Secure communication method and system of control chip
By using PUF circuit to generate unique data and public-private key encryption technology in the control chip for two-way authentication, the problems of large amount of encryption and decryption calculation and inconvenient key management in the prior art are solved, and data security and communication efficiency are improved.
Patent Information
- Application Number
- CN202411542978.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-31
- Publication Date
- 2025-02-18
Smart Images
Figure CN119475382A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of chip communication and security encryption technology, and in particular to a secure communication method and system for a control chip. Background Art
[0002] The secure communication of control chips usually refers to a series of measures taken to protect data from unauthorized access, tampering or destruction when transmitting data between control chips and other devices or systems. These measures ensure the confidentiality, integrity and availability of data. At present, random process deviations in the manufacturing process of integrated circuit chips lead to differences in device size or electrical characteristics between chips. The readout circuit samples this random characteristic to obtain unique and unclonable data, which can be used as the unique identity of the chip. This technology is closely related to the physical unclonable function (PUF). Since this type of data does not exist in non-volatile memory such as EEPROM or FLASH, it has the characteristics of being lost when powered off and cannot be read, which can improve the security performance of the secure identity authentication link during the communication handshake.
[0003] The control chip design method is lightweight, consumes less energy, and is easy to study multi-channel concurrent security protection mechanisms. It can use multiple independent security subsystems with embedded security modules to physically isolate each security subsystem from the main system, and the security subsystems are also isolated from each other, thereby realizing multi-channel business encryption and decryption services and multi-channel parallel computing. At the same time, the isolation of software and hardware ensures the secure isolation and parallel computing of multiple services, which can greatly reduce the delay and data packet loss caused by security encryption and decryption during multi-mode and multi-channel communications. At present, the main methods for secure communication between the control chip and the main system are encryption technology, key management technology, digital signature technology, secure communication protocol, and identity authentication technology. These technologies have technical problems such as large encryption and decryption calculations, inconvenient key management, and complex implementation process. Summary of the invention
[0004] In response to the above technical problems, the present application provides a secure communication method and system for a control chip, which integrates multiple communication encryption technologies to achieve secure communication between the control chip and the main system, thereby improving data security during the communication process.
[0005] In a first aspect, an embodiment of the present application provides a secure communication method for a control chip, comprising:
[0006] Get the access request command and determine the control chip to be accessed;
[0007] Generate a first random number based on the PUF circuit corresponding to the control chip;
[0008] Sending the first random number to the control chip, so that the control chip generates a corresponding response signal according to the first random number;
[0009] Acquire the response signal, and verify the response signal according to a preset first encryption algorithm;
[0010] If the verification is successful, a data transmission channel is established with the control chip;
[0011] Encrypted data transmission is performed with the control chip based on the data transmission channel.
[0012] The embodiment of the present application provides a secure communication method for a control chip, which takes advantage of the fact that the integrated circuit chip has the characteristics of being lost and unreadable when processing and storing data. The identity authentication mechanism is constructed through the PUF circuit of the control chip, so that it generates unique and unclonable data as identity authentication information, which can ensure that the identity authentication information generated or received cannot be stolen by a third party, thereby improving the data security during the communication process. During the identity authentication process, the PUF circuit is used to generate a first random number and send it to the control chip to complete the identity authentication of the control chip to the main system; the response signal of the control chip is obtained, the response signal is verified, and the identity authentication of the control chip by the main system is completed. Through the two-way authentication between the main system and the control chip, the data security during the communication process is further improved. After completing the two-way identity authentication, a data transmission channel is established, and the data is encrypted for transmission, which further strengthens the data security during the communication process in the link of data transmission.
[0013] Furthermore, before obtaining the access request command, generating a first public key and a first private key includes:
[0014] Randomly generate a first public key according to the PUF circuit;
[0015] Encrypt the first public key using a second encryption algorithm to generate a corresponding first private key;
[0016] The first public key is sent to the control chip, and a second public key of the control chip is obtained.
[0017] Furthermore, the secure communication method further includes the control chip generating a second public key and a second private key, specifically:
[0018] The control chip randomly generates a second public key according to the PUF circuit;
[0019] The control chip encrypts the second public key using a third encryption algorithm to generate a corresponding second private key;
[0020] The control chip sends the second public key to the main system, and obtains the first public key of the main system.
[0021] In the embodiment of the present application, the two communicating parties each generate a public key and a private key in advance, and each informs the other party of its own public key. The two parties can then use the other party's public key for encryption in subsequent communications to ensure the confidentiality of the data. Public-private key encryption technology can effectively prevent data from being stolen and tampered with during transmission, thereby improving the security of communications.
[0022] In a possible implementation manner, the generating a first random number based on the PUF circuit corresponding to the control chip includes:
[0023] Sending a first preset value to the PUF circuit, so that the PUF circuit generates the first random number corresponding to the first preset value;
[0024] Obtain the first random number generated by the PUF circuit.
[0025] In a possible implementation, sending the first random number to the control chip so that the control chip generates a corresponding response signal according to the first random number includes:
[0026] Digitally sign the first random number according to the first private key to generate a challenge signal;
[0027] Sending the challenge signal to the control chip so that the control chip determines whether the challenge signal meets a response condition;
[0028] If the response condition is met, the challenge signal is encrypted using the first encryption algorithm to generate the response signal.
[0029] The embodiment of the present application provides a method for a control chip to generate a response signal, by using a first private key to digitally sign a first random number, and packaging the first random number as a challenge signal, thereby ensuring the security of the first random number during the transmission process, and providing an authentication method for the control chip to authenticate the identity of the main system. After receiving the challenge signal and confirming that the response conditions are met, the control chip completes the identity authentication of the control chip to the main system. The control chip then encrypts the challenge signal into a response signal as the identity authentication information of the main system to the control chip, and prepares data for subsequent two-way identity authentication.
[0030] Furthermore, the control chip determines whether the challenge signal satisfies a response condition, including:
[0031] Using a first public key corresponding to the first private key to perform signature verification on the digital signature of the challenge signal, to determine whether the digital signature of the challenge signal is the digital signature of the first private key;
[0032] Determining whether the moment of receiving the challenge signal is within a preset time period;
[0033] If it is determined that the digital signature of the challenge signal is the digital signature of the first private key, and the time of receiving the challenge signal is within a preset time period, it is confirmed that the challenge signal meets the response condition.
[0034] In the embodiment of the present application, the control chip authenticates the main system mainly through a digital signature, and verifies the digital signature of the challenge signal through a pre-acquired first public key to confirm that the challenge signal is issued by the main system rather than other malicious programs; in addition, it is necessary to further confirm whether the moment of the challenge signal is within a preset time period, verify the legitimacy of the challenge signal, and determine that the challenge signal appears within the corresponding time period to improve data security during the communication process.
[0035] Further, the verifying the response signal according to a preset first encryption algorithm includes:
[0036] Encrypt the first random number using the first encryption algorithm to obtain an encrypted first random number;
[0037] Determining whether the value of the encrypted first random number is consistent with the value of the response signal;
[0038] If they are consistent, it is determined that the verification of the response signal is successful.
[0039] In the embodiment of the present application, the main system realizes the identity authentication of the control chip by comparing the value of the encrypted first random number with the value of the response signal. Since the response signal is obtained by using an encryption algorithm on the challenge signal, if the same encryption algorithm is used to generate the encrypted first random number, theoretically, the value of the encrypted first random number is the same as the value of the response signal. Therefore, this feature can be used to realize the identity authentication of the control chip by the main system. In general, the embodiment of the present application introduces digital signature and encryption algorithm technology in the two-way authentication process between the main system and the control chip, wherein the digital signature is used for the identity authentication of the control chip to the main system, and the encryption algorithm is used for the identity authentication of the control chip by the main system, further enhancing the data security during the communication process.
[0040] In a possible implementation, the data transmission channel is a multi-channel transmission channel, and the multi-channel transmission channel is constructed by combining high-speed wireless security encryption technology with power line carrier security encryption technology;
[0041] The encrypted data transmission with the control chip based on the data transmission channel includes:
[0042] During the encrypted data transmission process, continuously obtaining the signal strength and bit error rate of each channel;
[0043] Determine the working status of each channel according to the signal strength and bit error rate;
[0044] When it is determined that a main channel among the channels is in an abnormal working state, determining a standby channel from the channels according to a preset channel switching strategy and the working state of the channels;
[0045] A communication link is transferred from the primary channel to the backup channel.
[0046] The embodiment of the present application provides a multi-channel transmission method, which constructs a multi-channel transmission channel by combining high-speed wireless security encryption technology with power carrier security encryption technology, so that the control chip can use multiple channels to communicate with the main system at the same time. When a channel fails, it automatically switches to other channels for communication. Among them, the multi-channel transmission method combining high-speed wireless security encryption with power carrier security encryption is an advanced communication technology that can play an important role in key areas such as smart grids. This technology combines the flexibility of high-speed wireless communication and the stability of power carrier communication, and improves the reliability and efficiency of data transmission through a multi-channel transmission mechanism. Multi-channel transmission technology can effectively improve the success rate of communication and reduce the risk of communication interruption. At the same time, multi-channel transmission can also increase the bandwidth of communication to meet the requirements of low-voltage power distribution systems for data transmission speed.
[0047] In one possible implementation, when performing the encrypted data transmission, the data sender uses the data receiver's public key to encrypt the original data and then sends the encrypted data; the data receiver uses its own private key to decrypt the encrypted data to obtain the original data.
[0048] In a second aspect, accordingly, an embodiment of the present application provides a secure communication system for a control chip, including an acquisition module, a random number generation module, a sending module, a verification module, a channel establishment module, and a data transmission module;
[0049] The acquisition module is used to acquire an access request command and determine the control chip to be accessed;
[0050] The random number generation module is used to generate a first random number based on the PUF circuit corresponding to the control chip;
[0051] The sending module is used to send the first random number to the control chip, so that the control chip generates a corresponding response signal according to the first random number;
[0052] The verification module is used to obtain the response signal and verify the response signal according to a preset first encryption algorithm;
[0053] The channel establishment module is used to establish a data transmission channel with the control chip if the verification is successful;
[0054] The data transmission module is used to perform encrypted data transmission with the control chip based on the data transmission channel. BRIEF DESCRIPTION OF THE DRAWINGS
[0055] Figure 1 : A flow chart of a secure communication method for a control chip provided in an embodiment of the present application.
[0056] Figure 2 : A schematic diagram of a three-party communication process in a secure communication method for a control chip provided in an embodiment of the present application.
[0057] Figure 3 : A schematic diagram of the process of generating public keys and private keys in a secure communication method for a control chip provided in an embodiment of the present application.
[0058] Figure 4 : A structural diagram of a multi-channel transmission channel in a secure communication method for a control chip provided in an embodiment of the present application.
[0059] Figure 5 : A structural diagram of a secure communication system of a control chip provided in an embodiment of the present application. DETAILED DESCRIPTION
[0060] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0061] It should be noted that the step numbers in the text are only for the convenience of explanation of the specific embodiments and do not serve to limit the order in which the steps are executed. In the description of this application, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.
[0062] Throughout the specification, the control chip described in this specification integrates a PUF circuit, which can generate a unique identifier and key based on the physical characteristics of the chip. PUF technology is non-clonable, and even if an attacker obtains the physical structure of the chip, it is difficult to copy the same key. This ensures that the data of the control chip is difficult to be obtained by the outside, and even if it is obtained, it is impossible to find the correct key to access the data.
[0063] Embodiment 1:
[0064] like Figure 1 As shown, embodiment 1 provides a secure communication method for a control chip, including steps S1-S6:
[0065] Step S1, obtaining an access request command and determining the control chip to be accessed;
[0066] Step S2, generating a first random number based on the PUF circuit corresponding to the control chip;
[0067] Step S3, sending the first random number to the control chip, so that the control chip generates a corresponding response signal according to the first random number;
[0068] Step S4, obtaining the response signal, and verifying the response signal according to a preset first encryption algorithm;
[0069] Step S5: if the verification is successful, a data transmission channel is established with the control chip;
[0070] Step S6: performing encrypted data transmission with the control chip based on the data transmission channel.
[0071] The embodiment of the present application provides a secure communication method for a control chip, which takes advantage of the fact that the integrated circuit chip has the characteristics of being lost and unreadable when processing and storing data. The identity authentication mechanism is constructed through the PUF circuit of the control chip, so that it generates unique and unclonable data as identity authentication information, which can ensure that the identity authentication information generated or received cannot be stolen by a third party, thereby improving the data security during the communication process. During the identity authentication process, the PUF circuit is used to generate a first random number and send it to the control chip to complete the identity authentication of the control chip to the main system; the response signal of the control chip is obtained, the response signal is verified, and the identity authentication of the control chip by the main system is completed. Through the two-way authentication between the main system and the control chip, the data security during the communication process is further improved. After completing the two-way identity authentication, a data transmission channel is established, and the data is encrypted for transmission, which further strengthens the data security during the communication process in the link of data transmission.
[0072] In a preferred embodiment, in step S1, the access request command is usually sent by the client to the main system to request access to the data transmitted between the main system and the control chip on the channel, and the request command complies with data integrity and protocol compatibility. The communication process between the client, the main system and the control chip is as follows: Figure 2As shown, first, the client sends an application command to the main system to apply for access to specific data in the control chip. In the communication architecture of the embodiment of the present application, the client cannot directly access the control chip, but needs to obtain the data in the control chip through the main system, and then the main system sends it to the client, which further improves the data security in the control chip. After receiving the application command, the main system sends a challenge signal to the specified control chip, and the challenge signal is generated after PUF encryption. Then, after the control chip is verified, the main system obtains the response signal sent by the control chip. After the main system verifies the response signal, the two-way identity authentication between the main system and the control chip is completed. Finally, the main system establishes a data transmission channel with the control chip to perform data transmission, thereby ensuring data security during the communication process.
[0073] Furthermore, before obtaining the access request command, generating a first public key and a first private key includes:
[0074] Randomly generate a first public key according to the PUF circuit;
[0075] Encrypt the first public key using a second encryption algorithm to generate a corresponding first private key;
[0076] The first public key is sent to the control chip, and a second public key of the control chip is obtained.
[0077] Furthermore, the secure communication method further includes the control chip generating a second public key and a second private key, specifically:
[0078] The control chip randomly generates a second public key according to the PUF circuit;
[0079] The control chip encrypts the second public key using a third encryption algorithm to generate a corresponding second private key;
[0080] The control chip sends the second public key to the main system, and obtains the first public key of the main system.
[0081] In the embodiment of the present application, the two communicating parties each generate a public key and a private key in advance, and each informs the other party of its own public key. The two parties can then use the other party's public key for encryption in subsequent communications to ensure the confidentiality of the data. Public-private key encryption technology can effectively prevent data from being stolen and tampered with during transmission, thereby improving the security of communications.
[0082] In a preferred embodiment, the generation process of the public key and the private key is as follows: Figure 3 As shown, steps S100-S104 are included:
[0083] Step S100, the main system and the control chip generate their own public keys;
[0084] Step S101: The main system and the control chip transmit their public keys to each other through a secure channel.
[0085] Step S102: Both of them encrypt their own public keys using the RSA algorithm to obtain their respective private keys.
[0086] Step S103: Both of them verify the obtained public and private keys to ensure that they can decrypt each other.
[0087] Step S104: When transmitting data between them, the transmitting party encrypts with the other party's public key, and the receiving party decrypts with the private key to obtain the original data.
[0088] Furthermore, the communication parties use the HTTPS protocol to transmit the public key to ensure the security of the public key.
[0089] Among them, the specific process of generating the public key and private key using the RSA algorithm is as follows:
[0090] Select two large prime numbers p and q.
[0091] Calculate n = p * q, and n will be used as the modulus of the public key and private key.
[0092] Calculate φ(n) = (p - 1)(q - 1), where φ(n) is the Euler's totient function of n and is used to select the private key.
[0093] Select an integer e such that 1 < e < φ(n) and e is relatively prime to φ(n), and e will be part of the public key.
[0094] Calculate d such that d * e = 1 (mod φ(n)), and d is the private key.
[0095] The public key is (n, e), and the private key is (n, d).
[0096] The specific process of encryption and decryption using the public key and private key is as follows:
[0097] Encryption process: Receive the plaintext message M, and convert it to an integer m, where 0 < m < n.
[0098] Encrypt using the public key: c = me (mod n), where c is the ciphertext.
[0099] Decryption process: Decrypt using the private key: m = cd (mod n) to restore the original plaintext M.
[0100] In this embodiment, the response value of the PUF circuit is used as the public key, and the RSA algorithm is used to calculate the public key to generate a private key. It should be noted that the public key and the private key are generated by a specific algorithm, and they are mathematically related. In the communication initialization phase, the control chip obtains the other party's public key through a secure channel and sends its own public key to the other party. In this way, both parties can use the other party's public key for encryption in subsequent communications to ensure the confidentiality of the data. Public-private key encryption technology can effectively prevent data from being stolen and tampered with during transmission, and improve the security of communication.
[0101] In a possible implementation, in step S2, generating a first random number based on a PUF circuit corresponding to the control chip includes:
[0102] Sending a first preset value to the PUF circuit, so that the PUF circuit generates the first random number corresponding to the first preset value;
[0103] Obtain the first random number generated by the PUF circuit.
[0104] In a possible implementation, in step S3, sending the first random number to the control chip so that the control chip generates a corresponding response signal according to the first random number includes:
[0105] Digitally sign the first random number according to the first private key to generate a challenge signal;
[0106] Sending the challenge signal to the control chip so that the control chip determines whether the challenge signal meets a response condition;
[0107] If the response condition is met, the challenge signal is encrypted using the first encryption algorithm to generate the response signal.
[0108] The embodiment of the present application provides a method for a control chip to generate a response signal, by using a first private key to digitally sign a first random number, and packaging the first random number as a challenge signal, thereby ensuring the security of the first random number during the transmission process, and providing an authentication method for the control chip to authenticate the identity of the main system. After receiving the challenge signal and confirming that the response conditions are met, the control chip completes the identity authentication of the control chip to the main system. The control chip then encrypts the challenge signal into a response signal as the identity authentication information of the main system to the control chip, and prepares data for subsequent two-way identity authentication.
[0109] Furthermore, the control chip determines whether the challenge signal satisfies a response condition, including:
[0110] Using a first public key corresponding to the first private key to perform signature verification on the digital signature of the challenge signal, to determine whether the digital signature of the challenge signal is the digital signature of the first private key;
[0111] Determining whether the moment of receiving the challenge signal is within a preset time period;
[0112] If it is determined that the digital signature of the challenge signal is the digital signature of the first private key, and the time of receiving the challenge signal is within a preset time period, it is confirmed that the challenge signal meets the response condition.
[0113] In the embodiment of the present application, the control chip authenticates the main system mainly through a digital signature, and verifies the digital signature of the challenge signal through a pre-acquired first public key to confirm that the challenge signal is issued by the main system rather than other malicious programs; in addition, it is necessary to further confirm whether the moment of the challenge signal is within a preset time period, verify the legitimacy of the challenge signal, and determine that the challenge signal appears within the corresponding time period to improve data security during the communication process.
[0114] Further, in step S4, verifying the response signal according to a preset first encryption algorithm includes:
[0115] Encrypt the first random number using the first encryption algorithm to obtain an encrypted first random number;
[0116] Determining whether the value of the encrypted first random number is consistent with the value of the response signal;
[0117] If they are consistent, it is determined that the verification of the response signal is successful.
[0118] In the embodiment of the present application, the main system realizes the identity authentication of the control chip by comparing the value of the encrypted first random number with the value of the response signal. Since the response signal is obtained by using an encryption algorithm on the challenge signal, if the same encryption algorithm is used to generate the encrypted first random number, theoretically, the value of the encrypted first random number is the same as the value of the response signal. Therefore, this feature can be used to realize the identity authentication of the control chip by the main system. In general, the embodiment of the present application introduces digital signature and encryption algorithm technology in the two-way authentication process between the main system and the control chip, wherein the digital signature is used for the identity authentication of the control chip to the main system, and the encryption algorithm is used for the identity authentication of the control chip by the main system, further enhancing the data security during the communication process.
[0119] In a preferred embodiment, the first encryption algorithm is the RSA algorithm.
[0120] In a possible implementation, in step S5, the data transmission channel is a multi-channel transmission channel, such as Figure 4 As shown, the multi-channel transmission channel is constructed by combining high-speed wireless security encryption technology with power carrier security encryption technology;
[0121] In step S6, the encrypted data transmission with the control chip based on the data transmission channel includes:
[0122] During the encrypted data transmission process, continuously obtaining the signal strength and bit error rate of each channel;
[0123] Determine the working status of each channel according to the signal strength and bit error rate;
[0124] When it is determined that a main channel among the channels is in an abnormal working state, determining a standby channel from the channels according to a preset channel switching strategy and the working state of the channels;
[0125] A communication link is transferred from the primary channel to the backup channel.
[0126] The embodiment of the present application provides a multi-channel transmission method, which constructs a multi-channel transmission channel by combining high-speed wireless security encryption technology with power carrier security encryption technology, so that the control chip can use multiple channels to communicate with the main system at the same time. When a channel fails, it automatically switches to other channels for communication. Among them, the multi-channel transmission method combining high-speed wireless security encryption with power carrier security encryption is an advanced communication technology that can play an important role in key areas such as smart grids. This technology combines the flexibility of high-speed wireless communication and the stability of power carrier communication, and improves the reliability and efficiency of data transmission through a multi-channel transmission mechanism. Multi-channel transmission technology can effectively improve the success rate of communication and reduce the risk of communication interruption. At the same time, multi-channel transmission can also increase the bandwidth of communication to meet the requirements of low-voltage power distribution systems for data transmission speed.
[0127] In a preferred embodiment, the specific implementation of encrypted data transmission based on the multi-channel transmission channel is as follows:
[0128] The control chip can use multiple channels to communicate with the main system at the same time. When a channel fails, it automatically switches to other channels for communication. In this embodiment, a multi-channel transmission method combining high-speed wireless security encryption and power carrier security encryption is adopted. This is an advanced communication technology that can play an important role in key areas such as smart grids. This technology combines the flexibility of high-speed wireless communication and the stability of power carrier communication, and improves the reliability and efficiency of data transmission through a multi-channel transmission mechanism.
[0129] In multi-channel transmission, the present invention adopts the code division multiple access method, that is, each communication link is modulated using a different code sequence, and all signals are transmitted simultaneously at the same frequency and time, but are distinguished by different code sequences. The control chip needs to have the functions of generating, allocating and identifying these code sequences to ensure that signals from different channels can be correctly distinguished and received. At the same time, the signal to be transmitted needs to be modulated accordingly. In this invention, a specific code sequence is used to spread spectrum modulate the signal, and the control chip at the receiving end needs to perform corresponding demodulation operations to restore the original signal from the received mixed signal.
[0130] In this transmission mode, the timing and frequency synchronization in multi-channel transmission is required at the sending and receiving ends. A clock synchronization mechanism is used to keep the clocks of the sending and receiving ends consistent, as well as the sending and detection of synchronization signals, so that the receiving end can accurately identify the starting and ending positions of the data on each channel.
[0131] When a channel is damaged, it is necessary to switch to a backup channel. Here, a channel switching mechanism is used so that the channel can be switched to the backup channel in time after it is damaged. The operation is as follows:
[0132] Detection mechanism: The control chip continuously monitors the status of each channel and determines whether the channel is working properly by detecting the signal strength and bit error rate. Once a channel fails or its performance drops to a certain threshold, the switching mechanism is triggered.
[0133] Switching decision: When the main channel is detected to be damaged, the control chip decides whether to switch and which backup channel to switch to based on the preset strategy.
[0134] Switching execution: The control chip performs the switching operation to transfer the communication link from the damaged channel to the backup channel. By changing the communication parameters such as frequency, time slot or code sequence, it ensures that the communication can be correctly established on the backup channel. At the same time, the communication peer device should be notified of the channel switching in a timely manner so that the peer device can also adjust the receiving parameters accordingly.
[0135] Multi-channel transmission technology can effectively improve the success rate of communication and reduce the risk of communication interruption. At the same time, multi-channel transmission can also increase the bandwidth of communication and meet the requirements of low-voltage power distribution system for data transmission speed.
[0136] In one possible implementation, when performing the encrypted data transmission, the data sender uses the data receiver's public key to encrypt the original data and then sends the encrypted data; the data receiver uses its own private key to decrypt the encrypted data to obtain the original data.
[0137] Embodiment 2:
[0138] like Figure 5 As shown, accordingly, embodiment 2 provides a secure communication system for a control chip, including an acquisition module 10, a random number generation module 20, a sending module 30, a verification module 40, a channel establishment module 50 and a data transmission module 60;
[0139] The acquisition module 10 is used to acquire an access application command and determine the control chip to be accessed;
[0140] The random number generation module 20 is used to generate a first random number based on the PUF circuit corresponding to the control chip;
[0141] The sending module 30 is used to send the first random number to the control chip, so that the control chip generates a corresponding response signal according to the first random number;
[0142] The verification module 40 is used to obtain the response signal and verify the response signal according to a preset first encryption algorithm;
[0143] The channel establishing module 50 is used to establish a data transmission channel with the control chip if the verification is successful;
[0144] The data transmission module 60 is used to perform encrypted data transmission with the control chip based on the data transmission channel.
[0145] Furthermore, the secure communication system further includes a first secret key generation module, which is used to generate a first public key and a first private key before obtaining the access request command, including:
[0146] Randomly generate a first public key according to the PUF circuit;
[0147] Encrypt the first public key using a second encryption algorithm to generate a corresponding first private key;
[0148] The first public key is sent to the control chip, and a second public key of the control chip is obtained.
[0149] Furthermore, the secure communication system further includes a second secret key generation module, and the second secret key generation module is used to generate a second public key and a second private key through a control chip, specifically:
[0150] The control chip randomly generates a second public key according to the PUF circuit;
[0151] The control chip encrypts the second public key using a third encryption algorithm to generate a corresponding second private key;
[0152] The control chip sends the second public key to the main system, and obtains the first public key of the main system.
[0153] In a possible implementation, the random number generation module 20 generates a first random number based on the PUF circuit corresponding to the control chip, including:
[0154] Sending a first preset value to the PUF circuit, so that the PUF circuit generates the first random number corresponding to the first preset value;
[0155] Obtain the first random number generated by the PUF circuit.
[0156] In a possible implementation, the sending module 30 sends the first random number to the control chip so that the control chip generates a corresponding response signal according to the first random number, including:
[0157] Digitally sign the first random number according to the first private key to generate a challenge signal;
[0158] Sending the challenge signal to the control chip so that the control chip determines whether the challenge signal meets a response condition;
[0159] If the response condition is met, the challenge signal is encrypted using the first encryption algorithm to generate the response signal.
[0160] Furthermore, the control chip determines whether the challenge signal satisfies a response condition, including:
[0161] Using a first public key corresponding to the first private key to perform signature verification on the digital signature of the challenge signal, to determine whether the digital signature of the challenge signal is the digital signature of the first private key;
[0162] Determining whether the moment of receiving the challenge signal is within a preset time period;
[0163] If it is determined that the digital signature of the challenge signal is the digital signature of the first private key, and the time of receiving the challenge signal is within a preset time period, it is confirmed that the challenge signal meets the response condition.
[0164] Furthermore, the verification module 40 verifies the response signal according to a preset first encryption algorithm, including:
[0165] Encrypt the first random number using the first encryption algorithm to obtain an encrypted first random number;
[0166] Determining whether the value of the encrypted first random number is consistent with the value of the response signal;
[0167] If they are consistent, it is determined that the verification of the response signal is successful.
[0168] In a possible implementation, the data transmission channel is a multi-channel transmission channel, and the multi-channel transmission channel is constructed by combining high-speed wireless security encryption technology with power line carrier security encryption technology;
[0169] The data transmission module 60 performs encrypted data transmission with the control chip based on the data transmission channel, including:
[0170] During the encrypted data transmission process, continuously obtaining the signal strength and bit error rate of each channel;
[0171] Determine the working status of each channel according to the signal strength and bit error rate;
[0172] When it is determined that a main channel among the channels is in an abnormal working state, determining a standby channel from the channels according to a preset channel switching strategy and the working state of the channels;
[0173] A communication link is transferred from the primary channel to the backup channel.
[0174] In one possible implementation, when the data transmission module 60 performs the encrypted data transmission, the data sender uses the data receiver's public key to encrypt the original data and then sends the encrypted data; the data receiver uses its own private key to decrypt the encrypted data to obtain the original data.
[0175] The embodiment of the present application provides a secure communication system for a control chip, which takes advantage of the fact that the integrated circuit chip loses data when it processes and stores data and cannot be read out after power is turned off. The identity authentication mechanism is constructed through the PUF circuit of the control chip, so that it generates unique and unclonable data as identity authentication information, which can ensure that the identity authentication information generated or received cannot be stolen by a third party, thereby improving the data security during the communication process. During the identity authentication process, the PUF circuit is used to generate a first random number and send it to the control chip to complete the identity authentication of the control chip to the main system; the response signal of the control chip is obtained, the response signal is verified, and the identity authentication of the control chip by the main system is completed. The data security during the communication process is further improved by the two-way authentication between the main system and the control chip. After completing the two-way identity authentication, a data transmission channel is established, and the data is encrypted for transmission, which further strengthens the data security during the communication process in the link of data transmission.
[0176] The more detailed working principle and step flow of this embodiment can refer to, but are not limited to, the relevant records of Embodiment 1.
[0177] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of protection of the present application.
Claims
1. A secure communication method for a control chip, characterized in that: include: Get the access request command and determine the control chip to be accessed; Generate a first random number based on the PUF circuit corresponding to the control chip; Sending the first random number to the control chip, so that the control chip generates a corresponding response signal according to the first random number; Acquire the response signal, and verify the response signal according to a preset first encryption algorithm; If the verification is successful, a data transmission channel is established with the control chip; Encrypted data transmission is performed with the control chip based on the data transmission channel.
2. A secure communication method for a control chip as claimed in claim 1, characterized in that: Before obtaining the access request command, generating a first public key and a first private key includes: Randomly generate a first public key according to the PUF circuit; Encrypt the first public key using a second encryption algorithm to generate a corresponding first private key; The first public key is sent to the control chip, and a second public key of the control chip is obtained.
3. A secure communication method for a control chip as claimed in claim 2, characterized in that: The secure communication method further includes, the control chip generating a second public key and a second private key, specifically: The control chip randomly generates a second public key according to the PUF circuit; The control chip encrypts the second public key using a third encryption algorithm to generate a corresponding second private key; The control chip sends the second public key to the main system, and obtains the first public key of the main system.
4. A secure communication method for a control chip as claimed in claim 1, characterized in that: The generating a first random number based on the PUF circuit corresponding to the control chip includes: Sending a first preset value to the PUF circuit, so that the PUF circuit generates the first random number corresponding to the first preset value; Obtain the first random number generated by the PUF circuit.
5. A secure communication method for a control chip as claimed in claim 3, characterized in that: The sending the first random number to the control chip so that the control chip generates a corresponding response signal according to the first random number includes: Digitally sign the first random number according to the first private key to generate a challenge signal; Sending the challenge signal to the control chip so that the control chip determines whether the challenge signal meets a response condition; If the response condition is met, the challenge signal is encrypted using the first encryption algorithm to generate the response signal.
6. A secure communication method for a control chip as claimed in claim 5, characterized in that: The control chip determines whether the challenge signal meets the response condition, including: Using a first public key corresponding to the first private key to perform signature verification on the digital signature of the challenge signal, to determine whether the digital signature of the challenge signal is the digital signature of the first private key; Determining whether the moment of receiving the challenge signal is within a preset time period; If it is determined that the digital signature of the challenge signal is the digital signature of the first private key, and the time of receiving the challenge signal is within a preset time period, it is confirmed that the challenge signal meets the response condition.
7. A secure communication method for a control chip as claimed in claim 6, characterized in that: The verifying the response signal according to a preset first encryption algorithm includes: Encrypt the first random number using the first encryption algorithm to obtain an encrypted first random number; Determining whether the value of the encrypted first random number is consistent with the value of the response signal; If they are consistent, it is determined that the verification of the response signal is successful.
8. A secure communication method for a control chip as claimed in claim 1, characterized in that: The data transmission channel is a multi-channel transmission channel, which is constructed by combining high-speed wireless security encryption technology with power line carrier security encryption technology; The encrypted data transmission with the control chip based on the data transmission channel includes: During the encrypted data transmission process, continuously obtaining the signal strength and bit error rate of each channel; Determine the working status of each channel according to the signal strength and bit error rate; When it is determined that a main channel among the channels is in an abnormal working state, determining a standby channel from the channels according to a preset channel switching strategy and the working state of the channels; A communication link is transferred from the primary channel to the backup channel.
9. A secure communication method for a control chip as claimed in claim 3, characterized in that: When performing the encrypted data transmission, the data sender uses the public key of the data receiver to encrypt the original data and then sends the encrypted data; the data receiver uses its own private key to decrypt the encrypted data to obtain the original data.
10. A secure communication system for a control chip, characterized in that: It includes an acquisition module, a random number generation module, a sending module, a verification module, a channel establishment module and a data transmission module; The acquisition module is used to acquire an access request command and determine the control chip to be accessed; The random number generation module is used to generate a first random number based on the PUF circuit corresponding to the control chip; The sending module is used to send the first random number to the control chip, so that the control chip generates a corresponding response signal according to the first random number; The verification module is used to obtain the response signal and verify the response signal according to a preset first encryption algorithm; The channel establishment module is used to establish a data transmission channel with the control chip if the verification is successful; The data transmission module is used to perform encrypted data transmission with the control chip based on the data transmission channel.