WO2022199190A1 - 一种安全启动的方法及装置 - Google Patents

一种安全启动的方法及装置 Download PDF

Info

Publication number
WO2022199190A1
WO2022199190A1 PCT/CN2021/142998 CN2021142998W WO2022199190A1 WO 2022199190 A1 WO2022199190 A1 WO 2022199190A1 CN 2021142998 W CN2021142998 W CN 2021142998W WO 2022199190 A1 WO2022199190 A1 WO 2022199190A1
Authority
WO
WIPO (PCT)
Prior art keywords
cryptographic algorithm
esbc
signature
public key
secure
Prior art date
Application number
PCT/CN2021/142998
Other languages
English (en)
French (fr)
Inventor
陈海武
董红红
曹斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21932797.0A priority Critical patent/EP4300340A4/en
Publication of WO2022199190A1 publication Critical patent/WO2022199190A1/zh
Priority to US18/469,807 priority patent/US20240005007A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
    • G06F11/10—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services

Definitions

  • the present application relates to the field of data security, and in particular, to a method and device for secure booting.
  • the secure boot technology is usually used for boot.
  • the image file of the application to be loaded is verified first, and the image file of the application is loaded after the verification is passed, thus ensuring the integrity and legality of the image file of the application loaded during the boot process.
  • a cryptographic algorithm for secure booting is usually stored in a network device, such as asymmetric cryptographic algorithms involving RSA, error checking and correction (ECC).
  • a network device such as asymmetric cryptographic algorithms involving RSA, error checking and correction (ECC).
  • ECC error checking and correction
  • the embodiments of the present application provide a secure boot method, so that a communication device can flexibly use different cryptographic algorithms to perform secure boot based on different security requirements, thereby ensuring the security of the communication device.
  • quantum computers will be widely used. Quantum computers are good at reverse computing and parallel computing, finding qualified solutions from a huge data space, and simulating microscopic time using the characteristics of parallel computing.
  • the widely used asymmetric cryptographic algorithms in the process of securely booting software are not resistant to post-quantum attacks.
  • quantum computers can crack the asymmetric cryptographic algorithms that are currently widely used in the process of securely booting software. With the method provided in the present application, it can be effectively ensured that the communication device can cope with the possible post-quantum attack at any time.
  • an embodiment of the present application provides a method for secure booting, and the method may be executed by, for example, a communication device.
  • the communication device may obtain an external secure boot code (ESBC).
  • the ESBC includes a code segment of the first cryptographic algorithm.
  • the communication device may perform an integrity check on the ESBC. And after the ESBC passes the integrity check, the signature of the next-level software is verified based on the first cryptographic algorithm.
  • ESBC can be obtained, and the first cryptographic algorithm included in the ESBC can be used to perform secure startup, so as to meet the security requirements.
  • the communication device can obtain the ESBC including the first cryptographic algorithm, so as to verify the next level based on the first cryptographic algorithm Software signature.
  • the first cryptographic algorithm may be an algorithm resistant to post-quantum attacks, so that after obtaining the ESBC including the first cryptographic algorithm, the first cryptographic algorithm resistant to post-quantum attacks can be used to verify the next level Software signature. It can be seen that the use of this scheme can enable the communication device to cope with the post-quantum attack that may come at any time.
  • an embodiment of the present application provides a method for safe booting, and the method can be executed by, for example, a communication device.
  • the first device may perform a secure boot based on a second cryptographic algorithm in a first communication cycle, and in a second communication cycle, perform a secure boot based on a first cryptographic algorithm obtained from outside the first device Safe boot. It can be seen that, with this solution, when the second cryptographic algorithm cannot meet the security requirements, the first cryptographic algorithm can be obtained from the outside, and the security startup can be performed based on the first cryptographic algorithm, thereby meeting the security requirements.
  • the communication device can obtain the first cryptographic algorithm from outside, so as to verify the next-level software based on the first cryptographic algorithm 's signature.
  • the first cryptographic algorithm may be an algorithm that resists post-quantum attacks.
  • the next-level software can be verified by using the first cryptographic algorithm that resists post-quantum attacks. 's signature. It can be seen that the use of this scheme can enable the communication device to cope with the post-quantum attack that may come at any time.
  • the method before using the first cryptographic algorithm to verify the signature of the next-level software, the method further includes: acquiring an external secure boot code ESBC, where the ESBC includes a code segment of the first cryptographic algorithm; ESBC performs integrity check.
  • the verifying the signature of the next-level software based on the first cryptographic algorithm includes: after the ESBC passes the integrity check, verifying the signature of the next-level software based on the first cryptographic algorithm.
  • the second cryptographic algorithm is a cryptographic algorithm preset at the factory of the communication device.
  • the first cryptographic algorithm can be used to perform the secure boot, so as to meet the security requirement.
  • the ESBC may be stored in a processor-independent external storage entity, eg, the ESBC may be stored in a non-volatile storage medium. Therefore, in one example, the communication device may store the ESBC stored in the non-volatile storage medium in the SRAM of the processor after determining to use the first cryptographic algorithm for secure boot, and then, from the The ESBC is obtained from the SRAM, so that the ESBC can be subsequently checked for integrity, and after the ESBC passes the integrity check, the first cryptographic algorithm is used to verify the signature of the next-level software.
  • the ESBC may also include a root public key baseline value, where the root public key baseline value is used to perform a root public key analysis on the root public key of the first cryptographic algorithm. Integrity verification.
  • the communication device may further perform integrity verification on the root public key of the first cryptographic algorithm based on the root public key baseline value.
  • the communication device may use the second-level public key of the first cipher when verifying the signature of the next-level software.
  • the aforementioned public key certificate may further include the signature of the secondary public key and the public key certificate.
  • the communication device can use the verified root public key to verify the signature of the public key certificate. To determine the validity and integrity of the secondary public key.
  • the signature of the next-level software can be verified by using the first cryptographic algorithm and the second-level public key of the first cryptographic algorithm.
  • the ESBC may use the baseline value of the ESBC to perform the integrity check on the ESBC.
  • the baseline value of the ESBC may be pre-stored in the secure storage entity, so that the communication device may obtain the baseline value of the ESBC stored in the secure storage entity, and then use the baseline value of the ESBC to compare the ESBC value. Integrity verification.
  • the secure storage entity is a one-time programmable memory in the processor or a secure chip in the processor.
  • the first cryptographic algorithm may be enabled in the processor for secure startup. In this way, it can be ensured that the communication device can ensure that the first cryptographic algorithm can be used before verifying the signature of the next-level software based on the first cryptographic algorithm.
  • indication information may be stored in the secure storage entity of the communication device, where the indication information can be used to indicate that the first cryptographic algorithm is enabled.
  • the communication device may determine that the first cryptographic algorithm is enabled for secure startup after reading the indication information from the secure storage entity, and further, the communication device may determine that the first cryptographic algorithm is enabled for secure startup based on the The first cryptographic algorithm verifies the signature of the next-level software.
  • the communication device uses the second cryptographic algorithm for secure booting before using the first cryptographic algorithm for secure booting, that is: before using the first cryptographic algorithm for secure booting, the communication device uses the second cryptographic algorithm The algorithm verifies the signature of the next level of software. Then, after the first cryptographic algorithm is used for secure booting, the use of the second cryptographic algorithm for secure booting can also be prohibited, so as to avoid two cryptographic algorithms being enabled for secure booting at the same time, affecting the normal secure booting of the communication device. .
  • the BIOS is the first software loaded when the CPU is running, therefore, the communication device uses the first cryptographic algorithm to verify the software of the next level.
  • the signature of the BIOS can be verified by using the first cryptographic algorithm.
  • the communication device may continue to verify the signature of the OS code by using the first cryptographic algorithm and the corresponding public key. After the signature of the OS code is verified, the communication device can load the OS, and continue to verify the signature of the APP by using the first cryptographic algorithm and the corresponding public key. After the signature of the APP is verified, the communication device can safely load the APP.
  • an embodiment of the present application provides a secure boot device, the device includes: an acquisition unit configured to acquire an external secure boot code ESBC, where the ESBC includes a code segment of a first cryptographic algorithm; a processing unit, configured with performing integrity check on the ESBC; the processing unit is further configured to verify the signature of the next-level software based on the first cryptographic algorithm after the ESBC passes the integrity check.
  • an acquisition unit configured to acquire an external secure boot code ESBC, where the ESBC includes a code segment of a first cryptographic algorithm
  • a processing unit configured with performing integrity check on the ESBC
  • the processing unit is further configured to verify the signature of the next-level software based on the first cryptographic algorithm after the ESBC passes the integrity check.
  • the ESBC further includes a root public key baseline value
  • the processing unit is further configured to, before verifying the next-level software based on the first cryptographic algorithm, based on the root public key baseline The value verifies the integrity of the root public key of the first cryptographic algorithm.
  • the processing unit is further configured to verify the signature of the public key certificate based on the root public key of the first cryptographic algorithm after performing integrity verification on the root public key of the first cryptographic algorithm,
  • the public key certificate includes the secondary public key of the first cryptographic algorithm;
  • the verifying the signature of the next-level software based on the first cryptographic algorithm includes: after the signature verification of the public key certificate is passed, The first cryptographic algorithm and the second-level public key verify the signature of the next-level software.
  • the first cryptographic algorithm is a post-quantum algorithm for resisting post-quantum attacks.
  • the performing integrity check on the ESBC includes: performing the integrity check on the ESBC according to a baseline value of the ESBC stored in a secure storage entity.
  • the secure storage entity is a one-time programmable memory in the processor or a secure chip in the processor.
  • the processing unit is further configured to enable the first cryptographic algorithm for secure startup in the processor before verifying the signature of the next-level software based on the first cryptographic algorithm.
  • enabling the first cryptographic algorithm in the processor for secure startup includes: acquiring indication information, where the indication information is used to indicate that the first cryptographic algorithm is enabled for secure startup start up.
  • the processing unit is further configured to disable the use of a second cryptographic algorithm for secure booting in the processor after performing the integrity check on the ESBC, wherein the second cryptographic algorithm for verifying the signature of the next-level software before enabling the first cryptographic algorithm.
  • verifying the signature of the next-level software based on the first cryptographic algorithm includes: verifying the signature of the basic input/output system BIOS code based on the first cryptographic algorithm.
  • the processing unit is further configured to: verify the signature of the OS code of the operating system based on the first cryptographic algorithm; and verify the signature of the application program APP loaded by the OS based on the first cryptographic algorithm.
  • the obtaining unit is configured to: obtain the ESBC from the static random access memory SRAM of the processor.
  • the processing unit is further configured to: before acquiring the ESBC from the SRAM of the processor, store the external secure boot code ESBC stored in a non-volatile storage medium to the SRAM.
  • the present application provides a communication device, the communication device includes a memory and a processor; the memory is used for storing a program code; the processor is used for running the instructions in the program code, so that The communication device executes the method described in any one of the first aspect and the first aspect above, or causes the communication device to execute the method described in any one of the second aspect and the second aspect above.
  • an embodiment of the present application provides a secure storage entity, where the secure storage entity includes at least one reserved storage area, and the at least one reserved storage area is used to enable the first password when the first password is enabled.
  • a baseline value of an external secure boot code ESBC is stored, where the ESBC includes a code segment of the first cryptographic algorithm.
  • the secure storage entity is a one-time programmable memory or a secure chip in the processor.
  • the secure storage entity is a one-time programmable memory efuse
  • the storage area is a slot in the efuse
  • an embodiment of the present application provides a communication apparatus, where the communication apparatus includes the secure storage entity described in any one of the fifth aspect above.
  • an embodiment of the present application provides a computer storage medium, where an instruction is stored in the computer-readable storage medium, and when it runs on a computer, the computer is made to execute the above first aspect and the above first aspect The method described in any one of the above, or, causing the computer to execute the above second aspect and the method described in any one of the above second aspect.
  • an embodiment of the present application provides a computer program product, including a program that, when the program runs on a processor, implements the above first aspect and the method described in any one of the above first aspect, or, When the program runs on the processor, the above second aspect and the method described in any one of the above second aspects are implemented.
  • FIG. 1 is a schematic diagram of an exemplary application scenario
  • FIG. 2 is a schematic flowchart of a method for safe booting provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a method for safe booting provided by an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a device for safe startup provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the embodiments of the present application provide a method for safe booting, which can enable a communication device to cope with post-quantum attacks that may come at any time.
  • FIG. 1 the figure is a schematic diagram of an exemplary application scenario.
  • the secure boot process shown in Figure 1 is: after the communication device is powered on, first start the secure boot code (boot read-only memory secure boot code, BSBC), which uses the preset public key 1 and algorithm 1 to boot and load The digital signature of the bootloader is verified. If the digital signature of the bootloader is verified, the bootloader is loaded. After the bootloader is loaded, it uses the preset public key 2 and algorithm 1 to verify the digital signature of the operating system (operation system, OS). If the digital signature of the OS is verified, the OS uses the preset public key 3 and algorithm 1 to digitally sign the application (application, APP). If the digital signature of the APP is verified, the APP can be loaded.
  • BSBC boot read-only memory secure boot code
  • BSBC is the secure boot code inside the chip, which is a code fragment fixed inside a processor such as a central processing unit (CPU), and can also be called an internal secure boot code (ISBC).
  • the BSBC can be considered as the root of trust (ROT) of the communication device, and the ROT can be used to implement one or more security functions. For example, it is used to implement security functions such as secure storage and secure authentication.
  • the communication device mentioned in the embodiments of this application refers to a device with a communication function.
  • the communication device may be a network device such as a router and a switch, and for another example, the communication device may be a terminal device.
  • the communication devices mentioned in the embodiments of the present application include all devices that require switching of security algorithms.
  • the algorithm 1 used in the aforementioned secure boot process may be an RSA algorithm, an ECC algorithm, or other asymmetric cryptographic algorithms.
  • these passwords cannot meet better security requirements in some scenarios, or do not meet the security requirements of some users.
  • these asymmetric ciphers are not resistant to post-quantum attacks.
  • the life cycle of communication equipment can generally reach several years, especially for network equipment such as routers, whose communication cycle can be as long as several decades. Therefore, how to ensure that the cryptographic algorithms used by communication devices can always meet the security requirements, for example, before the arrival of the post-quantum era, how to ensure that the communication devices can cope with post-quantum attacks that may come at any time is an unsolved problem.
  • an embodiment of the present application provides a secure boot method.
  • the secure boot algorithm will be introduced with reference to the accompanying drawings.
  • signature is “digital signature”, and the two can be used interchangeably.
  • FIG. 2 is a schematic flowchart of a method for safe booting provided by an embodiment of the present application.
  • the method for secure booting shown in FIG. 2 can be performed by, for example, a communication device.
  • the method 100 for secure booting shown in FIG. 2, for example, may include the following S101-S103.
  • the communication device may first run a BSBC, and the BSBC may be executed in a processor of the communication device. After the communication device runs the BSBC, it can be determined whether the communication device needs to be booted securely according to the BSBC, and whether the cryptographic algorithm currently used for secure booting is an asymmetric cryptographic algorithm such as RSA, or other cryptographic algorithms obtained from outside.
  • asymmetric cryptographic algorithm such as RSA
  • the communication device may determine whether the communication device needs to be booted securely according to the value of the relevant parameter stored in the secure storage entity. For example, parameter 1 is stored in the secure storage entity, and the value of parameter 1 is used to indicate whether the communication device needs to be activated securely. In yet another example, the communication device may determine, according to the configuration information 1, whether the communication device needs to be booted securely.
  • the configuration information 1 may include, for example, indication information for indicating whether the communication device needs to be started securely.
  • the configuration information 1 includes indication information 1, where the indication information 1 is used to indicate that the communication device needs to be started securely.
  • the configuration information 1 may be stored, for example, in a secure storage entity of the communication device.
  • the communication device may determine, according to the value of the relevant parameter stored in the secure storage entity, a cryptographic algorithm used when the communication device is started securely.
  • parameter 2 is stored in the secure storage entity, and the value of parameter 2 is used to indicate a cryptographic algorithm used when the communication device is securely activated. For example, when the value of parameter 2 is 0, the communication device uses the default RSA during secure startup, and when the value of parameter 2 is 1, the communication device uses other cryptographic algorithms obtained from outside during secure startup.
  • parameter 2 and parameter 2' are stored in the secure storage entity, and the two together indicate a cryptographic algorithm used when the communication device is securely activated.
  • the value of parameter 2 is used to indicate the cryptographic algorithm used when the communication device is started securely, and the value of parameter 2' is used to indicate whether parameter 2 is officially effective.
  • the communication device uses other cryptographic algorithms obtained from the outside during secure startup.
  • the value of parameter 2' is 0, even if the value of parameter 2 is 1, the default RSA is used when the communication device is started securely, and other cryptographic algorithms obtained from outside cannot be used.
  • the communication device may determine, according to the aforementioned configuration information 1, a cryptographic algorithm used when the communication device is started securely.
  • the configuration information 1 may include, for example, indication information for instructing a cryptographic algorithm used when the communication device is started securely.
  • the configuration information 1 includes indication information 2, where the indication information 2 is used to instruct the communication device to use other cryptographic algorithms obtained from the outside when it is started securely.
  • the secure storage entity mentioned in the embodiment of the present application may be a one-time programmable memory in the processor, for example, a segment of FLASH inside the processor that cannot be re-edited, a one-time electrically programmable fuse (efuse) , can also be a security chip in the processor, can also be a read-only memory (read-only memory, ROM), or can be an external general-purpose memory with a security storage function, which is not limited here.
  • a one-time programmable memory in the processor for example, a segment of FLASH inside the processor that cannot be re-edited
  • efuse electrically programmable fuse
  • efuse can also be a security chip in the processor
  • the cryptographic algorithm used for secure boot of the communication device is an asymmetric cryptographic algorithm such as RSA
  • the asymmetric cryptographic algorithm can be used for secure boot.
  • the specific secure boot process please refer to the description of FIG. 1 above. Not detailed here.
  • the communication device may continue to perform the following S101-S103.
  • S101 Acquire an external boot security code ESBC, where the ESBC includes a code segment of a first cryptographic algorithm.
  • the ESBC may be stored in an external storage entity independent of the processor, for example, the ESBC may be stored in a non-volatile storage medium.
  • the non-volatile storage medium mentioned here may be, for example, flash.
  • the communication device After the communication device determines that the cryptographic algorithm used for secure boot is the cryptographic algorithm obtained from the outside, the communication device can read the ESBC stored in the non-volatile storage medium and store it in the static random access memory (static random access memory) of the processor. -access memory, SRAM), and then obtain the ESBC from the SRAM.
  • static random access memory static random access memory
  • the code segment of the first cryptographic algorithm in the embodiment of the present application is used to describe the first cryptographic algorithm.
  • the code segment of the first cryptographic algorithm may be a piece of software code.
  • an integrity check may be performed on the ESBC. If the ESBC passes the integrity check, it means that the code segment of the first cryptographic algorithm in the ESBC has not been tampered with. Therefore, the signature of the next-level software can be verified based on the first cryptographic algorithm.
  • the ESBC when S102 is specifically implemented, the ESBC can be used to perform integrity verification on the ESBC by using the baseline value of the ESBC.
  • the baseline value of the ESBC may be stored in a secure storage entity. Regarding the secure storage entity, you can refer to the relevant description part above, and the description will not be repeated here.
  • the communication device may acquire the baseline value of the ESBC stored in the secure storage entity, and then perform integrity verification on the ESBC by using the baseline value of the ESBC.
  • the baseline value of the ESBC mentioned here may be the hash value of the ESBC. In this case, the communication device can perform hash calculation on the ESBC, and compare the obtained calculation result with the baseline value of the ESBC. If the two are the same, the ESBC passes the integrity verification. If the two are different, Then the ESBC fails the integrity verification.
  • the hash algorithm can resist post-quantum attacks to a certain extent, and the longer the length of the hash calculation result, the stronger the ability to resist post-quantum attacks. For example, if the hash calculation result is 256 bits and the hash calculation result is 128 bits, the former is more resistant to post-quantum attacks than the latter. Therefore, when the baseline value of the ESBC is the hash value of the ESBC, the risk of the ESBC being cracked and tampered can also be mitigated to a certain extent. Moreover, in this embodiment of the present application, the length of the baseline value of the ESBC can also be set to a relatively long length (for example, 512 bits) to better resist post-quantum attacks.
  • the ESBC baseline value stored in the secure storage entity may be pre-stored in the secure storage entity.
  • the secure storage entity is an efuse in the processor
  • the ESBC baseline value may be pre-programmed into the efuse.
  • a corresponding storage area may be reserved for a secure storage entity in the communication device, so as to store the ESBC baseline value in the reserved storage area subsequently middle.
  • a storage area 1 is reserved in the storage entity, and before the communication device uses the first cryptographic algorithm for secure startup, the baseline value of the ESBC is stored in the storage area. in area 1.
  • the storage area may be, for example, a slot in the efuse.
  • multiple storage areas may be preset for it in the secure storage entity to store the baseline value of the ESBC containing the first cryptographic algorithm.
  • the reason for this is: when the secure storage entity is a one-time programmable memory, once the first cryptographic algorithm is modified, an unused storage area can be selected from the preset multiple storage areas to Stores the baseline value of the ESBC containing the first cryptographic algorithm. For example, when the first cryptographic algorithm is enabled for the first time, the baseline value of the ESBC containing the first cryptographic algorithm is stored in the storage area 1 of the one-time programmable memory. Since the storage area 1 has been set once, it cannot be Modify its value.
  • the baseline value of the ESBC containing the modified first cryptographic algorithm will change, and at this time, the changed baseline value can be stored in the storage area 2 of the one-time programmable memory.
  • the embodiments of the present application do not specifically limit the first cryptographic algorithm.
  • the first cryptographic algorithm may be a cryptographic algorithm resistant to post-quantum attacks. In this way, after the ESBC including the first cryptographic algorithm is obtained from the outside, the signature of the next-level software can be verified by using the first cryptographic algorithm resistant to post-quantum attacks. It can be seen that the use of this scheme can enable communication devices to cope with post-quantum attacks that may come at any time.
  • the first cryptographic algorithm may also be other cryptographic algorithms different from the default RSA algorithm, so that after the RSA algorithm is cracked, the first cryptographic algorithm can be used to verify the next level The signature of the software improves security.
  • the ESBC may further include a root public key baseline value, where the root public key baseline value is used to perform a comparation with the first cryptographic algorithm. Root public key for integrity verification.
  • the communication device may further perform integrity verification on the root public key of the first cryptographic algorithm based on the root public key baseline value.
  • the root public key baseline value mentioned here may be the root public key itself or a hash value of the root public key, which is not specifically limited in this embodiment of the present application.
  • the ESBC may include a public key certificate in addition to the code segment for describing the first cryptographic algorithm and the root public key baseline value.
  • the public key certificate may include the root public key of the first cryptographic algorithm.
  • the communication device can verify the legitimacy of the root public key according to the root public key in the public key certificate and the root public key baseline value. For example, when the root public key baseline value is the root public key itself, the root public key baseline value and the root public key in the public key certificate can be compared, and if the two are the same, the root public key value is determined. The public key passes the verification, and if the two are different, it is determined that the root public key fails the verification.
  • the root public key baseline value is the hash value of the root public key
  • the hash value of the root public key in the public key certificate can be calculated, and the calculation result can be compared with the root public key. Hash value, if the two are the same, it is determined that the root public key has passed the verification, and if the two are different, it is determined that the root public key has not passed the verification.
  • the root public key of the first cryptographic algorithm may be used to verify the signature of the next-level software. Therefore, if the root public key of the first cryptographic algorithm passes the verification, a possible implementation of S103 is: based on the first cryptographic algorithm and the root public key of the first cryptographic algorithm, verify the next level Software signature.
  • the communication device may use the second-level public key of the first cipher when verifying the signature of the next-level software.
  • the aforementioned public key certificate may further include the signature of the secondary public key and the public key certificate.
  • the communication device can use the verified root public key to verify the signature of the public key certificate. It can be understood that, if the signature of the public key certificate is verified, it means that the public key certificate is legal, so it can be considered that the secondary public key included in the public key certificate is legal, and it is determined in S102.
  • the ESBC passes the integrity verification, so the integrity of the secondary public key can also be guaranteed.
  • the signature of the next-level software can be verified by using the first cryptographic algorithm and the second-level public key of the first cryptographic algorithm.
  • the secondary public key may be a derived key of the root public key. That is: the key obtained after the root public key is derived using a key derivation algorithm.
  • the basic input/output system (basic input output system, BIOS) is the first software loaded when the CPU is running, therefore, S103 specifically During implementation, the signature of the BIOS can be verified by using the first cryptographic algorithm. For example, the signature of the BIOS can be verified using the first cryptographic algorithm and the corresponding public key (eg, the aforementioned root public key or secondary public key). In addition, after the BIOS is verified, the communication device can continue to verify the signature of the OS code using the first cryptographic algorithm and the corresponding public key (e.g., public key 1).
  • the communication device can load the OS, and continue to verify the signature of the APP by using the first cryptographic algorithm and the corresponding public key (eg, public key 2). After the signature of the APP is verified, the communication device can safely load the APP.
  • the communication device may further enable the first cryptographic algorithm in the processor for secure booting. After enabling the first cryptographic algorithm for secure boot, the communication device continues to perform "based on the first cryptographic algorithm for secure boot" in S103.
  • indication information 3 may be stored in the secure storage entity of the communication device, and the indication information 3 can be used to indicate that the first cryptographic algorithm is enabled.
  • the communication device may determine that the first cryptographic algorithm is enabled for secure startup after reading the indication information 3 from the secure storage entity, and further, the communication device may determine that the first cryptographic algorithm is enabled for secure booting based on The first cryptographic algorithm verifies the signature of the next-level software.
  • the indication information 3 may be embodied as a value of a parameter corresponding to the first cryptographic algorithm stored in the secure storage entity.
  • parameter 3 is stored in the secure storage entity, and the value of parameter 3 is used to indicate whether the first cryptographic algorithm is enabled for secure boot. For example, when the value of parameter 3 is 0, it means that the first cryptographic algorithm is enabled. When the value of parameter 3 is 1, it means that the first cryptographic algorithm is not enabled.
  • parameter 3 and parameter 3' corresponding to the first cryptographic algorithm are stored in the secure storage entity, and the two together indicate whether the first cryptographic algorithm is enabled.
  • the value of the parameter 3 is used to indicate whether the first cryptographic algorithm is enabled for secure startup, and the value of the parameter 3' is used to indicate whether the parameter 3 is officially effective. For example, when the value of parameter 3 is 1, and the value of parameter 3' is also 1, then the first cryptographic algorithm is enabled for secure boot. When the value of parameter 3' is 0, regardless of whether the value of parameter 3 is 0 or 1, the first cryptographic algorithm is not enabled for secure boot.
  • the indication information 3 may be an indication information in the aforementioned configuration information 1 .
  • the communication device may receive an algorithm enabling file from another device such as a network management, and The algorithm enabling file is verified, and after the algorithm enabling file is verified, based on the instructions of the algorithm enabling file, the value of each indication parameter in the secure storage entity is modified, so as to facilitate the safe start-up.
  • the cryptographic algorithm used in the secure boot process is determined according to the values of the respective indicated parameters.
  • the communication device may modify the local configuration file based on the instruction of the algorithm enabling file to obtain the aforementioned configuration file 1, so as to determine, according to the configuration information 1, the configuration file 1 for the secure boot process during the secure boot process.
  • the cryptographic algorithm used is the first cryptographic algorithm.
  • the algorithm enabling file may include, for example, information related to the enabled algorithm and related verification information. For example, it can be understood with reference to Table 1 below.
  • the "action type” can include two types, one is algorithm enable and the other is algorithm disable.
  • the type is algorithm enable.
  • “algorithm enablement” may include two stages, taking the enabling of the first cryptographic algorithm as an example, one stage is the programming of the baseline value (eg, the hash value) of the root public key of the first cryptographic algorithm stage, the other stage is the stage when the first cryptographic algorithm is officially effective for secure startup; in these two stages, the algorithm enabling file may be issued once respectively, or the algorithm enabling file may be issued only once, which is not done in this embodiment of the present application. Specific restrictions.
  • the baseline value of the algorithm root public key can be the hash value of the algorithm root public key.
  • the algorithm public key is the public key used to verify the next-level software, and the algorithm public key can be the root public key or the secondary public key.
  • Algorithm Name is used to indicate the name of the algorithm.
  • the preset slot of the baseline value of the ESBC file containing the algorithm is used to indicate the storage area corresponding to the baseline value of the ESBC file containing the algorithm in the secure storage entity.
  • the Device ID is used to indicate on which device the algorithm is enabled.
  • the "digital signature of the file” is used to authenticate the algorithm-enabled file.
  • Signature Algorithm is used to indicate the signature algorithm used by the “Digital Signature of File”.
  • the communication device After the communication device receives the algorithm enabling file, it can verify the signature of the algorithm enabling file. After the verification is passed, it can obtain the baseline value of the ESBC including the algorithm indicated by the algorithm enabling file, and store the baseline value in the secure storage. in the entity.
  • the communication device may store the ESBC baseline value of the code segment including the first cryptographic algorithm in the secure storage entity, so as to facilitate the execution of S102 , and perform the integrity check on the ESBC according to the baseline value of the ESBC stored in the secure storage entity.
  • the communication device may also modify the values of parameter 3 and parameter 3', so that the communication device performs the "verification based on the first cryptographic algorithm" in S103. Before signing the next level of software", it can be determined that the first cryptographic algorithm has been enabled for secure boot.
  • the communication device uses the second cryptographic algorithm for secure booting before using the first cryptographic algorithm for secure booting, that is: before using the first cryptographic algorithm for secure booting, the communication device uses the second cryptographic algorithm The algorithm verifies the signature of the next level of software. Then, after the first cryptographic algorithm is used for secure boot, the use of the second cryptographic algorithm for secure boot may also be prohibited.
  • the communication device may receive the algorithm prohibition file sent by the network administrator. After receiving the algorithm prohibition file, based on the instruction of the algorithm prohibition file, modify the value of the indication parameter corresponding to the second encryption algorithm in the secure storage entity, so as to achieve the purpose of prohibiting the second encryption algorithm.
  • the communication device may modify the aforementioned configuration file 1 based on the instruction of the algorithm prohibition file to obtain the aforementioned configuration file 2, so as to determine, according to the configuration information 2, the configuration file used for safe booting during the secure boot process.
  • the cipher algorithm is the first cipher algorithm, and the second cipher algorithm has been disabled for secure boot.
  • the network management mentioned in the embodiments of this application may be a device running a network management system (network management system, NMS).
  • the algorithm prohibition file may include information related to prohibited algorithms and related verification information.
  • the parameters included in the algorithm prohibition file reference may be made to the description part of Table 1 above, which will not be described in detail here.
  • the communication device can verify the signature of the algorithm prohibition file, and after the verification is passed, the parameters related to the second cryptographic algorithm in the secure storage entity can be modified.
  • the value of parameter 4 corresponding to the second cryptographic algorithm may be modified, and the value of parameter 4 is used to indicate whether the second cryptographic algorithm is prohibited.
  • the communication device may modify the value of the parameter 4 to 1 after the algorithm prohibits the file from passing the verification.
  • the local configuration information is modified from configuration information 1 to configuration information 2.
  • each cryptographic algorithm may correspond to an enable control bit, and correspondingly, each cryptographic algorithm may correspond to a prohibition control bit.
  • the Sig_Alg_Control and Sig_Alg_Forbid may each include 8 bytes. It can be understood in conjunction with Table 3 below.
  • the 8 bytes from high to low are used to indicate the enable control bit of algorithm 1, the enable control bit of algorithm 2, the enable control bit of algorithm 3, The enable control bit of algorithm 4 and the enable control bit of algorithm 5, the last 3 bytes are reserved.
  • the 8 bytes from high to low are used to indicate the prohibition control bit of algorithm 1, the prohibition control bit of algorithm 2, the prohibition control bit of algorithm 3, the prohibition control bit of algorithm 4 and the algorithm. 5 is the prohibition control bit, and the last 3 bytes are reserved.
  • the algorithm 1 may be, for example, the default RSA, and the algorithm 2, the algorithm 3, the algorithm 4, and the algorithm 5 may be cryptographic algorithms stored in an external storage entity.
  • the communication device may be preset with a cryptographic algorithm enabling file 1 when it is shipped from the factory, where the cryptographic algorithm enabling file 1 is used to indicate that the cryptographic algorithm used for secure boot is Algorithm 1 (for example, RSA).
  • the "action type" parameter in the cryptographic algorithm enabling file 1 may be, for example:
  • Alg_Forbid includes 8 bits, and the first 5 bits from high to low are the algorithm prohibition control bits of Algorithm 1 to Algorithm 5 respectively; X can be 0 or 1.
  • the RoTPK Hash can also include 8 bits, and the first 5 bits from high to low are the control bits of the root public key baseline value of Algorithm 1 to Algorithm 5, respectively.
  • the communication device enables file 1 according to the cryptographic algorithm, modifies the value of L1_control in the secure storage entity to 0, and modifies the value of L1_control_lock to 1.
  • the parameter L1_control mentioned here may correspond to the parameter 2 in the above method 100, and the L1_control_lock mentioned here may correspond to the parameter 2' in the above method 100.
  • the communication device may receive the encryption algorithm enabling file 2 sent by the network management, and the "action type" parameter in the encryption algorithm enabling file 2 may be, for example:
  • the communication device can verify the signature of the cryptographic algorithm enabling file 2, and after the signature of the cryptographic algorithm enabling file 2 is verified, the communication device can securely store the Modify the value of L1_control to 1, store the hash value of the first-level root public key of Algorithm 2 in the secure storage entity, and modify the control bit corresponding to Algorithm 2 in Sig_Alg_Control in the secure storage entity, for example, set the value of Sig_Alg_Control Modified to 1-1-0-0-0, and the baseline value of ESBC including Algorithm 2 is stored in a secure storage entity.
  • the baseline value of the ESBC including the algorithm 2 can be stored in the slot corresponding to the secure storage entity bit, and correspondingly modify the values of L1_slot_control and L1_slot_control_lock.
  • the communication device can store the baseline value of the ESBC including the algorithm 2 to the corresponding secure storage entity In slot 2 of the security storage entity, modify the value of the parameter L1_slot_control in the secure storage entity to 2, and set the value of L1_slot_control_lock to 1.
  • the communication device continues to receive the cryptographic algorithm enabling file 3 sent by the network management, and the "action type" parameter in the cryptographic algorithm enabling file 3 may be, for example:
  • the communication device After the communication device receives the cryptographic algorithm enabling file 3, it can verify the signature of the cryptographic algorithm enabling file 3. After the signature of the cryptographic algorithm enabling file 3 passes the verification, the communication device can verify that the value of Sig_Alg_Control is 1. -1-0-0-0, therefore, the communication device modifies the value of L1_control_lock to 1 to indicate that the value of L1_control takes effect. Then, the communication device can execute S101-S103 in the above method 100, so as to realize using the algorithm 2 for safe booting.
  • the communication device enabling algorithm 2 After the communication device enabling algorithm 2 is used for safe startup, it can continue to receive the password algorithm prohibition file 4 sent by the network management, and the "action type" parameter in the password algorithm prohibition file 4 can be, for example:
  • the communication device can verify the signature of the cryptographic algorithm prohibition file 4. After the signature of the cryptographic algorithm prohibition file 4 is verified, since the value of Alg_Forbid is 1-0-0- 0-0, therefore, the communication device modifies the value of Sig_Alg_Forbid in the secure storage entity to 1-0-0-0-0 to indicate that Algorithm 1 is disabled.
  • the highest byte of Sig_Alg_Forbid mentioned here may correspond to parameter 4 in the above method 100 .
  • FIG. 3 this figure is a schematic flowchart of a method for safe booting provided by an embodiment of the present application.
  • the method 200 for secure booting shown in FIG. 3, for example, may include the following S201-S202.
  • S202 During the second communication cycle, perform secure startup based on a first cryptographic algorithm obtained from outside the first device.
  • the first communication period and the second communication period are two different periods.
  • the end moment of the first communication cycle may be the start moment of the second communication cycle.
  • the second cryptographic algorithm is a cryptographic algorithm preset at the factory of the first device. For example, when the communication device leaves the factory, the second cryptographic algorithm is used for secure booting. After the first communication cycle ends, the second communication cycle is entered, and in the second communication cycle, the first cryptographic algorithm is used to perform secure startup.
  • the second cryptographic algorithm may also be a cryptographic algorithm obtained from outside the device after the first device leaves the factory. For example, as shown in the above embodiments of the present application, during the secure boot process, the code segment corresponding to the second cryptographic algorithm is obtained from the external secure boot code, so as to obtain the second cryptographic algorithm.
  • FIG. 4 this figure is a schematic structural diagram of a safety starting device provided by an embodiment of the present application.
  • the apparatus 400 for secure booting shown in FIG. 4 may include, for example, an acquisition unit 401 and a processing unit 402 .
  • an obtaining unit 401 configured to obtain an external secure boot code ESBC, where the ESBC includes a code segment of a first cryptographic algorithm;
  • a processing unit 402 configured to perform an integrity check on the ESBC
  • the processing unit 402 is further configured to verify the signature of the next-level software based on the first cryptographic algorithm after the ESBC passes the integrity check.
  • the ESBC further includes a root public key baseline value
  • the processing unit 402 is further configured to, before verifying the next-level software based on the first cryptographic algorithm, based on the root public key
  • the baseline value performs integrity verification on the root public key of the first cryptographic algorithm.
  • the processing unit 402 is further configured to verify the signature of the public key certificate based on the root public key of the first cryptographic algorithm after performing integrity verification on the root public key of the first cryptographic algorithm , the public key certificate includes the secondary public key of the first cryptographic algorithm;
  • the verification of the signature of the next-level software based on the first cryptographic algorithm includes:
  • the signature of the next-level software is verified based on the first cryptographic algorithm and the second-level public key.
  • the first cryptographic algorithm is a post-quantum algorithm for resisting post-quantum attacks.
  • the performing integrity check on the ESBC includes:
  • the integrity check is performed on the ESBC according to the baseline value of the ESBC stored in the secure storage entity.
  • the secure storage entity is a one-time programmable memory in the processor or a secure chip in the processor.
  • the processing unit 402 is further configured to enable the first cryptographic algorithm for secure startup in the processor before verifying the signature of the next-level software based on the first cryptographic algorithm.
  • enabling the first cryptographic algorithm in the processor for secure boot includes:
  • indication information where the indication information is used to indicate that the first cryptographic algorithm is enabled for secure startup.
  • the processing unit 402 is further configured to prohibit the use of a second cryptographic algorithm for secure booting in the processor after performing the integrity check on the ESBC, wherein the second cryptographic algorithm The algorithm is used to verify the signature of the next-level software before enabling the first cryptographic algorithm.
  • verifying the signature of the next-level software based on the first cryptographic algorithm includes:
  • the signature of the basic input/output system BIOS code is verified based on the first cryptographic algorithm.
  • processing unit 402 is further configured to:
  • the signature of the application program APP loaded by the OS is verified based on the first cryptographic algorithm.
  • the obtaining unit 401 is configured to:
  • the ESBC is obtained from the static random access memory SRAM of the processor.
  • processing unit 402 is further configured to:
  • the external secure boot code ESBC stored in a non-volatile storage medium is stored in the SRAM.
  • FIG. 5 is a schematic structural diagram of a communication apparatus provided by an embodiment of the present application.
  • the communication apparatus 500 can be used to execute the method 100 or the method 200 in the above embodiments.
  • the communication apparatus 500 may include a processor 510 and a memory 520 coupled to the processor 510 .
  • the processor 510 may be a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP), or a combination of CPU and NP.
  • the processor may also be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field programmable logic gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array logic, abbreviation: GAL) or any combination thereof.
  • the processor 510 may refer to one processor, or may include multiple processors.
  • the memory 520 may include volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) , such as read-only memory (English: read-only memory, abbreviation: ROM), flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviation: HDD) or solid-state drive (English: solid-state drive , abbreviation: SSD); the memory 520 may also include a combination of the above-mentioned types of memory.
  • the memory 520 may refer to one memory, or may include multiple memories.
  • computer-readable instructions are stored in the memory 520 , and the computer-readable instructions include a plurality of software modules, such as a sending module 521 , a processing module 522 and a receiving module 523 .
  • the processor 510 can perform corresponding operations according to the instructions of each software module.
  • an operation performed by a software module actually refers to an operation performed by the processor 510 according to the instruction of the software module.
  • the communication device 500 can execute the method 100 in the above embodiments, when the communication device 500 is used to execute the method 100 in the above embodiments: the processor 510 is configured to execute the relevant instructions in the memory 520 , to obtain the external boot security code ESBC, the ESBC includes the code segment of the first cryptographic algorithm, the integrity check is performed on the ESBC, and after the ESBC passes the integrity check, based on the first cryptographic algorithm Verify the signature of the next level software.
  • the processor 510 is configured to execute the relevant instructions in the memory 520 , to obtain the external boot security code ESBC
  • the ESBC includes the code segment of the first cryptographic algorithm
  • the integrity check is performed on the ESBC
  • Verify the signature of the next level software Verify the signature of the next level software.
  • the communication apparatus 500 may execute the method 200 in the above embodiments, and when the communication apparatus 500 is used for executing the method 200 in the above embodiments: the processor 510 is used for executing the relevant instructions in the memory 520 , so as to perform secure booting based on the second cryptographic algorithm in the first communication period, and perform secure booting based on the first cryptographic algorithm obtained from the outside of the first device in the second communication period.
  • the communication apparatuses may be the communication device itself or a part of the components on the communication device.
  • the communication device may be a network device such as a switch or a router, or may be a part of the network device, such as a single board, a line card, or a network device on the network device.
  • a functional module above may also be a chip for implementing the method of the present application, which is not specifically limited in the embodiment of the present application.
  • the functions performed by the acquisition unit 401 and the processing unit 402 in the apparatus 400 may be performed by a processor.
  • the processor may be, for example, the processor shown in apparatus 500 .
  • an embodiment of the present application further provides a secure storage entity, where the secure storage entity includes at least one reserved storage area, and the at least one reserved storage area is used for enabling the first cryptographic algorithm Before being used for secure boot, a baseline value of an external secure boot code ESBC is stored, where the ESBC includes a code segment of the first cryptographic algorithm.
  • the secure storage entity is a one-time programmable memory or a secure chip.
  • the full storage entity may be, for example, a one-time programmable memory in a processor, and the processor may be the processor described in the apparatus 500 described above.
  • the one-time programmable memory is a one-time electrically programmable electric fuse efuse
  • the storage area is a reserved slot in the efuse
  • an embodiment of the present application provides a communication apparatus, where the communication apparatus includes the above-mentioned secure storage entity.
  • the communication device may be used to perform the above method 100 or 200, for example.
  • the communication device may also be the device 400 or the device 500 including the secure storage entity.
  • the present application also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, and when the computer-readable storage medium is run on a computer, the computer is made to perform any one of the foregoing embodiments. any one or more of the methods (eg, method 100 and method 200 ).
  • the present application also provides a computer program product, including a computer program that, when run on a computer, causes the computer to perform the method described in any one of the preceding embodiments (eg, method 100 and method 200 ). ) any one or more of the operations.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of units is only a logical business division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each service unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of a software business unit.
  • the integrated unit if implemented as a software business unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .
  • the services described in the present invention may be implemented by hardware, software, firmware or any combination thereof.
  • the services may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Quality & Reliability (AREA)
  • Storage Device Security (AREA)

Abstract

一种安全启动的方法，该方法可以由通信设备执行。该方法可以使得通信设备能够基于不同的安全需求灵活的使用不同的密码算法进行安全启动，从而确保通信设备的安全性，通信设备可以获取外部安全启动代码。该ESBC中包括第一密码算法的代码段。获取所述ESBC之后，通信设备可以对所述ESBC进行完整性校验，并在所述ESBC通过完整性校验之后，基于所述第一密码算法验证下一级软件的签名。在通信设备所使用的密码算法无法满足安全需求时，可以获取ESBC，并利用ESBC中包括的第一密码算法，来进行安全启动，从而满足安全需求。

Description

一种安全启动的方法及装置
本申请要求于2021年3月25日提交中国国家知识产权局、申请号为202110321006.9、申请名称为“一种安全启动的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据安全领域，尤其涉及一种安全启动的方法及装置。
背景技术
为了确保网络设备在启动过程中的安全性，通常采用安全启动技术进行启动。安全启动过程中，先对待加载的应用程序的镜像文件进行验证，验证通过后才加载该应用程序的镜像文件，这样，确保启动过程中所加载的应用程序的镜像文件的完整性和合法性。
目前，网络设备内通常保存一种用于安全启动的密码算法，例如：涉及RSA、错误检查和纠正(error checking and correction，ECC)等非对称密码算法。当该密码算法无法满足更高的安全需求时，或者，该密码算法不符合部分用户的安全要求时，该网络设备无法再借助安全启动技术对启动中软件完整性进行安全保护，从而威胁网络设备的安全。
发明内容
本申请实施例提供了一种安全启动方法，使得通信设备能够基于不同的安全需求灵活的使用不同的密码算法进行安全启动，从而确保通信设备的安全性。例如，在后量子时代，量子计算机会得到广泛应用。量子计算机擅长逆向计算和并行计算，擅长从一个巨大的数据空间中找到符合条件的解，以及利用平行计算的特点模拟微观时间。目前安全启动软件的过程中广泛应用的非对称密码算法均无法抵抗后量子攻击。换言之，量子计算机能够破解目前安全启动软件的过程中广泛应用的非对称密码算法。通过本申请提供的方法，可以有效确保通信设备能够应对随时可能到来的后量子攻击。
第一方面，本申请实施例提供了一种安全启动的方法，该方法例如可以由通信设备执行。在一个示例中，通信设备可以获取外部安全启动代码(external secure boot code，ESBC)。该ESBC中包括第一密码算法的代码段。获取所述ESBC之后，通信设备可以对所述ESBC进行完整性校验。并在所述ESBC通过完整性校验之后，基于所述第一密码算法验证下一级软件的签名。由此可见，利用本方案，在通信设备出厂时安全启动所使用的密码算法无法满足安全需求时，可以获取ESBC，并利用ESBC中包括的第一密码算法，来进行安全启动，从而满足安全需求。在一个示例中，即使后量子时代到来，目前安全启动所使用的密码算法无法抵抗后量子攻击，通信设备也可以获取包括第一密码算法的ESBC，从而基于所述第一密码算法验证下一级软件的签名。在一个示例中，第一密码算法可以是抵抗后量子攻击的算法，这样一来，获取包括第一密码算法的ESBC之后，即可利用该抵抗后量子攻击的第一密码算法来验证下一级软件的签名。由此可见，利用本方案，能够使得通信设备能够应对随时可能到来的后量子攻击。
第二方面，本申请实施例提供了一种安全启动的方法，该方法例如可以由通信设备执行。在一个示例中，所述第一设备可以在第一通信周期内，基于第二密码算法进行安全启动，在第二通信周期内，基于从所述第一设备的外部获取的第一密码算法进行安全启动。由此可见，利用本方案，当第二密码算法不能满足安全需求时，可以从外部获取第一密码 算法，并基于第一密码算法进行安全启动，从而满足安全需求。在一个示例中，即使后量子时代到来，目前安全启动所使用的密码算法无法抵抗后量子攻击，通信设备也可以从外部获取第一密码算法，从而基于所述第一密码算法验证下一级软件的签名。在一个示例中，第一密码算法可以是抵抗后量子攻击的算法，这样一来，从外部获取第一密码算法之后，即可利用该抵抗后量子攻击的第一密码算法来验证下一级软件的签名。由此可见，利用本方案，能够使得通信设备能够应对随时可能到来的后量子攻击。
在一种实现方式中，在利用第一密码算法验证下一级软件的签名之前，所述方法还包括：获取外部安全启动代码ESBC，所述ESBC包括第一密码算法的代码段；对所述ESBC进行完整性校验。相应的，所述基于所述第一密码算法验证下一级软件的签名，包括：在所述ESBC通过所述完整性校验后，基于所述第一密码算法验证下一级软件的签名。
在一种实现方式中，所述第二密码算法为所述通信设备出厂时预置的密码算法。这样一来，可以在通信设备出厂时安全启动所使用的第二密码算法无法满足安全需求时，可以使用第一密码算法来进行安全启动，从而满足安全需求。
在以上第一方面和第二方面中：
在一种实现方式中，所述ESBC可以存储在独立于处理器的外部存储实体中，例如所述ESBC可以存储在非易失存储介质中。因此，在一个示例中，所述通信设备可以在确定利用第一密码算法用于安全启动之后，将非易失性存储介质存储的所述ESBC存储到处理器的SRAM中，而后，从所述SRAM中获取所述ESBC，以便于后续对所述ESBC进行完整性校验，并在所述ESBC通过完整性校验之后，利用所述第一密码算法验证下一级软件的签名。
在一种实现方式中，所述ESBC中除了包括第一密码算法的代码段之外，还可以包括根公钥基线值，该根公钥基线值用于对第一密码算法的根公钥进行完整性验证。对于这种情况，在基于所述第一密码算法验证下一级软件的签名之前，通信设备还可以基于所述根公钥基线值对第一密码算法的根公钥进行完整性验证。
在一种实现方式中，通信设备在对下一级软件的签名进行验证时，可以使用第一密码的二级公钥。对于这种情况，前述公钥证书中，还可以包括所述二级公钥和所述公钥证书的签名。此时，通信设备可以利用通过验证的所述根公钥，验证所述公钥证书的签名。以确定所述二级公钥的合法性以及完整性。在所述公钥证书通过验证之后，可以利用所述第一密码算法和所述第一密码算法的二级公钥，验证下一级软件的签名。
在一种实现方式中，对ESBC进行完整性校验时，可以利用所述ESBC的基线值对所述ESBC进行完整性校验。其中，安全存储实体中可以预先存储所述ESBC的基线值，这样一来，通信设备可以获取所述安全存储实体中存储的所述ESBC的基线值，而后，利用ESBC的基线值对所述ESBC进行完整性验证。
在一种实现方式中，所述安全存储实体为处理器中的一次性可编程存储器或处理器中的安全芯片。
在一种实现方式中，通信设备在所述基于所述第一密码算法验证下一级软件的签名之前，还可以在处理器中使能所述第一密码算法用于安全启动。这样一来，可以保证通信设备在基于第一密码算法验证下一级软件的签名之前，确保第一密码算法能够被使用。
在一种实现方式中，通信设备的安全存储实体中可以存储有指示信息，该指示信息能够用于指示第一密码算法被使能。对于这种情况，通信设备可以在从所述安全存储实体中读取到该指示信息之后，即可确定所述第一密码算法被使能用于安全启动，进一步地，通信设备即可基于所述第一密码算法验证下一级软件的签名。
在一种实现方式中，若通信设备在使用第一密码算法用于安全启动之前，使用第二密码算法用于安全启动，即：在使用第一密码算法用于安全启动之前，使用第二密码算法验证下一级软件的签名。则在第一密码算法被用于安全启动之后，还可以禁止使用所述第二密码算法用于安全启动，从而避免同时有两种密码算法被使能用于安全启动，影响通信设备正常安全启动。
在一种实现方式中，考虑到对于包括处理器系统例如CPU系统的通信设备而言，BIOS是CPU运行时加载的第一个软件，因此，通信设备使用第一密码算法验证下一级软件的签名在具体实现时，可以利用第一密码算法验证BIOS的签名。
在一种实现方式中，在BIOS通过验证之后，通信设备可以继续利用第一密码算法和对应的公钥验证OS代码的签名。在OS代码的签名通过验证之后，通信设备可以加载OS，并继续利用第一密码算法和对应的公钥，验证所述APP的签名。在所述APP的签名通过验证之后，通信设备即可安全的加载所述APP。
第三方面，本申请实施例提供了一种安全启动的装置，所述装置包括：获取单元，用于获取外部安全启动代码ESBC，所述ESBC包括第一密码算法的代码段；处理单元，用于对所述ESBC进行完整性校验；所述处理单元，还用于在所述ESBC通过所述完整性校验后，基于所述第一密码算法验证下一级软件的签名。
在一种实现方式中，所述ESBC还包括根公钥基线值，所述处理单元，还用于在基于所述第一密码算法对下一级软件进行验证之前，基于所述根公钥基线值对所述第一密码算法的根公钥进行完整性验证。
在一种实现方式中，所述处理单元，还用于对所述第一密码算法的根公钥进行完整性验证之后，基于所述第一密码算法的根公钥验证公钥证书的签名，所述公钥证书包括所述第一密码算法的二级公钥；所述基于所述第一密码算法验证下一级软件的签名，包括：在所述公钥证书的签名验证通过后，基于所述第一密码算法和所述二级公钥验证所述下一级软件的签名。
在一种实现方式中，所述第一密码算法为用于抵抗后量子攻击的后量子算法。
在一种实现方式中，所述对所述ESBC进行完整性校验包括：根据安全存储实体中存储的所述ESBC的基线值对所述ESBC进行所述完整性校验。
在一种实现方式中，所述安全存储实体为处理器中的一次性可编程存储器或处理器中的安全芯片。
在一种实现方式中，所述处理单元，还用于在基于所述第一密码算法验证下一级软件的签名之前，在处理器中使能所述第一密码算法用于安全启动。
在一种实现方式中，在处理器中使能所述第一密码算法用于安全启动，包括：获取指示信息，所述指示信息用于指示所述第一密码算法被使能，用于安全启动。
在一种实现方式中，所述处理单元，还用于在对所述ESBC进行完整性校验之后，在 处理器中禁止使用第二密码算法用于安全启动，其中，所述第二密码算法用于在使能所述第一密码算法之前，验证所述下一级软件的签名。
在一种实现方式中，基于所述第一密码算法验证下一级软件的签名，包括：基于所述第一密码算法验证基本输入/输出系统BIOS代码的签名。
在一种实现方式中，所述处理单元，还用于：基于所述第一密码算法验证操系统OS代码的签名；基于所述第一密码算法验证所述OS加载的应用程序APP的签名。
在一种实现方式中，所述获取单元，用于：从处理器的静态随机存取存储器SRAM中获取所述ESBC。
在一种实现方式中，所述处理单元，还用于：从处理器的SRAM中获取所述ESBC之前，将非易失性存储介质存储的所述外部安全启动代码ESBC存储到所述SRAM。
第四方面，本申请提供了一种通信装置，所述通信装置包括存储器和处理器；所述存储器，用于存储程序代码；所述处理器，用于运行所述程序代码中的指令，使得所述通信装置执行以上第一方面以及第一方面任意一项所述的方法，或者，使得所述通信装置执行以上第二方面以及第二方面任意一项所述的方法。
第五方面，本申请实施例提供了一种安全存储实体，所述安全存储实体中包括至少一个预留的存储区域，所述至少一个预留的存储区域用于在使能所述第一密码算法用于安全启动之前，存储外部安全启动代码ESBC的基线值，所述ESBC包括所述第一密码算法的代码段。
在一种实现方式中，所述安全存储实体为处理器中的一次性可编程存储器或者安全芯片。
在一种实现方式中，所述安全存储实体为一次性可编程存储器efuse，所述存储区域为所述efuse中的槽位。
第六方面，本申请实施例提供了一种通信装置，所述通信装置包括以上第五方面任意一项所述的安全存储实体。
第七方面，本申请实施例提供了一种计算机存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得所述计算机执行以上第一方面以及以上第一方面任意一项所述的方法，或者，使得所述计算机执行以上第二方面以及以上第二方面任意一项所述的方法。
第八方面，本申请实施例提供了一种计算机程序产品，包括程序，当所述程序在处理器上运行时，实现以上第一方面以及以上第一方面任意一项所述的方法，或者，当所述程序在处理器上运行时，实现以上第二方面以及以上第二方面任意一项所述的方法。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为一种示例性应用场景示意图；
图2为本申请实施例提供的一种安全启动的方法的流程示意图；
图3为本申请实施例提供的一种安全启动的方法的流程示意图；
图4为本申请实施例提供的一种安全启动的装置的结构示意图；
图5为本申请实施例提供的一种通信装置的结构示意图。
具体实施方式
本申请实施例提供了一种安全启动的方法，可以使得通信设备能够应对随时可能到来的后量子攻击。
为方便理解，首先对安全启动的相关技术进行简单介绍。
参见图1，该图为一种示例性应用场景示意图。
图1所示的安全启动流程为：通信设备上电之后，首先启动安全启动代码(boot read-only memory secure boot code，BSBC)，，其利用预先设定的公钥1和算法1对启动加载器(bootloader)的数字签名进行验证。若bootloader的数字签名通过验证则加载bootloader。bootloader加载之后，其利用预先设定的公钥2和算法1对操作系统(operation system，OS)的数字签名进行验证。若OS的数字签名通过验证，则OS利用预先设定的公钥3和算法1对应用程序(application，APP)的数字签名。若APP的数字签名通过验证，则可以加载所述APP。其中，BSBC是芯片内部的安全启动代码，是固定在处理器例如中央处理器(central processing unit，CPU)内部的代码片段，也可以被称为内部安全启动代码(internal secure boot code，ISBC)。BSBC可以认为是通信设备的信任根(root of trust，ROT)，ROT可以用于实现一种或者多种安全功能。例如，用于实现安全存储、安全验证等安全功能。
关于对数字签名进行验证的具体方式，此处不做详细描述。
本申请实施例中提及的通信设备，指的是具备通信功能的设备。例如，所述通信设备可以是路由器、交换机等网络设备，又如，所述通信设备可以是终端设备。本申请实施例提及的通信设备包括所有有安全算法切换需求的设备。
目前，前述安全启动过程中使用的算法1，可以是RSA、也可以是ECC算法，还可以是其它非对称密码算法。但是，这些密码在一些场景中不能满足更好的安全需求，或者，不符合部分用户的安全要求。例如，这些非对称密码并不能抵抗后量子攻击。而通信设备的生命周期一般可达数年，尤其是对于路由器等网络设备而言，其通信周期可以长达数十年。因此，如何确保通信设备所使用的密码算法能够一直符合安全需求，例如在后量子时代到来之前，如何确保通信设备能够应对随时可能到来的后量子攻击，是目前尚待解决的问题。
为了解决这个问题，本申请实施例提供了一种安全启动方法，接下来，结合附图对该安全启动算法进行介绍。
在本申请实施例的以下描述中，“签名”即为“数字签名”，二者可以交替使用。
参见图2，图2为本申请实施例提供的一种安全启动的方法的流程示意图。图2所示的安全启动的方法，例如可以由通信设备执行。
图2所示的安全启动的方法100，例如可以包括如下S101-S103。
在一个示例中，通信设备在执行S101-S103之前，首先可以运行BSBC，所述BSBC可以运行在通信设备的处理器中。通信设备运行BSBC之后，可以根据BSBC确定通信设备是否需要安全启动，以及确定当前安全启动所使用的密码算法是非对称密码算法例如RSA， 还是从外部获取的其它密码算法。
在一个示例中，所述通信设备可以根据安全存储实体中存储的相关参数的值，确定通信设备是否需要安全启动。例如，安全存储实体中存储有参数1，参数1的值用于指示通信设备是否需要安全启动。在又一个示例中，所述通信设备可以根据配置信息1，确定通信设备是否需要安全启动。该配置信息1中例如可以包括用于指示通信设备是否需要安全启动的指示信息。例如，所述配置信息1中包括指示信息1，指示信息1用于指示所述通信设备需要安全启动。其中，所述配置信息1例如可以存储在所述通信设备的安全存储实体中。
在一个示例中，所述通信设备可以根据安全存储实体中存储的相关参数的值，确定通信设备安全启动时所使用的密码算法。在一些实施例中，安全存储实体中存储有参数2，参数2的值用于指示通信设备安全启动时所使用的密码算法。例如，当参数2的值为0时，则通信设备安全启动时使用默认的RSA，当参数2的值为1时，则通信设备安全启动时利用从外部获取的其它密码算法。在另一些实施例中，安全存储实体中存储有参数2和参数2’，二者共同指示通信设备安全启动时所使用的密码算法。其中，参数2的值用于指示通信设备安全启动时所使用的密码算法，参数2’的值用于指示参数2是否正式生效。例如，当参数2的值为1时，且参数2’的值也是1时，则通信设备安全启动时利用从外部获取的其它密码算法。当参数2’的值为0时，即使参数2的值是1，则通信设备安全启动时也使用默认的RSA，而不能使用从外部获取的其它密码算法。
在又一个示例中，所述通信设备可以根据前述配置信息1，确定通信设备安全启动时所使用的密码算法。该配置信息1中例如可以包括用于指示通信设备安全启动时所使用的密码算法的指示信息。例如，所述配置信息1中包括指示信息2，指示信息2用于指示所述通信设备安全启动时利用从外部获取的其它密码算法。
本申请实施例中提及的安全存储实体，可以是处理器中的一次性可编程存储器，例如可以是处理器内部一段不可二次编辑的FLASH,一次性的电可编程的熔丝(efuse)，也可以是处理器中的安全芯片，还可以是只读存储器(read-only memory，ROM)，还可以是外部的具备安全存储功能的通用存储器，此处不做限定。
若通信设备需要安全启动，且通信设备安全启动所使用的密码算法是非对称密码算法例如RSA，可以利用该非对称密码算法进行安全启动，具体安全启动过程可以参考上文对于图1的描述部分，此处不做详述。
若通信设备需要安全启动，且通信设备安全启动所使用的密码算法是从外部获取的其它密码算法，通信设备可以继续执行以下S101-S103。
S101：获取外部启动安全代码ESBC，所述ESBC包括第一密码算法的代码段。
在本申请实施例中，所述ESBC可以存储在独立于处理器的外部存储实体中，例如所述ESBC可以存储在非易失存储介质中。此处提及的非易失存储介质，例如可以是flash。
通信设备在确定安全启动使用的密码算法为从外部获取的密码算法之后，可以读取所述非易失存储介质中存储的ESBC，并将其存储到处理器的静态随机存取存储器(static random-access memory，SRAM)中，而后，从所述SRAM中获取所述ESBC。
本申请实施例中的第一密码算法的代码段，用于描述第一密码算法。在一个示例中，所述第一密码算法的代码段，可以是一段软件代码。
S102：对所述ESBC进行完整性校验。
获取所述ESBC之后，为了避免ESBC中的第一密码算法被篡改，从而带来安全隐患，在本申请实施例中，可以对所述ESBC进行完整性校验。若所述ESBC通过完整性校验，则说明该ESBC中的第一密码算法的代码段没有被篡改，因此，可以基于所述第一密码算法验证下一级软件的签名。
在本申请实施例的一种实现方式中，S102在具体实现时，可以利用所述ESBC的基线值，对所述ESBC进行完整性验证。所述ESBC的基线值，可以存储在安全存储实体中。关于安全存储实体，可以参考上文的相关描述部分，此处不做重复描述。通信设备可以获取所述安全存储实体中存储的所述ESBC的基线值，而后，利用ESBC的基线值对所述ESBC进行完整性验证。此处提及的ESBC的基线值，可以是所述ESBC的哈希值。对于这种情况，通信设备可以对所述ESBC进行哈希计算，并比较得到的计算结果和所述ESBC的基线值，若二者相同，则所述ESBC通过完整性验证，若二者不同，则所述ESBC未通过完整性验证。
哈希算法在一定程度上能够抵抗后量子攻击，并且，哈希计算结果的长度越长，其抵抗后量子攻击的能力越强。例如，哈希计算结果为256比特与哈希计算结果为128比特相比，前者抵抗后量子攻击的能力较后者更强。因此，当所述ESBC的基线值为所述ESBC的哈希值时，也能在一定程度上减轻所述ESBC被破解以及被篡改的风险。而且，在本申请实施例中，还可以通过将所述ESBC的基线值的长度设置为比较长的长度(例如512比特)，以更好地抵抗后量子攻击。
在本申请实施例中，所述安全存储实体中存储的所述ESBC的基线值，可以是预先存储到所述安全存储实体中的。例如，当所述安全存储实体为处理器中的efuse时，所述ESBC的基线值，可以是预先烧写到所述efuse中的。
在一个示例中，所述通信设备在出厂时，可以为所述通信设备中的安全存储实体预留对应的存储区域，以便于后续将所述ESBC的基线值存储至所述预留的存储区域中。例如，在所述通信设备出厂时，所述存储实体中预留有存储区域1，在所述通信设备利用第一密码算法用于安全启动之前，将所述ESBC的基线值存储至所述存储区域1中。
当所述安全存储实体为efuse时，所述存储区域例如可以是所述efuse中的槽位。
在一种实现方式中，对于一个密码算法例如第一密码算法而言，可以在安全存储实体中为其预置多个存储区域来存储包含该第一密码算法的ESBC的基线值。这么做的原因在于：当所述安全存储实体为一次性可编程存储器时，一旦对该第一密码算法进行了修改，则可以从预置的多个存储区域中选择一个未使用的存储区域来存储包含该第一密码算法的ESBC的基线值。例如，第一次使能该第一密码算法时，将包含第一密码算法的ESBC的基线值存储在一次性可编程存储器的存储区域1中，由于存储区域1已经被置位一次，因此不可对它的值进行修改。后续对第一密码算法进行修改之后，则包含修改后的第一密码算法的ESBC的基线值会发生改变，此时，可以将改变后的基线值存储在一次性可编程存储器的存储区域2中。本申请实施例不具体限定所述第一密码算法，在一个示例中，所述第一密码算法可以是抵抗后量子攻击的密码算法。这样一来，从外部获取包括第一密码算法的ESBC之后，即可利用该抵抗后量子攻击的第一密码算法来验证下一级软件的签名。由 此可见，利用本方案，能够使得通信设备能够应对随时可能到来的后量子攻击。在又一个示例中，所述第一密码算法也可以是其它不同于默认的RSA算法的其它密码算法，这样一来，当RSA算法被破解之后，可以利用所述第一密码算法验证下一级软件的签名，提升安全性。
S103：在所述ESBC通过完整性校验后，基于所述第一密码算法验证下一级软件的签名。
在本申请实施例的一种实现方式中，所述ESBC中除了包括第一密码算法的代码段之外，还可以包括根公钥基线值，该根公钥基线值用于对第一密码算法的根公钥进行完整性验证。对于这种情况，在执行S103之前，通信设备还可以基于所述根公钥基线值对第一密码算法的根公钥进行完整性验证。此处提及的根公钥基线值，可以是所述根公钥本身，也可以是所述根公钥的哈希值，本申请实施例不做具体限定。
在一个示例中，所述ESBC除了包括用于描述第一密码算法的代码段、根公钥基线值之外，还可以包括公钥证书。所述公钥证书中可以包括第一密码算法的根公钥。这样一来，通信设备即可根据所述公钥证书中的根公钥，以及所述根公钥基线值，验证所述根公钥的合法性。例如，当所述根公钥基线值为所述根公钥本身时，可以比较所述根公钥基线值和所述公钥证书中的根公钥，若二者相同，则确定所述根公钥通过验证，若二者不同，则确定所述根公钥未通过验证。又如：当所述根公钥基线值为所述根公钥的哈希值时，可以计算所述公钥证书中的根公钥的哈希值，并比较计算结果和所述根公钥哈希值，若二者相同，则确定所述根公钥通过验证，若二者不同，则确定所述根公钥未通过验证。
在一个示例中，S103在具体实现时，可以利用所述第一密码算法的根公钥，验证下一级软件的签名。因此，若所述第一密码算法的根公钥通过验证，则S103的一种可能的实现方式为：基于所述第一密码算法和所述第一密码算法的根公钥，验证下一级软件的签名。
在又一个示例中，通信设备在对下一级软件的签名进行验证时，可以使用第一密码的二级公钥。对于这种情况，前述公钥证书中，还可以包括所述二级公钥和所述公钥证书的签名。此时，通信设备可以利用通过验证的所述根公钥，验证所述公钥证书的签名。可以理解的是，若所述公钥证书的签名通过验证，则说明所述公钥证书是合法的，因此可以认为所述公钥证书中包括的二级公钥合法，并且，在执行S102确定所述ESBC通过完整性验证，因此，所述二级公钥的完整性也能得到保证。换言之，若所述公钥证书通过验证，则说明所述二级公钥是合法的，并且，也没有被篡改。因此，可以利用所述第一密码算法和所述第一密码算法的二级公钥，验证下一级软件的签名。
关于所述第一密码算法的二级公钥，需要说明的是，在一个示例中，所述二级公钥可以是所述根公钥的派生密钥。即：利用密钥派生算法对所述根公钥进行派生之后得到的密钥。
在一个示例中，考虑到对于包括处理器系统例如CPU系统的通信设备而言，基本输入/输出系统(basic input output system，BIOS)是CPU运行时加载的第一个软件，因此，S103在具体实现时，可以利用第一密码算法验证BIOS的签名。例如，可以利用第一密码算法和对应的公钥(例如前述根公钥或者二级公钥)，验证BIOS的签名。另外，在BIOS通过验证之后，通信设备可以继续利用第一密码算法和对应的公钥(例如公钥1)验证OS代码的 签名。在OS代码的签名通过验证之后，通信设备可以加载OS，并继续利用第一密码算法和对应的公钥(例如公钥2)，验证所述APP的签名。在所述APP的签名通过验证之后，通信设备即可安全的加载所述APP。
在一个示例中，在执行S103之前，通信设备还可以在处理器中使能所述第一密码算法用于安全启动。在使能所述第一密码算法用于安全启动之后，通信设备继续执行S103中的“基于所述第一密码算法用于安全启动”。在一个示例中，通信设备的安全存储实体中可以存储有指示信息3，该指示信息3能够用于指示第一密码算法被使能。对于这种情况，通信设备可以在从所述安全存储实体中读取到该指示信息3之后，即可确定所述第一密码算法被使能用于安全启动，进一步地，通信设备即可基于所述第一密码算法验证下一级软件的签名。
在一些实施例中，所述指示信息3可以体现为安全存储实体中存储的第一密码算法对应的参数的值。在一些实施例中，安全存储实体中存储有参数3，参数3的值用于指示第一密码算法是否被使能用于安全启动。例如，当参数3的值为0时，表示第一密码算法被使能。当参数3的值为1时，表示第一密码算法未被使能。在另一些实施例中，安全存储实体中存储有第一密码算法对应的参数3和参数3’，二者共同指示第一密码算法是否被使能。其中，所述参数3的值用于指示第一密码算法是否被使能用于安全启动，参数3’的值用于指示参数3是否正式生效。例如，当参数3的值为1时，且参数3’的值也是1时，则第一密码算法被使能用于安全启动。当参数3’的值为0时，无论参数3的值是0还是1，则第一密码算法未被使能用于安全启动。在另一些实施例中，所述指示信息3可以是前述配置信息1中的一个指示信息。
在一些实施例中，若通信设备出厂时安全启动所使用的密码算法不是第一密码算法，则在执行以上方法100之前，所述通信设备可以从其它设备例如网管处接收算法使能文件，并对所述算法使能文件进行校验，在所述算法使能文件完成校验之后，基于该算法使能文件的指示，修改所述安全存储实体中各个指示参数的值，以便于在安全启动过程中，根据所述各个指示参数的值，确定安全启动过程中所使用的密码算法。或者，所述通信设备可以基于所述算法使能文件的指示，对本地的配置文件进行修改，得到前述配置文件1，以便于在安全启动过程中，根据所述配置信息1，确定安全启动所使用的密码算法为第一密码算法。
其中，所述算法使能文件中，例如可以包括与被使能的算法相关的信息以及相关的验证信息。例如，可以参考下表1进行理解。
表1
Figure PCTCN2021142998-appb-000001
关于表1所示的参数，需要说明的是：
“动作类型”可以包括两种，一种为算法使能，另一种为算法禁止，对于算法使能文件而言，其类型为算法使能。
在一个示例中，“算法使能”可以包括两个阶段，以使能第一密码算法为例，一个阶段是包括第一密码算法的根公钥的基线值(例如哈希值)的烧写阶段，另一个阶段为第一密码算法正式生效用于安全启动的阶段；这两个阶段可以分别下发一次算法使能文件，也可以仅下发一次算法使能文件，本申请实施例不做具体限定。
算法根公钥的基线值，例如可以是算法根公钥的哈希值。
算法公钥为对下一级软件进行验证时所使用的公钥，算法公钥可以是根公钥，也可以是二级公钥。
“算法名称”用于指示该算法的名称。
“包含该算法的ESBC文件的基线值的预置槽位”，用于指示包含该算法的ESBC文件的基线值在安全存储实体中对应的存储区域。
“器件标识”用于指示在哪个设备上使能该算法。
“文件的数字签名”用于对所述算法使能文件进行验证。
“签名算法”用于指示所述“文件的数字签名”所使用的签名算法。
通信设备接收到算法使能文件之后，可以验证算法使能文件的签名，验证通过之后，可以获取包括该算法使能文件所指示的算法的ESBC的基线值，并将该基线值存储到安全存储实体中。
在一个示例中，通信设备可以在接收到第一密码算法对应的算法使能文件之后，将包括第一密码算法的代码段的ESBC的基线值存储到安全存储实体中，以便于在执行S102时，根据安全存储实体中存储的所述ESBC的基线值对所述ESBC进行所述完整性校验。
另外，通信设备在接收到第一密码算法对应的算法使能文件之后，还可以对参数3和参数3’的值进行修改，使得通信设备在执行S103中的“基于所述第一密码算法验证下一级软件的签名”之前，能够确定所述第一密码算法已经被使能用于安全启动。
在一种实现方式中，若通信设备在使用第一密码算法用于安全启动之前，使用第二密 码算法用于安全启动，即：在使用第一密码算法用于安全启动之前，使用第二密码算法验证下一级软件的签名。则在第一密码算法被用于安全启动之后，还可以禁止使用所述第二密码算法用于安全启动。
在一个示例中，通信设备可以接收网管发送的算法禁止文件。在接收到算法禁止文件之后，基于该算法禁止文件的指示，修改所述安全存储实体中与第二密码算法对应的指示参数的值，从而达到禁止第二密码算法的目的。或者，所述通信设备可以基于所述算法禁止文件的指示，对前述配置文件1进行修改，得到前述配置文件2，以便于在安全启动过程中，根据所述配置信息2，确定安全启动所使用的密码算法为第一密码算法，并且，第二密码算法已经被禁止用于安全启动。本申请实施例中提及的网管，可以是运行了网络管理系统(network manage system，NMS)的设备。
所述算法禁止文件中例如可以包括与被禁止的算法相关的信息以及相关的验证信息。关于算法禁止文件所包括的参数，可以参考上文对于表1的描述部分，此处不再详述。
通信设备接收到用于禁止第二密码算法的算法禁止文件之后，可以验证算法禁止文件的签名，验证通过之后，可以修改安全存储实体中与第二密码算法相关的参数。例如，可以修改与第二密码算法对应的参数4的值，参数4的值用于指示第二密码算法是否被禁止。在一个示例中，通信设备可以在所述算法禁止文件通过验证之后，将所述参数4的值修改为1。又如，将本地的配置信息，由配置信息1修改为配置信息2。
以上对本申请实施例提供的安全启动算法进行了简单介绍。接下来，结合具体实施例对本申请实施例提供的安全启动算法进行介绍。
首先，对安全存储实体中存储的相关参数进行介绍，可参见表2，表2示出了安全存储实体中存储的参数。
表2
参数 功能
NS bit 用于指示是否支持安全启动
RoTPK Hash(可选) 当前所使用的密码算法的一级根公钥的哈希值
SubKey Category(可选) 当前所使用的密码算法二级子公钥类型
Sig_Alg_Control 密码算法使能控制位
Sig_Alg_Forbid 密码算法禁止控制位
L1_control 是否使用从外部获取的密码算法的控制位
L1_control_lock L1_control的锁定位，用于指示L1_control是否生效
L1_slot_control 包括当前被使能的密码算法的ESBC的基线值的存储槽位
L1_slot_control_lock L1_slot_control的锁定位，用于指示L1_slot_control是否生效
L1 Hash_slot1 槽位1中存储的基线值
L1 Hash_slot2 槽位2中存储的基线值
L1 Hash_slot3 槽位3中存储的基线值
L1 Hash_slot4 槽位4中存储的基线值
关于Sig_Alg_Control和Sig_Alg_Forbid需要说明的是，若外部存储实体中存储有多种密码算法，则每种密码算法可以各对应一个使能控制位，相应的，每种密码算法可以各对 应一个禁止控制位。
在一个示例中，所述Sig_Alg_Control和Sig_Alg_Forbid可以各包括8字节。可结合下表3进行理解，对于Sig_Alg_Control而言，该8字节从高位到低位，分别用于指示算法1的使能控制位、算法2的使能控制位、算法3的使能控制位、算法4的使能控制位以及算法5的使能控制位，最后3字节预留。类似的，对于Sig_Alg_Forbid而言，该8字节从高位到低位，分别用于指示算法1的禁止控制位、算法2的禁止控制位、算法3的禁止控制位、算法4的禁止控制位以及算法5的禁止控制位，最后3字节预留。其中，所述算法1例如可以为默认的RSA，算法2、算法3、算法4以及算法5可以为外部存储实体中存储的密码算法。
表3
Figure PCTCN2021142998-appb-000002
接下来，以所述算法1对应方法100中的第二密码算法，所述算法2对应方法100中的第一密码算法为例对本申请实施例中的安全启动的方法进行说明。
在一个示例中，通信设备在出厂时，可以预置有密码算法使能文件1，其中，该密码算法使能文件1用于指示安全启动所使用的密码算法为算法1(例如RSA)。此时，所述密码算法使能文件1中的“动作类型”参数例如可以为：
Figure PCTCN2021142998-appb-000003
其中，Alg_Forbid包括8比特，从高到低的前5比特分别为算法1至算法5的算法禁止控制位；X可以为0或者1。
RoTPK Hash也可以包括8比特，从高到底前5比特分别为算法1至算法5的根公钥基线值控制位。
通信设备根据该密码算法使能文件1，将安全存储实体中的L1_control的值修改为0，并将L1_control_lock的值修改为1。此处提及的参数L1_control，可以对应以上方法100中的参数2，此处提及的L1_control_lock，可以对应以上方法100中的参数2’。
通信设备运行一段时间之后，通信设备可以接收网管发送的密码算法使能文件2，所述密码算法使能文件2中的“动作类型”参数例如可以为：
Figure PCTCN2021142998-appb-000004
通信设备接收到所述密码算法使能文件2之后，可以验证所述密码算法使能文件2的签名，在所述密码算法使能文件2的签名通过验证之后，通信设备可以安全存储实体中的L1_control的值修改为1、将算法2的一级根公钥的哈希值存储至安全存储实体中，并且，修改安全存储实体中Sig_Alg_Control中与算法2对应的控制位，例如，将Sig_Alg_Control 的值修改为1-1-0-0-0，并且将包括算法2的ESBC的基线值存储至安全存储实体中。在一个示例中，可以根据密码算法使能文件2中的参数“包含该算法的ESBC文件的基线值的预置槽位”，将包括算法2的ESBC的基线值存储至安全存储实体对应的槽位中，并对应修改L1_slot_control和L1_slot_control_lock的值。例如，密码算法使能文件中，参数“包含该算法的ESBC文件的基线值的预置槽位”的值为2，则通信设备可以将包括算法2的ESBC的基线值存储至安全存储实体对应的槽位2中，并将安全存储实体中的参数L1_slot_control的值修改为2，将L1_slot_control_lock的值设置为1。
而后，通信设备继续接收网管发送的密码算法使能文件3，所述密码算法使能文件3中的“动作类型”参数例如可以为：
Figure PCTCN2021142998-appb-000005
通信设备接收到所述密码算法使能文件3之后，可以验证所述密码算法使能文件3的签名，在所述密码算法使能文件3的签名通过验证之后，通信设备由于Sig_Alg_Control的值为1-1-0-0-0，故而，通信设备将L1_control_lock的值修改为1，以指示L1_control的值正式生效。而后，通信设备即可执行以上方法100中的S101-S103，以实现利用算法2用于安全启动。
通信设备使能算法2用于安全启动之后，可以继续接收网管发送的密码算法禁止文件4，所述密码算法禁止文件4中的“动作类型”参数例如可以为：
Figure PCTCN2021142998-appb-000006
通信设备接收到所述密码算法禁止文件4之后，可以验证所述密码算法禁止文件4的签名，在所述密码算法禁止文件4的签名通过验证之后，由于Alg_Forbid的值为1-0-0-0-0，故而，通信设备将安全存储实体中的Sig_Alg_Forbid的值修改为1-0-0-0-0，以指示算法1被禁止。此处提及的Sig_Alg_Forbid的最高字节，可以对应以上方法100中的参数4。
本申请实施例还提供了一种安全启动的方法，参见图3，该图为本申请实施例提供的一种安全启动的方法的流程示意图。图3所示的安全启动的方法200，例如可以包括如下S201-S202。
S201：在第一通信周期内，基于第二密码算法进行安全启动。
S202：在第二通信周期内，基于从所述第一设备的外部获取的第一密码算法进行安全启动。
所述第一通信周期和所述第二通信周期是两个不同的周期。在一个示例中，所述第一通信周期的结束时刻可以是所述第二通信周期的起始时刻。在一个示例中，所述第二密码算法是所述第一设备出厂时预置的密码算法。例如，所述通信设备出厂时，利用第二密码算法进行安全启动。第一通信周期结束，进入第二通信周期，在第二通信周期，利用第一密码算法进行安全启动。在另一个示例中，所述第二密码算法也可以是在所述第一设备出厂后从设备外部获取的密码算法。例如，如本申请上述实施例所示，在安全启动过程中， 从外部安全启动代码中获取第二密码算法对应的代码段，从而获取所述第二密码算法。
关于利用外部获取的第一密码算法或第二密码算法进行安全启动的具体实现，可以参考上文对于方法100的具体描述部分，此处不做重复描述。关于利用内部预置的第二密码算法进行安全启动的具体实现方式，可以参考前文对于图1所示的安全启动方式的描述部分，此处不再重复描述。
本申请实施例还提供了一种安全启动的装置。参见图4，该图为本申请实施例提供的一种安全启动装置的结构示意图。
图4所示的安全启动的装置400，例如可以包括：获取单元401和处理单元402。
获取单元401，用于获取外部安全启动代码ESBC，所述ESBC包括第一密码算法的代码段；
处理单元402，用于对所述ESBC进行完整性校验；
所述处理单元402，还用于在所述ESBC通过所述完整性校验后，基于所述第一密码算法验证下一级软件的签名。
在一种实现方式中，所述ESBC还包括根公钥基线值，所述处理单元402，还用于在基于所述第一密码算法对下一级软件进行验证之前，基于所述根公钥基线值对所述第一密码算法的根公钥进行完整性验证。
在一种实现方式中，所述处理单元402，还用于对所述第一密码算法的根公钥进行完整性验证之后，基于所述第一密码算法的根公钥验证公钥证书的签名，所述公钥证书包括所述第一密码算法的二级公钥；
所述基于所述第一密码算法验证下一级软件的签名，包括：
在所述公钥证书的签名验证通过后，基于所述第一密码算法和所述二级公钥验证所述下一级软件的签名。
在一种实现方式中，所述第一密码算法为用于抵抗后量子攻击的后量子算法。
在一种实现方式中，所述对所述ESBC进行完整性校验包括：
根据安全存储实体中存储的所述ESBC的基线值对所述ESBC进行所述完整性校验。
在一种实现方式中，所述安全存储实体为处理器中的一次性可编程存储器或处理器中的安全芯片。
在一种实现方式中，所述处理单元402，还用于在基于所述第一密码算法验证下一级软件的签名之前，在处理器中使能所述第一密码算法用于安全启动。
在一种实现方式中，在处理器中使能所述第一密码算法用于安全启动，包括：
获取指示信息，所述指示信息用于指示所述第一密码算法被使能，用于安全启动。
在一种实现方式中，所述处理单元402，还用于在对所述ESBC进行完整性校验之后，在处理器中禁止使用第二密码算法用于安全启动，其中，所述第二密码算法用于在使能所述第一密码算法之前，验证所述下一级软件的签名。
在一种实现方式中，基于所述第一密码算法验证下一级软件的签名，包括：
基于所述第一密码算法验证基本输入/输出系统BIOS代码的签名。
在一种实现方式中，所述处理单元402，还用于：
基于所述第一密码算法验证操系统OS代码的签名；
基于所述第一密码算法验证所述OS加载的应用程序APP的签名。
在一种实现方式中，所述获取单元401，用于：
从处理器的静态随机存取存储器SRAM中获取所述ESBC。
在一种实现方式中，所述处理单元402，还用于：
从处理器的SRAM中获取所述ESBC之前，将非易失性存储介质存储的所述外部安全启动代码ESBC存储到所述SRAM。
关于所述装置400的各个单元所对应的功能的具体实现，可以参考上文对于方法100的相关描述部分，此处不做详述。
此外，本申请实施例还提供了一种通信装置500，参见图5所示，图5为本申请实施例提供的一种通信装置的结构示意图。
该通信装置500可以用于执行以上实施例中的方法100或者方法200。
如图5所示，通信装置500可以包括处理器510，与所述处理器510耦合连接的存储器520。处理器510可以是中央处理器(英文：central processing unit，缩写：CPU)，网络处理器(英文：network processor，缩写：NP)或者CPU和NP的组合。处理器还可以是专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)，可编程逻辑器件(英文：programmable logic device，缩写：PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程逻辑门阵列(英文：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。处理器510可以是指一个处理器，也可以包括多个处理器。存储器520可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如只读存储器(英文：read-only memory，缩写：ROM)，快闪存储器(英文：flash memory)，硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid-state drive，缩写：SSD)；存储器520还可以包括上述种类的多种存储器的组合。存储器520可以是指一个存储器，也可以包括多个存储器。在一个实施方式中，存储器520中存储有计算机可读指令，所述计算机可读指令包括多个软件模块，例如发送模块521，处理模块522和接收模块523。处理器510执行各个软件模块后可以按照各个软件模块的指示进行相应的操作。在本实施例中，一个软件模块所执行的操作实际上是指处理器510根据所述软件模块的指示而执行的操作。
在一个示例中，所述通信装置500可以执行以上实施例中的方法100，当通信装置500用于执行以上实施例中的方法100时：所述处理器510用于执行存储器520中的相关指令，以获取外部启动安全代码ESBC，所述ESBC包括第一密码算法的代码段，对所述ESBC进行完整性校验，并在所述ESBC通过完整性校验后，基于所述第一密码算法验证下一级软件的签名。
在一个示例中，所述通信装置500可以执行以上实施例中的方法200，当通信装置500用于执行以上实施例中的方法200时：所述处理器510用于执行存储器520中的相关指令，以在第一通信周期内，基于第二密码算法进行安全启动，并在第二通信周期内，基于从所述第一设备的外部获取的第一密码算法进行安全启动。
关于本申请实施例中提及的通信装置(例如安全启动的装置400以及通信装置500)，需要说明的是：所述通信装置可以是通信设备本身，也可以是通信设备上的一部分组件。例如，当通信设备为网络设备时，所述通信装置可以是交换机、路由器等网络设备，也可以是网络设备上的一部分组件，例如是网络设备上的单板，线卡，还可以是网络设备上的一个功能模块，还可以是用于实现本申请方法的芯片，本申请实施例不做具体限定。
在一个具体的示例中，装置400中获取单元401，处理单元402所执行的功能可以由处理器执行。该处理器例如可以是装置500中所示的处理器。
此外，本申请实施例还提供了一种安全存储实体，所述安全存储实体中包括至少一个预留的存储区域，所述至少一个预留的存储区域用于在使能所述第一密码算法用于安全启动之前，存储外部安全启动代码ESBC的基线值，所述ESBC包括所述第一密码算法的代码段。
在一种实现方式中，所述安全存储实体为一次性可编程存储器或者安全芯片。作为示例，该全存储实体例如可以是处理器中的一次性可编程存储器，该处理器可以是上文中所介绍的装置500中所述的处理器。
在一种实现方式中，所述一次性可编程存储器为一次性的电可编程的电熔丝efuse，所述存储区域为所述efuse中的预留槽位。
关于所述安全存储实体的相关描述，可以参考方法100中关于安全存储实体的描述部分，此处不再详述。关于所述安全存储实体中存储的ESBC的基线值，也可以参考方法100中关于ESBC的基线值的相关描述部分，此处不再重复描述。
此外，本申请实施例提供了一种通信装置，所述通信装置包括上述安全存储实体。所述通信装置例如可以用于执行以上方法100或者方法200。在一个示例中，所述通信装置还可以是包括了所述安全存储实体的装置400或装置500。
此外，本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得所述计算机执行前述实施例中任一实施例所述的方法(例如，方法100和方法200)中任意一个或多个操作。
此外，本申请还提供了一种计算机程序产品，包括计算机程序，当其在计算机上运行时，使得所述计算机执行前述实施例中任一实施例所述的方法(例如，方法100和方法200)中任意一个或多个操作。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通 过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑业务划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各业务单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件业务单元的形式实现。
集成的单元如果以软件业务单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的业务可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些业务存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上仅为本发明的具体实施方式而已。
以上，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (33)

  1. 一种安全启动的方法，其特征在于，所述方法包括：
    获取外部安全启动代码ESBC，所述ESBC包括第一密码算法的代码段；
    对所述ESBC进行完整性校验；
    在所述ESBC通过所述完整性校验后，基于所述第一密码算法验证下一级软件的签名。
  2. 根据权利要求1所述的方法，其特征在于，所述ESBC还包括根公钥基线值，在基于所述第一密码算法对下一级软件进行验证之前，所述方法还包括：
    基于所述根公钥基线值对所述第一密码算法的根公钥进行完整性验证。
  3. 根据权利要求2所述的方法，对所述第一密码算法的根公钥进行完整性验证之后，所述方法还包括：
    基于所述第一密码算法的根公钥验证公钥证书的签名，所述公钥证书包括所述第一密码算法的二级公钥；
    所述基于所述第一密码算法验证下一级软件的签名，包括：
    在所述公钥证书的签名验证通过后，基于所述第一密码算法和所述二级公钥验证所述下一级软件的签名。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第一密码算法为用于抵抗后量子攻击的后量子算法。
  5. 根据权利要求1-4任一所述的方法，其特征在于，所述对所述ESBC进行完整性校验包括：
    根据安全存储实体中存储的所述ESBC的基线值对所述ESBC进行所述完整性校验。
  6. 根据权利要求5所述的方法，其特征在于，所述安全存储实体为处理器中的一次性可编程存储器或处理器中的安全芯片。
  7. 根据权利要求1-6任意一项所述的方法，其特征在于，所述基于所述第一密码算法验证下一级软件的签名之前，所述方法还包括：
    在处理器中使能所述第一密码算法用于安全启动。
  8. 根据权利要求7所述的方法，其特征在于，在处理器中使能所述第一密码算法用于安全启动，包括：
    获取指示信息，所述指示信息用于指示所述第一密码算法被使能，用于安全启动。
  9. 根据权利要求1-8任意一项所述的方法，其特征在于，所述对所述ESBC进行完整性校验之后，所述方法还包括：
    在处理器中禁止使用第二密码算法用于安全启动，其中，所述第二密码算法用于在使能所述第一密码算法之前，验证所述下一级软件的签名。
  10. 根据权利要求1-9任意一项所述的方法，其特征在于，基于所述第一密码算法验证下一级软件的签名，包括：
    基于所述第一密码算法验证基本输入/输出系统BIOS代码的签名。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，所述方法还包括：
    基于所述第一密码算法验证操系统OS代码的签名；
    基于所述第一密码算法验证所述OS加载的应用程序APP的签名。
  12. 根据权利要求1-11任一项所述的方法，其特征在于，所述获取外部安全启动代码，包括：
    从处理器的静态随机存取存储器SRAM中获取所述ESBC。
  13. 根据权利要求12所述的方法，其特征在于，从处理器的SRAM中获取所述ESBC之前，所述方法还包括：
    将非易失性存储介质存储的所述外部安全启动代码ESBC存储到所述SRAM。
  14. 一种安全启动的装置，其特征在于，所述装置包括：
    获取单元，用于获取外部安全启动代码ESBC，所述ESBC包括第一密码算法的代码段；
    处理单元，用于对所述ESBC进行完整性校验；
    所述处理单元，还用于在所述ESBC通过所述完整性校验后，基于所述第一密码算法验证下一级软件的签名。
  15. 根据权利要求14所述的装置，其特征在于，所述ESBC还包括根公钥基线值，所述处理单元，还用于在基于所述第一密码算法对下一级软件进行验证之前，基于所述根公钥基线值对所述第一密码算法的根公钥进行完整性验证。
  16. 根据权利要求15所述的装置，其特征在于，所述处理单元，还用于对所述第一密码算法的根公钥进行完整性验证之后，基于所述第一密码算法的根公钥验证公钥证书的签名，所述公钥证书包括所述第一密码算法的二级公钥；
    所述基于所述第一密码算法验证下一级软件的签名，包括：
    在所述公钥证书的签名验证通过后，基于所述第一密码算法和所述二级公钥验证所述下一级软件的签名。
  17. 根据权利要求14-16任一项所述的装置，其特征在于，所述第一密码算法为用于抵抗后量子攻击的后量子算法。
  18. 根据权利要求14-17任一所述的装置，其特征在于，所述对所述ESBC进行完整性校验包括：
    根据安全存储实体中存储的所述ESBC的基线值对所述ESBC进行所述完整性校验。
  19. 根据权利要求18所述的装置，其特征在于，所述安全存储实体为处理器中的一次性可编程存储器或处理器中的安全芯片。
  20. 根据权利要求14-19任意一项所述的装置，其特征在于，
    所述处理单元，还用于在基于所述第一密码算法验证下一级软件的签名之前，在处理器中使能所述第一密码算法用于安全启动。
  21. 根据权利要求20所述的装置，其特征在于，在处理器中使能所述第一密码算法用于安全启动，包括：
    获取指示信息，所述指示信息用于指示所述第一密码算法被使能，用于安全启动。
  22. 根据权利要求14-21任意一项所述的装置，其特征在于，
    所述处理单元，还用于在对所述ESBC进行完整性校验之后，在处理器中禁止使用第二密码算法用于安全启动，其中，所述第二密码算法用于在使能所述第一密码算法之前，验证所述下一级软件的签名。
  23. 根据权利要求14-22任意一项所述的装置，其特征在于，基于所述第一密码算法验证下一级软件的签名，包括：
    基于所述第一密码算法验证基本输入/输出系统BIOS代码的签名。
  24. 根据权利要求14-23任一项所述的装置，其特征在于，所述处理单元，还用于：
    基于所述第一密码算法验证操系统OS代码的签名；
    基于所述第一密码算法验证所述OS加载的应用程序APP的签名。
  25. 根据权利要求14-24任一项所述的装置，其特征在于，所述获取单元，用于：
    从处理器的静态随机存取存储器SRAM中获取所述ESBC。
  26. 根据权利要求25所述的装置，其特征在于，所述处理单元，还用于：
    从处理器的SRAM中获取所述ESBC之前，将非易失性存储介质存储的所述外部安全启动代码ESBC存储到所述SRAM。
  27. 一种安全存储实体，其特征在于，所述安全存储实体中包括至少一个预留的存储区域，所述至少一个预留的存储区域用于在使能所述第一密码算法用于安全启动之前，存储外部安全启动代码ESBC的基线值，所述ESBC包括所述第一密码算法的代码段。
  28. 根据权利要求27所述的方法，其特征在于，所述安全存储实体为处理器中的一次性可编程存储器或者安全芯片。
  29. 根据权利要求27所述的方法，其特征在于，所述安全存储实体为一次性可编程存储器efuse，所述存储区域为所述efuse中的槽位。
  30. 一种通信装置，其特征在于，包括权利要求27-29任意一项所述的安全存储实体。
  31. 一种通信装置，其特征在于，包括存储器和处理器；
    所述存储器，用于存储程序代码；
    所述处理器，用于运行所述程序代码中的指令，使得所述通信装置执行以上权利要求1-13任意一项所述的方法。
  32. 一种计算机存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在处理器上运行时，实现权利要求1-13任意一项所述的方法。
  33. 一种计算机程序产品，其特征在于，包括程序，当所述程序在处理器上运行时，实现权利要求1-13任意一项所述的方法。
PCT/CN2021/142998 2021-03-25 2021-12-30 一种安全启动的方法及装置 WO2022199190A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21932797.0A EP4300340A4 (en) 2021-03-25 2021-12-30 SECURE BOOTING METHOD AND APPARATUS
US18/469,807 US20240005007A1 (en) 2021-03-25 2023-09-19 Secure boot method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110321006.9 2021-03-25
CN202110321006.9A CN115130143A (zh) 2021-03-25 2021-03-25 一种安全启动的方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/469,807 Continuation US20240005007A1 (en) 2021-03-25 2023-09-19 Secure boot method and apparatus

Publications (1)

Publication Number Publication Date
WO2022199190A1 true WO2022199190A1 (zh) 2022-09-29

Family

ID=83374772

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/142998 WO2022199190A1 (zh) 2021-03-25 2021-12-30 一种安全启动的方法及装置

Country Status (4)

Country Link
US (1) US20240005007A1 (zh)
EP (1) EP4300340A4 (zh)
CN (1) CN115130143A (zh)
WO (1) WO2022199190A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117909980A (zh) * 2022-10-10 2024-04-19 华为技术有限公司 一种启动验证方法及相关装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1553349A (zh) * 2003-05-29 2004-12-08 联想(北京)有限公司 一种安全芯片及基于该芯片的信息安全处理设备和方法
CN103902915A (zh) * 2014-04-17 2014-07-02 中国科学院信息工程研究所 一种可信工控终端及其构建方法
CN104156659A (zh) * 2014-08-14 2014-11-19 电子科技大学 一种嵌入式系统的安全启动方法
CN106209376A (zh) * 2016-07-01 2016-12-07 陕西科技大学 一种抵抗伪造签名攻击的多变量签名方法
CN111783097A (zh) * 2020-05-28 2020-10-16 东方红卫星移动通信有限公司 一种星载计算系统的信息完整性度量验证方法及系统
CN112511306A (zh) * 2020-11-03 2021-03-16 中国航空工业集团公司西安航空计算技术研究所 一种基于混合信任模型的安全运行环境构建方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8667580B2 (en) * 2004-11-15 2014-03-04 Intel Corporation Secure boot scheme from external memory using internal memory
EP1845470B1 (en) * 2006-04-13 2016-11-09 STMicroelectronics (Research & Development) Limited Multiple purpose integrated circuit
KR20120092222A (ko) * 2011-02-11 2012-08-21 삼성전자주식회사 보안 부팅 방법 및 보안 부트 이미지 생성 방법
CN103886246B (zh) * 2012-12-22 2018-08-31 三星电子株式会社 支持认证装置安全引导的动态改变的方法和设备
US10592669B2 (en) * 2016-06-23 2020-03-17 Vmware, Inc. Secure booting of computer system

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1553349A (zh) * 2003-05-29 2004-12-08 联想(北京)有限公司 一种安全芯片及基于该芯片的信息安全处理设备和方法
CN103902915A (zh) * 2014-04-17 2014-07-02 中国科学院信息工程研究所 一种可信工控终端及其构建方法
CN104156659A (zh) * 2014-08-14 2014-11-19 电子科技大学 一种嵌入式系统的安全启动方法
CN106209376A (zh) * 2016-07-01 2016-12-07 陕西科技大学 一种抵抗伪造签名攻击的多变量签名方法
CN111783097A (zh) * 2020-05-28 2020-10-16 东方红卫星移动通信有限公司 一种星载计算系统的信息完整性度量验证方法及系统
CN112511306A (zh) * 2020-11-03 2021-03-16 中国航空工业集团公司西安航空计算技术研究所 一种基于混合信任模型的安全运行环境构建方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4300340A4

Also Published As

Publication number Publication date
EP4300340A1 (en) 2024-01-03
US20240005007A1 (en) 2024-01-04
CN115130143A (zh) 2022-09-30
EP4300340A4 (en) 2024-09-04

Similar Documents

Publication Publication Date Title
US10339327B2 (en) Technologies for securely binding a platform manifest to a platform
US11496518B2 (en) System and method for distributed network access control
US10771264B2 (en) Securing firmware
US9147075B1 (en) Apparatus and method for securely logging boot-tampering actions
JP6073320B2 (ja) デジタル署名するオーソリティ依存のプラットフォームシークレット
US9208292B2 (en) Entering a secured computing environment using multiple authenticated code modules
JP7450713B2 (ja) ソフトウェア完全性保護方法および装置、ならびにソフトウェア完全性検証方法および装置
US11252193B2 (en) Attestation service for enforcing payload security policies in a data center
WO2018086469A1 (zh) 芯片中非易失性存储空间的数据存储方法和可信芯片
US11868474B2 (en) Securing node groups
US10936722B2 (en) Binding of TPM and root device
JP2017504267A (ja) セキュアブート中のキー抽出
US20190042725A1 (en) System, Apparatus And Method For Independently Recovering A Credential
US11347858B2 (en) System and method to inhibit firmware downgrade
US12021982B2 (en) Method for performing secure boot based on redundant cryptographic algorithm and device
CN112148314B (zh) 一种嵌入式系统的镜像验证方法、装置、设备及存储介质
WO2022199190A1 (zh) 一种安全启动的方法及装置
CN115934194A (zh) 一种控制器启动方法、装置、电子设备及储存介质
WO2023029826A1 (zh) 一种启动文件校验方法、校验组件及设备
CN116244253A (zh) 硬件完整性验证机制
US12056262B2 (en) Applying trusted backup configuration to a node
US12039052B2 (en) Information processing apparatus, method of controlling the same, and storage medium
US20240126928A1 (en) Data security verification method and electronic apparatus
US20240193275A1 (en) Electronic device and secure booting method thereof
CN118551386A (zh) 一种云平台的安全启动方法及片上系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21932797

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2021932797

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2021932797

Country of ref document: EP

Effective date: 20230926

NENP Non-entry into the national phase

Ref country code: DE