Encryption circuit, encryption method and server

Abstract

The invention discloses an encryption circuit, an encryption method and a server, and the encryption circuit generates a dynamic encryption key through introducing a physical unclonable function, carries out the secondary encryption of initial encryption data through the key, can effectively improve the identity authentication and access control safety of a to-be-accessed module in the server, and improves the safety of the to-be-accessed module. Different from a traditional static password or secret key authentication mode, the dynamic encryption secret key generated based on the physical unclonable function is unpredictable, unique and difficult to clone, and the secret key does not need to provide a storage space for storage, so that even if a malicious device forges an identity or steals the secret key, the secret key can be stored in the storage space. Effective authentication information cannot be obtained through brute force cracking or phishing attack; besides, the verification process is further enhanced by a mechanism of comparing secondary encryption with reference encrypted data, and only a legal user can access the system, so that access of untrusted equipment is effectively prevented, and the security of the server and the integrity of the system are protected.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to an encryption circuit, method and server. Background Art

[0002] With the development of the information industry and the increasing frequency of information interaction, the server's BMC (Baseboard Management Controller) and BIOS (Basic Input / Output System) have become important links in information security protection as key components of system core management and initialization. Untrusted devices accessing BMC by forging identities or tampering with BIOS configurations may lead to sensitive information leakage, malicious modification of system configurations, or even direct paralysis, bringing huge security risks and economic losses to information systems. Current access mechanisms usually rely on traditional authentication methods, such as passwords or static keys, which are vulnerable to threats such as brute force cracking, phishing attacks, or key leakage, and it is difficult to effectively identify untrusted electronic devices.

[0003] Therefore, how to deny untrusted devices access to BMC and BIOS through reliable identity authentication mechanisms and secure access policies to ensure server security and system integrity has become a hot topic in key technology research. Summary of the invention

[0004] The purpose of the present invention is to provide an encryption circuit, method and server. The dynamic encryption key generated by the encryption circuit is unique and difficult to clone. The mechanism of secondary encryption and comparison with reference encrypted data further strengthens the verification process, ensuring that only legitimate users can access the system, thereby effectively preventing access by untrusted devices.

[0005] In a first aspect, the present application provides an encryption circuit, applied to a server, the server further comprising a module to be accessed and an encryption module in communication connection, the encryption circuit comprising a key circuit respectively connected to the module to be accessed and the encryption module;

[0006] The module to be accessed is used to encrypt the user information inputted to obtain initial encrypted data upon receiving the user information inputted, and to verify whether the secondary encrypted data is the same as the pre-stored reference encrypted data upon receiving the secondary encrypted data sent by the encryption module, and if they are the same, allow the user who inputted the user information to access; the user information includes a user name and a login password;

[0007] The key circuit is used to generate a dynamic encryption key corresponding to the initial encrypted data based on a physical unclonable function;

[0008] The encryption module is used to perform secondary encryption on the initial encrypted data based on the dynamic encryption key to obtain secondary encrypted data.

[0009] Optionally, the key circuit includes an arbitrator physical unclonable circuit and a key generation circuit;

[0010] The arbiter physical unclonable circuit is used to use the initial encrypted data as an input stimulus and trigger the built-in physical structure characteristics to respond to the input stimulus to generate response data corresponding to the initial encrypted data;

[0011] The key generation circuit is used to receive the response data and generate the dynamic encryption key according to the response data.

[0012] Optionally, the key circuit further includes:

[0013] an encoding circuit, an input end of which is connected to the arbiter physical unclonable circuit;

[0014] A decoding circuit, whose input end is connected to the output end of the arbiter physical unclonable circuit and the encoding circuit respectively, and whose output end is connected to the key generation circuit;

[0015] The arbiter physical unclonable circuit is further used to generate initialization data corresponding to the excitation signal based on the physical unclonable function according to the input excitation signal during the initialization process;

[0016] The encoding circuit is used to encode the initialization data during the initialization process to obtain auxiliary information, wherein the auxiliary information at least includes check information for error correction;

[0017] The decoding circuit is used to receive the response data and the auxiliary information, and decode the response data using the auxiliary information to generate decoded response data;

[0018] The key generation circuit includes a hash calculation circuit and a key generation circuit, wherein:

[0019] The hash calculation circuit is used to receive the response data and perform hash calculation on the response data through a hash function to generate a hash;

[0020] The key generation circuit is used to receive the hash and generate a dynamic encryption key corresponding to the hash according to the key format requirement.

[0021] Optionally, the module to be accessed is a baseboard management controller or a basic input and output system, and encrypting the user information to obtain initial encrypted data includes:

[0022] The user information is encrypted to obtain initial encrypted data, including:

[0023] The module to be accessed encrypts the user information using a preset encryption algorithm to obtain an encrypted hash or the hash value corresponding to the user information.

[0024] Optionally, a preset storage space is provided in the module to be accessed, and a preset relationship table is stored in the preset storage space. The preset relationship table is a one-to-one correspondence between a plurality of the user information and a plurality of the reference encrypted data.

[0025] Optionally, the server further includes a field programmable gate array, and the key circuit is integrated on the field programmable gate array.

[0026] Optionally, the module to be accessed is also used to deny access to the user who has input the user information when it is verified that the secondary encrypted data is different from the pre-stored reference encrypted data, and to trigger the generation of a security alarm and / or the recording of a time log and / or an automatic locking mechanism or a delay mechanism when the number of access denials reaches a threshold.

[0027] Optionally, the reference encrypted data is generated by:

[0028] During the initialization process, obtaining the user credentials pre-stored in the module to be accessed, wherein the user credentials include multiple sets of user information;

[0029] For each set of user information, the module to be accessed performs initial encryption on the user information to obtain initial encrypted data;

[0030] Transmitting the initial encrypted data to the key circuit and the encryption module;

[0031] generating a dynamic encryption key corresponding to the initial encrypted data using the key circuit based on a physically unclonable function;

[0032] Using the encryption module to perform secondary encryption on the initial encrypted data according to the dynamic encryption key to obtain reference encrypted data corresponding to each user information;

[0033] The reference encrypted data is transmitted to the module to be accessed. After receiving the reference encrypted data, the module to be accessed triggers a storage operation to store the reference encrypted data in its own preset storage space.

[0034] In a second aspect, the present application provides a server, comprising the encryption circuit as described above, and also comprising a module to be accessed and an encryption module, wherein the encryption circuit is arranged between the module to be accessed and the encryption module, and the encryption module is communicatively connected with the module to be accessed.

[0035] In a third aspect, the present application provides an encryption method, comprising:

[0036] Receiving input user information, the user information including user name and login password;

[0037] Initially encrypting the user information to obtain initial encrypted data;

[0038] Using the initial encrypted data as a stimulus to enable a circuit based on a physical unclonable function to generate a dynamic encryption key corresponding to the initial encrypted function;

[0039] Performing secondary encryption on the initial encrypted data according to the dynamic encryption key to obtain secondary encrypted data;

[0040] Verifying whether the secondary encrypted data is identical to the pre-stored reference encrypted data;

[0041] When the secondary encrypted data is identical to the reference encrypted data, access is permitted to the user who inputs the user information.

[0042] The present invention provides an encryption circuit, method and server. The encryption circuit can effectively improve the identity authentication and access control security of a module to be accessed in a server by introducing a dynamic encryption key generated based on a physical unclonable function and using the key to perform secondary encryption on initial encrypted data. Different from the traditional static password or key authentication method, the dynamic encryption key generated based on the physical unclonable function is unpredictable, unique and difficult to clone, and the key does not need to provide storage space for storage. Even if a malicious device forges an identity or steals a key, it cannot obtain valid authentication information through brute force cracking or phishing attacks. In addition, the secondary encryption and the mechanism of comparing with reference encrypted data further strengthen the verification process, ensuring that only legitimate users can access the system, thereby effectively preventing access by untrusted devices and protecting the security of the server and the system integrity. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A schematic diagram of the response principle of an APUF provided by the present invention;

[0045] Figure 2 A schematic diagram of the circuit principle of an APUF provided by the present invention;

[0046] Figure 3 A schematic diagram of a switch block inside a circuit of an APUF provided by the present invention;

[0047] Figure 4 A schematic diagram of an arbiter inside an APUF circuit provided by the present invention;

[0048] Figure 5 A connection diagram of an encryption circuit provided by the present invention;

[0049] Figure 6 A schematic diagram of initialization of an encryption circuit provided by the present invention;

[0050] Figure 7 A block diagram of a specific implementation method of an encryption circuit provided by the present invention;

[0051] Figure 8 A schematic diagram of BMC encryption provided by the present invention;

[0052] Fig. 9 A schematic diagram of BIOS encryption provided by the present invention;

[0053] Fig.10 The present invention provides a flowchart of an encryption method. DETAILED DESCRIPTION

[0054] The core of the present invention is to provide an encryption circuit, method and server. The dynamic encryption key generated by the encryption circuit is unique and difficult to clone. The mechanism of secondary encryption and comparison with reference encrypted data further strengthens the verification process, ensuring that only legitimate users can access the system, thereby effectively preventing access by untrusted devices.

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Before describing this embodiment, several concepts designed in this embodiment are first described. Physical Unclonable Function (PUF) is a technology that uses the inevitable random process differences in the manufacturing process of integrated circuits to generate a unique "fingerprint". Even under the same manufacturing method and process, each chip will be different due to slight process differences. These differences are similar to human fingerprints, making each chip unique. The basic principle of APUF (Arbiter Physical Unclonable Function) design is based on the difference between nonlinear feedback shift register (NFSR) and linear feedback shift register (LFSR), and a random sequence of 0 and 1 is generated by combining the output sequences of these two registers. NFSR is composed of nonlinear gates (such as AND, OR, XOR, etc.), while LFSR is composed of linear gates (XOR) and D flip-flops. The output function of APUF depends on the slight differences between electronic devices in the circuit, including changes in device parameters and random noise. The core idea of ​​FPGA (Field Programmable Gate Array) is "programmable", that is, after the chip is manufactured, its function can be defined by programming, so as to flexibly realize various circuit designs.

[0057] The Arbiter Physical Unclonable Function (APUF) is a classic delay-based Physical Unclonable Function (PUF) that uses the propagation delay of digital signals in integrated circuits to generate unique responses. The propagation delay of digital signals is affected by the electronic parameters of components, such as the channel length and width of the field effect transistor, the thickness of the oxide layer, and the threshold voltage. Figure 2 As shown in Figure 1, these electronic parameters have tiny random differences during the manufacturing process, resulting in completely different responses even if PUFs with the same structure are deployed on multiple chips and given the same input stimulus. This difference makes the APUF output of each chip unique, similar to a fingerprint, thus achieving the physical unclonability feature.

[0058] like Figure 2 As shown in Figure 1, the design uses switch blocks to construct two symmetrical paths and uses a latch or flip-flop to implement the arbiter circuit. Each switch block has two input terminals and two output terminals, and determines whether the signal passes directly or crosses according to the selection bit Ci. Specifically, Figure 3 As shown in Figure 1, when the selection bit Ci=0, the signal crosses through; when Ci=1, the signal passes directly. By connecting multiple such switch blocks in series, two parameterized delay lines can be formed and sent to the arbiter circuit. Figure 4As shown in the figure, the function of the arbiter circuit is to compare the arrival time of the upper signal and the lower signal. If the upper signal arrives earlier than the lower signal, it outputs 1; otherwise, it outputs 0. The selection bit Ci of the switch group is used as the input stimulus of the PUF, and the output of the arbiter is the response of the PUF. This design takes advantage of the slight difference in signal propagation delay in the integrated circuit, and realizes the characteristics of the physical unclonable function through the configuration of the switch block and the comparison of the arbiter.

[0059] First, as Figure 5 As shown, the present application provides an encryption circuit, which is applied to a server. The server also includes a to-be-accessed module 11 and an encryption module 13 that are communicatively connected. The encryption circuit includes a key circuit 12 that is respectively connected to the to-be-accessed module 11 and the encryption module 13; the to-be-accessed module 11 is used to encrypt the user information upon receiving the input user information to obtain initial encrypted data, and to verify whether the secondary encrypted data is the same as the pre-stored reference encrypted data upon receiving the secondary encrypted data sent by the encryption module 13. If they are the same, the user who input the user information is allowed to access; the user information includes a user name and a login password; the key circuit 12 is used to generate a dynamic encryption key corresponding to the initial encrypted data based on a physically unclonable function; the encryption module 13 is used to secondary encrypt the initial encrypted data based on the dynamic encryption key to obtain secondary encrypted data.

[0060] The working principle of the encryption circuit is based on the unique properties of the physical unclonable function (PUF), which can significantly enhance the security of the server, especially in the password protection of BIOS and BMC. Specifically, the module to be accessed 11 in the server first receives the authentication information (such as user name and login password) input by the user. This information is encrypted to generate initial encrypted data. The initial encrypted data encrypts the user information through a traditional encryption algorithm to form encrypted data.

[0061] The key circuit 12 in the encryption circuit processes the initial encrypted data using a physically unclonable function (PUF). PUF is a hardware security mechanism that generates a unique and unpredictable response, and even the same circuit generates different responses under the same stimulus signal. This means that each generated key is dynamic and cannot be copied or guessed externally. This feature prevents the key circuit 12 from storing any static keys or passwords, thereby avoiding the common risks of password leakage and theft.

[0062] Once the key circuit 12 generates the dynamic encryption key corresponding to the initial encrypted data, the initial encrypted data is then re-encrypted by the encryption module 13. This process uses the dynamic encryption key generated by the PUF to encrypt the initial encrypted data to generate secondary encrypted data. The secondary encryption not only increases the complexity of the encryption process, but also makes it impossible for an attacker to decrypt the initial encrypted data without the dynamic key even if they can obtain it.

[0063] After receiving the secondary encrypted data generated by the encryption module 13, the access module 11 will compare it with the pre-stored reference encrypted data. The reference encrypted data is generated and stored by secondary encryption according to the user information when the system is initialized. If the secondary encrypted data matches the reference encrypted data, it means that the authentication process of the user information is legal, and the access module 11 allows the user to access the server. If the secondary encrypted data does not match the reference encrypted data, the user is denied access.

[0064] Through this design, even with the same circuit and the same stimulus input, the generated dynamic key is unpredictable, which greatly enhances the security of the system. Since no static key or password is stored in the key circuit 12, even if an attacker successfully obtains part of the system data (such as encrypted data), he cannot obtain the correct key through brute force or other attack methods, further ensuring the password security of BIOS and BMC. This method effectively prevents identity forgery, configuration tampering and other potential security threats, and is an advanced and reliable identity authentication and encryption technology.

[0065] As an optional embodiment, the server further includes a field programmable gate array, and the key circuit 12 is integrated on the field programmable gate array. Specifically, the key circuit 12 can be integrated into the FPGA (Field-Programmable Gate Array, field programmable gate array) to further enhance the flexibility and security of the system. FPGA is a programmable hardware device with high flexibility and reconfigurability, and the circuit structure and function can be customized according to requirements. In this embodiment, the key circuit 12 is integrated into the FPGA. The programmable characteristics of the FPGA enable the key circuit 12 to be optimized and adjusted according to specific encryption requirements, and can effectively meet the server's high requirements for dynamic encryption key generation. The key circuit 12 can flexibly implement different key generation algorithms and encryption strategies according to different configurations, workloads or security requirements of the server, thereby improving the security of the entire system. Integrating the key circuit 12 on the FPGA makes the hardware implementation of the entire encryption process more closed and difficult to be tampered by attackers. Unlike the encryption algorithm implemented by software, the hardware encryption circuit running on the FPGA is not easily affected by external software attacks. Since the hardware logic inside the FPGA is irreversible and physically difficult to copy or reverse engineer, the dynamic encryption key generated by it has higher security. By integrating the key circuit 12 into the FPGA, the key generation, encryption and decryption operations can be implemented at the hardware level. Compared with traditional software encryption methods, hardware implementation has higher speed and lower latency. Especially when processing a large amount of user information, authentication requests and encryption operations, FPGA can significantly improve the throughput and response speed of the system. A significant advantage of FPGA is its reconfigurability, which means that once a security vulnerability is discovered or a new encryption standard needs to be supported, the design of the key circuit 12 can be modified by reprogramming without replacing the hardware. This flexible update capability enables the system to adapt to future security challenges and ensure long-term security.

[0066] In summary, by integrating the key circuit 12 on the FPGA, the encryption processing capability, flexibility and security of the server system can be greatly improved, ensuring the reliability and efficiency of the dynamic key generation and encryption process, while enhancing the defense capability against potential security threats.

[0067] As an optional embodiment, the key circuit 12 includes an arbitrator physical unclonable circuit and a key generation circuit; the arbitrator physical unclonable circuit is used to take the initial encrypted data as input stimulus and trigger the built-in physical structure characteristics to respond to the input stimulus to generate response data corresponding to the initial encrypted data; the key generation circuit is used to receive the response data and generate a dynamic encryption key based on the response data.

[0068] In this optional embodiment, the key circuit 12 is composed of an arbiter physical unclonable circuit (APUF) and a key generation circuit, which is intended to improve the security and unpredictability of the key during the encryption process. A physical unclonable function (PUF) is a circuit structure that uses tiny physical differences inherent in hardware to generate a unique response, and has the characteristics of being non-replicable and irreversible. Therefore, integrating PUF into the key circuit 12 can significantly enhance the security of the system and avoid the security risks brought about by traditional key storage and management methods.

[0069] Specifically, the arbiter's physical unclonable circuit uses the initial encrypted data as input stimulus to trigger its internal physical structure characteristics to respond. These physical structure characteristics, such as tiny differences in transistors and electrical characteristics of devices, determine that the PUF's response to the input signal is unique and cannot be copied. Since these physical differences come from the hardware itself, rather than external input or software control, the response data generated by each PUF is unique, and even the same circuit will produce different responses due to tiny physical differences. These response data have extremely high security protection because they cannot be predicted, copied, or reversed.

[0070] The key generation circuit is responsible for receiving the response data from the PUF and generating dynamic encryption keys based on this data. The key generation circuit uses the unique response data generated by the PUF as input, and converts the response data into encryption keys after a certain algorithm processing. These keys are dynamic and unpredictable, and only rely on the physical properties of the PUF, rather than static keys or passwords stored in the system. In this way, the key generation process is different each time, and even the same device will not generate the same key at different times, which effectively prevents key leakage and replay attacks.

[0071] In summary, by combining the arbiter physically unclonable circuit with the key generation circuit, the security of the encryption circuit can be greatly improved. As a hardware-level security mechanism, PUF ensures the uniqueness and unpredictability of the key, while the key generation circuit generates a dynamic key suitable for encryption operations by processing the PUF response data, which makes the entire encryption system more difficult to attack or crack. In addition, PUF also avoids the risks brought by traditional key storage and management, further improving the overall security of the system.

[0072] like Figure 6 and Figure 7As shown, as an optional embodiment, the key circuit 12 also includes: an encoding circuit, whose input end is connected to the arbiter physical unclonable circuit; a decoding circuit, whose input end is respectively connected to the output end of the arbiter physical unclonable circuit and the encoding circuit, and whose output end is connected to the key generation circuit; the arbiter physical unclonable circuit is also used to generate initialization data corresponding to the excitation signal based on the physical unclonable function according to the input excitation signal during the initialization process; the encoding circuit is used to encode the initialization data during the initialization process to obtain auxiliary information, and the auxiliary information at least includes verification information for error correction; the decoding circuit is used to receive response data and auxiliary information, and use the auxiliary information to decode the response data to generate decoded response data; the key generation circuit includes a hash calculation circuit and a key generation circuit, wherein: the hash calculation circuit is used to receive the response data, and perform hash calculation on the response data through a hash function to generate a hash hash; the key generation circuit is used to receive the hash hash and generate a dynamic encryption key corresponding to the hash hash according to the key format requirements.

[0073] In this optional embodiment, the key circuit 12 specifically includes an encoding circuit, a decoding circuit, an arbiter physically unclonable circuit (PUF), a hash calculation circuit, and a key generation circuit to ensure the uniqueness and anti-attack capability of key generation, and introduces an error correction mechanism to improve the reliability of response data. The system provides multiple layers of protection during initialization and actual operation to prevent attackers from forging responses or manipulating the encryption process.

[0074] Specifically, when the system is initialized, the arbiter physical unclonable circuit (PUF) receives the input stimulus signal and generates initialization data corresponding to the stimulus signal based on its built-in physical unclonable function. The uniqueness of the PUF circuit lies in its inherent tiny physical differences, which determine the unique response of the PUF to the input, so that the initialization data generated each time is unique and unpredictable, with a high degree of security. These initialization data are the basis of the encryption process, ensuring the dynamic and unpredictable nature of the key.

[0075] Subsequently, the encoding circuit encodes these initialization data to generate an auxiliary information, which contains not only the necessary checksum information, but also other elements for error correction. The purpose of the encoding process is to enhance the robustness of the system in the face of noise or data interference, and to ensure that the key generation can remain accurate and stable even when there are certain errors in the communication environment. The checksum information in the auxiliary information is particularly critical, as it can help verify and correct potential errors in subsequent steps.

[0076] The decoding circuit receives the response data from the PUF and the auxiliary information generated by the encoding circuit. The decoding circuit uses this auxiliary information to decode the response data to ensure that the final decoding result is correct and reliable. The decoded response data represents the response of the PUF circuit to the excitation signal, and this response data will be used to generate the encryption key.

[0077] During the key generation process, the hash calculation circuit receives the decoded response data and hashes it through a hash function. The hash calculation converts the response data into a fixed-length hash, which not only increases the unpredictability of the data, but also makes the generated key more computationally efficient. The use of the hash function ensures that the content of the response data cannot be reversed back to the original input, while avoiding repeated or known outputs.

[0078] Finally, the key generation circuit generates a corresponding dynamic encryption key based on the hash. This key not only meets the predetermined format requirements, but also generates the final encryption key based on the hash result. The key generation circuit ensures that the key is unique, dynamic, and closely related to the response data of the PUF, and cannot be foreseen or copied.

[0079] In summary, by combining the arbitrator's physical unclonable circuit to generate unique response data, the encoding circuit and decoding circuit to provide an error correction mechanism, and the hash calculation circuit and key generation circuit to ensure the uniqueness and security of the encryption key, this key circuit 12 system effectively improves the reliability, dynamics and anti-attack capability of the key generation process, and significantly enhances the overall security of the encryption system.

[0080] As an optional embodiment, the module to be accessed 11 is a baseboard management controller or a basic input and output system, which encrypts the user information to obtain initial encrypted data, including: encrypting the user information to obtain initial encrypted data, including: the module to be accessed 11 uses a preset encryption algorithm to encrypt the user information to obtain an encrypted hash or the hash value corresponding to the user information.

[0081] like Figure 8 and Fig. 9 As shown, in this optional embodiment, the module to be accessed 11 may be a baseboard management controller (BMC) or a basic input and output system (BIOS), and its main task is to encrypt the user information using a preset encryption algorithm when receiving the user information, thereby generating initial encrypted data corresponding to the user information, which is usually expressed in the form of an encrypted hash or hash value. The core goal of the encryption process is to ensure that the user's identity information always maintains confidentiality and integrity during transmission and storage.

[0082] First, after the access module 11 receives the user information (such as user name and login password), it processes the information through a preset encryption algorithm. The encryption algorithm may use symmetric encryption (such as AES) or asymmetric encryption (such as RSA), or a hash algorithm (such as SHA-256). If a hash algorithm is used, the encrypted data is usually a hash value of a fixed length, which represents the "fingerprint" of the user information. The hash value is irreversible, which means that even if an attacker obtains the encrypted hash, the original user information cannot be restored from it.

[0083] At this time, the generated encrypted hash or hash value serves as an encrypted representation of the user information, and it has the following significant features: even during storage or transmission, malicious attackers cannot restore the original user information by intercepting the encrypted data, thereby avoiding the risk of password leakage; due to the design of the hash algorithm, any different input data will produce different hash values, and the hash value is unpredictable, which ensures that the encrypted hash generated for each user information is unique; in the subsequent verification process, the module to be accessed 11 can compare the encrypted information input by the user with the stored encrypted hash value. Any tampering with the original user information will result in a significantly different encryption result, thereby preventing illegal access.

[0084] This encryption method not only protects the user's privacy information, but also provides strong security for the subsequent authentication process. If decryption is required later, the access module 11 uses a key or other encryption technology to further generate a key and decrypt information. In this way, the security of the entire authentication process is significantly enhanced, especially in preventing common attack methods such as brute force cracking, password guessing or data leakage, providing effective protection.

[0085] As an optional embodiment, a preset storage space is provided in the module to be accessed 11, and a preset relationship table is stored in the preset storage space. The preset relationship table is a one-to-one correspondence between multiple user information and multiple reference encrypted data.

[0086] In this optional embodiment, a preset storage space is set inside the module to be accessed 11, and the storage space is used to store a preset relationship table. The preset relationship table contains a one-to-one correspondence between multiple user information and multiple reference encrypted data. This means that in the module to be accessed 11, each user's identity information (such as user name, login password, etc.) will be associated with a unique encryption value (i.e., reference encrypted data).

[0087] Specifically, when a user accesses for the first time, the module to be accessed 11 generates corresponding initial encrypted data based on the information input by the user (such as user name and password), and verifies the user's identity by comparing it with the stored reference encrypted data. The preset relationship table is used to provide a fast search mechanism, so that the module to be accessed 11 can quickly find the corresponding reference encrypted data based on the input user information, thereby effectively performing identity authentication.

[0088] For example, assuming there are multiple users A, B, and C, the module to be accessed 11 will store the usernames and passwords of these users and the encrypted data (such as hash values) in a preset relationship table. When a user tries to log in, the module to be accessed 11 will search the preset relationship table based on the user's input information, find the corresponding reference encrypted data, and compare it with the encrypted information entered by the user. If the two are consistent, it means that the user's identity is legal and he is allowed to access. This design not only improves the efficiency of identity authentication, but also enhances the security of the system and avoids the risk of bypassing verification by tampering with or forging identity information.

[0089] As an optional embodiment, the module to be accessed 11 is also used to deny access to the user who inputs the user information when it is verified that the secondary encrypted data is different from the pre-stored reference encrypted data, and to trigger the generation of a security alarm and / or the recording of a time log and / or an automatic locking mechanism or a delay mechanism when the number of access denials reaches a threshold.

[0090] In this optional embodiment, the module to be accessed 11 has an enhanced security function, which can deny access to the user who inputs the user information when the verification secondary encrypted data is not the same as the pre-stored reference encrypted data. This means that when the verification data input by the user cannot match the reference encrypted data stored in the system, the user's access request is automatically denied. This design helps prevent unauthorized users from trying to access the system.

[0091] Furthermore, in order to prevent brute force cracking or frequent attacks, the access module 11 also includes a threshold control mechanism. When the number of access denials reaches a preset threshold, multiple security measures are triggered to enhance protection. These security measures include generating security alerts to remind administrators that the system may be facing security threats; recording time logs to facilitate subsequent analysis and tracking of potential attack events; and starting automatic locking mechanisms or delay mechanisms, such as temporarily locking an account or delaying the next attempt, to reduce the chances of repeated attempts by attackers.

[0092] This mechanism strengthens the prevention of illegal access and violent attacks by adding a layer of protection, ensuring that the system can respond quickly and take effective measures when faced with potential threats, thereby improving the overall security and reliability of the system.

[0093] As an optional embodiment, when the secondary encrypted data is verified to be different from the pre-stored reference encrypted data, the user who inputs the user information is denied access, and when the number of access denials reaches a threshold, an automatic locking mechanism or a delay mechanism is triggered, including: a counter may be set in the access module to count the number of consecutive failures for each user or session; determine whether the number of failures of the user or session has reached a preset threshold; if the number of failures exceeds the threshold, lock the user account for a period of time to prevent brute force cracking (this time may be set to a few minutes to a few hours, and the user cannot attempt to log in during the lock period); in extreme cases, if there are multiple failures, the account can be permanently locked until the administrator manually unlocks it. When the locking mechanism is triggered, the access module will mark the user's account status as "locked" and block further access requests. Another common security measure is a delay mechanism. This mechanism will increase the waiting time for login attempts after each user fails to log in. Specifically, each time the verification fails, a delay time will be added before the next user attempt to log in is allowed. For example, the first failure is delayed by 1 second, the second failure is delayed by 2 seconds, and so on. In this way, it is more difficult for attackers to crack passwords.

[0094] As an optional embodiment, the method for generating reference encrypted data is: during the initialization process, obtain the user credentials pre-stored in the module to be accessed 11, the user credentials including multiple groups of user information; for each group of user information, the module to be accessed 11 performs an initial encryption on the user information to obtain initial encrypted data; transmit the initial encrypted data to the key circuit 12 and the encryption module 13; use the key circuit 12 to generate a dynamic encryption key corresponding to the initial encrypted data based on a physically unclonable function; use the encryption module 13 to perform a secondary encryption on the initial encrypted data according to the dynamic encryption key to obtain reference encrypted data corresponding to each user information; transmit the reference encrypted data to the module to be accessed 11, and the module to be accessed 11 triggers a storage operation after receiving the reference encrypted data to store the reference encrypted data in its own preset storage space.

[0095] In this optional embodiment, the process of generating reference encrypted data ensures the security of user information through multi-step encryption operations. During the initialization process, the pre-stored user credentials are first obtained from the module to be accessed 11, and the credentials contain multiple sets of user information. For each set of user information, the module to be accessed 11 will first encrypt the information for the first time to generate initial encrypted data. This step is to ensure that the user's sensitive information is protected during transmission. Then, the initial encrypted data will be transmitted to the key circuit 12 and the encryption module 13. In the key circuit 12, a dynamic encryption key corresponding to the initial encrypted data is generated based on a physical unclonable function (PUF). The physical unclonable function generates unpredictable response data by utilizing the unique physical properties in the hardware, which makes each encryption key unique and cannot be copied. Subsequently, the encryption module 13 uses the dynamic encryption key to perform a secondary encryption on the initial encrypted data, thereby generating reference encrypted data corresponding to each user information. The secondary encryption enhances the complexity and security of the encryption process, ensuring that even if an attacker obtains the initial encrypted data, it is difficult to crack the real user information. Finally, the generated reference encrypted data is transmitted back to the module to be accessed 11 and stored in a preset storage space of the module.

[0096] This design ensures the secure storage of reference encrypted data on the server and increases the difficulty of data tampering or theft through multiple encryption steps, thereby greatly improving the security of the system.

[0097] On the second aspect, the present application provides a server, including the encryption circuit as described above, and also including a module to be accessed 11 and an encryption module 13, wherein the encryption circuit is arranged between the module to be accessed 11 and the encryption module 13, and the encryption module 13 is in communication connection with the module to be accessed 11. The server receives user information through the module to be accessed 11, and encrypts and verifies the information through the encryption circuit and the encryption module 13 to ensure that only verified users can access the system, thereby improving the security of the server. The encryption circuit plays an important role in this process, and further ensures the data protection and defense capabilities of the server by generating a dynamic encryption key and performing secondary encryption on the user information. For other introductions to the server, please refer to the above embodiments, and the present application will not repeat them here.

[0098] Thirdly, Fig.10 As shown, the present application provides an encryption method, comprising:

[0099] S11: receiving input user information, the user information includes user name and login password;

[0100] In this step, the module to be accessed receives the identity information entered by the user, which usually includes the user name and login password. This information entered by the user is the basis for the system to identify the user and authorize access. The collection of this information is the first step in the system identity authentication process and lays the foundation for subsequent encryption operations.

[0101] S12: Initially encrypt the user information to obtain initial encrypted data;

[0102] After receiving the user information, the module to be accessed uses a preset encryption algorithm (such as symmetric encryption or hash algorithm, etc.) to perform preliminary processing on the user information and generate initial encrypted data. The purpose of this step is to convert the user's sensitive information into unreadable encrypted data to prevent the information from being stolen or tampered with during transmission. The preliminary encrypted data provides input for subsequent encryption key generation.

[0103] S13: using the initial encrypted data as a stimulus to enable a circuit based on a physical unclonable function to generate a dynamic encryption key corresponding to the initial encryption function;

[0104] In this step, the initial encrypted data is used as input stimulus and input into the arbitrator physical unclonable circuit (PUF). The circuit based on the physical unclonable function (PUF) will produce a unique and unpredictable response based on the input stimulus. Each time the same initial encrypted data is input, the circuit will generate a different dynamic encryption key. The key generated in this way is based on hardware characteristics and has a high degree of security because the response of the PUF cannot be copied or predicted.

[0105] S14: re-encrypting the initial encrypted data according to the dynamic encryption key to obtain re-encrypted data;

[0106] In this step, the generated dynamic encryption key is used to further encrypt the initial encrypted data, i.e., secondary encryption. By secondary encrypting the initial encrypted data, the encryption strength can be further improved, making the original data more secure and tamper-proof during the encryption process. The secondary encrypted data is the data that cannot be easily cracked after encryption, i.e., secondary encrypted data.

[0107] S15: Verify whether the secondary encrypted data is identical to the pre-stored reference encrypted data;

[0108] Next, the generated secondary encrypted data is compared with the pre-stored reference encrypted data. The reference encrypted data is the encrypted data that the system pre-generates and stores for each user information during the initialization process. If the secondary encrypted data is consistent with the reference encrypted data, it means that the user information has not been tampered with and the user identity has been verified.

[0109] S16: When the secondary encrypted data is the same as the reference encrypted data, the user who entered the user information is allowed to access. If the secondary encrypted data matches the reference encrypted data, the user is allowed to access the system or resource. This is the core of the entire authentication process. A successful verification process ensures the authenticity of the user's identity, thereby authorizing access and ensuring that only legitimate users can access the server or related resources. If the verification fails, the user's access request will be denied.

[0110] For other introductions to the encryption method, please refer to the above embodiments, and this application will not go into details here.

[0111] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0112] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An encryption circuit, characterized in that: Applied to a server, the server further comprises a module to be accessed and an encryption module which are communicatively connected, and the encryption circuit comprises a key circuit which is respectively connected to the module to be accessed and the encryption module; The module to be accessed is used to encrypt the user information inputted to obtain initial encrypted data upon receiving the user information inputted, and to verify whether the secondary encrypted data is the same as the pre-stored reference encrypted data upon receiving the secondary encrypted data sent by the encryption module, and if they are the same, allow the user who inputted the user information to access; the user information includes a user name and a login password; The key circuit is used to generate a dynamic encryption key corresponding to the initial encrypted data based on a physical unclonable function; The encryption module is used to perform secondary encryption on the initial encrypted data based on the dynamic encryption key to obtain secondary encrypted data.

2. The encryption circuit according to claim 1, characterized in that: The key circuit includes an arbitrator physical unclonable circuit and a key generation circuit; The arbiter physical unclonable circuit is used to use the initial encrypted data as an input stimulus and trigger the built-in physical structure characteristics to respond to the input stimulus to generate response data corresponding to the initial encrypted data; The key generation circuit is used to receive the response data and generate the dynamic encryption key according to the response data.

3. The encryption circuit according to claim 2, characterized in that: The key circuit also includes: an encoding circuit, an input end of which is connected to the arbiter physical unclonable circuit; A decoding circuit, whose input end is connected to the output end of the arbiter physical unclonable circuit and the encoding circuit respectively, and whose output end is connected to the key generation circuit; The arbiter physical unclonable circuit is further used to generate initialization data corresponding to the excitation signal based on the physical unclonable function according to the input excitation signal during the initialization process; The encoding circuit is used to encode the initialization data during the initialization process to obtain auxiliary information, wherein the auxiliary information at least includes check information for error correction; The decoding circuit is used to receive the response data and the auxiliary information, and decode the response data using the auxiliary information to generate decoded response data; The key generation circuit includes a hash calculation circuit and a key generation circuit, wherein: The hash calculation circuit is used to receive the response data and perform hash calculation on the response data through a hash function to generate a hash; The key generation circuit is used to receive the hash and generate a dynamic encryption key corresponding to the hash according to the key format requirement.

4. The encryption circuit according to claim 1, characterized in that: The module to be accessed is a baseboard management controller or a basic input and output system, and the user information is encrypted to obtain initial encrypted data, including: The user information is encrypted to obtain initial encrypted data, including: The module to be accessed encrypts the user information using a preset encryption algorithm to obtain an encrypted hash or the hash value corresponding to the user information.

5. The encryption circuit according to claim 1, characterized in that: The module to be accessed is provided with a preset storage space, and the preset storage space stores a preset relationship table, and the preset relationship table is a one-to-one correspondence between a plurality of the user information and a plurality of the reference encrypted data.

6. The encryption circuit according to claim 1, characterized in that: The server further comprises a field programmable logic gate array, and the key circuit is integrated on the field programmable logic gate array.

7. The encryption circuit according to claim 1, characterized in that: The module to be accessed is also used to deny access to the user who has input the user information when it is verified that the secondary encrypted data is different from the pre-stored reference encrypted data, and to trigger the generation of a security alarm and / or the recording of a time log and / or an automatic locking mechanism or a delay mechanism when the number of access denials reaches a threshold.

8. The encryption circuit according to any one of claims 1 to 7, characterized in that: The reference encrypted data is generated in the following manner: During the initialization process, obtaining the user credentials pre-stored in the module to be accessed, wherein the user credentials include multiple sets of user information; For each set of user information, the module to be accessed performs initial encryption on the user information to obtain initial encrypted data; Transmitting the initial encrypted data to the key circuit and the encryption module; generating a dynamic encryption key corresponding to the initial encrypted data using the key circuit based on a physically unclonable function; Using the encryption module to perform secondary encryption on the initial encrypted data according to the dynamic encryption key to obtain reference encrypted data corresponding to each user information; The reference encrypted data is transmitted to the module to be accessed. After receiving the reference encrypted data, the module to be accessed triggers a storage operation to store the reference encrypted data in its own preset storage space.

9. A server, characterized in that: It comprises the encryption circuit as described in any one of claims 1-8, and also comprises a module to be accessed and an encryption module, the encryption circuit is arranged between the module to be accessed and the encryption module, and the encryption module is communicatively connected with the module to be accessed.

10. An encryption method, characterized in that: include: Receiving input user information, the user information including user name and login password; Performing initial encryption on the user information to obtain initial encrypted data; Using the initial encrypted data as a stimulus to enable a circuit based on a physical unclonable function to generate a dynamic encryption key corresponding to the initial encrypted function; Performing secondary encryption on the initial encrypted data according to the dynamic encryption key to obtain secondary encrypted data; Verifying whether the secondary encrypted data is identical to the pre-stored reference encrypted data; When the secondary encrypted data is identical to the reference encrypted data, access is permitted to the user who inputs the user information.

Images