DE102018211932A1 - Method and device for safely starting a device - Google Patents

Abstract

Method (10) for the safe start of a device (30), characterized by the following features: - a boot manager of the device (30) is verified (11), - if verification (11) is successful (12), the boot manager is loaded ( 13), - the boot manager loads an update routine (14), - the update routine checks a status indicator of the device (30) (15) and - if the status indicator indicates normal operation (16), a non-volatile program memory of the device ( 30) protected against write access (17).

Description

The present invention relates to a method for safely starting a device. The present invention also relates to a corresponding device, a corresponding computer program and a corresponding storage medium.

State of the art

In the area of digital rights management (DRM), so-called hardware restrictions are widespread, which grant content protection through the electronic components of a device. A relevant measure is known to the person skilled in the art as a secure boot and limits the booting of the device to software which the device manufacturer deems to be trustworthy in order to prevent malware or other unwanted programs from starting.

DE102015202936A1 discloses a method for influencing data communication with a device, in which, in response to a received challenge of a predetermined challenge-response authentication method, a cryptographic signature of instructions or data provided for the operation of the device, a cryptographic signature generated by the device, generated by a certification body at least one rule regarding which, in particular physical, data may be transmitted via which communication channels or which security measures are to be taken during transmission or at the recipient, a public cryptographic key suitable for validating the cryptographic signature of the device, and a response that attests that the cryptographic signature of the device was created in a trusted area of the device.

Disclosure of the invention

Against this background, the invention provides a method for safely starting a device, a corresponding device, a corresponding computer program and a corresponding storage medium according to the independent claims.

One advantage of this solution is its high flexibility: the proposed method builds on an initial trust anchor, which is not changed as much as possible during the lifetime of the device.

The measures listed in the dependent claims allow advantageous developments and improvements of the basic idea specified in the independent claim. Thus, it can be provided that after the program memory has been protected, application programs from the program memory are verified and loaded. The application programs are only executed by the device if this verification is successful. In this way, the chain of trust is extended to the software component to be protected and manipulation of the software during the runtime is prevented by the write protection. This protection of the software component is carried out transparently on the target device and therefore does not require any additional steps when creating the software, for example for signing the software.

According to a further aspect, it can be provided that the verification of the application programs is carried out by means of a block cipher such as AES operated in the Galois / Counter Mode (GCM). This opens up the transparent use of a symmetrical encryption method with the possibility of verifying the authenticity of the software component to be executed while it is being loaded from its persistent memory. By using such a symmetrical cryptography method for the authentication of the software, a high speed of authentication is achieved. This is done transparently during charging with negligible additional effort.

According to a further aspect, it can be provided that if the start fails after loading the boot manager, the device is put into update mode. In this, the device can be re-recorded using the normal update process in order to bring it into a functional state, provided the hardware is error-free. In most cases, an attack via the memory is reliably recognized and appropriately handled by the system.

According to a further aspect, it can be provided that the write accesses to the program memory are optionally permitted by a trusted system platform (trusted computing base) of the device. Such platforms are trusted across industries because they are robust and protected from attack by isolation.

list of figures

• 1 das Flussdiagramm eines Verfahrens gemäß einer ersten Ausführungsform.
• 2 schematisch ein Steuergerät gemäß einer zweiten Ausführungsform.

Embodiments of the invention are shown in the drawings and explained in more detail in the following description. It shows:

• 1 the flowchart of a method according to a first embodiment.
• 2 schematically a control device according to a second embodiment.

Embodiments of the invention

1 illustrates the basic steps of a safe start-up procedure ( 10 ) according to an embodiment of the invention. Instead of signing the entire software of a device, the process presented is based on an initial trust anchor. Such an anchor of trust can be embodied, for example, by an unencrypted and signed boot manager.

An unencrypted boot manager should not contain confidential data. This initial boot manager is the software component which - once verified (process 11 ) and loaded (process 13 ) - controls the further boot process and removes the write rights for subsequent software components.

The chain of trust is continued by the initial, authentic boot component initializing the system to such an extent that encrypted code and in particular an update routine can be loaded from the memory (process 14 ). If the system is to be booted and an update is not requested (decision 15 ), the initial component irrevocably withdraws the rights to write areas of the flash memory that contain executable code. For this purpose, the system's memory protection unit (MPU) is configured accordingly and write protection of the configuration is activated (process 17 ).

This procedure means that the device must be restarted to update it. After executing the initial component, a second, decrypted boot manager is loaded, which can no longer change the executable code of the system. All subsequent components only have to check the so-called authentication tag, which is generated by AES-GCM during decryption, and an abort ( 24 ) of the boot process if the calculated tag does not match a stored reference value.

There are two use cases to consider in which a secure boot process can fail. The first case occurs when the initial software cannot be verified or the first component to be verified symmetrically cannot be authenticated (branch 23 ). In this state, the control unit can no longer use the normal update mechanism ( 19 ) to be repaired and does not start. The second error occurs when the boot process is later in the process ( 10 ) fails.

It should be noted that the write protection of the code area in the memory does not necessarily have to last until a possible restart. The write protection of the memory can also be removed at runtime by a secure mechanism. However, the write authorization should only be changed by authentic software components such as a trustworthy system platform.

This method ( 10 ) can, for example, in software or hardware or in a mixed form of software and hardware, for example in a control unit ( 30 ) be implemented as the schematic representation of the 2 clarified.

QUOTES INCLUDE IN THE DESCRIPTION

This list of documents listed by the applicant has been generated automatically and is only included for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102015202936 A1 [0003]

Claims (10)

Method (10) for the safe start of a device (30), characterized by the following features: - a boot manager of the device (30) is verified (11), - if verification (11) is successful (12), the boot manager is loaded ( 13), - an update routine is loaded by the boot manager (14), - the update routine checks a status indicator of the device (30) (15) and - if the status indicator indicates normal operation (16), a non-volatile program memory of the device ( 30) protected against write access (17). Method (10) according to Claim 1 , characterized by the following feature: - if the status indicator indicates a pending update (18), the device (30) is switched to an update mode (19). Method (10) according to Claim 2 , characterized by the following features: - after protecting (17) the program memory, application programs from the program memory are verified and loaded (20) and - if verification and loading (20) is successful (21), the application programs are activated by the device (30 ) carried out (22). Method (10) according to Claim 3 , characterized by the following feature: - If the verification of the boot manager (11) or the application programs (20) fails (23), the start is aborted (24). Method (10) according to Claim 3 or 4 , characterized by the following feature: - the application programs (20) are verified by means of a block cipher operated in a Galois counter mode. Method (10) according to one of the Claims 2 to 5 , characterized by the following feature: - if the start fails after loading (13) the boot manager, the device (30) is also put into update mode (19). Method (10) according to one of the Claims 1 to 6 , characterized by the following features: - the write accesses to the program memory are optionally permitted by a trustworthy system platform of the device (30). Computer program which is set up, the method (10) according to one of the Claims 1 to 7 perform. Machine-readable storage medium on which the computer program according Claim 8 is saved. Device (30) which is set up to process (10) according to one of the Claims 1 to 7 perform.

Images