CN118550561A - Firmware generation method, firmware update method and firmware processing device - Google Patents

Abstract

The present invention relates to the field of firmware update technology, and in particular to a firmware generation method, a firmware update method, and a firmware processing device. The firmware generation method includes: when the firmware is generated, first obtain an image file, a loading startup file, and a pair of key values; the pair of key values includes a first key value and a second key value that match each other; then use a security fidelity verification method to verify the image file and the loading startup file to obtain a first verification value, and use the first key value to sign the first verification value to obtain a first signature; finally, encapsulate the image file, the loading startup file, the first signature, and the second key value into a firmware to be updated; wherein the first signature and the second key value can be used to verify the integrity of the image file and the loading startup file during the firmware update process, thereby ensuring the success rate of the firmware update.

Description

Firmware generation method, firmware update method and firmware processing device

Technical Field

The present invention relates to the technical field of firmware update, and in particular to a firmware generation method, a firmware update method and a firmware processing device.

Background Art

Firmware is the control program of the hardware device, which is used to manage the functions and performance of the hardware device. When the functions and requirements of the hardware device change, the firmware in the hardware device also needs to be updated accordingly.

During the firmware update process, the firmware to be updated is first downloaded to the hardware device, and then the update program is run to update the new firmware to the hardware device. During the firmware download and transmission process, the integrity of the image file and the loaded startup file in the firmware may be affected by factors such as signal interruption, data packet loss, malicious firmware tampering, and bundled risky software. In the related art, no integrity verification strategy for the image file and the loaded startup file in the firmware is set during the firmware generation and firmware update process. In this way, when the integrity of the image file or the loaded startup file is damaged, the firmware update will fail.

The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art.

Summary of the invention

The main purpose of the present invention is to provide a firmware generation method and a firmware update method, aiming to solve the technical problem in the prior art that the integrity of the image file or the loaded startup file cannot be verified when the firmware is updated.

On the one hand, the present application provides a firmware generation method, comprising:

Obtain an image file, load a startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other;

Using a security and fidelity verification method to verify the image file and the loaded startup file to obtain a first verification value;

Sign the first verification value using the first key value to obtain a first signature;

The image file, the loading startup file, the first signature and the second key value are encapsulated into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file.

In one embodiment, before obtaining the image file, loading the startup file and a pair of key values, the method further includes:

Obtain a key pair in a trusted environment;

The private key in the key pair is converted to obtain the first key value; the public key in the key pair is converted to obtain the second key value.

In one embodiment, the using of a security fidelity verification method to verify the image file and the loaded startup file to obtain a first verification value includes:

The trform-model in AmzXL in the AI computing power component library is used to perform hash verification on the image file and the loaded startup file to obtain the first verification value.

On the other hand, the present application also provides a firmware update method, wherein the firmware is generated by any of the firmware generation methods described above, and the firmware update method includes:

Receive a firmware to be updated, wherein the firmware to be updated includes an image file, a loading startup file, a first signature, and a second key value;

Obtaining an image file and a loading startup file included in the firmware to be updated, and verifying the image file and the loading startup file using a security fidelity verification method to obtain a second verification value;

Obtaining a second key value included in the firmware to be updated, performing security verification on the second key value, and if the verification passes, using the second key value to sign the second check value to obtain a second signature;

Determine whether the first signature and the second signature match, and if so, determine that the firmware to be updated passes verification.

In one embodiment, the firmware update method further includes:

When the firmware to be updated passes the verification, the firmware to be updated is updated to the current device.

In one embodiment, the adopting a security fidelity verification method to verify the image file and the loaded startup file to obtain a second verification value includes:

The trform-model in AmzXL in the AI computing power component library is used to perform hash verification on the image file and the loaded startup file to obtain the second verification value.

In one embodiment, after determining whether the first signature and the second signature match, the method further includes:

The result of whether the first signature and the second signature match is updated in the firmware update log.

On the other hand, the present application also provides a firmware generation device, including:

An acquisition unit, used to acquire an image file, load a startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other;

A verification unit, configured to verify the image file and the loaded startup file using a security and fidelity verification method to obtain a first verification value;

A signature unit, configured to sign the first verification value using the first key value to obtain a first signature;

The encapsulation unit is used to encapsulate the image file, the loading startup file, the first signature and the second key value into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file.

On the other hand, the present application also provides a firmware processing device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the firmware generation method as described in any one of the above items; or the computer program is configured to implement the steps of the firmware update method as described in any one of the above items.

On the other hand, the present application also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the firmware generation method as described in any one of the above items are implemented; or the computer program is configured to implement the steps of the firmware update method as described in any one of the above items.

On the other hand, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the firmware generation method as described in any one of the above items; or the computer program is configured to implement the steps of the firmware update method as described in any one of the above items.

According to the firmware generation method provided by the present invention, when the firmware is generated, firstly, an image file, a loading startup file and a pair of key values are obtained; the pair of key values includes a first key value and a second key value that match each other; then, a security fidelity verification method is used to verify the image file and the loading startup file to obtain a first verification value, and the first key value is used to sign the first verification value to obtain a first signature; finally, the image file, the loading startup file, the first signature and the second key value are encapsulated into the firmware to be updated; wherein, the first signature and the second key value can be used to verify the integrity of the image file and the loading startup file during the firmware update process, thereby ensuring the success rate of the firmware update.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the structure of a firmware processing device in a hardware operating environment according to an embodiment of the present invention;

FIG2 is a schematic diagram of a firmware generation method according to an embodiment of the present invention;

FIG3 is a schematic diagram of a firmware update method according to an embodiment of the present invention;

FIG4 is a schematic diagram of a hardware device structure for updating firmware according to an embodiment of the present invention;

FIG5 is a schematic diagram of the structure of a firmware generation device provided in an embodiment of the present application.

The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

DETAILED DESCRIPTION

It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

Referring to Figure 1, Figure 1 is a schematic diagram of the structure of a firmware processing device in a hardware operating environment according to an embodiment of the present invention. The firmware processing device may be a firmware generating device or a firmware updating device.

As shown in FIG1 , the firmware processing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

Those skilled in the art will appreciate that the structure shown in FIG. 1 does not constitute a limitation on the firmware processing device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a firmware generation program or a firmware update program.

In the firmware processing device shown in FIG1 , the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the device of the present invention can be set in the firmware processing device, and the firmware processing device calls the firmware processing program stored in the memory 1005 through the processor 1001, and executes the firmware generation method or the firmware update method provided in the embodiment of the present invention.

It is understandable that when the functions and requirements of hardware devices change, the firmware in the hardware devices also needs to be updated accordingly. For example, existing firmware on the market usually improves stability and security or enhances functionality. Specifically, firmware updates can improve the performance and compatibility of accelerator cards by optimizing code, improving algorithms, or fixing bugs. As technology develops, manufacturers may release new firmware versions to provide better performance.

Firmware generally mainly includes image files and loading startup files. The image files mainly include the updated software program code, and the loading startup files are mainly used to control the loading and startup process of the image files, thereby completing the firmware update process. In order to ensure the success rate of firmware updates, it is necessary to verify the integrity of the image files and loading startup files in the firmware. If the integrity of the image files and loading startup files is damaged, it will affect the firmware update process, resulting in firmware update failure or hardware device freeze or paralysis. In addition, updating firmware that has not been signature verified may bring security risks, performance issues, credibility and integrity issues, and maintenance and support issues. Firmware that lacks signature verification may contain malicious code or vulnerabilities, causing the system to be threatened by security vulnerabilities and may cause performance degradation or instability. In addition, non-verified signature firmware updates may increase the difficulty of maintenance and support. In order to ensure the security and success rate of firmware updates, firmware should be signature verified.

In order to overcome the defects in the related art, the present application provides a method of using signature verification in the firmware generation and update process to check the integrity of the image file and the loading startup file in the firmware. The firmware after signature verification can ensure the integrity of the image file and the loading startup file in the firmware, which improves the success rate and security of the firmware update. Specifically, when the firmware is generated, the present application first obtains the image file, the loading startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other; then the image file and the loading startup file are verified by a security fidelity verification method to obtain a first verification value, and the first verification value is signed by the first key value to obtain a first signature; finally, the image file, the loading startup file, the first signature and the second key value are encapsulated into the firmware to be updated; wherein the first signature and the second key value can be used to verify the integrity of the image file and the loading startup file during the firmware update process, thereby ensuring the success rate of the firmware update.

An embodiment of the present invention provides a firmware generation method. Referring to FIG. 2 , FIG. 2 is a schematic flow chart of the firmware generation method provided by the embodiment of the present invention.

In this embodiment, the firmware generation method includes:

Step S201, obtaining an image file, loading a startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other.

In this embodiment, a key pair is first obtained in a trusted environment; since the key pair may contain special characters and other information that affect signature verification, in this embodiment, the private key in the key pair is converted to obtain the first key value; the public key in the key pair is converted to obtain the second key value. For example, in a secure offline environment, a pair of key values is generated by a chip manufacturer or other trusted institution. The second key value is used to encrypt and verify the signature, while the first key value is only securely stored in the trusted area and used to generate a digital signature.

In one embodiment, a PKI (Public Key Infrastructure) tree may be generated first, the private key and the public key are a key pair on the PKI tree, and then the private key and the secret key are respectively converted into base64 to obtain a first key value and a second key value.

Step S202: Use a security and fidelity verification method to verify the image file and the loaded startup file to obtain a first verification value.

In one embodiment, the image file and the loading startup file are hash-checked using the trform-model in AmzXL in the AI computing component library to obtain the first check value. The first check value is a unique identifier generated based on the image file and the loading startup file.

Exemplarily, after the initial check value is calculated by the hash function, the optimal check value of the currently loaded boot image can be calculated during the startup process in combination with the trform-model (originally used for the back-flow data model) in AmzXL in the AI computing power component library. If it is not the optimal check value, the calculation is repeated to obtain the optimal check value of the current image file. If the optimal check value is obtained, it can be confirmed that the current image file has not been tampered with.

In this embodiment, the first check value generated by the "security fidelity check" is more secure than the fixed-length check value generated by the hash function, can prevent tampering, and ensure the integrity of the image file and the security during the transmission process.

Step S203: Use the first key value to sign the first verification value to obtain a first signature.

It can be understood that using the first key value to sign the first verification value is equivalent to using a private key to sign the first verification value.

Among them, the first key value is generally safely stored in the trusted area to ensure that only authorized hardware devices can generate a valid first signature.

Specifically, the verification process in the above step S202 and the signing process in the above step S203 can be packaged into a signature tool, which is essentially a software signature function module. The signature tool can be used to verify and sign the input firmware related files.

Step S204: encapsulate the image file, the loading startup file, the first signature and the second key value into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file.

In one embodiment, the image file, the loading startup file, the first signature and the second key value are packaged into the firmware to be updated in a trusted environment. Specifically, the first signature and the second key value can be stored in a one-time programmable memory.

In one embodiment, a hash function may be used to verify the second key value to obtain a first hash verification value of the second key value, and the first hash verification value of the second key value may be stored in a one-time programmable memory.

It can be seen that according to the firmware generation method provided in this embodiment, when the firmware is generated, firstly, an image file, a loading startup file and a pair of key values are obtained; the pair of key values includes a first key value and a second key value that match each other; then, a security fidelity verification method is used to verify the image file and the loading startup file to obtain a first verification value, and at the same time, the first verification value is signed using the first key value to obtain a first signature; finally, the image file, the loading startup file, the first signature and the second key value are encapsulated into the firmware to be updated; wherein, the first signature and the second key value can be used to verify the integrity of the image file and the loading startup file during the firmware update process, thereby ensuring the success rate of the firmware update.

Based on the firmware generation method provided in the above embodiment, a firmware update method corresponding to the above firmware generation method is provided below.

Further, referring to FIG. 3 , FIG. 3 is a schematic flow chart of a firmware update method provided by an embodiment of the present invention, wherein the firmware update method comprises:

Step S301: receiving a firmware to be updated, wherein the firmware to be updated includes an image file, a loading startup file, a first signature, and a second key value.

Figure 4 is a schematic diagram of the hardware device structure for updating firmware provided in an embodiment of the present invention. As shown in Figure 4, the hardware device may generally include an update response module 401, a start flag reading module 402, a firmware receiving module 403 to be updated, a verification module 404, and an update operation module 405.

Among them, the update response module 401 is used to receive the input update request, the read startup flag module 402 is used to read the startup flag in the firmware to be updated; the receiving firmware to be updated module 403 is used to receive the data packet of the firmware to be updated, and the general data packet includes information such as the image file, the loading startup file, the first signature and the second key value; the verification module 404 is used to verify the integrity and security of the image file, the loading startup file and other information in the firmware to be updated; the update operation module 405 is used to run the program of the firmware to be updated that has passed the verification to realize the firmware update.

In one embodiment, the hardware device receives a downloaded or pushed firmware to be updated, where the firmware to be updated mainly includes an image file, a loading startup file, a first signature, and a second key value.

The private key in the key pair is converted to obtain a first key value, which is used to sign the first verification value when generating the firmware to obtain a first signature. The public key in the key pair is converted to obtain the second key value, which is used to verify the signature.

Step S302: obtaining the image file and the loading startup file included in the firmware to be updated, and verifying the image file and the loading startup file using a security fidelity verification method to obtain a second verification value.

Generally, after the received firmware to be updated is obtained, the firmware to be updated is parsed to obtain the image file, the loading startup file, the first signature and the second key value included in the firmware to be updated.

The image file and the loaded startup file are verified by using a security fidelity verification method to obtain a second verification value, which specifically includes:

The trform-model in AmzXL in the AI computing power component library is used to perform hash verification on the image file and the loaded startup file to obtain the second verification value.

Step S303: Obtain a second key value included in the firmware to be updated, perform security verification on the second key value, and if the verification passes, use the second key value to sign the second check value to obtain a second signature.

In one embodiment, after obtaining the second key value included in the firmware to be updated, the second key value is firstly security verified to determine whether the second key value has been tampered with. If the second key value has been tampered with, it will affect the accuracy of the second signature generated during the signature verification, thereby affecting the accuracy of the integrity detection of the image file and the loaded startup file.

In one embodiment, when performing security verification on the second key value, a second hash check value of the second key value can be first obtained by using a hash function, and then the first hash check value stored in the one-time programmable memory is obtained, and the second hash check value is compared with the first hash check value. If the two match, for example, the two are consistent, it is determined that the security verification of the second key value has passed, that is, it is determined that the second key value has not been tampered with.

In one embodiment, when the verification passes, the second verification value is signed using the second key value to obtain a second signature.

Step S304: determine whether the first signature and the second signature match; if they do, determine that the firmware to be updated passes verification.

It can be understood that, since the first key value and the second key value in this embodiment are generated by a pair of keys that match each other, the first signature and the second signature obtained using the first key value and the second key value should also match each other when the image file and the loading startup file have not been tampered with or damaged. Therefore, before starting the firmware update program, it is first determined whether the first signature and the second signature match. If they match, it is determined that the firmware to be updated has passed the verification, that is, it is determined that the image file and the loading startup file have not been tampered with or damaged, which can ensure the security and success rate of the firmware update.

In one embodiment, when the firmware to be updated passes the verification, that is, when it is determined that the image file and the loading startup file have not been tampered with or damaged, the firmware to be updated is updated to the current hardware device. Specifically, the loading startup file can be run to update the image file to the current hardware device.

In one embodiment, after determining whether the first signature and the second signature match, the result of whether the first signature and the second signature match is also updated to the firmware update log, such as recording the result of signature verification and related information, and storing it in the audit log to facilitate subsequent tracing and viewing, so that the source, validity and integrity of the upgraded firmware can be easily traced and checked.

It can be seen that according to the firmware update method provided in this embodiment, when the firmware is updated, after the hardware device receives the firmware to be updated, it first obtains the image file and the loading startup file included in the firmware to be updated, and uses a security fidelity verification method to verify the image file and the loading startup file to obtain a second verification value; then obtains the second key value included in the firmware to be updated, performs security verification on the second key value, and if the verification passes, uses the second key value to sign the second verification value to obtain a second signature; finally, it determines whether the first signature and the second signature match, and according to the matching result, it can be determined whether the image file and the loading startup file have been tampered with or damaged, thereby ensuring the security and success rate of the firmware update.

The firmware generation device provided in the present application is further described below. The firmware generation device provided below can refer to and correspond to the firmware generation method provided above.

FIG5 is a schematic diagram of the structure of a firmware generation device provided in an embodiment of the present application. Referring to FIG5 , the firmware generation device includes:

An acquisition unit 501 is used to acquire an image file, load a startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other;

A verification unit 502 is used to verify the image file and the loaded startup file using a security and fidelity verification method to obtain a first verification value;

A signature unit 503, configured to sign the first verification value using the first key value to obtain a first signature;

The encapsulation unit 504 is used to encapsulate the image file, the loading startup file, the first signature and the second key value into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file.

In one embodiment, the firmware generation device further includes:

The key value generation unit is used to obtain a key pair in a trusted environment; convert the private key in the key pair to obtain the first key value; and convert the public key in the key pair to obtain the second key value.

In one embodiment, the verification unit 502 is specifically configured to:

The trform-model in AmzXL in the AI computing power component library is used to perform hash verification on the image file and the loaded startup file to obtain the first verification value.

The embodiment of the present application also provides a firmware processing device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the firmware generation method as described above; or the computer program being configured to implement the steps of the firmware update method as described above. The firmware generation method comprises: obtaining an image file, loading a startup file, and a pair of key values; the pair of key values comprises a first key value and a second key value that match each other; using a security fidelity verification method to verify the image file and the loading startup file to obtain a first verification value; using the first key value to sign the first verification value to obtain a first signature; encapsulating the image file, the loading startup file, the first signature, and the second key value into a firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file. The firmware update method includes: receiving firmware to be updated, wherein the firmware to be updated includes an image file, a loading startup file, a first signature and a second key value; obtaining the image file and the loading startup file included in the firmware to be updated, and verifying the image file and the loading startup file using a security fidelity verification method to obtain a second verification value; obtaining the second key value included in the firmware to be updated, performing security verification on the second key value, and if the verification passes, signing the second verification value using the second key value to obtain a second signature; determining whether the first signature and the second signature match, and if they match, determining that the firmware to be updated passes the verification.

The embodiment of the present application also provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the firmware generation method described above are implemented; or the computer program is configured to implement the steps of the firmware update method described above. Wherein, the firmware generation method includes: obtaining an image file, loading a startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other; using a security fidelity verification method to verify the image file and the loading startup file to obtain a first verification value; using the first key value to sign the first verification value to obtain a first signature; encapsulating the image file, the loading startup file, the first signature and the second key value into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file. The firmware update method includes: receiving firmware to be updated, wherein the firmware to be updated includes an image file, a loading startup file, a first signature and a second key value; obtaining the image file and the loading startup file included in the firmware to be updated, and verifying the image file and the loading startup file using a security fidelity verification method to obtain a second verification value; obtaining the second key value included in the firmware to be updated, performing security verification on the second key value, and if the verification passes, signing the second verification value using the second key value to obtain a second signature; determining whether the first signature and the second signature match, and if they match, determining that the firmware to be updated passes the verification.

An embodiment of the present invention also provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the firmware generation method described above are implemented; or the computer program is configured to implement the steps of the firmware update method described above. The firmware generation method includes: obtaining an image file, a loading startup file, and a pair of key values; the pair of key values includes a first key value and a second key value that match each other; using a security fidelity verification method to verify the image file and the loading startup file to obtain a first verification value; using the first key value to sign the first verification value to obtain a first signature; encapsulating the image file, the loading startup file, the first signature, and the second key value into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file. The firmware update method includes: receiving firmware to be updated, wherein the firmware to be updated includes an image file, a loading startup file, a first signature and a second key value; obtaining the image file and the loading startup file included in the firmware to be updated, and verifying the image file and the loading startup file using a security fidelity verification method to obtain a second verification value; obtaining the second key value included in the firmware to be updated, performing security verification on the second key value, and if the verification passes, signing the second verification value using the second key value to obtain a second signature; determining whether the first signature and the second signature match, and if they match, determining that the firmware to be updated passes the verification.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims (11)

1. A firmware generation method, comprising: Obtain an image file, load a startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other; Using a security and fidelity verification method to verify the image file and the loaded startup file to obtain a first verification value; Sign the first verification value using the first key value to obtain a first signature; The image file, the loading startup file, the first signature and the second key value are encapsulated into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file. 2. The firmware generation method according to claim 1, characterized in that before obtaining the image file, loading the startup file and a pair of key values, it also includes: Obtain a key pair in a trusted environment; The private key in the key pair is converted to obtain the first key value; the public key in the key pair is converted to obtain the second key value. 3. The firmware generation method according to claim 1 or 2, characterized in that the adopting of a security fidelity verification method to verify the image file and the loaded startup file to obtain a first verification value comprises: The trform-model in AmzXL in the AI computing power component library is used to perform hash verification on the image file and the loaded startup file to obtain the first verification value. 4. A firmware update method, wherein the firmware is generated by the firmware generation method according to any one of claims 1 to 3, wherein the firmware update method comprises: Receive a firmware to be updated, wherein the firmware to be updated includes an image file, a loading startup file, a first signature, and a second key value; Obtaining an image file and a loading startup file included in the firmware to be updated, and verifying the image file and the loading startup file using a security fidelity verification method to obtain a second verification value; Obtaining a second key value included in the firmware to be updated, performing security verification on the second key value, and if the verification passes, using the second key value to sign the second check value to obtain a second signature; Determine whether the first signature and the second signature match, and if so, determine that the firmware to be updated passes verification. 5. The firmware update method according to claim 3, further comprising: When the firmware to be updated passes the verification, the firmware to be updated is updated to the current device. 6. The firmware update method according to claim 4 or 5, characterized in that the adopting of a security fidelity verification method to verify the image file and the loaded startup file to obtain a second verification value comprises: The trform-model in AmzXL in the AI computing power component library is used to perform hash verification on the image file and the loaded startup file to obtain the second verification value. 7. The firmware update method according to claim 4 or 5, characterized in that after determining whether the first signature and the second signature match, it also includes: The result of whether the first signature and the second signature match is updated in the firmware update log. 8. A firmware generation device, comprising: An acquisition unit, used to acquire an image file, load a startup file and a pair of key values; the pair of key values includes a first key value and a second key value that match each other; A verification unit, configured to verify the image file and the loaded startup file using a security and fidelity verification method to obtain a first verification value; A signature unit, configured to sign the first verification value using the first key value to obtain a first signature; The encapsulation unit is used to encapsulate the image file, the loading startup file, the first signature and the second key value into the firmware to be updated; the first signature and the second key value are used to verify the integrity of the image file and the loading startup file. 9. A firmware processing device, characterized in that the device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the firmware generation method as described in any one of claims 1 to 3; or the computer program is configured to implement the steps of the firmware update method as described in any one of claims 4 to 7. 10. A storage medium, characterized in that a computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the firmware generation method as described in any one of claims 1 to 3 are implemented; or the computer program is configured to implement the steps of the firmware update method as described in any one of claims 4 to 7. 11. A computer program product, characterized in that the computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the steps of the firmware generation method as described in any one of claims 1 to 3; or the computer program is configured to implement the steps of the firmware update method as described in any one of claims 4 to 7.