3. CVITEK SDK Cyber Security Precautions for Secondary Development¶

3.1. u-boot Usage Precautions¶

3.1.1. Serial Port¶

CVITEK SDKinu-bootserial portfunctiondefaultisenable. inu-bootexecuteflowin, u-bootwilletc.wait foronesecondstimemakedeveloperscaninexecutestepsegmentthroughpressclickpresskeymethodinterruptu-bootexecuteprocesswithremaininu-boot stepsegmentperform debug. If processinno hasanypressclickpresskey eventoccur, onesecondsafterthenwillcontinueu-bootbootflow.

inproductionreleaseproduct, canwillthisconfigurecancel, withreachcannotinu-bootstepsegmentthroughserial portdebugcurrent, specificimplementmethodas follows:

Step 1. Enable build/boards/{processor_name}/{board_name}/u-boot/{board_name}_defconfig (according to eachproductnamingmaywillhasnotsamefile namecall, this exampleinis cvitek_cv1842hp_wevb_0014a_spinand_defconfig). modifyCONFIG_BOOTDELAYconfigurevalueis"-2".

CONFIG_IDENT_STRING="cvitek_cv184x"
CONFIG_DISTRO_DEFAULTS=y
CONFIG_BOOTDELAY=-2
# CONFIG_DISPLAY_CPUINFO is not set

Step 2. Recompile u-boot

3.1.2. u-boot Commands¶

u-bootunderprovideallowmultipledevelopersperform developmentwithdebugcommand, for example: md, mw, setenv, saveenvetc.. butthesecommandinproduction productinandnon-ismust. canselectretainnoneconcernsystemsecuritycommand, andwillothercommanddelete.

for examplewant todelete md/mwcommand, specificimplementmethodas follows:

Enable /u-boot-2021.10/cmd/Makefile, becausemd/mw specificimplementcodeisinmem.cMedium

thereforedirectlyconnectwillbelowshowexampleinobj-$(CONFIG_CMD_MEMORY) += mem.ocomment outordelete

obj-$(CONFIG_LOGBUFFER) += log.o
obj-$(CONFIG_ID_EEPROM) += mac.o
obj-$(CONFIG_CMD_MD5SUM) += md5sum.o
#obj-$(CONFIG_CMD_MEMORY) += mem.o
obj-$(CONFIG_CMD_IO) += io.o
obj-$(CONFIG_CMD_MFSL) += mfsl.o

orismodify /u-boot-2021.10/cmd/Kconfig, willdefaultconfigureis"n".

config CMD_MEMORY
   bool "md, mm, mw, cp, cmp, base, loop, ip_update"
   default n
   help
    Memory commands.
       md - memory display
       mm - memory modify (auto-incrementing address)
       mw - memory write (fill)
       cp - memory copy
       cmp - memory compare
       base - print or set address offset
       loop - initialize loop on address range
       ip_update - sync ip from mem 0x400038C/900 to uboot env

The procedure for deleting other commands is similar.

3.2. Linux Cyber Security Precautions¶

3.2.1. root Account¶

In a production product, need toforrootuserdosecuritynessmodify, usercan determinechangedefaultpasswordorisProhibit root Login through the Shell. The procedure is as follows:

Change the Password

Step 1. executeshellcommand "passwd"changepassword.

Step 2. will/etc/shadowcopyoutto (can throughmountSDcardorisnetwork)

Step 3. willshadowfilecopyto/ramdisk/rootfs/overlay/{processor_name}/etc under.

Step 4. recompilerootfsfile system (command: pack_rootfs), andwillrootfs.spinor re-newprogram intoplatform.
Prohibit root Login through the Shell

Step 1. Modify the following file in the SDK package: /ramdisk/rootfs/overlay/{processor_name}/etc/passwd, willcontent

root:x:0:0:root:/root:/bin/sh

change to :

root:x:0:0:root:/root:/bin/false

Step 2. recompilerootfsfile system (command: pack_rootfs), andwillrootfs.spinorre-newprogram intoplatform.

3.2.2. File Permissions¶

CVITEK SDK defaultuseSquashFSfile system, usercannotforpreloadedfile systemperform writeordeletemoveoperation, therebythistoprotectionsystemstability.

3.3. Linux Driver Cyber Security Precautions¶

3.3.1. Serial Port¶

developersinlinuxincan throughserial porttododebug, If need toavoidserial portbeinvalidconnectrisk of entering, determineserial portinproductinnotthenuse, theninfactory shipmentwhencandisableserial port. specificimplementmethodas follows:

Step 1. Enable build/boards/{processor_name}/{board_name}/dts /{processor_name}/ {processor_name}_base.dtsi (according to eachproductnamingmaywillhasnotsamefile namecall, this exampleiniscv184x), modify as followsshowexamplecode,

  uart0: serial@04140000 {
              compatible = "snps,dw-apb-uart";
              reg = <0x0 0x04140000 0x0 0x1000>;
              clock-frequency = <25000000>;
              reg-shift = <2>;
              reg-io-width = <4>;
-             status = "okay";
+             status = "disabled";
     };

Step 2. Recompile Linux

3.4. Application Development Security Precautions¶

3.4.1. Cipher Driver¶

CIPHER isJingshi Intelligentnumbermediaprocessingplatformprovidesecurityalgorithmmodule, provides symmetric encryption/decryption algorithms including AES/DES/SM4, Asymmetric Encryption/Decryption AlgorithmsRSA Random Number Generation, anddigest algorithmincludingHASH, HMAC, customercan used to audiovideobitstreamperform encryption/decryptionprotection, authenticationuservalidnessetc.scene. For details, see "CVITEK CIPHER API Reference".

3.5. Other Security Precautions¶

3.5.1. Bare-Chip Burning¶

CVITEK SDKpacketprovideSD, USBbare chipburningfunction, recommendinactualproductinwillbare chipburningfunctiondisable. SD, USBbare-chip burningfunctioncanthroughhardwareondesignperform disable.

3.5.2. SD Card/USB Drive Mount Permissions¶

If developmentproducthaveSD cardorisUdisketc.removable storage deviceconnectwhen using the interface, recommendmountstoredevicefile systembeforeaddon"-o noexec"Parameters, to avoidmalicious third partyprogramruntherebycausesystemdamage.

3.5.3. JTAG¶

recommendinactualproductonremoveJTAGconnectport, to avoidmalicioustamperchangesystemconfigureandcausesystemdamage.

3.6. AliOS Development and Usage Precautions¶

Refer to the AliOS open-source documentation https://github.com/alibaba/AliOS-Things/tree/master/documentation