A user authentication process encryption system based on industrial product generation terminals

Abstract

The present invention discloses a user authentication process encryption system based on an industrial product generation terminal, the system comprising: an encryption module and a decryption module; the encryption module comprising: a first encryption unit, a second encryption unit and a third encryption unit, the first encryption unit is used to read the ChipID on the SOC in the encryption stage, the second encryption unit is used to calculate the first summary of the ChipID by a preset algorithm in the encryption stage, and the third encryption unit is used to write the first code into the eFuse preset area; the decryption module comprises: a first decryption unit, a second decryption unit and a third decryption unit, the first decryption unit is used to read the ChipID on the SOC in the decryption stage, the second decryption unit is used to calculate the second summary of the ChipID by the preset algorithm in the decryption stage, and the third decryption unit is used to compare the first code with the second code. The system according to the present invention has lower operating costs while achieving confidentiality.

Description

Technical Field

[0001] The present invention relates to the technical field of authentication in industrial products, and in particular to a user authentication process encryption system based on an industrial product generating terminal. Background Art

[0002] In the prior art, in order to protect the company's products from third-party abuse of system firmware, external encryption chips are often added to product applications. For example, it is necessary to separately purchase a chip with EEPROM (Electrically Erasable Programmable Read-Only Memory) and a secure hash algorithm as an external encryption chip, which will result in excessively high operating costs. Therefore, there is room for improvement in the above technology. Summary of the invention

[0003] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, one purpose of the present invention is to propose a user authentication process encryption system based on an industrial product generation terminal, which protects the system firmware from being used in other similar hardware products through the SOC's own resources without adding peripherals, thereby achieving confidentiality and greatly reducing operating costs.

[0004] According to an embodiment of the present invention, a user authentication process encryption system based on an industrial product generation terminal includes: an encryption module and a decryption module; the encryption module includes: a first encryption unit, a second encryption unit and a third encryption unit, the first encryption unit is used to read the ChipID on the SOC in the encryption stage, the second encryption unit is used to calculate the first summary of the ChipID by a preset algorithm in the encryption stage, extract data from the first summary according to the preset algorithm and combine it into a first code, and the third encryption unit is used to write the first code into an eFuse preset area; the decryption module includes: a first decryption unit, a second decryption unit and a third decryption unit, the first decryption unit is used to read the ChipID on the SOC in the decryption stage, the second decryption unit is used to calculate the second summary of the ChipID by the preset algorithm in the decryption stage, extract data from the second summary according to the preset algorithm and combine it into a second code, and store the second code in a memory, and the third decryption unit is used to compare the first code and the second code, when the first code and the second code are the same, prompt that the authentication is successful, when the first code and the second code are different, prompt that the authentication fails.

[0005] According to the user authentication process encryption system based on the industrial product generation terminal of the present invention, without adding peripherals, the system firmware is protected by the SOC's own resources so as not to be used in other similar hardware products, thereby achieving confidentiality and greatly reducing operating costs.

[0006] According to a user authentication process encryption system based on an industrial product generation terminal according to an embodiment of the present invention, the preset algorithm is a first type of data encryption algorithm, and the first type of data encryption algorithm is run through a calculation module, and the calculation module includes: a first calculation unit, a second calculation unit and a third calculation unit, the first calculation unit is used to perform salt processing on the CPUID to obtain A data, the second calculation unit is used to perform a preset operation on the A data to obtain B data, and the third calculation unit is used to confuse and sort the B data to obtain C data.

[0007] According to a user authentication process encryption system based on an industrial product generation terminal according to an embodiment of the present invention, the preset operation includes processing the A data using a secure hash algorithm, a message digest algorithm, and a message authentication code.

[0008] According to a user authentication process encryption system based on an industrial product generation terminal according to an embodiment of the present invention, the preset algorithm is a second type of data encryption algorithm, the second type of data encryption algorithm is run through the operation module, the first operation unit is used to salt the CPUID to obtain the first data, the second operation unit is used to verify the first data through the encryption algorithm identifier and the encrypted data corresponding to the password data to obtain the corresponding second data, and the third operation unit is used to perform secure hash processing on the second data to obtain the third data.

[0009] According to a user authentication process encryption system based on an industrial product generation terminal according to an embodiment of the present invention, the execution order of the encryption modules is the first encryption unit, the second encryption unit and the third encryption unit.

[0010] According to a user authentication process encryption system based on an industrial product generation terminal according to an embodiment of the present invention, the execution order of the decryption modules is the first decryption unit, the second decryption unit and the third decryption unit.

[0011] According to a user authentication process encryption system based on an industrial product generation terminal according to an embodiment of the present invention, the execution order of the operation modules is the first operation unit, the second operation unit and the third operation unit.

[0012] According to an embodiment of the present invention, in the user authentication process encryption system based on the industrial product generation terminal, the decryption stage is added in the boot of the SOC.

[0013] According to an embodiment of the present invention, in the user authentication process encryption system based on the industrial product generation terminal, the decryption stage is added during the application startup process. In this way, the decryption stage can be added in the boot of the SOC startup or in the application startup process as needed, thereby achieving diversity in the involvement of the decryption stage.

[0014] According to the user authentication process encryption system based on the industrial product generation terminal according to an embodiment of the present invention, after the first code is written into the eFuse preset area, the first code is solidified.

[0015] According to an embodiment of the present invention, a user authentication process encryption system based on an industrial product generation terminal is applied to an embedded Linux system.

[0016] In summary, the user authentication process encryption system based on the industrial product generation terminal according to the present invention protects the system firmware from being used in other similar hardware products through the SOC's own resources without adding peripherals, thereby greatly reducing operating costs while achieving confidentiality.

[0017] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0019] Figure 1 is a schematic diagram of the structure of an encryption module according to an embodiment of the present invention;

[0020] Figure 2 is a schematic diagram of the structure of a decryption module according to an embodiment of the present invention;

[0021] Figure 3 is a schematic diagram of the structure of a computing module according to an embodiment of the present invention;

[0022] Figure 4 is a flow chart of the operation of the encryption module according to an embodiment of the present invention;

[0023] Figure 5 is a flow chart of the operation of a decryption module according to an embodiment of the present invention;

[0024] Figure 6 is a flow chart of a first type of encryption algorithm used in a computing module according to an embodiment of the present invention;

[0025] Figure 7 It is a flow chart of the second type of encryption algorithm used in the operation module according to an embodiment of the present invention.

[0026] Reference numerals:

[0027] 10-encryption module; 101-first encryption unit; 102-second encryption unit; 103-third encryption unit; 20-decryption module; 201-first decryption unit; 202-second decryption unit; 203-third decryption unit; 30-operation module; 301-first operation unit; 302-second operation unit; 303-third operation unit. DETAILED DESCRIPTION

[0028] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0029] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0030] Please refer to the following Figure 1-Figure 7 , describing the user authentication process encryption system based on the industrial product generation terminal of the embodiment of the present invention. In view of the prior art mentioned in the above background technology center, in order to protect the company's products from abusing the system firmware by a third party, an external encryption chip is often added to the product application, which leads to the problem of excessive cost. The present invention proposes a user authentication process encryption system based on the industrial product generation terminal. The user authentication process encryption system based on the industrial product generation terminal can ensure confidentiality without adding peripherals, while greatly reducing the operating cost.

[0031] Specifically, Figure 1 The user authentication process encryption system based on the industrial product generation terminal according to the embodiment of the present invention is provided in the embodiment of the present invention, specifically, as Figure 1 and Figure 2 As shown, the user authentication process encryption system based on the industrial product generation terminal may include: an encryption module 10 and a decryption module 20; further, as Figure 1As shown, the encryption module 10 may include: a first encryption unit 101, a second encryption unit 102 and a third encryption unit 103. Specifically, the first encryption unit 101 is used to read the ChipID (chip identifier) ​​on the SOC (System on Chip) during the encryption phase. Further, the second encryption unit 102 is used to calculate the first summary of the ChipID by a preset algorithm during the encryption phase, extract data from the first summary according to the preset algorithm, and combine it into a first code. Further, the third encryption unit 103 is used to write the first code into the preset area of ​​the eFuse (one-time programmable memory). It should be noted that ChipID is a chip unique ID. Further, the encryption system based on the user authentication process of the industrial product generation terminal uses the encryption module 10 in the system to protect the system firmware from being used in other similar hardware products through the SOC's own resources without adding peripherals, thereby achieving confidentiality and greatly reducing operating costs.

[0032] Furthermore, if Figure 2 As shown, the decryption module 20 includes: a first decryption unit 201, a second decryption unit 202 and a third decryption unit 203. Specifically, the first decryption unit 201 is used to read the ChipID on the SOC in the decryption stage. Further, the second decryption unit 202 is used to calculate the second summary of the ChipID by a preset algorithm in the decryption stage, extract data from the second summary according to the preset algorithm and combine it into a second code, and store the second code in the memory. Further, the third decryption unit 203 is used to compare the first code with the second code. When the first code and the second code are the same, the authentication is successful. When the first code and the second code are different, the authentication fails. It should be noted that the content stored in the eFuse of the specific area is read and compared with the value stored in the memory in the second decryption unit 202 to determine whether the comparison results are consistent. If they are consistent, it means that the SOC is encrypted by a specific algorithm and the hardware trusted authentication is successful. If the comparison results are inconsistent, it means that the hardware has not been encrypted at the factory, then the startup or application authentication fails, the system cannot be started normally or the application cannot be started normally, and the hardware untrusted authentication fails.

[0033] According to the user authentication process encryption system based on the industrial product generation terminal of the present invention, without adding peripherals, the system firmware is protected by the SOC's own resources so as not to be used in other similar hardware products, thereby achieving confidentiality and greatly reducing operating costs.

[0034] According to an embodiment of the present invention, the user authentication process encryption system based on the industrial product generation terminal, the preset algorithm is a first type of data encryption algorithm, and the first type of data encryption algorithm is run through the operation module 30, such as Figure 3As shown, the operation module 30 includes: a first operation unit 301, a second operation unit 302 and a third operation unit 303. Further, the first operation unit 301 is used to perform salt processing on the CPUID (central processing unit identifier) ​​to obtain A data, further, the second operation unit 302 is used to perform a preset operation on the A data to obtain B data, and further, the third operation unit 303 is used to confuse and sort the B data to obtain C data.

[0035] According to a user authentication process encryption system based on an industrial product generation terminal according to an embodiment of the present invention, the preset operation includes processing A data with a secure hash algorithm, a message digest algorithm and a message authentication code.

[0036] According to an embodiment of the present invention, the user authentication process encryption system based on the industrial product generation terminal, the preset algorithm is the second type of data encryption algorithm, the second type of data encryption algorithm is run by the operation module 30, further, as Figure 7 As shown, the first operation unit 301 is used to perform salt processing on the CPUID (central processing unit identifier) ​​to obtain first data. Further, the second operation unit 302 is used to perform verification processing on the first data through the encryption algorithm identifier and the encrypted data corresponding to the password data to obtain the corresponding second data. Further, the third operation unit 303 is used to perform secure hash processing on the second data to obtain third data.

[0037] According to an embodiment of the present invention, a user authentication process encryption system based on an industrial product generation terminal is provided. Figure 1 As shown, the execution order of the encryption module 10 is the first encryption unit 101, the second encryption unit 102 and the third encryption unit 103, thereby realizing the encryption process.

[0038] According to an embodiment of the present invention, a user authentication process encryption system based on an industrial product generation terminal is provided. Figure 2 As shown, the execution order of the decryption module 20 is the first decryption unit 201, the second decryption unit 202 and the third decryption unit 203, thereby realizing the decryption process.

[0039] According to an embodiment of the present invention, a user authentication process encryption system based on an industrial product generation terminal is provided. Figure 3 As shown, the execution order of the operation module 30 is the first operation unit 301, the second operation unit 302 and the third operation unit 303, thereby realizing the operation process.

[0040] According to an encryption system for a user authentication process based on an industrial product generation terminal according to an embodiment of the present invention, a decryption phase is added to a boot (boot program) started by a SOC.

[0041] According to an embodiment of the present invention, in the user authentication process encryption system based on the industrial product generation terminal, the decryption stage is added during the application startup process. In this way, the decryption stage can be added in the boot of the SOC startup or in the application startup process as needed, thereby achieving diversity in the involvement of the decryption stage.

[0042] It should be noted that due to the one-time programming characteristics of the eFuse area, the data cannot be tampered with. This allows the system and SOC to be bound, meaning that the released firmware can only be used on the encrypted SOC, and the system or software cannot start normally on unidentified hardware.

[0043] According to the user authentication process encryption system based on the industrial product generation terminal according to one embodiment of the present invention, after the first code is written into the eFuse preset area, the first code is solidified.

[0044] According to an embodiment of the present invention, a user authentication process encryption system based on an industrial product generation terminal is applied to an embedded Linux system.

[0045] Furthermore, combined with Figure 4 , specifically introduce the workflow of the encryption module in the encryption system of the user authentication process based on the industrial product generation terminal:

[0046] Step 1: Read the unique ID information on the SOC;

[0047] Step 2: Encrypt the unique ID information and calculate the digest;

[0048] Step 3: Extract data from the abstracts;

[0049] Step 4: Store to the specified general eFuse storage area.

[0050] Furthermore, combined with Figure 5 , specifically introduce the workflow of the decryption module in the encryption system of the user authentication process based on the industrial product generation terminal:

[0051] Step 1: Read the unique ID information on the SOC;

[0052] Step 2: Encrypt the unique ID information and calculate the digest;

[0053] Step 3: Extract data from the abstracts;

[0054] Step 4: Compare the data in the eFuse to see if it is consistent with the extracted data. If so, the authentication is successfully started normally; if not, the authentication fails and the workflow ends.

[0055] Furthermore, combined with Figure 6According to the first type of data encryption algorithm, the workflow of the operation module in the user authentication process encryption system based on the industrial product generation terminal is specifically introduced:

[0056] Step 1: Salt the CPUID (central processing unit identifier) ​​to get data A;

[0057] Step 2: Perform a preset operation on the A data to obtain the B data, where the preset operation includes performing a secure hash algorithm, a message digest algorithm, and a message authentication code on the first data;

[0058] Step 3: Obfuscate and sort the B data to obtain C data.

[0059] Furthermore, combined with Figure 7 According to the second type of data encryption algorithm, the workflow of the operation module in the user authentication process encryption system based on the industrial product generation terminal is specifically introduced:

[0060] Step 1: Add salt to CPUID to obtain the first data.

[0061] Step 2: Verify the first data using the encryption algorithm identifier and the encrypted data corresponding to the password data to obtain the corresponding second data;

[0062] Step 3: Perform secure hash processing on the second data to obtain third data.

[0063] Furthermore, in combination with a specific embodiment, an example is given to illustrate a user authentication process encryption system based on an industrial product generation terminal:

[0064] Step 1: Make a bootloader for encryption. Encode the encryption process step by step into the bootloader startup code. When the SOC is booted with the encrypted bootloader before leaving the factory, the encrypted information can be stored in the SOC.

[0065] Step 2: Create a decrypted bootloader, put it into the product, and call it every time the product SOC starts up. During actual use, the product will authenticate whether the SOC meets the startup requirements every time it starts up.

[0066] It should be noted that the encrypted bootloader mentioned above only exists in the factory, and the decrypted bootloader will be released with the product.

[0067] In summary, the user authentication process encryption system based on the industrial product generation terminal according to the present invention protects the system firmware from being used in other similar hardware products through the SOC's own resources without adding peripherals, thereby greatly reducing operating costs while achieving confidentiality.

[0068] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0069] In the description of the present invention, it is to be understood that the terms “center”, “longitudinal”, “lateral”, “length”, “width”, “thickness”, “up”, “down”, “front”, “back”, “left”, “right”, “vertical”, “horizontal”, “top”, “bottom”, “inside”, “outside”, “clockwise”, “counterclockwise”, “axial”, “radial”, “circumferential”, etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0070] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "N" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0071] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present invention belong.

[0072] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection with one or N wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0073] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0074] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0075] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0076] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A user authentication process encryption system based on an industrial product generation terminal, characterized in that: include: Encryption module and decryption module; The encryption module includes: a first encryption unit, a second encryption unit and a third encryption unit, the first encryption unit is used to read the ChipID on the SOC in the encryption stage, the second encryption unit is used to calculate the first summary of the ChipID by a preset algorithm in the encryption stage, extract data from the first summary according to the preset algorithm, and combine it into a first code, and the third encryption unit is used to write the first code into the eFuse preset area; the decryption module includes: a first decryption unit, a second decryption unit and a third decryption unit, the first decryption unit is used to read the ChipID on the SOC in the decryption stage, the second decryption unit is used to calculate the second summary of the ChipID by the preset algorithm in the decryption stage, extract data from the second summary according to the preset algorithm and combine it into a second code, and store the second code in the memory, and the third decryption unit is used to compare the first code and the second code, when the first code and the second code are the same, prompt the authentication success, when the first code and the second code are different, prompt the authentication failure; The encryption system further includes: making a bootloader for encryption; encoding the encryption process into the bootloader startup code and calling it, and when the SOC is booted and started using the encrypted bootloader before leaving the factory, the encrypted information is stored in the SOC; making a decrypted bootloader, putting the decrypted bootloader into the product, and calling it in each startup process of the product SOC; during actual use, the product will authenticate whether the SOC meets the startup requirements each time it is started; the encryption bootloader only exists in the factory, and the decrypted bootloader will be released with the product; The preset algorithm is a first type of data encryption algorithm, which is run through a computing module, and the computing module includes: a first computing unit, a second computing unit, and a third computing unit, the first computing unit is used to perform salting on the CPUID to obtain A data, the second computing unit is used to perform a preset operation on the A data to obtain B data, and the third computing unit is used to perform obfuscation sorting on the B data to obtain C data; The preset operation includes processing the A data using a secure hash algorithm, a message digest algorithm and a message authentication code; The preset algorithm is a second type of data encryption algorithm, and the second type of data encryption algorithm is run through the operation module. The first operation unit is used to perform salt processing on the CPUID to obtain first data. The second operation unit is used to verify the first data through the encryption algorithm identifier and the encrypted data corresponding to the password data to obtain the corresponding second data. The third operation unit is used to perform secure hash processing on the second data to obtain third data.

2. The user authentication process encryption system based on the industrial product generation terminal according to claim 1 is characterized in that: The execution order of the encryption modules is the first encryption unit, the second encryption unit and the third encryption unit.

3. The user authentication process encryption system based on the industrial product generation terminal according to claim 1 is characterized in that: The execution order of the decryption modules is the first decryption unit, the second decryption unit and the third decryption unit.

4. The user authentication process encryption system based on the industrial product generation terminal according to claim 1 is characterized in that: The execution order of the operation modules is the first operation unit, the second operation unit and the third operation unit.

5. The user authentication process encryption system based on the industrial product generation terminal according to claim 1 is characterized in that: The decryption stage is added during the boot of the SOC.

6. The user authentication process encryption system based on the industrial product generation terminal according to claim 1 is characterized in that: The decryption phase is added during the application startup process.

7. The user authentication process encryption system based on the industrial product generation terminal according to claim 1 is characterized in that: After the first code is written into the eFuse preset area, the first code is solidified, and the encryption system is applied to an embedded Linux system.

Images