A trusted communication method based on FPGA and SOC

Abstract

The present application discloses a trusted communication method based on FPGA and SOC, which relates to the field of trusted communication technology. The engineer station and the control station use the SM2 signature algorithm for identity authentication, obtain the SM4 key after successful authentication, and communicate in the form of SM4 encrypted configuration information interaction. For each session, the SM4 key is dynamically determined. The present application realizes trusted communication in the field of nuclear industry control.

Description

Technical Field

[0001] The present application relates to the field of trusted communication technology, and in particular to a trusted communication method based on FPGA and SOC. Background Art

[0002] With the rapid development of network technology, trusted systems have become increasingly critical in many fields, including aerospace, military, and nuclear power. While network technology brings convenience and speed to access, it also brings various threats. The more open the network environment, the more threats there are. How to ensure that the control system can communicate with other systems in a trusted manner when exchanging data, especially when functional safety data is involved, to effectively avoid the leakage or tampering of functional safety data caused by threats.

[0003] The official concept of trustworthiness is: "An entity is trustworthy if its behavior is always as expected when achieving a given goal." This requires that the designed system not only provide stable services, but also ensure its own trustworthiness, ensuring that the entity processes in the system can always run in an error-free environment and ultimately output trustworthy results.

[0004] In the field of nuclear industry control, there are very high requirements for trusted attributes such as system security, reliability and confidentiality. The trustworthiness of the system means that the final results of the behavior of the system process are always in line with the expected assumptions. Even in the case of constant interference and attacks from the external environment, the system can still stably provide continuous services and reliable computing results.

[0005] In summary, the continuous development and improvement of trusted technology, in-depth research on trustworthiness-related technologies in distributed control systems in the field of nuclear industry control, fundamentally solving the increasingly prominent trustworthiness problems from the system architecture, and building a real-time and trusted system communication environment are of great practical significance in the field of nuclear industry control.

[0006] Therefore, how to design a trusted communication method to prevent the operation of untrusted entity processes has become an urgent problem to be solved in the field of nuclear industry control. Summary of the invention

[0007] The purpose of this application is to provide a trusted communication method based on FPGA and SOC to solve the problem that trusted communication cannot be truly realized.

[0008] To achieve the above objectives, this application provides the following solutions.

[0009] The present application provides a trusted communication method based on FPGA and SOC, the trusted communication method based on FPGA and SOC is implemented by using a trusted communication system, the trusted communication system includes: a security authentication center, an engineer station and a control station, the security authentication center, the engineer station and the control station are connected in pairs, the control station includes: a maintenance interface module, a controller module, a communication module and an IO module; the maintenance interface module includes: a field programmable gate array and a system-level chip;

[0010] The FPGA and SOC-based trusted communication method includes:

[0011] The security certification center generates a trusted root public key and a trusted root private key, and sends the trusted root public key to the control station and the trusted root private key to the engineer station;

[0012] After receiving the trusted root private key, the engineer station generates an engineer station public key and an engineer station private key, uses the trusted root private key to generate a signature based on the engineer station public key using the national secret SM2 signature algorithm, and sends the first data packet consisting of the engineer station public key and the signature to the control station;

[0013] After the control station receives the first data packet, the maintenance interface module performs SM2 signature verification on the first data packet and the signature to obtain the public key of the engineer station, and returns a "control station signature verification success" sign to the engineer station after the signature verification succeeds;

[0014] After receiving the "control station signature verification success" sign, the engineer station generates a second data packet and sends the second data packet to the control station; the second data packet is a data packet requesting the encrypted SM4 key;

[0015] After the control station receives the second data packet, the maintenance interface module generates an SM4 key, performs SM2 encryption on the SM4 key using the public key of the engineer station, generates an encrypted SM4 key, and sends the encrypted SM4 key to the engineer station;

[0016] After receiving the encrypted SM4 key, the engineer station uses the engineer station private key to decrypt the encrypted SM4 key to obtain the decrypted SM4 key, and uses the decrypted SM4 key to perform SM4 encryption on the current downloaded configuration data to obtain the encrypted configuration message, and sends the encrypted configuration message to the control station;

[0017] After the control station receives the encrypted configuration message, the maintenance interface module uses the SM4 key to perform SM4 decryption on the encrypted configuration message to obtain decrypted configuration information, parses the decrypted configuration information, distributes the parsing results to each module in the control station, and performs SM4 encryption on the third data packet to obtain an encrypted third data packet, and returns the encrypted third data packet to the engineer station; the third data packet is the configuration data packet fed back by each module in the control station and received by the maintenance interface module;

[0018] After receiving the encrypted third data packet, the engineer station performs SM4 decryption on the encrypted third data packet to obtain the encrypted third data packet, and determines whether the encrypted third data packet is consistent with the current downloaded configuration data. If so, the control station successfully downloads the current downloaded configuration data, updates the current downloaded configuration data to the next downloaded configuration data, and returns "use the decrypted SM4 key to perform SM4 encryption on the current downloaded configuration data, obtain the encrypted configuration message, and send the encrypted configuration message to the control station"; if not, directly returns "use the decrypted SM4 key to perform SM4 encryption on the current downloaded configuration data, obtain the encrypted configuration message, and send the encrypted configuration message to the control station".

[0019] Optionally, the FPGA and SOC-based trusted communication method further includes:

[0020] The engineer station stores the trusted root private key and the engineer station private key in the trusted chip.

[0021] Optionally, the FPGA and SOC-based trusted communication method further includes:

[0022] The control station stores the trusted root public key in the maintenance interface module.

[0023] Optionally, sending a first data packet consisting of the public key and signature of the engineer station to the control station includes:

[0024] The first data packet consisting of the public key and signature of the engineering station is sent to the control station via the M-NET protocol.

[0025] Optionally, the maintenance interface module performs SM2 signature verification on the first data packet and the signature to obtain the engineer station public key, and after successful signature verification, returns a sign of "control station signature verification success" to the engineer station, including:

[0026] The field programmable gate array performs SM2 parsing on the first data packet, and sends the data validity flag, the first data and the trusted root public key obtained by the parsing to the system-level chip;

[0027] The system-level chip uses the trusted root public key to perform SM2 verification on the signature and obtains the engineer station public key; wherein, during the process of the system-level chip using the trusted root public key to perform SM2 verification on the signature, the verification flag position is "0", and after the verification is successful, the verification flag position is "1";

[0028] The field programmable gate array reads the signature verification flag. If the signature verification flag is "0", the M-NET protocol returns the "control station is verifying the signature" flag to the engineer station. If the signature verification flag is "1", the M-NET protocol returns the "control station successfully verified the signature" flag to the engineer station.

[0029] Optionally, sending the parsed data validity flag, the first data, and the trusted root public key to the system-level chip includes:

[0030] The parsed data validity flag, the first data and the trusted root public key are sent to the system-level chip through the AXI bus.

[0031] Optionally, sending the second data packet to the control station includes:

[0032] The second data packet is sent to the control station via the M-NET protocol.

[0033] Optionally, the maintenance interface module generates an SM4 key, performs SM2 encryption on the SM4 key by using the public key of the engineer station, generates an encrypted SM4 key, and sends the encrypted SM4 key to the engineer station, including:

[0034] The system-level chip generates a random number as the SM4 key, and uses the public key of the engineer station to perform SM2 encryption on the SM4 key to generate an encrypted SM4 key; wherein, after the SM2 encryption of the SM4 key using the public key of the engineer station is completed, the encryption completion flag is set to "1", and the encryption completion flag, the SM4 key and the encrypted SM4 key are sent to the field programmable gate array, and the signature verification flag is set to "0";

[0035] The field programmable gate array reads the encryption completion flag. If the encryption completion flag is "0", it will feedback "encryption not completed" to the engineering station through the M-NET protocol. If the encryption completion flag is "1", the encrypted SM4 key will be fed back to the engineering station through the M-NET protocol and the SM4 key will be saved.

[0036] Optionally, sending the encryption completion flag, the SM4 key and the encrypted SM4 key to the field programmable gate array includes:

[0037] The encryption completion flag, the SM4 key and the encrypted SM4 key are sent to the field programmable gate array through the AXI bus.

[0038] Optionally, sending the encrypted configuration message to the control station includes:

[0039] The encrypted configuration message is sent to the control station via the M-NET protocol.

[0040] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0041] This application discloses a trusted communication method based on FPGA and SOC, which uses Field Programmable Gate Array (FPGA) and System on a chip (SOC) for communication, and uses a hardware architecture based on FPGA technology to implement the main control and communication functions. The stable operation of the system does not rely on microprocessors and software, and realizes trusted communication in the field of nuclear industry control. The specific advantages are as follows.

[0042] 1. Determinism: FPGA implements the security functions of the trusted system in the form of pure hardware circuits. The execution of hardware circuits is more certain than that of software and operating systems.

[0043] 1. Reliability: The engineer station and the control station first establish a trusted connection to obtain the communication key. The key changes randomly during each conversation to ensure the security and reliability of the system.

[0044] 3. Security: FPGA technology provides better protection against malicious network attacks. First, the hardware logic burned into the FPGA cannot be modified at will without engineering tools; second, the modification of the hardware logic must be carried out through a special interface, which is generally disconnected when the system is running; finally, the hardware logic adopts encryption measures to make it difficult to reproduce the FPGA logic through reverse engineering.

[0045] 4. Performance: The trusted root system generated based on FPGA control has a faster processing speed than CPU control, and the processing of input and output signals is carried out in parallel. Its execution time is not limited by the data refresh rate of the periodic method, and it is not easy to be decompiled and cracked.

[0046] 5. Sustainability and economy: The CPU chip is updated faster than the FPGA chip, which means that the life of the distributed control system platform based on CPU technology is shorter than that of the distributed control system platform based on FPGA technology. With the upgrading of CPU chips, it is difficult to transplant the existing software code in the original CPU chip to the new generation of CPU chips. On the contrary, FPGA technology makes future system upgrades easier. The FPGA logic code and register-level design compiled using hardware description language can be transplanted to the new FPGA chip. The new FPGA only needs to use new software tools to re-synthesize and layout the existing code and design, and the investment in software design can be retained to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A flow chart of a trusted communication method based on FPGA and SOC provided in one embodiment of the present application.

[0049] Figure 2 A schematic diagram of the architecture of a trusted communication method based on FPGA and SOC provided in one embodiment of the present application.

[0050] Figure 3 Schematic diagram of the trusted communication system structure.

[0051] Figure 4 This is a schematic diagram of the internal structure of the control station.

[0052] Figure 5 Schematic diagram of the SM2 signature verification process for the maintenance interface module.

[0053] Figure 6 Schematic diagram of the SM4 key encryption process.

[0054] Figure 7 A schematic diagram of the process of judging whether the configuration data is successfully downloaded. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] The purpose of this application is to provide a trusted communication method based on FPGA and SOC, aiming to achieve trusted communication in the field of nuclear industry control.

[0057] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0058] In an exemplary embodiment, Figure 1 and Figure 2 As shown, the trusted communication method based on FPGA and SOC in this embodiment uses the trusted communication method based on FPGA and SOC as shown in FIG. Figure 3 The trusted communication system shown in the figure is implemented. The trusted communication system includes: a security authentication center (authorization machine), an engineer station and a control station. The security authentication center, the engineer station and the control station are connected in pairs, such as Figure 4 As shown, the control station includes: a maintenance interface module, a controller module, a communication module and an IO module; the maintenance interface module includes: a field programmable gate array and a system-level chip.

[0059] The trusted communication method based on FPGA and SOC includes the following steps.

[0060] Step 1: The security certification center generates a trusted root public key X1 and a trusted root private key Y1, and sends the trusted root public key X1 to the control station and the trusted root private key Y1 to the engineer station.

[0061] Specifically, the trusted root private key Y1 is sent to the engineering station through the M-NET protocol.

[0062] As an optional implementation, the trusted communication method based on FPGA and SOC further includes:

[0063] The control station stores the trusted root public key X1 in the maintenance interface module.

[0064] Step 2: After receiving the trusted root private key Y1, the engineer station generates the engineer station public key X2 and the engineer station private key Y2, uses the trusted root private key Y1 to generate the signature Z based on the engineer station public key X2 using the national secret SM2 signature algorithm, and sends the first data packet consisting of the engineer station public key X2 and the signature Z to the control station. The first data packet is data packet 1.

[0065] As an optional implementation, sending a first data packet consisting of the public key X2 and the signature Z of the engineer station to the control station includes:

[0066] The first data packet consisting of the engineering station public key X2 and the signature Z is sent to the control station via the M-NET protocol.

[0067] As an optional implementation, the trusted communication method based on FPGA and SOC further includes:

[0068] The engineer station stores the trusted root private key Y1 and the engineer station private key Y2 in the trusted chip.

[0069] Step 3: After the control station receives the first data packet, the maintenance interface module performs SM2 verification on the first data packet and signature Z to obtain the engineer station public key X2, and after successful verification, returns a "control station verification success" sign to the engineer station.

[0070] As an optional implementation, Figure 5 As shown, the maintenance interface module performs SM2 verification on the first data packet and signature Z to obtain the engineer station public key X2, and after successful verification, returns a sign of "control station signature verification successful" to the engineer station, including steps 31 to 33.

[0071] Step 31: The field programmable gate array performs SM2 parsing on the first data packet, and sends the data validity flag, the first data and the trusted root public key X1 obtained by the parsing to the system-level chip.

[0072] As an optional implementation manner, sending the parsed data validity flag, the first data and the trusted root public key X1 to the system-level chip includes:

[0073] The data validity flag, the first data and the trusted root public key X1 obtained by parsing are sent to the system-level chip through the AXI bus.

[0074] Step 32: The system-level chip uses the trusted root public key X1 to perform SM2 verification on the signature Z to obtain the engineer station public key X2; wherein, during the process of the system-level chip using the trusted root public key X1 to perform SM2 verification on the signature Z, the verification flag position is "0", and after the verification is successful, the verification flag position is "1".

[0075] Step 33: The field programmable gate array reads the signature verification flag. If the signature verification flag is "0", a flag indicating that the control station is verifying the signature is returned to the engineer station through the M-NET protocol. If the signature verification flag is "1", a flag indicating that the control station successfully verified the signature is returned to the engineer station through the M-NET protocol.

[0076] Step 4: After receiving the "Control Station Signature Verification Successful" sign, the engineer station generates a second data packet and sends the second data packet to the control station.

[0077] The second data packet is a data packet for requesting the encrypted SM4 key SM4-key'. The first data packet is data packet 2.

[0078] As an optional implementation manner, sending the second data packet to the control station includes:

[0079] The second data packet is sent to the control station via the M-NET protocol.

[0080] Step 5: After the control station receives the second data packet, the maintenance interface module generates an SM4 key SM4-key, uses the engineer station public key X2 to perform SM2 encryption on the SM4 key SM4-key, generates an encrypted SM4 key SM4-key', and sends the encrypted SM4 key SM4-key' to the engineer station.

[0081] As an optional implementation, Figure 6 As shown, the maintenance interface module generates an SM4 key SM4-key, uses the engineer station public key X2 to perform SM2 encryption on the SM4 key SM4-key, generates an encrypted SM4 key SM4-key', and sends the encrypted SM4 key SM4-key' to the engineer station, including steps 51-52.

[0082] Step 51: the system-level chip generates a random number as the SM4 key SM4-key, and uses the engineer station public key X2 to perform SM2 encryption on the SM4 key SM4-key to generate an encrypted SM4 key SM4-key'; wherein, after the SM2 encryption of the SM4 key SM4-key using the engineer station public key X2 is completed, the encryption completion flag is set to "1", and the encryption completion flag, the SM4 key SM4-key and the encrypted SM4 key SM4-key' are sent to the field programmable gate array, and the signature verification flag is set to "0".

[0083] As an optional implementation, sending the encryption completion flag, the SM4 key SM4-key and the encrypted SM4 key SM4-key' to the field programmable gate array includes:

[0084] The encryption completion flag, the SM4 key SM4-key and the encrypted SM4 key SM4-key' are sent to the field programmable gate array through the AXI bus.

[0085] Step 52: The field programmable gate array reads the encryption completion flag. If the encryption completion flag is "0", "encryption is not completed" is fed back to the engineering station through the M-NET protocol. If the encryption completion flag is "1", the encrypted SM4 key SM4-key' is fed back to the engineering station through the M-NET protocol, and the SM4 key SM4-key is saved.

[0086] Step 6: After receiving the encrypted SM4 key SM4-key', the engineer station uses the engineer station private key Y2 to decrypt the encrypted SM4 key SM4-key' to obtain the decrypted SM4 key SM4-key, and uses the decrypted SM4 key SM4-key to perform SM4 encryption on the current downloaded configuration data to obtain the encrypted configuration message, and sends the encrypted configuration message to the control station.

[0087] As an optional implementation, sending the encrypted configuration message to the control station includes:

[0088] The encrypted configuration message is sent to the control station via the M-NET protocol.

[0089] Step 7: After the control station receives the encrypted configuration message, the maintenance interface module uses the SM4 key SM4-key to perform SM4 decryption on the encrypted configuration message to obtain decrypted configuration information, parses the decrypted configuration information, distributes the parsed results to each module in the control station, performs SM4 encryption on the third data packet to obtain an encrypted third data packet, and returns the encrypted third data packet to the engineer station.

[0090] The third data packet is a configuration data packet fed back by each module in the control station and received by the maintenance interface module.

[0091] Specifically, the encrypted third data packet is returned to the engineering station through the M-NET protocol.

[0092] Step 8: Figure 7 As shown, after receiving the encrypted third data packet, the engineer station performs SM4 decryption on the encrypted third data packet to obtain the encrypted third data packet, and determines whether the encrypted third data packet is consistent with the current downloaded configuration data. If so, the control station successfully downloads the current downloaded configuration data, updates the current downloaded configuration data to the next downloaded configuration data, and returns "use the decrypted SM4 key SM4-key to perform SM4 encryption on the current downloaded configuration data, obtain the encrypted configuration message, and send the encrypted configuration message to the control station"; if not, directly returns "use the decrypted SM4 key SM4-key to perform SM4 encryption on the current downloaded configuration data, obtain the encrypted configuration message, and send the encrypted configuration message to the control station".

[0093] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A trusted communication method based on FPGA and SOC, wherein the trusted communication method based on FPGA and SOC is implemented using a trusted communication system, characterized in that: The trusted communication system includes: a security authentication center, an engineer station and a control station, wherein the security authentication center, the engineer station and the control station are connected in pairs, and the control station includes: a maintenance interface module, a controller module, a communication module and an IO module; the maintenance interface module includes: a field programmable gate array and a system-level chip; The FPGA and SOC-based trusted communication method includes: The security certification center generates a trusted root public key and a trusted root private key, and sends the trusted root public key to the control station and the trusted root private key to the engineer station; After receiving the trusted root private key, the engineer station generates an engineer station public key and an engineer station private key, uses the trusted root private key to generate a signature based on the engineer station public key using the national secret SM2 signature algorithm, and sends the first data packet consisting of the engineer station public key and the signature to the control station; After the control station receives the first data packet, the maintenance interface module performs SM2 signature verification on the first data packet and the signature to obtain the public key of the engineer station, and returns a "control station signature verification success" sign to the engineer station after the signature verification succeeds; After receiving the "control station signature verification success" sign, the engineer station generates a second data packet and sends the second data packet to the control station; the second data packet is a data packet requesting the encrypted SM4 key; After the control station receives the second data packet, the maintenance interface module generates an SM4 key, performs SM2 encryption on the SM4 key using the public key of the engineer station, generates an encrypted SM4 key, and sends the encrypted SM4 key to the engineer station; After receiving the encrypted SM4 key, the engineer station uses the engineer station private key to decrypt the encrypted SM4 key to obtain the decrypted SM4 key, and uses the decrypted SM4 key to perform SM4 encryption on the current downloaded configuration data to obtain the encrypted configuration message, and sends the encrypted configuration message to the control station; After the control station receives the encrypted configuration message, the maintenance interface module uses the SM4 key to perform SM4 decryption on the encrypted configuration message to obtain decrypted configuration information, parses the decrypted configuration information, distributes the parsing results to each module in the control station, and performs SM4 encryption on the third data packet to obtain an encrypted third data packet, and returns the encrypted third data packet to the engineer station; the third data packet is the configuration data packet fed back by each module in the control station and received by the maintenance interface module; After receiving the encrypted third data packet, the engineer station performs SM4 decryption on the encrypted third data packet to obtain the encrypted third data packet, and determines whether the encrypted third data packet is consistent with the current downloaded configuration data. If so, the control station successfully downloads the current downloaded configuration data, updates the current downloaded configuration data to the next downloaded configuration data, and returns "use the decrypted SM4 key to perform SM4 encryption on the current downloaded configuration data, obtain the encrypted configuration message, and send the encrypted configuration message to the control station"; if not, directly returns "use the decrypted SM4 key to perform SM4 encryption on the current downloaded configuration data, obtain the encrypted configuration message, and send the encrypted configuration message to the control station".

2. The trusted communication method based on FPGA and SOC according to claim 1, characterized in that: The FPGA and SOC-based trusted communication method further includes: The engineer station stores the trusted root private key and the engineer station private key in the trusted chip.

3. The trusted communication method based on FPGA and SOC according to claim 1, characterized in that: The FPGA and SOC-based trusted communication method further includes: The control station stores the trusted root public key in the maintenance interface module.

4. The trusted communication method based on FPGA and SOC according to claim 1, characterized in that: The first data packet consisting of the engineering station public key and signature is sent to the control station, including: The first data packet consisting of the public key and signature of the engineering station is sent to the control station via the M-NET protocol.

5. The trusted communication method based on FPGA and SOC according to claim 1, characterized in that: The maintenance interface module performs SM2 signature verification on the first data packet and the signature to obtain the public key of the engineer station. After successful signature verification, the maintenance interface module returns a "control station signature verification success" sign to the engineer station, including: The field programmable gate array performs SM2 parsing on the first data packet, and sends the data validity flag, the first data and the trusted root public key obtained by the parsing to the system-level chip; The system-level chip uses the trusted root public key to perform SM2 verification on the signature and obtains the engineer station public key; wherein, during the process of the system-level chip using the trusted root public key to perform SM2 verification on the signature, the verification flag position is "0", and after the verification is successful, the verification flag position is "1"; The field programmable gate array reads the signature verification flag. If the signature verification flag is "0", the M-NET protocol returns the "control station is verifying the signature" flag to the engineer station. If the signature verification flag is "1", the M-NET protocol returns the "control station successfully verified the signature" flag to the engineer station.

6. The trusted communication method based on FPGA and SOC according to claim 5, characterized in that: Sending the parsed data validity flag, the first data and the trusted root public key to the system-level chip includes: The parsed data validity flag, the first data and the trusted root public key are sent to the system-level chip through the AXI bus.

7. The trusted communication method based on FPGA and SOC according to claim 1, characterized in that: The second data packet is sent to the control station, including: The second data packet is sent to the control station via the M-NET protocol.

8. The trusted communication method based on FPGA and SOC according to claim 1, characterized in that: The maintenance interface module generates an SM4 key, performs SM2 encryption on the SM4 key using the public key of the engineering station, generates an encrypted SM4 key, and sends the encrypted SM4 key to the engineering station, including: The system-level chip generates a random number as the SM4 key, and uses the public key of the engineer station to perform SM2 encryption on the SM4 key to generate an encrypted SM4 key; wherein, after the SM2 encryption of the SM4 key using the public key of the engineer station is completed, the encryption completion flag is set to "1", and the encryption completion flag, the SM4 key and the encrypted SM4 key are sent to the field programmable gate array, and the signature verification flag is set to "0"; The field programmable gate array reads the encryption completion flag. If the encryption completion flag is "0", it will feedback "encryption not completed" to the engineering station through the M-NET protocol. If the encryption completion flag is "1", the encrypted SM4 key will be fed back to the engineering station through the M-NET protocol and the SM4 key will be saved.

9. The trusted communication method based on FPGA and SOC according to claim 8, characterized in that: Sending the encryption completion flag, the SM4 key and the encrypted SM4 key to the field programmable gate array includes: The encryption completion flag, the SM4 key and the encrypted SM4 key are sent to the field programmable gate array through the AXI bus.

10. The trusted communication method based on FPGA and SOC according to claim 1, characterized in that: Send the encrypted configuration message to the control station, including: The encrypted configuration message is sent to the control station via the M-NET protocol.

Images