Method for implementing firmware root-of-trust, and apparatus, device and readable storage-medium thereof
View Patent ↗The disclosure relates to the field of computer security. Provided are a method for implementing a firmware root-of-trust, and an apparatus, a device, and a readable storage-medium thereof. The method includes: setting a storage-medium for storing state-data of the firmware root-of-trust; integrating a processing-logic of an instruction of the firmware root-of-trust into a system-firmware; initializing the firmware root-of-trust, according to the state-data of the firmware root-of-trust and a startup-command of the firmware root-of-trust; creating a node of a device-tree for the firmware root-of-trust, for an operating-system to load a driver-program corresponding to the firmware root-of-trust; and registering an instruction-interface of the firmware root-of-trust into an interface-list.
1. A method for implementing a firmware root-of-trust, wherein the method comprises: setting a storage-medium for storing state-data of the firmware root-of-trust; integrating a processing-logic of an instruction of the firmware root-of-trust into a system-firmware; initializing the firmware root-of-trust, according to the state-data of the firmware root-of-trust and a startup-command of the firmware root-of-trust; creating a node of a device-tree for the firmware root-of-trust, for an operating-system to load a driver-program corresponding to the firmware root-of-trust; and registering an instruction-interface of the firmware root-of-trust into an interface-list; and wherein the initializing the firmware root-of-trust according to the state-data of the firmware root-of-trust and the startup-command of the firmware root-of-trust, comprises: obtaining the state-data of the firmware root-of-trust from the storage-medium; configuring an operating-state of the firmware root-of-trust according to the state-data of the firmware root-of-trust; loading persistent-data stored in the firmware root-of-trust from a user; and executing the startup-command of the firmware root-of-trust, to initialize internal data of the firmware root-of-trust;
wherein the method further comprises: executing the instruction of the firmware root-of-trust through the driver-program, and obtaining a processing-result of the instruction of the firmware root-of-trust; and wherein the executing the instruction of the firmware root-of-trust through the driver-program and obtaining the processing-result of the instruction of the firmware root-of-trust, comprises: receiving an access-request for the firmware root-of-trust indicating that the instruction of the firmware root-of-trust input from the user is received, through an operating-interface of the firmware root-of-trust provided by the operating-system; storing current states of a stack and a register; calling the instruction-interface to process the instruction of the firmware root-of-trust; obtaining a processing-result of the instruction-interface; restoring states of the stack and the register; and returning the processing-result of the instruction of the firmware root-of-trust.
2. The method for implementing the firmware root-of-trust according to claim 1 , wherein the calling the instruction-interface to process the instruction of the firmware root-of-trust, comprises: obtaining the instruction of the firmware root-of-trust; executing the instruction of the firmware root-of-trust; in response to the instruction of the firmware root-of-trust changing the state-data of the firmware root-of-trust, storing the state-data of the firmware root-of-trust; and returning an execution-result of the instruction of the firmware root-of-trust.
3. The method for implementing the firmware root-of-trust according to claim 2 , wherein, before the executing the instruction of the firmware root-of-trust, the method further comprises: in response to the instruction of the firmware root-of-trust containing time-information, calculating the time-information.
4. The method for implementing the firmware root-of-trust according to claim 3 , wherein the calculating the time-information, comprises: obtaining a timer-base when counting starts; and obtaining a counting-result by calculating a difference-value of the counting.
5. The method for implementing the firmware root-of-trust according to claim 1 , wherein the creating the node of the device-tree for the firmware root-of-trust, comprises: writing device-information into a node of a device-tree of the computer.
6. The method for implementing the firmware root-of-trust according to claim 1 , wherein a Flash-chip is used as the storage-medium for the state-data of the root-of-trust.
7. The method for implementing the firmware root-of-trust according to claim 1 , wherein a cryptographic mechanism is adopted to ensure security of the state-data of the firmware root-of-trust.
8. The method for implementing the firmware root-of-trust according to claim 1 , wherein the operating-system and application-programs change the state-data of the firmware root-of-trust through the instruction-interface of the firmware root-of-trust.
9. The method for implementing the firmware root-of-trust according to claim 6 , wherein the state-data of the firmware root-of-trust is stored into the Flash-chip in real time.
10. A computer device, comprising: a memory and a processor, wherein computer-readable instructions are stored in the memory and operable in the processor, and when the processor executes the computer-readable instructions, the processor performs operations comprising: setting a storage-medium for storing state-data of the firmware root-of-trust; integrating a processing-logic of an instruction of the firmware root-of-trust into a system-firmware; initializing the firmware root-of-trust, according to the state-data of the firmware root-of-trust and a startup-command of the firmware root-of-trust; creating a node of a device-tree for the firmware root-of-trust, for an operating-system to load a driver-program corresponding to the firmware root-of-trust; and registering an instruction-interface of the firmware root-of-trust into an interface-list; and wherein the initializing the firmware root-of-trust according to the state-data of the firmware root-of-trust and the startup-command of the firmware root-of-trust, comprises: obtaining the state-data of the firmware root-of-trust from the storage-medium; configuring an operating-state of the firmware root-of-trust according to the state-data of the firmware root-of-trust; loading persistent-data stored in the firmware root-of-trust from a user; and executing the startup-command of the firmware root-of-trust, to initialize internal data of the firmware root-of-trust; executing the instruction of the firmware root-of-trust through the driver-program, and obtaining a processing-result of the instruction of the firmware root-of-trust; and wherein the executing the instruction of the firmware root-of-trust through the driver-program and obtaining the processing-result of the instruction of the firmware root-of-trust, comprises: receiving an access-request for the firmware root-of-trust indicating that the instruction of the firmware root-of-trust input from the user is received, through an operating-interface of the firmware root-of-trust provided by the operating-system; storing current states of a stack and a register; calling the instruction-interface to process the instruction of the firmware root-of-trust; obtaining a processing-result of the instruction-interface; restoring states of the stack and the register; and returning the processing-result of the instruction of the firmware root-of-trust.
11. A non-transitory computer-readable storage-medium, storing computer-readable instructions, wherein, when the computer-readable instructions are executed by a processor, the computer-readable instructions cause the processor to perform operations comprising: setting a storage-medium for storing state-data of the firmware root-of-trust; integrating a processing-logic of an instruction of the firmware root-of-trust into a system-firmware; initializing the firmware root-of-trust, according to the state-data of the firmware root-of-trust and a startup-command of the firmware root-of-trust; creating a node of a device-tree for the firmware root-of-trust, for an operating-system to load a driver-program corresponding to the firmware root-of-trust; and
registering an instruction-interface of the firmware root-of-trust into an interface-list; and
wherein the initializing the firmware root-of-trust according to the state-data of the firmware root-of-trust and the startup-command of the firmware root-of-trust, comprises:
obtaining the state-data of the firmware root-of-trust from the storage-medium;
configuring an operating-state of the firmware root-of-trust according to the state-data of the firmware root-of-trust; loading persistent-data stored in the firmware root-of-trust from a user; and executing the startup-command of the firmware root-of-trust, to initialize internal data of the firmware root-of-trust; executing the instruction of the firmware root-of-trust through the driver-program, and obtaining a processing-result of the instruction of the firmware root-of-trust; and wherein the executing the instruction of the firmware root-of-trust through the driver-program and obtaining the processing-result of the instruction of the firmware root-of-trust, comprises: receiving an access-request for the firmware root-of-trust indicating that the instruction of the firmware root-of-trust input from the user is received, through an operating-interface of the firmware root-of-trust provided by the operating-system; storing current states of a stack and a register;
calling the instruction-interface to process the instruction of the firmware root-of-trust;
obtaining a processing-result of the instruction-interface; restoring states of the stack and the register; and returning the processing-result of the instruction of the firmware root-of-trust.