Hot plug guarantee method and device for iris recognition M.2 / mini-PCIe module

Abstract

The invention belongs to the technical field of biological feature recognition, embedded system security and computer bus interfaces, and particularly relates to a hot plug guarantee method and device for an iris recognition M.2 / mini-PCIe module. A security power domain comprises a session key memory, a security element chip and a key state holding circuit, and a processor power domain (Vcore) comprises a main controller and an image interface. The safe power domain (Vsec) comprises a ferroelectric random access memory (FRAM) and a static random access memory (SRAM); and when the system detects that the PERST # signal jumps from a high level to a low level, cutting off the power supply of the safety power supply domain (Vsec), and triggering a safety sealing process. According to the invention, through organic combination of a dual-power-domain architecture design, an ultra-fast data storage mechanism, a self-adaptive security protection strategy and a distributed data integrity verification system, the technical problem of an iris recognition module in a hot plug scene is solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of biometric recognition, embedded system security and computer bus interface, and particularly relates to a hot plug guarantee method and device for an iris recognition M.2 / mini-PCIe module. BACKGROUND

[0002] With the wide application of biometric recognition technology in the fields of financial payment, access control, medical supervision and public security, iris recognition technology is increasingly adopted due to its unique advantages such as strong uniqueness, good stability and difficulty in forgery. In order to meet the rapid integration needs of industrial-grade mainboards and embedded systems, modern iris acquisition modules are usually designed in the form of standard M.2 or mini-PCIe expansion cards to facilitate flexible hardware configuration and later upgrades by system integrators.

[0003] However, the existing PCI-SIG hot plug specification mainly focuses on the security of the electrical level, including voltage surge suppression, current limitation and link reset timing, etc. basic issues, but there are significant deficiencies in the security protection of sensitive biometric data. When the iris recognition module is accidentally pulled out or planned for maintenance during operation, a series of serious technical problems and security risks will occur.

[0004] First, the session data loss problem caused by instantaneous power failure. When the module is pulled out, the sudden interruption of 3.3V main power supply will cause all the session keys, cached iris template data and ongoing authentication context information stored in volatile memory to disappear immediately. This sudden data loss not only interrupts the ongoing identity authentication process, but also may cause the user to need to perform a complete registration process again, seriously affecting the user experience.

[0005] Second, the time delay problem of complete template reloading. After the module is reinserted, the system usually needs to download the user's complete iris template from a remote server or cloud database, and these template data often reach the size of tens of kilobytes. In the environment of limited network bandwidth or unstable network connection, this re-synchronization process may take several seconds or even longer, seriously affecting the real-time response capability of the system.

[0006] Third, the consistency destruction problem of incremental template differential chain. Modern iris recognition systems usually use incremental update mechanism to adapt to the slight changes of user iris features, and these incremental data form a logical chain structure. When the system experiences unexpected power failure during incremental data writing, the continuity of the chain hash will be destroyed, resulting in failure of subsequent data integrity verification and affecting the audit traceability capability of the system.

[0007] Finally, the security threat of cold boot attack. A malicious attacker may try to obtain sensitive key information or biometric data within the short time window of system power-on initialization by repeatedly performing hot plug operations. Traditional software encryption mechanisms often appear to be inadequate in the face of such physical layer attacks.

[0008] In the prior art, some solutions try to avoid data loss problems through external uninterruptible power supply (UPS), super capacitor backup or whole machine hibernation mechanism, but these solutions generally have the disadvantages of high cost, large size, complex maintenance, etc., and conflict with the design concept of "plug and play". Therefore, there is an urgent need for an innovative technical solution that can realize a safe, efficient and low-cost hot plug state preservation function while maintaining standard interface compatibility. SUMMARY

[0009] In view of the deficiencies of the prior art, the present application provides a hot plug protection method and device for an iris recognition M.2 / mini-PCIe module. The present application solves the technical problems of cold boot attack faced by the iris recognition module in the hot plug scene through the organic combination of dual power domain architecture design, ultra-fast data sealing mechanism, adaptive security protection strategy and distributed data integrity verification system.

[0010] The technical solution of the present application is: a hot plug protection method for an iris recognition M.2 / mini-PCIe module, characterized by comprising the following steps: Step a, the step of the safe sealing mechanism: when the PERST# signal drop is detected, the Safe-Suspend process is started: the true random number generator (TRNG) of the processor power domain (Vcore) generates a one-time session key Ks; the latest iris template incremental data, authentication session counter, live detection state identifier and other key business context information are subjected to double-encapsulation encryption processing; the encrypted data is written into the ferroelectric random memory (FRAM) of the secure power domain (Vsec) through direct memory access (DMA) mode; Step b, the step of session key self-destruction: when the voltage of the secure power domain (Vsec) drops to a threshold value of 1.5V or below, the static random memory (SRAM) storing the session key Ks enters a power-off state, and all the data stored therein will be irreversibly lost; Step c, the step of managing and synchronizing the incremental template differential chain: the complete iris template T0 is safely used as the reference version, and all subsequent template updates are recorded in the form of incremental difference; Step d, resuming the step of connecting with the breakpoint: first, the voltage stabilization process of the secure power domain (Vsec) is completed within 150 microseconds, and then the ferroelectric random access memory (FRAM) is read within 180 microseconds to complete the retraining and initialization of the PCIe link; after the link is established, the authentication token in the mini-PCIe module BAR0 register is read, the token is verified, the legality of the mini-PCIe module identity is confirmed, and the RESUME resume command is sent; after the mini-PCIe module receives the resume command, the encrypted data in the FRAM is unpacked using the previously generated session key Ks, and the incremental link node cache and service state are restored.

[0011] According to the hot plug protection method of the iris recognition M.2 / mini-PCIe module as described above, characterized in that: the step of security policy and risk assessment: monitoring the cumulative drift ΣΔH, the user activity index A and the comprehensive risk score R, when any one parameter exceeds the preset safety threshold, starting the self-destruction countdown mechanism, the countdown time is dynamically calculated according to the formula t_wipe = λe^(-A), wherein λ is a configurable basic time constant.

[0012] According to the hot plug protection method of the iris recognition M.2 / mini-PCIe module as described above, characterized in that: the double-encapsulated encryption processing adopts a nested encryption structure, the outer layer is encrypted using the generated session key Ks, and the inner layer is encrypted using the pre-established daily rotation key Kd, forming a double-protected structure of EncKs{EncKd{data}}.

[0013] According to the hot plug protection method of the iris recognition M.2 / mini-PCIe module as described above, characterized in that: step b also includes a security protection mechanism: by continuously monitoring the activity index and risk assessment parameters of the system, when abnormal use mode or potential attack behavior is detected, the adaptive self-destruction countdown function is started, and all sensitive data are automatically cleared within the preset time window.

[0014] According to the hot plug protection method of the iris recognition M.2 / mini-PCIe module as described above, characterized in that: each incremental node of the incremental difference contains the difference data itself, carries the accurate time stamp and the forward hash value, and forms the data structure of Δ|TS|PrevHash; the incremental data is written into the solid state memory of the edge device, the Merkle tree structure is calculated periodically, and the tree root hash value is submitted to the block chain network for permanent evidence.

[0015] According to the hot plug guarantee method of the iris recognition M.2 / mini-PCIe module, the incremental chain node adopts a standardized data structure design, each node contains three core components of differential data, accurate time stamp and forward hash value, forms a fixed format of DeltaData ‖ TS ‖ PrevHash, and the hash calculation adopts an SHA-256 algorithm to ensure the consistency and safety of the calculation result.

[0016] The application further discloses a hot plug guarantee device of an iris recognition M.2 / mini-PCIe module, 5V main power supplies generate 1.1V power supply and 1.8V power supply through two independent DC-DC converters, and the device comprises a processor power supply domain and a security power supply domain, wherein the 1.1V power supply supplies power for the processor power supply domain (Vcore), and the 1.8V power supply supplies power for the security power supply domain (Vsec); the processor power supply domain (Vcore) provides power supply for a main control microprocessor, a peripheral interface and a digital logic circuit; the security power supply domain is used for storing a session key, a security element chip and a key state maintaining circuit; the processor power supply domain (Vcore) comprises a main controller and an image interface; the security power supply domain (Vsec) comprises a ferroelectric random access memory (FRAM) and a static random access memory (SRAM); when the system detects that a PERST# signal jumps from a high level to a low level, the power supply of the security power supply domain (Vsec) is cut off, and a security sealing process is triggered.

[0017] According to the hot plug guarantee device of the iris recognition M.2 / mini-PCIe module, the hot plug controller cuts off the power supply of the security power supply domain (Vsec) within 1 microsecond.

[0018] According to the hot plug guarantee device of the iris recognition M.2 / mini-PCIe module, the device further comprises a standard communication interface, the communication interface is used for synchronizing data with an edge gateway and a block chain network, supports an on-chain storage operation of an incremental chain Merkle root, and the edge gateway system realizes an intelligent batch processing management mechanism, accumulates the number and time interval of incremental data, constructs a Merkle tree data structure when the time condition or the accumulated number condition is met, and submits a tree root hash value obtained through calculation to the block chain network for permanent storage.

[0019] According to the hot plug protection device of the iris recognition M.2 / mini-PCIe module, the processor power domain and the secure power domain exchange data through the SPI interface, the main controller requests key services from the secure element through the SPI interface in normal operation, the main controller transmits key data to the FRAM of the secure element through the SPI interface when the hot plug is triggered, and the secure element returns the encrypted data to the main controller after verifying the identity in the recovery.

[0020] The present application has the following advantages: first, the safe storage of the latest iris template incremental data and key service context information is automatically completed within 1 microsecond after the hot plug signal is detected, ensuring that the data is not lost due to sudden power failure; second, through the innovative session key self-destruction mechanism, all sensitive keys are invalidated immediately after the module power failure, fundamentally eliminating the possibility of cold start attack; third, the complete service state is quickly restored within 1 second after the module is reinserted and powered on, without the need to download a large amount of template data or re-register the user; fourth, through the distributed incremental chain management and block chain storage mechanism, the history change record of the iris template data is ensured to be continuous, complete and tamper-proof, meeting the strict audit compliance requirements. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 Iris module hardware system architecture diagram: including the division of dual power domains (Vcore and Vsec), the connection relationship of hot plug controller and electronic fuse, the integration mode of FRAM memory, the deployment position of secure element and the running direction of various key signal lines. The mutual relationship of power management unit, microcontroller, secure storage area and PCIe interface circuit is indicated in the figure, which provides an intuitive visual reference for understanding the hardware basis of the whole system.

[0022] Figure 2 Hot plug operation timing waveform diagram: this diagram depicts the timing change relationship of each key signal in the hot plug process, including the falling edge trigger time of the PERST# signal, the voltage change curve of the Vsec power domain, the evolution process of the BAR0 register state and the execution time window of the Safe-Suspend process. Through this timing diagram, the strict timing relationship between each operation step and how the system completes the complex data protection operation in a very short time can be clearly seen.

[0023] Figure 3Safe-Suspend to Resume state machine transition diagram: This diagram presents the complete transition process of the system from normal operation state to safe suspension state, and then to full recovery state in the form of a flowchart. The triggering conditions, key operations performed, and possible exception handling paths are marked in the diagram, including the normal recovery process and the safe clearing process in abnormal situations.

[0024] Figure 4 Double-encapsulation encryption and decryption data flow diagram: This diagram illustrates the specific implementation process of the core double-encryption mechanism of the invention, showing how the original iris template data is encrypted twice by the inner key Kd and the outer key Ks to form highly secure ciphertext data, and how the original data is restored through the corresponding decryption steps in the recovery process. The diagram also shows the key generation, storage, and destruction process.

[0025] Figure 5 Incremental differential chain and Merkle tree synchronization mechanism diagram: This diagram shows the chain management structure of incremental iris template data, illustrating how to build a continuous update chain from the initial complete template T0 through a series of incremental differentials Δk, and how these incremental data are periodically aggregated to generate a Merkle tree structure, and ultimately submitted to the blockchain network for permanent evidence.

[0026] Figure 6 Detailed circuit diagram for dual power domain architecture.

[0027] Figure 7 Detailed circuit diagram for power management circuit.

[0028] Figure 8 Detailed circuit diagram for data exchange between Vcore and Vsec.

[0029] Figure 9 Detailed circuit diagram for hot plug controller to cut off power within 1 microsecond.

[0030] Noun explanation: M.2 interface (NGFF) is a compact hardware interface widely used in solid state drives, wireless network cards and other devices, supporting PCIe, SATA, USB and other protocols, with the advantages of high transmission rate, low power consumption and small size.

[0031] Mini PCIe (Mini Peripheral Component Interconnect Express) module, full name "Mini PCI Express module", is a small expansion module designed based on PCI Express (PCIe) bus standard, mainly used to provide flexible hardware function expansion for devices (especially small electronic devices). DETAILED DESCRIPTION

[0032] The technical solutions of the present application are further described below in combination with the drawings.

[0033] In order to achieve the above technical objectives, the present application adopts a multi-level and multi-dimensional comprehensive technical solution, the core of which is to build a safe and efficient hot plug state retention system.

[0034] As shown in Figure 1 and Figure 6 , the hot plug protection device of the iris recognition M.2 / mini-PCIe module of the present application adopts a dual power domain isolation architecture, including a processor power domain (Vcore) and a secure power domain (Vsec), wherein the processor power domain (Vcore) works at a 1.1V voltage level, mainly providing power supply for the main control microprocessor, peripheral interface and general digital logic circuit. The secure power domain (Vsec) works at a 1.8V voltage level, and is specially used to supply power for the key security components, including the session key memory, the security element chip and the key state retention circuit. The dual power domain isolation architecture of the present application has the advantage that the secure power domain (Vsec) is connected to the main power system through a series of carefully designed power management circuits, including the hot plug controller, the electronic fuse (eFuse) and the intelligent monitoring field effect transistor. The processor power domain (Vcore) includes the main controller and the image interface; the secure power domain (Vsec) includes the ferroelectric random access memory (FRAM) and the static random access memory (SRAM). As shown in Figure 1 , the 5V main power supply generates 1.1V power supply and 1.8V power supply through two independent DC-DC converters, the 1.1V power supply is used to supply power for the processor power domain (Vcore), and the 1.8V power supply is used to supply power for the secure power domain (Vsec); the 5V main power supply is provided by the PCIe / M.2 interface, the 5V main power supply generates 1.1V through the DC-DC step-down converter to supply power for the processor power domain (Vcore); and 1.8V is generated through another DC-DC converter to supply power for the secure power domain (Vsec). When the overall system detects that the PERST# signal jumps from high level to low level, the hot plug controller can cut off the power supply of the secure power domain (Vsec) in a very short time of 1 microsecond, and trigger the secure storage process. The present application adopts a dual power domain isolation architecture, which divides the power supply system inside the module into two relatively independent power supply domains.

[0035] The device of the application is also equipped with a standard communication interface for data synchronization with an edge gateway and a blockchain network, supporting incremental chain Merkle root uploading and storage operation. The edge gateway system realizes an intelligent batch processing management mechanism. When the cumulative number of incremental data and the time interval meet the time condition of every 5 minutes or the number condition of cumulative 200 incremental records, the overall system automatically constructs a complete Merkle tree data structure, and submits the calculated tree root hash value to the blockchain network for permanent storage. This periodic batch processing mechanism not only ensures the timeliness of data integrity verification, but also effectively controls the transaction frequency and cost of the blockchain network.

[0036] The device system architecture of the application includes the following core modules and their cooperative relationship: (1) Processor power domain (Vcore) includes running iris recognition algorithm engine, managing PCIe communication interface, controlling image acquisition sensor, and performing data encryption / decryption operation. (2) Secure power domain (Vsec) includes hardware security module (HSM): storing root key and certificate; FRAM controller: managing non-volatile secure storage; SRAM cache: temporarily storing session key; cryptographic coprocessor: accelerating encryption operation. (3) Cross-domain communication mechanism: data exchange between processor power domain (Vcore) and secure power domain (Vsec) through SPI interface, which includes: 4-wire SPI bus (MOSI, MISO, SCK, CS#), optocoupler isolator or magnetic coupler isolator, and maximum support 50MHz communication rate. (4) Workflow: during normal operation, the main controller requests key service from the secure element through the SPI interface. When hot plug is triggered, the main controller transmits critical data to the FRAM of the secure element through the SPI. During recovery, the secure element verifies the identity and returns the encrypted data to the main controller.

[0037] As shown in Figures 1 to 9 The application also discloses a hot plug protection method for the iris recognition M.2 / mini-PCIe module, including the following steps: Step a, the step of super-fast safe storage mechanism: As shown in Figure 1 When the PERST# signal drop is detected, the overall system immediately starts the Safe-Suspend process, which is the core link of the entire hot plug protection mechanism.

[0038] The Safe-Suspend procedure first invokes the True Random Number Generator (TRNG) of the master controller of the processor power domain (Vcore) to quickly generate a high-strength one-time session key Ks, such as a 256-bit high-strength one-time session key Ks within 3-5 nanoseconds. The random nature of this key Ks guarantees the uniqueness and unpredictability of each sealing process. Subsequently, the master control system (Master Control System: refers to the master controller (MCU) in the processor power domain (Vcore), responsible for running the iris recognition algorithm, managing data flow and performing encryption operations) will perform double-encapsulation encryption processing on the current most important runtime data, including the latest iris template incremental data, authentication session counter, liveness detection state identifier and other key business context information. This double-encapsulation mechanism adopts a nested encryption structure, with the outer layer encrypted using the just-generated session key Ks and the inner layer encrypted using the pre-established daily rotation key Kd, forming a double-protection structure of EncKs{EncKd{data}}. The encrypted data is quickly written to the ferroelectric random access memory (FRAM) of the secure power domain (Vsec) through direct memory access (DMA), and the entire writing process is strictly controlled to be completed within 1 microsecond.

[0039] Step b, session key self-destruction and security protection mechanism As Figure 2The automatic self-destruction function of the session key is an important innovation of the present application. When the voltage of the secure power domain (Vsec) drops below the threshold of 1.5V, the static random access memory (SRAM) storing the session key Ks will automatically enter a power-off state, and all the stored data will be irreversibly lost. This hardware-level self-destruction mechanism based on voltage threshold ensures that even in the most extreme attack scenarios, attackers cannot obtain valid key information through rapid power-on or other physical means. At the same time, the overall system also implements a dynamic security protection mechanism, which continuously monitors the activity indicators and risk assessment parameters of the system. When abnormal usage patterns or potential attack behaviors are detected, the overall system will start an adaptive self-destruction countdown function to automatically clear all sensitive data within a preset time window. The sensitive data includes the data of static random access memory (SRAM), ferroelectric random access memory (FRAM), and the data cached by the main controller. The data of static random access memory (SRAM) includes the session key Ks, temporary authentication token, and live detection parameters. The data of ferroelectric random access memory (FRAM) includes the encrypted iris template, incremental differential data, and business context. The data cached by the main controller includes the iris image being processed and the intermediate calculation results. When abnormal usage patterns are detected, the overall system will start an adaptive self-destruction countdown function to automatically clear all session keys and temporary data in the static random access memory (SRAM) and the incremental data in the ferroelectric random access memory (FRAM) that have not been synchronized within a preset time window.

[0040] Step c, management and synchronization of incremental template difference chain As Figure 3 As shown in the state transition diagram, in order to minimize data transmission overhead and improve the response speed of the overall system, the present application adopts an innovative incremental template difference chain management mechanism. The overall system securely stores the user's complete iris template T0 in the hardware security module (HSM) as the reference version, and all subsequent template updates are recorded in the form of incremental difference, i.e. Δk = Tk ⊕ Tk-1, where ⊕ represents the exclusive OR operation. Each incremental node not only contains the difference data itself, but also carries an accurate timestamp and a forward hash value, forming a standardized data structure of Δ|TS|PrevHash. These incremental data are written into the edge device solid state memory (SSD) in the processor power domain (Vcore), forming a logically continuous chain structure. The overall system periodically calculates the Merkle tree structure for these incremental nodes (usually every 5 minutes or after accumulating a certain number), and submits the tree root hash value to the blockchain network for permanent evidence, ensuring the integrity and tamper resistance of the data.

[0041] Step d, fast recovery and breakpoint continuation AsFigure 4 The double-encapsulation encryption process shown, when the mini-PCIe module is reinserted into the host system, the fast recovery process will start immediately.

[0042] The decryption recovery process is that the security system first completes the voltage stabilization process of the security power domain (Vsec) within 150 microseconds, and then reads the ferroelectric random access memory (FRAM) within 180 microseconds to complete the retraining and initialization of the PCIe link. After the link is established, the host driver reads the authentication token in the BAR0 register of the mini-PCIe module, which is generated based on the device serial number and the latest hash value of the incremental chain node using the SHA-256 algorithm, and has the characteristics of uniqueness and anti-forgery. The host system verifies the token and confirms the legality of the mini-PCIe module identity, and then sends the RESUME recovery command. After receiving the recovery command, the mini-PCIe module uses the previously generated session key Ks to unpack the encrypted data in the FRAM, restores the incremental chain node cache and service state, and the total time consumption of the entire recovery process is strictly controlled within 1 second.

[0043] The incremental chain node in this step adopts a standardized data structure design, each node contains three core components of differential data, precise timestamp and forward hash value, forming a fixed format of ΔData‖TS‖PrevHash, and all hash calculations adopt the SHA-256 algorithm to ensure the consistency and security of the calculation results. This structured design not only facilitates fast data retrieval and verification, but also provides a reliable technical foundation for subsequent audit tracing.

[0044] The application can also include the steps of adaptive security policy and risk assessment As Figure 5 The security policy decision process shown, the application also integrates an intelligent adaptive security policy system, which can dynamically adjust the security protection strength according to real-time usage and risk assessment results. The overall system continuously monitors parameters such as cumulative drift ΣΔH, user activity index A, and comprehensive risk score R in multiple dimensions. When any parameter exceeds the preset safety threshold, the overall system will start a self-destruction countdown mechanism, and the countdown time is dynamically calculated according to the formula t_wipe = λe^(-A), where λ is a configurable base time constant, usually set between 30 and 60 seconds. This adaptive mechanism can effectively prevent various security threats, and can also avoid unnecessary interference to normal use.

[0045] The beneficial effects of the present application are: it can significantly improve the performance and security protection capability of the iris recognition mini-PCIe module in the hot plug scene, which is embodied in the following aspects. First, in terms of user experience, the present application realizes the true sense of hot plug service continuity. When the user performs normal hardware maintenance or upgrade operation, there is no need to worry about the interruption of authentication session or the loss of data, and the mini-PCIe module can automatically recover to the working state before being pulled out in a very short time, and the user experiences a nearly seamless use experience. This continuity is of particular importance to industrial application scenarios that require long-term continuous operation. Second, in terms of security, the present application builds an almost invincible security barrier through multi-level protection mechanism. The double-enclosed encryption mechanism ensures the absolute safety of data in the storage and transmission process, even if the attacker obtains physical access, it is also difficult to crack the encrypted sensitive information. The automatic self-destruction function of the session key fundamentally eliminates the possibility of cold start attack, and the adaptive security strategy can effectively deal with various known and unknown attack means. Third, in terms of performance efficiency, the present application significantly reduces the response delay and network transmission overhead of the system. Through the ultra-fast read-write capability of FRAM and the optimized data sealing algorithm, the system can complete the safe sealing of key data in 1 microsecond, which is several orders of magnitude faster than traditional hard disk or flash memory. The incremental differential chain mechanism reduces the network transmission data volume by about 70%, which has important value for network bandwidth limited application environment. Finally, in terms of compliance, the design of the present application fully considers various industry standards and regulatory requirements. The block chain storage mechanism ensures the integrity and non-repudiation of audit traceability, meets the strict requirements of FDA (U.S. Food and Drug Administration), GMP (Good Manufacturing Practice) and ISO 24745 international standards for biometric data management. This high degree of compliance makes the present application particularly suitable for industries such as medical care and finance that are subject to strict regulation.

[0046] The present application provides a comprehensive technical solution for maintaining session state and ensuring biometric data integrity during hot plug operation. The present application is particularly suitable for scenarios that require frequent hardware module replacement, upgrade or maintenance in industrial application environments. Through innovative hardware architecture design and software protocol mechanism, the present application ensures the business continuity and data security of the iris recognition system during hot plug.

[0047] The system of the present application refers to the main control system, the security system and the integrated system. The main control system (MCS - Main Control System) refers to the main controller MCU in the processor power domain (Vcore) and the embedded software it runs, responsible for: iris image acquisition and recognition algorithm execution; PCIe communication protocol stack management; data encryption / decryption operation; cross-domain communication with the security element. The security system (SES - Security Element System) refers to the security element chip in the security power domain (Vsec) and its firmware, responsible for: key generation, storage and management; access control of FRAM / SRAM; security policy execution; self-destruction mechanism triggering. The integrated system (IMS - Integrated Module System) refers to the complete module system containing two power domains, which is the collection of the main control system and the security system. The main controller MCU (main control system) transmits the current most important runtime data, including the latest iris template incremental data, authentication session counter, live detection state identifier and other key business context information, to the security element through the SPI interface, and the security element performs double-encapsulation encryption processing. At the same time, the security element firmware (security system) also implements a dynamic security protection mechanism, which continuously evaluates system activity indicators and risk parameters through its internal monitoring module. When the security element detects abnormal usage patterns, it will start the adaptive self-destruction countdown function.

[0048] In order to better illustrate the specific implementation method and expected effect of the technical solutions of the present application in actual application, two typical embodiments are provided below, which are based on different application scenarios and technical requirements, and demonstrate the wide applicability and technical advantages of the present application.

[0049] Embodiment 1: High-performance M.2 Key-E four-channel iris recognition module This embodiment is aimed at application scenarios that require high concurrent processing capability, adopts M.2 Key-E interface standard, and supports four-way parallel iris image acquisition and processing. In terms of hardware selection, the hot plug controller selects Texas Instruments' TPS25982 model, which has precise current monitoring and fast circuit protection functions, and can cut off the power supply within microseconds when detecting abnormal current. The electronic fuse part uses a precision device with a current limiting value of 1.5 amperes to ensure reliable overcurrent protection under various abnormal conditions. The monitoring MOSFET selects Texas Instruments' CSD17577Q model, which has extremely low on-resistance and fast switching characteristics.

[0050] The buck converter of the secure power domain adopts the MPQ8633 chip of Monolithic Power Systems, which is specially optimized for low-power applications and can maintain stable output when the input voltage changes. The system designs a precise voltage monitoring circuit, which will immediately trigger a SAFE_SHDN hardware interrupt through a GPIO signal when the Vsec voltage drops below 1.6V, starting the emergency data protection process.

[0051] The storage system uses the MB85RS2MT ferroelectric memory of Fujitsu, with a capacity of 2 megabytes and a single read-write operation delay of only 35 nanoseconds, much faster than traditional flash memory or EEPROM. In actual testing, the amount of data encrypted by double encapsulation is about 2 kilobytes, and the total time taken to write it into the FRAM through DMA is only 0.74 microseconds, fully meeting the design requirement of completing data encapsulation within 1 microsecond.

[0052] After 10,000 consecutive hot plug cycles, the system's false acceptance rate (FAR) remained at 1x10⁻ 5 , the false rejection rate (FRR) was controlled within 1%, and the average delay of service recovery was 0.96 seconds, fully meeting the performance requirements of actual applications. During the test process, various abnormal situations were simulated, including power voltage fluctuations, temperature extreme conditions, and electromagnetic interference, and the system showed good stability and reliability.

[0053] Embodiment 2: Wide temperature range mini-PCIe access control module This embodiment is specifically designed for access control applications in harsh environments, requiring stable operation in a wide temperature range of -40°C to +85°C. Considering the impact of extreme temperatures on electronic device performance, this embodiment has been specially optimized in device selection and circuit design.

[0054] The hot plug protection circuit adopts the MAX40200 series chip set of Maxim Integrated, which is specially designed for wide temperature applications and can maintain stable performance parameters under extreme temperature conditions. The circuit board uses a special multi-layer design and high-temperature soldering process to ensure mechanical reliability during temperature cycling.

[0055] At the software level, the breakpoint recovery process maintains the same core logic as Embodiment 1, but uses a higher strength encryption algorithm in the token generation and verification process. The identity verification token is generated and verified using the 256-bit Elliptic Curve Digital Signature Algorithm (ECDSA), which increases the authentication delay by about 9 milliseconds, but significantly improves the security of the system, making it particularly suitable for high-security access control applications.

[0056] Considering the security threats that access control systems usually face, this embodiment particularly strengthens the self-destruction protection mechanism. The base time constant λ of the self-destruction countdown is set to 30 seconds, and for low-active users who have not performed a legal authentication operation for 3 consecutive days, the system will automatically clear all cached data, preventing long-idle devices from becoming potential security hazards.

[0057] In actual deployment testing, this module has been running in access control systems in multiple different geographic locations and climate conditions for more than 6 months, experiencing full-year temperature changes from the cold northern winter to the hot southern summer, and the system has always maintained stable operation without any failures or performance degradation caused by temperature changes.

Claims

1. A method for ensuring hot-swappable iris recognition M.2 / mini-PCIe modules, characterized in that: Includes the following steps: Step a, the steps of the secure encapsulation mechanism: When the PERST# signal drop is detected, the Safe-Suspend process is initiated: the true random number generator in the processor power domain is called to generate a one-time session key Ks; the latest iris template incremental data, authentication session counter, liveness detection status identifier and other key business context information are subjected to double encapsulation encryption processing; After encryption, the data is written to the ferroelectric random access memory in the secure power domain via direct memory access. Step b, the self-destruction step of the session key: When the voltage of the secure power domain drops below the threshold of 1.5V, the static random access memory storing the session key Ks enters a power-down state, and all data stored therein will be irreversibly lost. Step c, the management and synchronization steps of the incremental template differential chain: take the complete iris template T0 security as the base version, and record all subsequent template updates in the form of incremental differential; Step d, the steps for recovery and breakpoint continuation: First, complete the voltage regulation process of the safe power domain within 150 microseconds, and then read the ferroelectric random access memory within 180 microseconds to complete the retraining and initialization of the PCIe link; After the link is established, the authentication token in the BAR0 register of the mini-PCIe module is read, the token is verified, and after confirming the legitimacy of the mini-PCIe module's identity, the RESUME recovery command is sent. After receiving the recovery command, the mini-PCIe module uses the previously generated session key Ks to unpack the encrypted data in the FRAM and restore the incremental chain node cache and service state.

2. The hot-swap protection method for an iris recognition M.2 / mini-PCIe module according to claim 1, characterized in that: It also includes security strategy and risk assessment steps: monitoring the cumulative drift amount ΣΔH, user activity index A, and comprehensive risk score R. When any parameter exceeds the preset security threshold, a self-destruct countdown mechanism is activated. The countdown time is dynamically calculated according to the formula t_wipe = λe^(-A), where λ is a configurable base time constant.

3. A hot-swap protection method for an iris recognition M.2 / mini-PCIe module according to claim 1 or 2, characterized in that: The double-encapsulation encryption process employs a nested encryption structure. The outer layer uses the generated session key Ks for encryption, while the inner layer uses a pre-established daily rotating key Kd for encryption, forming a double protection structure EncKs{EncKd{data}}.

4. A hot-swap protection method for an iris recognition M.2 / mini-PCIe module according to claim 1 or 2, characterized in that: Step b also includes a security protection mechanism: by continuously monitoring activity indicators and risk assessment parameters, when abnormal usage patterns or potential attack behaviors are detected, an adaptive self-destruct countdown function is activated to automatically clear all sensitive data within a preset time window.

5. A hot-swap protection method for an iris recognition M.2 / mini-PCIe module according to claim 1 or 2, characterized in that: Each incremental node in the incremental differential process contains the differential data itself, carrying a precise timestamp and forward hash value, forming a Δ|TS|PrevHash data structure. The incremental data is written to the solid-state storage of the edge device. The incremental nodes periodically calculate the Merkle tree structure and submit the root hash value to the blockchain network for permanent storage.

6. A hot-swap protection method for an iris recognition M.2 / mini-PCIe module according to claim 1 or 2, characterized in that: The incremental chain nodes adopt a standardized data structure design. Each node contains three core components: differential data, precise timestamp, and forward hash value, forming a fixed format of ΔData‖TS‖PrevHash. Hash calculations all use the SHA-256 algorithm to ensure the consistency and security of the calculation results.

7. A hot-swap protection device for an iris recognition M.2 / mini-PCIe module, wherein a 5V main power supply generates 1.1V and 1.8V power supplies respectively through two independent DC-DC converters, including a processor power domain and a safety power domain, characterized in that: A 1.1V power supply powers the processor power domain, and a 1.8V power supply powers the safety power domain. The processor power domain provides power to the main control microprocessor, peripheral interfaces, and digital logic circuits. The secure power domain includes the session key memory, secure element chip, and critical state retention circuitry. The processor power domain includes the main controller and graphics interface. The secure power domain includes ferroelectric random access memory and static random access memory. When the PERST# signal transitions from high to low, the power supply to the secure power domain is cut off, triggering the secure sealing process.

8. The hot-swap protection device for an iris recognition M.2 / mini-PCIe module according to claim 7, characterized in that: The hot-swap controller cuts off power to the safety power domain within 1 microsecond.

9. A hot-swap protection device for an iris recognition M.2 / mini-PCIe module according to claim 7, characterized in that: It also includes a standard communication interface for data synchronization with edge gateways and blockchain networks, supporting on-chain evidence storage operations for the incremental chain Merkle root. The edge gateway system implements an intelligent batch processing management mechanism. By monitoring the cumulative quantity and time interval of incremental data, when the time condition or the cumulative quantity condition is met, it constructs a Merkle tree data structure and submits the calculated root hash value to the blockchain network for permanent storage.

10. A hot-swap protection device for an iris recognition M.2 / mini-PCIe module according to claim 7, characterized in that: The processor power domain and the secure power domain exchange data via an SPI interface. During normal operation, the master controller requests key services from the secure element through the SPI interface. Upon hot-plug triggering, the master controller transmits critical data to the secure element's FRAM via the SPI interface. During recovery, the secure element verifies the identity and sends encrypted data back to the master controller.

Images