 to 0. The format of the preset security level stored in the Fuse area is as follows:

预设安全等级的取值（十进制） Value of preset security level (decimal)	Fuse区域存储预设安全等级的数据（二进制） Fuse area stores data of preset security level (binary)
0 0	00000000 00000000
1 1	00000001 00000001
2 2	00000011 00000011
3 3	00000111 00000111
4 4	00001111 00001111

By analogy, there are as many 1s as there are security levels. This embodiment uses two bytes of storage space, so this embodiment can support 16 security levels.

Specifically, when the security level of the BOOT file is greater than the preset security level, it means that the version of the BOOT file to be downloaded is higher than the version of the downloaded BOOT file. At this time, the security level of the BOOT file is written into the Fuse area, the FUSE area The security level is the preset security level.

In addition, when the security level of the BOOT file is less than the preset security level, the download of the BOOT file to be downloaded is prohibited at this time, that is, the download of the BOOT file fails; when the security level of the BOOT file is greater than or equal to the preset security level, the The BOOT file to be downloaded is written into the Flash area and started.

Step S103: Start the BOOT file to obtain the security level of the BOOT file.

In step S104, it is determined whether the security level of the OS file meets the security level of the BOOT file, and if it is satisfied, the OS file is started according to the BOOT file.

Specifically, after starting the BOOT file, it is determined whether the security level of the OS file to be started is greater than or equal to the security level of the BOOT file, and if it is greater than or equal to the security level of the BOOT file, it indicates that the OS file is to be started Is higher than the security level of the booted BOOT file, or the security level of the OS file to be started is equal to the security level of the booted BOOT file, then the OS file is started, if it is less than the security level of the BOOT file, Then the startup fails.

In an embodiment, referring to FIG. 2 is a schematic diagram of a specific implementation process of step S103 and step S104 in FIG. 1, wherein SecLevel is a preset security level variable, BootSecLevel is a security level variable of a BOOT file, and OsSecLevel is the security of an OS file Level variables, detailed as follows:

Step S201, start. The startup program of the downloaded firmware file is entered.

In step S202, the SecLevel parameter of the Fuse area is loaded.

In step S203, it is determined whether BootSecLevel is greater than SecLevel; if BootSecLevel is greater than SecLevel, go to step S204; if BootSecLevel is not greater than SecLevel, go to step S205 to step S204, write BootSecLevel to the Fuse area, and then go to step S207.

Step S205, when BootSecLevel is not greater than SecLevel, it is determined whether BootSecLevel is less than SecLevel; if BootSecLevel is equal to SecLevel, go to step S207; if BootSecLevel is less than SecLevel, go to step S206.

Step S206, the startup fails.

In step S207, BOOT is started, and step S208 is entered.

In step S208, OsSecLevel is read.

In step S209, it is determined whether BootSecLevel is greater than OsSecLevel; if BootSecLevel is greater than OsSecLevel, proceed to step S206; if BootSecLevel is not greater than OsSecLevel, proceed to step S210.

Step S210, start the OS.

The preset security level of the Fuse area in this process may be the security level of the downloaded firmware file, for example, the security level of the BOOT file. In this embodiment, when the OS file is started, it is verified whether the security level of the OS file meets the security level of the BOOT file. This is to prevent unauthorized persons from tampering with the firmware file downloaded to the Flash area to achieve the purpose of running a firmware file of a low version, which effectively eliminates The risk of the POS firmware file being rolled back to a non-secure version further improves the security of the POS.

In one embodiment, the firmware security authentication method further includes: if the downloaded firmware file has vulnerabilities, increase the security level of the firmware file to be downloaded currently.

For example, the security level variable of the firmware file originally downloaded in the POS is 1, and when a firmware file with a security level variable of 1 is found to be vulnerable, the security level of the firmware file to be downloaded is upgraded to 2 , So that the POS will not download or run the firmware file with security level variable 1.

The above firmware security authentication method compares the security level of the firmware file to be downloaded with the preset security level, completes the download of the firmware when the conditions are met, and writes the security level of the BOOT file to the Fuse area to indicate the current system The security level of the running firmware file is the preset security level, write the downloaded firmware into the Flash area, and compare the security level of the OS file with the security level of the BOOT file when starting the OS file, start the OS file after passing, pass This mechanism can ensure that even if the illegal person downloads the firmware of the low version through the flash to create a loophole, the system cannot be started normally, effectively eliminating the risk of the machine being returned to the non-secure version, and improving the safety of the machine .

Those skilled in the art may understand that the size of the sequence numbers of the steps in the above embodiments does not mean that the execution order is sequential, and the execution order of each process should be determined by its function and inherent logic, and should not correspond to the implementation process of the embodiments of the present invention Constitute any limitation.

Example 2

Corresponding to the firmware security authentication method described in Embodiment 1 above, FIG. 3 shows a structural block diagram of the firmware security authentication device in Embodiment 2 of the present invention. For ease of explanation, only parts related to this embodiment are shown.

The device includes: a security level judgment module 110, a firmware download module 120, a BOOT file startup module 130, and an OS file startup module 140.

The security level judgment module 110 is used to obtain the security level of the firmware file to be downloaded, and determine whether the security level of the firmware file to be downloaded meets the preset security level.

The firmware download module 120 is configured to download the firmware file when the security level of the firmware file to be downloaded meets the preset security level, where the firmware file includes a BOOT file or an OS file.

The BOOT file starting module 130 is used to start the BOOT file and obtain the security level of the BOOT file.

The OS file starting module 140 is used to judge whether the security level of the OS file meets the security level of the BOOT file, and if it meets, start the OS file according to the BOOT file.

Optionally, the firmware download module 120 is further configured to: when the security level of the firmware file to be downloaded meets the preset security level, write the firmware file into the Flash area.

Optionally, the firmware download module 120 is specifically configured to: when the security level of the BOOT file is greater than the preset security level, write the security level of the BOOT file into the Fuse area, and the security level in the Fuse area Set to the preset security level.

Optionally, the firmware download module 120 is also used to: if the downloaded firmware file has a vulnerability, increase the security level of the firmware file currently to be downloaded.

In the above firmware safety certification device, the safety level judgment module 110 compares the safety level of the firmware file to be downloaded with the preset safety level, and the firmware download module 120 completes the download of the firmware when the conditions are met, and compares the safety level of the BOOT file Write to the Fuse area to indicate that the security level of the firmware file currently running on the system is the preset security level, and the downloaded firmware is written to the Flash area. The OS file startup module 140 writes the security level and BOOT of the OS file when starting the OS file The security level of the file is compared. After the OS file is started, the mechanism can ensure that even if the illegal person downloads the firmware of the low version by writing the Flash to create a loophole, the system cannot be started normally, effectively preventing the machine from being rolled back. The risk of going to a non-secure version improves the security of the machine.

Example Three

4 is a schematic diagram of a payment terminal 100 provided in Embodiment 3 of the present invention. As shown in FIG. 4, the payment terminal 100 described in this embodiment includes: a processor 150, a memory 160, and a computer program 161 stored in the memory 160 and executable on the processor 150, such as firmware security certification Method of procedure. When the processor 150 executes the computer program 161, the steps in the above embodiments of the firmware security authentication method are implemented, for example, steps S101 to S104 shown in FIG. 1. Alternatively, when the processor 150 executes the computer program 161, the functions of each module / unit in the foregoing device embodiments are realized, for example, the functions of the modules 110 to 140 shown in FIG. 3.

Exemplarily, the computer program 161 may be divided into one or more modules / units, and the one or more modules / units are stored in the memory 160 and executed by the processor 150 to complete this invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program 161 in the payment terminal 100. For example, the computer program 161 may be divided into a security level judgment module, a firmware download module, a BOOT file startup module, and an OS file startup module. The specific functions of each module are as follows:

The security level judgment module is used to obtain the security level of the firmware file to be downloaded, and determine whether the security level of the firmware file to be downloaded meets the preset security level.

The firmware download module is used to download the firmware file when the security level of the firmware file to be downloaded meets the preset security level, where the firmware file includes a BOOT file or an OS file.

The BOOT file starting module is used to start the BOOT file and obtain the security level of the BOOT file.

The OS file startup module is used to determine whether the security level of the OS file meets the security level of the BOOT file, and if it meets the requirement, the OS file is started according to the BOOT file.

Optionally, the firmware download module is further used to: when the security level of the firmware file to be downloaded meets the preset security level, write the firmware file into the Flash area.

Optionally, the firmware download module is specifically configured to: when the security level of the BOOT file is greater than the preset security level, write the security level of the BOOT file into the Fuse area, and set the security level in the Fuse area Is the preset security level.

Optionally, the firmware download module is also used to increase the security level of the firmware file to be downloaded if the downloaded firmware file has vulnerabilities.

The payment terminal 100 may be a computing device such as a desktop computer, a notebook, a palmtop computer and a cloud server. The payment terminal 100 may include, but is not limited to, the processor 150 and the memory 160. Those skilled in the art can understand that FIG. 4 is only an example of the payment terminal 100, and does not constitute a limitation on the payment terminal 100, and may include more or less components than shown, or combine certain components, or different components. For example, the payment terminal 100 may also include input and output devices, network access devices, buses, and the like.

The so-called processor 150 may be a central processing unit (Central Processing Unit (CPU), can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (Application Specific Integrated Circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 160 may be an internal storage unit of the payment terminal 100, such as a hard disk or a memory of the payment terminal 100. The memory 160 may also be an external storage device of the payment terminal 100, such as a plug-in hard disk equipped on the payment terminal 100, a smart memory card (Smart Media Card, SMC), a secure digital (SD) card, or a flash memory card (Flash Card) etc. Further, the memory 160 may also include both an internal storage unit of the payment terminal 100 and an external storage device. The memory 160 is used to store the computer program and other programs and data required by the payment terminal 100. The memory 160 may also be used to temporarily store data that has been or will be output.

In the above embodiments, the description of each embodiment has its own emphasis. For a part that is not detailed or recorded in an embodiment, you can refer to the related descriptions of other embodiments.

Those of ordinary skill in the art may realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application of the technical solution and design constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

In the embodiments provided by the present invention, it should be understood that the disclosed device / payment terminal and method may be implemented in other ways. For example, the device / payment terminal embodiments described above are only schematic. For example, the division of the module or unit is only a logical function division. In actual implementation, there may be other division modes, such as multiple units Or components can be combined or integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or software functional unit.

If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the present invention can implement all or part of the processes in the methods of the above embodiments, and can also be completed by a computer program instructing relevant hardware. The computer program can be stored in a computer-readable storage medium. When the program is executed by the processor, the steps of the foregoing method embodiments may be implemented. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium may include: any entity or system capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunication signals, and software distribution media. It should be noted that the content included in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in jurisdictions. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media Does not include electrical carrier signals and telecommunications signals.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still implement the foregoing The technical solutions described in the examples are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not deviate from the essence and scope of the technical solutions of the embodiments of the present invention, and should be included in Within the protection scope of the present invention.

Claims

A firmware safety authentication method, which is characterized by including:

Obtain the security level of the firmware file to be downloaded, and determine whether the security level of the firmware file to be downloaded meets the preset security level;

Download the firmware file when the security level of the firmware file to be downloaded meets the preset security level, where the firmware file includes a BOOT file or an OS file;

Start the BOOT file to obtain the security level of the BOOT file;

It is determined whether the security level of the OS file meets the security level of the BOOT file, and if it is satisfied, the OS file is started according to the BOOT file.
The firmware security authentication method of claim 1, further comprising:

When the security level of the firmware file to be downloaded meets the preset security level, the firmware file is written into the Flash area.
The firmware security authentication method according to claim 2, wherein the downloading of the firmware file when the security level of the firmware file to be downloaded meets the preset security level includes:

When the security level of the BOOT file is greater than the preset security level, the security level of the BOOT file is written into the Fuse area, and the security level in the Fuse area is set to the preset security level.
The firmware security authentication method according to any one of claims 1 to 3, further comprising:

If the downloaded firmware file has vulnerabilities, increase the security level of the firmware file to be downloaded currently.
A firmware safety authentication device, characterized in that it includes:

The security level judgment module is used to obtain the security level of the firmware file to be downloaded, and determine whether the security level of the firmware file to be downloaded meets the preset security level;

A firmware download module, configured to download the firmware file when the security level of the firmware file to be downloaded meets the preset security level, where the firmware file includes a BOOT file or an OS file;

BOOT file startup module, used to start the BOOT file and obtain the security level of the BOOT file;

The OS file startup module is used to determine whether the security level of the OS file meets the security level of the BOOT file, and if it is satisfied, start the OS file according to the BOOT file.
The firmware security authentication device according to claim 5, wherein the firmware download module is further used to:

When the security level of the firmware file to be downloaded meets the preset security level, the firmware file is written into the Flash area.
The firmware security authentication device according to claim 6, wherein the firmware download module is specifically used for:

When the security level of the BOOT file is greater than the preset security level, the security level of the BOOT file is written into the Fuse area, and the security level in the Fuse area is set to the preset security level.
The firmware security authentication device according to any one of claims 5 to 7, wherein the firmware download module is further used to:

If the downloaded firmware file has vulnerabilities, increase the security level of the firmware file to be downloaded currently.
A payment terminal, including a memory, a processor, and a computer program stored in the memory and runable on the processor, characterized in that, when the processor executes the computer program, it is implemented as claimed in claims 1 to 4. The steps of any of the methods.
A computer-readable storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.