A software identity authentication method and system based on an embedded board card

Abstract

The application provides a software identity authentication method and system based on an embedded board card, after system startup, waiting for a CPU boot program to issue an identity authentication request, controlling a power supply time sequence of the board card through an MCU with a built-in authentication algorithm to perform identity authentication on the running software; after the identity authentication passes, allowing the program to continue to execute; if the authentication does not pass, the MCU reports authentication failure information through an external IIC bus and controls a power-on time sequence program to shut down the power supply, preventing the CPU from continuing to run, thereby realizing the function of identity authentication on the running software. After application, the application can greatly reduce the cost, does not need to depend on a specific external authentication module or a programming algorithm, has good universality, can monitor and perform corresponding identity authentication through the MCU in the startup process of various loading programs, ensures that the board card executes authorized programs, has good expansibility, supports more board cards and identity authentication algorithms to meet the growing demand.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of ship system information, and particularly relates to a software identity authentication method and system based on an embedded board card. BACKGROUND

[0002] With the rapid development of electronic information technology, the demand for embedded board card software of various application businesses is increasing, and more and more data centers begin to deploy complex large-scale computing systems composed of multiple embedded board cards. In the data center, not only the transmitted data needs to be encrypted, but also how to ensure that the running software is authorized by management or prevent executable files from being tampered with is also a problem that needs to be solved for data security.

[0003] The existing computer security enhancement system and method based on BIOS (Basic Input Output System) expansion need to expand a PCIE (Peripheral Component Interconnect Express) security module when performing security enhancement on the computer, and generally embedded devices do not reserve or use the PCIE bus, which makes the method unable to meet the security enhancement use scenarios of general embedded systems. Moreover, the security enhancement system only performs security enhancement on the computer BIOS, and does not meet the security enhancement of the computer operating system and computer application program. When the computer operating system or application program does not belong to the software authorized by the security center, it will also bring certain risks and security risks to the system.

[0004] The existing technology is limited to the use of a specific interface or the expansion of other security modules, and even some solutions need to use a specific software burning tool to meet the security requirements. When the customized embedded board card does not support the installation of the expanded security module due to size or funding reasons, it cannot meet the small, lightweight and low-cost requirements for software. In the data center, not only the transmitted data needs to be encrypted, but also how to ensure that the running software is authorized by management or prevent executable files from being tampered with is also a problem that needs to be solved for data security. SUMMARY

[0005] The technical problem to be solved by the application is to provide a software identity authentication method and system based on an embedded board card, which is used for identity authentication of the running software.

[0006] The technical scheme adopted by the application to solve the above technical problem is: a software identity authentication method based on an embedded board card, comprising the following steps:

[0007] S1: power on the system, and initialize the CPU and the MCU;

[0008] S2: the CPU loads the program and sends an identity authentication request to the MCU;

[0009] S3: after receiving the identity authentication request, the MCU uses an authentication algorithm to perform identity authentication on the program run by the CPU; if the program passes the identity authentication, the program continues to run; if the program fails the identity authentication, the program is refused to run;

[0010] S4: the MCU monitors the running state of the system and reports the identity authentication result and the program running state to the upper computer in real time.

[0011] According to the above scheme, in step S1, the initialization includes initializing various buses and control modules on the board card, which is used to prepare for subsequent sending and receiving information.

[0012] According to the above scheme, in step S2, the specific steps are as follows:

[0013] S21: the MCU waits for the CPU to load the boot program; if the MCU does not receive the identity authentication request from the CPU within a predetermined time, the waiting request times out, the power is turned off and the loading is stopped; if the authentication request is normally received, the next step is executed;

[0014] S22: the CPU reads and executes the boot program from the FLASH chip, and periodically sends an identity authentication request to the MCU until the MCU responds;

[0015] S23: after the MCU responds, the CPU sends the identity authentication information of the program to the MCU.

[0016] According to the above scheme, in step S3, the specific steps are as follows:

[0017] The MCU loads the identity authentication program and compares the identity authentication information sent by the CPU with the pre-stored identity authentication data;

[0018] If the program passes the identity authentication, the CPU normally starts and runs the program;

[0019] If the program fails the identity authentication, the module power is turned off, the power supply to the CPU is stopped, and the CPU is prevented from starting or running the program.

[0020] Further, in step S3, the program failing the identity authentication includes the case that the MCU detects that the running program is not authorized, does not receive the identity authentication request from the CPU within a specified time, or judges that the identity information of the CPU is incorrect.

[0021] According to the above scheme, the following steps are further included:

[0022] S0: the pre-written identity authentication program is burned into the MCU in advance through the MCU download tool.

[0023] According to the above scheme, the step S3 further comprises the following steps:

[0024] After the boot program identity authentication is completed, the MCU continues to authenticate the image program and other executable application programs, and the authentication process is consistent with the authentication process of the boot program.

[0025] According to the above scheme, the step S4 further comprises the following steps:

[0026] The MCU communicates with the upper computer to receive the control instruction of the upper computer to skip the identity authentication step.

[0027] A software identity authentication system based on an embedded board card, comprising a processor and a controller; the processor is used for running a program; the controller is used for identity authentication of the program running on the processor; the processor and the controller communicate through an internal bus; the controller communicates with an upper computer through an external bus.

[0028] Further, a memory is further included for storing a boot program and other programs to be run on the processor; the controller includes an internal memory for storing an identity authentication program and a power control program.

[0029] The beneficial effects of the present application are:

[0030] 1. The software identity authentication method and system based on an embedded board card of the present application, after the system is started, waits for the CPU (Central Processing Unit, central processor) boot program to issue an identity authentication request, controls the power sequence of the board card through the MCU (Micro Controller Unit, micro control unit) control board with a built-in authentication algorithm to perform identity authentication on the running software; when the identity authentication is passed, the program is allowed to continue to execute; if the authentication is not passed, the MCU reports the authentication failure information on the external IIC (Inter-Integrated Ciruit, integrated circuit) bus and controls the power-on sequence program to shut down the power, preventing the CPU from continuing to run, realizing the function of identity authentication on the running software, strengthening the security of the system, and ensuring that only authorized software programs can run on the target board card.

[0031] 2. The present application does not need to rely on specific external authentication module or programming algorithm, the MCU controlling the power-on logic is responsible for interacting with the identity verification program, loading the authorized program, and rejecting unauthorized programs. At the same time, the method also has scalability, and after the boot program is loaded, the image program and application program are loaded; these programs can be monitored by the MCU during the startup process and the corresponding identity authentication is performed, ensuring that the board card executes authorized programs. When unauthorized programs are detected, the illegal state is reported, and when debugging is required or special needs exist, the administrator can control the MCU to skip the identity authentication step.

[0032] 3. The present application can greatly reduce costs after application, has good universality, good scalability, and can be designed to support more board cards and identity authentication algorithms, facilitating better management and expansion of board cards with different functions, improving the security, reliability, and manageability of the system, and meeting the growing security needs. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 is a principle block diagram of an embodiment of the present application.

[0034] Figure 2 is a flowchart of an embodiment of the present application. DETAILED DESCRIPTION

[0035] The present application will be further described in detail below in combination with the drawings and specific embodiments.

[0036] Embodiment 1

[0037] Referring to Figure 1 , the embodiment includes a CPU chip responsible for executing software programs and an MCU completing identity verification; the CPU and the MCU communicate through an internal bus including a UART.

[0038] The FLASH chip on the embedded board card stores program files related to the board card; the MCU is used to control the power sequence and has a built-in authentication algorithm for identity authentication of the programs running on the CPU, and the programs that do not meet the identity authentication are identified as unauthorized programs and are not allowed to be executed.

[0039] The MCU is interconnected with an external management device through an I2C interface.

[0040] This embedded software identity authentication system can be applied to most embedded board cards without special restriction requirements. By adding a software identity authentication program in the MCU responsible for power management, ordinary embedded board cards can be upgraded to systems with software identity authentication function.

[0041] Embodiment 2

[0042] Figure 2The flow chart of the software identity authentication system MCU internal software execution process, the CPU boot program and the MCU identity authentication program of the embodiment include the following steps:

[0043] The pre-written identity authentication software (software algorithm specified by the user authorization center) is burned into the MCU in advance through the MCU software download tool.

[0044] Step one: power on the system, and the MCU completes the initialization of the internal system, such as the initialization of various buses and the initialization of control modules, to prepare for subsequent information sending and receiving.

[0045] Step two: the MCU waits for the CPU to load the boot program from the FLASH, and if the MCU does not receive the identity authentication request from the CPU within a certain time, the power supply is turned off to stop the CPU program loading when the identity authentication request waiting time is exceeded; if the authentication request is normally received, the identity authentication data interaction is performed.

[0046] After the CPU is powered on, the CPU reads and executes the program to be executed from the FLASH chip, generally starting from the boot program; the boot program periodically sends identity authentication request information to the MCU within a specified time until the MCU responds.

[0047] After the MCU responds, the CPU boot program sends the identity authentication request and the software identity information, which is the identity information that the MCU needs to verify and match according to the algorithm.

[0048] Step three: if the MCU receives the identity authentication request of the CPU, the internal authentication algorithm is used to authenticate the running program of the CPU; if the program identity is confirmed to be legal, the program is allowed to continue execution; if the identity authentication is not passed, the MCU controls the power supply module to stop the power supply of the CPU and refuses to execute the program.

[0049] After the boot program is loaded, the CPU performs identity authentication interaction with the MCU on the board card through the UART interface to control the power supply timing, and the MCU verifies the legality of the program; the interaction process includes identity authentication request, identity authentication information transmission, and identity authentication result determination.

[0050] The MCU loads the identity authentication software program, compares the identity authentication data, and if the program identity authentication information is not passed, the CPU module power supply is turned off to prevent program execution; if the program identity authentication information is passed, the program is executed; and the identity authentication request result is periodically reported to the administrator, specifically:

[0051] When the MCU identifies that the corresponding program is authorized by the administrator, and the identity of the CPU boot program is determined, the system is allowed to start normally and work; the CPU waits for the MCU to complete the identity authentication, and if the program passes the MCU identity authentication, the program that meets the central authentication is executed.

[0052] If the MCU determines that the program is not authorized, the program fails the identity authentication, the MCU controls the GPIO pin to turn off the power module of the board card to disconnect the power supply of the CPU, stops the CPU from running, and prevents the unauthorized program from starting or continuing to run, thereby realizing the function of authenticating the identity of the software. The unverified cases include when the MCU detects that the running program is unauthorized, fails to receive the identity authentication request information of the CPU within the specified time, or determines that the identity information authentication of the CPU is incorrect.

[0053] Step four: After the identity authentication of the boot program is completed, the MCU continues to authenticate the identity of the operation image program to the executable application program, and the authentication method is consistent with that of the boot program authentication.

[0054] After using the identity authentication system and method, the boot program of each board card CPU in the data center needs to pass the authentication of the authentication system before further running. When the boot program authentication fails, the authentication system turns off the power of the board card to prevent the device from continuing to work.

[0055] Step five: the MCU communicates with the administrator, receives the administrator's command or feedbacks the identity authentication result to the administrator, specifically:

[0056] The MCU receives the control instruction of the administrator through the I2C interface to skip the identity authentication step;

[0057] The MCU monitors the state of the board card running, and reports the identity authentication result and the program running state to the external management device in real time, so as to timely discover the risk software and notify the administrator to process; through the identity authentication and information feedback reporting, the network security is strengthened to protect the program of the embedded software system and the generated data.

[0058] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0059] The above embodiments are only used to illustrate the design idea and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the content of the present application and implement it, and the protection scope of the present application is not limited to the above embodiments. Therefore, any equivalent changes or modifications made according to the principles and design ideas disclosed by the present application are within the protection scope of the present application.

Claims

1. A software identity authentication method based on an embedded board card, characterized in that: The method comprises the following steps: S1: system power-on, CPU and MCU initialization; S2: CPU loads program, and sends identity authentication request to MCU; the specific steps are: S21: MCU waits for CPU to load boot program; if the MCU does not receive the identity authentication request of the CPU within a preset time, the waiting request is timed out, the power is turned off, and the loading is stopped; if the authentication request is normally received, the next step is executed; S22: the CPU reads and executes the boot program from the FLASH chip, and periodically sends the identity authentication request to the MCU until the MCU responds; S23: after the MCU responds, the CPU sends the program identity authentication information to the MCU; S3: after the MCU receives the identity authentication request, the authentication algorithm is used to authenticate the program running on the CPU; if the program passes the identity authentication, the program continues to run; if the program does not pass the identity authentication, the program is refused to run; S4: the MCU monitors the running state of the system, and reports the identity authentication result and the program running state to the upper computer in real time.

2. The software identity authentication method based on the embedded board card according to claim 1, characterized in that: In the step S1, the initialization includes initializing various buses and control modules on the board card, which is used to prepare for subsequent sending and receiving information.

3. The software authentication method based on the embedded board card according to claim 1, characterized in that: In the step S3, the specific steps are: The MCU loads the identity authentication program, and compares the identity authentication information sent by the CPU with the pre-stored identity authentication data; If the program passes the identity authentication, the CPU normally starts and runs the program; If the program does not pass the identity authentication, the module power is turned off, the power supply to the CPU is stopped, and the CPU is prevented from starting or running the program.

4. The software identity authentication method based on the embedded board card according to claim 3, characterized in that: In the step S3, the case that the program does not pass the identity authentication includes that the MCU detects that the running program is not authorized, does not receive the identity authentication request of the CPU within a specified time, or judges that the identity information authentication information of the CPU is incorrect.

5. The software authentication method based on embedded board card according to claim 1, characterized in that: The method further comprises the following steps: S0: the pre-written identity authentication program is burned into the MCU in advance through the MCU download tool.

6. The software authentication method based on embedded board card according to claim 1, characterized in that: In the step S3, the method further comprises the following steps: After the boot program identity authentication is completed, the MCU continues to authenticate the image program and other executable application programs, and the authentication process is consistent with the authentication process of the boot program.

7. The software authentication method based on embedded board card according to claim 1, characterized in that: In the step S4, the method further comprises the following steps: The MCU communicates with the upper computer, and receives the control instruction of the upper computer to skip the identity authentication step.

8. An authentication system for the software authentication method based on the embedded board card according to any one of claims 1 to 7, characterized in that: The system comprises a processor and a controller; the processor is used to run a program; the controller is used to authenticate the program running on the processor; the processor and the controller communicate through an internal bus; and the controller communicates with the upper computer through an external bus.

9. The authentication system according to claim 8, wherein: The system further comprises a memory for storing a boot program and other programs to be run on the processor; The controller comprises an internal memory for storing an identity authentication program and a power control program.

Images