Validation of the Startup

Introduced

Android 4.4 and later versions support authentication boot with optional dm-verity kernel features that provide transparent block device integrity checks. Dm-verity can help block the root component, The component is able to gain root privileges. This experimental feature helps to check if the device is being started as it was last used.

Smart malware with root privileges can hide the detection program and therefore be able to hide themselves. The root software can do this because they have more privileges than the detection program, which makes the software "lie" to the detection program.

The Dm-verity feature allows you to see a block device, the underlying storage layer of the file system, and decide whether to match his desired configuration. They use a password hash tree to implement. For each block (usually 4K), there is a SHA256 hash.

Since the hashes are stored in a page tree, only the top-level "root" hash can be trusted to validate the rest of the tree. The ability to modify blocks should be equivalent to breaking the cryptographic hash. Look at the diagram below to see a description of the structure.

dm-verity Hash table

A public key is included in the boot partition, which must be externally validated by the OEM. The key is used to verify the signature of the hash and to verify that the system partition of the device is protected and unchanging.

Prerequisites determine a validated start-up flow

To significantly reduce the risk of compromise, use a key burned to the device to verify the kernel. Detailed details are described in the following article, "Verifying startup."

Turn to block-oriented OTA

In order to enable the dm-verity of devices, it is necessary to use block-based OTA updates to ensure that all devices use the same system partition. More details are presented in the article "block-based Ota".

Configure Dm-verity

After turning to block-oriented OTA, combine the latest Android kernel with a rising kernel, and turn on dm-verity support by including the relevant configuration options config_dm_verity.

When using the Android kernel, Dm-verity is opened when the kernel is built. More details will be described in the following article "Implementing Dm-verity".

Validation of the Startup