An Embedded Encrypted Two-Way Authentication Method

Abstract

The present invention relates to the technical field of embedded system software, and in particular to an embedded encrypted two-way identity authentication method, comprising the following steps: an embedded device reports encrypted data one to a host computer software; the host computer software verifies the encrypted data one based on an authorization file, and sends encrypted data two to the embedded device; the embedded device verifies and judges the encrypted data two. The encryption and decryption algorithm adopted by the present invention has a certain anti-cracking strength, is relatively easy to implement in terms of code writing, occupies less system resources, and is easy to integrate with other functional modules; requiring the embedded system to perform two-way authentication with the host computer is equivalent to distributing the encryption and decryption algorithm, which greatly increases the difficulty of cracking. Thereby preventing the embedded product from being copied and misappropriated as a whole. And then solving the problem of the risk of being copied and misappropriated by pirates in the interaction process between the STM32 embedded system device and the host computer software.

Description

Technical Field

[0001] The present invention relates to the technical field of embedded system software, and in particular to an embedded encrypted bidirectional identity authentication method. Background Art

[0002] The software of embedded system products contains algorithms such as signal and data processing, business logic processing, etc. In order to prevent the software from being cracked and stolen, the communication needs to add encryption algorithms to the program to bind the software and hardware. The anti-cracking encryption algorithms of STM32 mainly include the following methods:

[0003] Enable Read Protection (RDP): In STM32 chips, you can set Read Protection (RDP) to prevent external tools from illegally accessing the internal FLASH. RDP can be configured through the STM32 HAL library. For example, setting RDP to Level 1 will prevent external debuggers and devices from reading the internal Flash content.

[0004] Encryption using UID: Each STM32 chip has a unique 96-bit UID, which can be used for encryption. By calculating the unique UID of each chip and using it as the input of the encryption algorithm, an encryption result is generated and stored in a specific address of the Flash. The MCU reads this result at startup and compares it with the calculated result. If they are consistent, execution continues, otherwise it enters an infinite loop. In this way, even if the program is copied from the product chip, it cannot be run in the new chip.

[0005] Use AES encryption algorithm: STM32 has built-in hardware-accelerated AES encryption algorithm, which can encrypt application code with AES and then decrypt it at startup. Only correctly encrypted application code can run normally, which ensures the integrity and security of the code itself and prevents the code from being tampered with and then running on the chip.

[0006] Combine multiple security measures: STM32 provides hardware-accelerated cryptographic algorithms such as AES and DES, which can greatly improve the speed and efficiency of encryption and decryption; it also provides a security module, including random number generation, secure storage and authentication functions, which further enhances the security of the device.

[0007] However, although STM32 provides the above security measures, there is still a risk of being copied and misused by pirates during the interaction between the STM32 embedded system device and the host computer software. Summary of the invention

[0008] The object of the present invention is to provide an embedded encrypted bidirectional identity authentication method, aiming to solve the problem that there is a risk of being copied and misused by pirates during the interaction between an STM32 embedded system device and a host computer software.

[0009] To achieve the above object, the present invention provides an embedded encrypted bidirectional identity authentication method, comprising the following steps:

[0010] The embedded device reports encrypted data to the host computer software;

[0011] The host computer software verifies the encrypted data 1 based on the authorization file, and sends the encrypted data 2 to the embedded device;

[0012] The embedded device verifies and judges the encrypted data 2.

[0013] Among them, in "Embedded device reports encrypted data to host computer software 1", it includes:

[0014] The embedded device accesses the host computer software and reports the encrypted data one, and starts the timeout reset system counter. If no response is received from the host computer after the timeout, the system is reset. If it does not time out, the operation continues.

[0015] Among them, in “the host computer software verifies the encrypted data one based on the authorization file and sends the encrypted data two to the embedded device”, it includes:

[0016] The host computer software, if receiving the encrypted data 1, enters the identity verification mode, if not receiving, exits the software;

[0017] The encrypted file 1 is verified based on the authorization file. If it exists, the encrypted file 2 is generated and sent to the embedded device. If it does not exist, the authentication fails and the software is exited.

[0018] Among them, in "verifying the encrypted file one based on the authorization file, if it exists, generating encrypted file two and sending it to the embedded device, if it does not exist, the authentication fails and the software exits", the authorization file is collected from the U ID of the STM32 chip, one copy is encrypted and stored inside the STM32, and the other copy is used to generate an authorization information file and provide it to the host computer software for identity authentication.

[0019] Wherein, in “the embedded device verifies and judges the encrypted data 2”, it includes:

[0020] The embedded device receives the encrypted data 2;

[0021] The encrypted data is verified, and if it is consistent, the normal operation mode is entered; if it is not consistent, the system is reset.

[0022] An embedded encryption two-way identity authentication method of the present invention comprises the following steps: an embedded device reports encrypted data one to a host computer software; the host computer software verifies the encrypted data one based on an authorization file, and sends encrypted data two to the embedded device; the embedded device verifies and judges the encrypted data two. The present invention requires that the STM32 embedded system and the host computer software perform two-way authentication, that is, the host computer software can only perform configuration operations on authorized devices, which is equivalent to binding the host computer software with the embedded system for use. Even if the pirate successfully copies the embedded system hardware and software to the new hardware and runs it, the host computer software will not be able to perform configuration operations on the new hardware because the new hardware is not authorized. Therefore, the embedded device copied by the pirated version cannot obtain the configuration parameters and cannot run normally. Thus, the security protection of the embedded system and data is achieved. The encryption and decryption algorithm used has a certain anti-cracking strength, is relatively easy to implement in terms of code writing, occupies less system resources, and is easy to integrate with other functional modules; requiring the embedded system and the host computer to perform two-way authentication is equivalent to distributing the encryption and decryption algorithm, which greatly increases the difficulty of cracking. Thus, the embedded product is prevented from being copied and misappropriated as a whole. This solves the problem of the risk of being copied and misused by pirates during the interaction between the STM32 embedded system device and the host computer software. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 The present invention provides a flowchart of an embedded encrypted two-way identity authentication method.

[0025] Figure 2 It is the structure diagram of embedded software.

[0026] Figure 3 It is the structure diagram of the upper computer software.

[0027] Figure 4 It is the embedded end authentication flow chart.

[0028] Figure 5 It is the identity authentication flow chart of the host computer.

[0029] Figure 6 It is the interactive process between embedded devices and host computer software using a dynamic two-way encryption authentication method.

[0030] Figure 7 It is a flowchart in which the host computer software verifies the encrypted data one based on the authorization file and sends the encrypted data two to the embedded device.

[0031] Figure 8 It is a flow chart of the embedded device verifying and judging the encrypted data 2. DETAILED DESCRIPTION

[0032] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0033] See also Figures 1 to 8 The present invention provides an embedded encrypted bidirectional identity authentication method, comprising the following steps:

[0034] S1 embedded device reports encrypted data to the host computer software;

[0035] The embedded device accesses the host computer software and reports the encrypted data one, and starts the timeout reset system counter. If no response is received from the host computer after the timeout, the system is reset. If it does not time out, the operation continues.

[0036] Specifically, once the identity authentication is started during the interaction between the embedded device and the host computer, the device will continue to operate normally only if the authentication is passed, otherwise the system will be automatically reset.

[0037] S2: the host computer software verifies the encrypted data 1 based on the authorization file and sends the encrypted data 2 to the embedded device;

[0038] The host computer software in S21 enters the identity verification mode if the encrypted data 1 is received, and exits the software if the encrypted data 1 is not received;

[0039] Specifically, after the authentication process is started, data D1 is collected from the embedded device.

[0040] S22 verifies the encrypted file 1 based on the authorization file. If it exists, the encrypted file 2 is generated and sent to the embedded device. If it does not exist, the authentication fails and the software is exited.

[0041] The authorization file is collected from the U ID of the STM32 chip, one copy is encrypted and stored inside the STM32, and the other copy is used to generate an authorization information file and provide it to the host computer software for identity authentication.

[0042] Specifically, the authorization information file data DD is traversed to find the complete data block D1. If it is included, the encrypted file 2 is sent to the embedded device. Otherwise, it is judged as authentication failure, that is, it is considered that the device is not authorized or is not a new hardware device produced by itself.

[0043] S3: the embedded device verifies and judges the encrypted data 2.

[0044] S31, the embedded device receives the encrypted data 2;

[0045] Specifically, the embedded device receives encrypted data 2 sent from the host computer.

[0046] S32 verifies the encrypted data, and if it complies, enters the normal operation mode; if it does not comply, resets the system.

[0047] Specifically, the expected encrypted data D2 is obtained from the data sent in response by the host computer, otherwise it is judged as authentication failure, that is, it is considered that the embedded software is running on an unauthorized new chip or the host computer software has not obtained the corresponding authorization file.

[0048] Beneficial effects:

[0049] 1. The encryption and decryption algorithm used in the present invention has a certain degree of anti-cracking strength, is relatively easy to implement in terms of code writing, occupies less system resources, and is easy to integrate with other functional modules;

[0050] Second, requiring the embedded system and the host computer to perform two-way authentication is equivalent to distributing the encryption and decryption algorithms, which greatly increases the difficulty of cracking.

[0051] What is disclosed above is only a preferred embodiment of an embedded encrypted bidirectional identity authentication method of the present invention. Of course, this cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiments and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. An embedded encrypted two-way identity authentication method, characterized in that: The following steps are involved: The embedded device reports encrypted data to the host computer software; The host computer software verifies the encrypted data 1 based on the authorization file, and sends the encrypted data 2 to the embedded device; The embedded device verifies and judges the encrypted data 2.

2. The embedded encrypted bidirectional identity authentication method according to claim 1, characterized in that: In "Embedded device reports encrypted data to host computer software 1", it includes: The embedded device accesses the host computer software and reports the encrypted data one, and starts the timeout reset system counter. If no response is received from the host computer after the timeout, the system is reset. If it does not time out, the operation continues.

3. The embedded encrypted bidirectional identity authentication method as claimed in claim 2, characterized in that: In “the host computer software verifies the encrypted data 1 based on the authorization file, and sends the encrypted data 2 to the embedded device”, it includes: The host computer software, if receiving the encrypted data 1, enters the identity verification mode, if not receiving, exits the software; The encrypted file 1 is verified based on the authorization file. If it exists, the encrypted file 2 is generated and sent to the embedded device. If it does not exist, the authentication fails and the software is exited.

4. The embedded encrypted bidirectional identity authentication method as claimed in claim 3, characterized in that: In "verifying the encrypted file one based on the authorization file, if it exists, generating encrypted file two and sending it to the embedded device, if it does not exist, the authentication fails and the software is exited", the authorization file is taken from the UID of the STM32 chip, one copy is encrypted and stored inside the STM32, and the other copy is used to generate an authorization information file and provide it to the host computer software for identity authentication.

5. The embedded encrypted bidirectional identity authentication method according to claim 4, characterized in that: In “the embedded device verifies and judges the encrypted data 2”, it includes: The embedded device receives the encrypted data 2; The encrypted data is verified, and if it is consistent, the normal operation mode is entered; if it is not consistent, the system is reset.

Images